189 files changed, 1904 insertions, 942 deletions

diff --git a/Documentation/acpi/enumeration.txt b/Documentation/acpi/enumeration.txt
index fd786ea13a1f..e182be5e3c83 100644
--- a/Documentation/acpi/enumeration.txt
+++ b/Documentation/acpi/enumeration.txt
@@ -60,12 +60,6 @@ If the driver needs to perform more complex initialization like getting and
 configuring GPIOs it can get its ACPI handle and extract this information
 from ACPI tables.
 
-Currently the kernel is not able to automatically determine from which ACPI
-device it should make the corresponding platform device so we need to add
-the ACPI device explicitly to acpi_platform_device_ids list defined in
-drivers/acpi/acpi_platform.c. This limitation is only for the platform
-devices, SPI and I2C devices are created automatically as described below.
-
 DMA support
 ~~~~~~~~~~~
 DMA controllers enumerated via ACPI should be registered in the system to
diff --git a/Documentation/devicetree/bindings/cpufreq/cpufreq-cpu0.txt b/Documentation/devicetree/bindings/cpufreq/cpufreq-cpu0.txt
index f055515d2b62..366690cb86a3 100644
--- a/Documentation/devicetree/bindings/cpufreq/cpufreq-cpu0.txt
+++ b/Documentation/devicetree/bindings/cpufreq/cpufreq-cpu0.txt
@@ -8,10 +8,12 @@ Both required and optional properties listed below must be defined
 under node /cpus/cpu@0.
 
 Required properties:
-- operating-points: Refer to Documentation/devicetree/bindings/power/opp.txt
-  for details
+- None
 
 Optional properties:
+- operating-points: Refer to Documentation/devicetree/bindings/power/opp.txt for
+  details. OPPs *must* be supplied either via DT, i.e. this property, or
+  populated at runtime.
 - clock-latency: Specify the possible maximum transition latency for clock,
   in unit of nanoseconds.
 - voltage-tolerance: Specify the CPU voltage tolerance in percentage.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index c1b9aa8c5a52..b7fa2f599459 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2790,6 +2790,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         leaf rcu_node structure.  Useful for very large
                         systems.
 
+        rcutree.jiffies_till_sched_qs= [KNL]
+                        Set required age in jiffies for a
+                        given grace period before RCU starts
+                        soliciting quiescent-state help from
+                        rcu_note_context_switch().
+
         rcutree.jiffies_till_first_fqs= [KNL]
                         Set delay from grace-period initialization to
                         first attempt to force quiescent states.
@@ -3526,7 +3532,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         the allocated input device; If set to 0, video driver
                         will only send out the event without touching backlight
                         brightness level.
-                        default: 0
+                        default: 1
 
         virtio_mmio.device=
                         [VMMIO] Memory mapped virtio (platform) device.
diff --git a/MAINTAINERS b/MAINTAINERS
index ae8cd00215b2..78215a5dea28 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8010,6 +8010,16 @@ F:	drivers/ata/
 F:      include/linux/ata.h
 F:      include/linux/libata.h
 
+SERIAL ATA AHCI PLATFORM devices support
+M:      Hans de Goede <hdegoede@redhat.com>
+M:      Tejun Heo <tj@kernel.org>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Supported
+F:      drivers/ata/ahci_platform.c
+F:      drivers/ata/libahci_platform.c
+F:      include/linux/ahci_platform.h
+
 SERVER ENGINES 10Gbps iSCSI - BladeEngine 2 DRIVER
 M:      Jayamohan Kallickal <jayamohan.kallickal@emulex.com>
 L:      linux-scsi@vger.kernel.org
diff --git a/Makefile b/Makefile
index f3c543df4697..6b2774145d66 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Shuffling Zombie Juror
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 245058b3b0ef..88acf8bc1490 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -6,6 +6,7 @@ config ARM
         select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
         select ARCH_HAVE_CUSTOM_GPIO_H
         select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_SUPPORTS_ATOMIC_RMW
         select ARCH_USE_BUILTIN_BSWAP
         select ARCH_USE_CMPXCHG_LOCKREF
         select ARCH_WANT_IPC_PARSE_VERSION
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index 287795985e32..b84bac5bada4 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -925,7 +925,7 @@
                         compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00500000 0x00100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&udphs_clk>,
+                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>,
                                  <&uhpck>;
                         clock-names = "usb_clk", "ohci_clk", "hclk", "uhpck";
                         status = "disabled";
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 2ebc42140ea6..2c0d6ea3ab41 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -1124,6 +1124,7 @@
                                 compatible = "atmel,at91sam9rl-pwm";
                                 reg = <0xf8034000 0x300>;
                                 interrupts = <18 IRQ_TYPE_LEVEL_HIGH 4>;
+                                clocks = <&pwm_clk>;
                                 #pwm-cells = <3>;
                                 status = "disabled";
                         };
@@ -1155,8 +1156,7 @@
                         compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00600000 0x100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&udphs_clk>,
-                                 <&uhpck>;
+                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ohci_clk", "hclk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/mach-exynos/hotplug.c b/arch/arm/mach-exynos/hotplug.c
index 8a134d019cb3..920a4baa53cd 100644
--- a/arch/arm/mach-exynos/hotplug.c
+++ b/arch/arm/mach-exynos/hotplug.c
@@ -40,15 +40,17 @@ static inline void cpu_leave_lowpower(void)
 
 static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
 {
+        u32 mpidr = cpu_logical_map(cpu);
+        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+
         for (;;) {
 
-                /* make cpu1 to be turned off at next WFI command */
-                if (cpu == 1)
-                        exynos_cpu_power_down(cpu);
+                /* Turn the CPU off on next WFI instruction. */
+                exynos_cpu_power_down(core_id);
 
                 wfi();
 
-                if (pen_release == cpu_logical_map(cpu)) {
+                if (pen_release == core_id) {
                         /*
                          * OK, proper wakeup, we're done
                          */
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 1c8d31e39520..50b9aad5e27b 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -90,7 +90,8 @@ static void exynos_secondary_init(unsigned int cpu)
 static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
 {
         unsigned long timeout;
-        unsigned long phys_cpu = cpu_logical_map(cpu);
+        u32 mpidr = cpu_logical_map(cpu);
+        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
         int ret = -ENOSYS;
 
         /*
@@ -104,17 +105,18 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
          * the holding pen - release it, then wait for it to flag
          * that it has been released by resetting pen_release.
          *
-         * Note that "pen_release" is the hardware CPU ID, whereas
+         * Note that "pen_release" is the hardware CPU core ID, whereas
          * "cpu" is Linux's internal ID.
          */
-        write_pen_release(phys_cpu);
+        write_pen_release(core_id);
 
-        if (!exynos_cpu_power_state(cpu)) {
-                exynos_cpu_power_up(cpu);
+        if (!exynos_cpu_power_state(core_id)) {
+                exynos_cpu_power_up(core_id);
                 timeout = 10;
 
                 /* wait max 10 ms until cpu1 is on */
-                while (exynos_cpu_power_state(cpu) != S5P_CORE_LOCAL_PWR_EN) {
+                while (exynos_cpu_power_state(core_id)
+                       != S5P_CORE_LOCAL_PWR_EN) {
                         if (timeout-- == 0)
                                 break;
 
@@ -145,20 +147,20 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
                  * Try to set boot address using firmware first
                  * and fall back to boot register if it fails.
                  */
-                ret = call_firmware_op(set_cpu_boot_addr, phys_cpu, boot_addr);
+                ret = call_firmware_op(set_cpu_boot_addr, core_id, boot_addr);
                 if (ret && ret != -ENOSYS)
                         goto fail;
                 if (ret == -ENOSYS) {
-                        void __iomem *boot_reg = cpu_boot_reg(phys_cpu);
+                        void __iomem *boot_reg = cpu_boot_reg(core_id);
 
                         if (IS_ERR(boot_reg)) {
                                 ret = PTR_ERR(boot_reg);
                                 goto fail;
                         }
-                        __raw_writel(boot_addr, cpu_boot_reg(phys_cpu));
+                        __raw_writel(boot_addr, cpu_boot_reg(core_id));
                 }
 
-                call_firmware_op(cpu_boot, phys_cpu);
+                call_firmware_op(cpu_boot, core_id);
 
                 arch_send_wakeup_ipi_mask(cpumask_of(cpu));
 
@@ -227,22 +229,24 @@ static void __init exynos_smp_prepare_cpus(unsigned int max_cpus)
          * boot register if it fails.
          */
         for (i = 1; i < max_cpus; ++i) {
-                unsigned long phys_cpu;
                 unsigned long boot_addr;
+                u32 mpidr;
+                u32 core_id;
                 int ret;
 
-                phys_cpu = cpu_logical_map(i);
+                mpidr = cpu_logical_map(i);
+                core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
                 boot_addr = virt_to_phys(exynos4_secondary_startup);
 
-                ret = call_firmware_op(set_cpu_boot_addr, phys_cpu, boot_addr);
+                ret = call_firmware_op(set_cpu_boot_addr, core_id, boot_addr);
                 if (ret && ret != -ENOSYS)
                         break;
                 if (ret == -ENOSYS) {
-                        void __iomem *boot_reg = cpu_boot_reg(phys_cpu);
+                        void __iomem *boot_reg = cpu_boot_reg(core_id);
 
                         if (IS_ERR(boot_reg))
                                 break;
-                        __raw_writel(boot_addr, cpu_boot_reg(phys_cpu));
+                        __raw_writel(boot_addr, cpu_boot_reg(core_id));
                 }
         }
 }
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 8e795dea02ec..8556c787e59c 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -70,7 +70,7 @@ static const char *cko_sels[] = { "cko1", "cko2", };
 static const char *lvds_sels[] = {
         "dummy", "dummy", "dummy", "dummy", "dummy", "dummy",
         "pll4_audio", "pll5_video", "pll8_mlb", "enet_ref",
-        "pcie_ref", "sata_ref",
+        "pcie_ref_125m", "sata_ref_100m",
 };
 
 enum mx6q_clks {
@@ -491,7 +491,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
 
         /* All existing boards with PCIe use LVDS1 */
         if (IS_ENABLED(CONFIG_PCI_IMX6))
-                clk_set_parent(clk[lvds1_sel], clk[sata_ref]);
+                clk_set_parent(clk[lvds1_sel], clk[sata_ref_100m]);
 
         /* Set initial power mode */
         imx6q_set_lpm(WAIT_CLOCKED);
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 477202fd39cc..2bdc3233abe2 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -292,6 +292,10 @@ static struct notifier_block mvebu_hwcc_nb = {
         .notifier_call = mvebu_hwcc_notifier,
 };
 
+static struct notifier_block mvebu_hwcc_pci_nb = {
+        .notifier_call = mvebu_hwcc_notifier,
+};
+
 static void __init armada_370_coherency_init(struct device_node *np)
 {
         struct resource res;
@@ -427,7 +431,7 @@ static int __init coherency_pci_init(void)
 {
         if (coherency_available())
                 bus_register_notifier(&pci_bus_type,
-                                       &mvebu_hwcc_nb);
+                                       &mvebu_hwcc_pci_nb);
         return 0;
 }
 
diff --git a/arch/arm/mach-mvebu/headsmp-a9.S b/arch/arm/mach-mvebu/headsmp-a9.S
index 5925366bc03c..da5bb292b91c 100644
--- a/arch/arm/mach-mvebu/headsmp-a9.S
+++ b/arch/arm/mach-mvebu/headsmp-a9.S
@@ -15,6 +15,8 @@
 #include <linux/linkage.h>
 #include <linux/init.h>
 
+#include <asm/assembler.h>
+
         __CPUINIT
 #define CPU_RESUME_ADDR_REG 0xf10182d4
 
@@ -22,13 +24,18 @@
 .global armada_375_smp_cpu1_enable_code_end
 
 armada_375_smp_cpu1_enable_code_start:
-        ldr     r0, [pc, #4]
+ARM_BE8(setend  be)
+        adr     r0, 1f
+        ldr     r0, [r0]
         ldr     r1, [r0]
+ARM_BE8(rev     r1, r1)
         mov     pc, r1
+1:
         .word   CPU_RESUME_ADDR_REG
 armada_375_smp_cpu1_enable_code_end:
 
 ENTRY(mvebu_cortex_a9_secondary_startup)
+ARM_BE8(setend  be)
         bl      v7_invalidate_l1
         b       secondary_startup
 ENDPROC(mvebu_cortex_a9_secondary_startup)
diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
index a1d407c0febe..25aa8237d668 100644
--- a/arch/arm/mach-mvebu/pmsu.c
+++ b/arch/arm/mach-mvebu/pmsu.c
@@ -201,12 +201,12 @@ static noinline int do_armada_370_xp_cpu_suspend(unsigned long deepidle)
 
         /* Test the CR_C bit and set it if it was cleared */
         asm volatile(
-        "mrc    p15, 0, %0, c1, c0, 0 \n\t"
-        "tst    %0, #(1 << 2) \n\t"
-        "orreq  %0, %0, #(1 << 2) \n\t"
-        "mcreq  p15, 0, %0, c1, c0, 0 \n\t"
+        "mrc    p15, 0, r0, c1, c0, 0 \n\t"
+        "tst    r0, #(1 << 2) \n\t"
+        "orreq  r0, r0, #(1 << 2) \n\t"
+        "mcreq  p15, 0, r0, c1, c0, 0 \n\t"
         "isb    "
-        : : "r" (0));
+        : : : "r0");
 
         pr_warn("Failed to suspend the system\n");
 
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a474de346be6..839f48c26ef0 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -4,6 +4,7 @@ config ARM64
         select ARCH_HAS_OPP
         select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
         select ARCH_USE_CMPXCHG_LOCKREF
+        select ARCH_SUPPORTS_ATOMIC_RMW
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
         select ARCH_WANT_FRAME_POINTERS
diff --git a/arch/arm64/kernel/efi-stub.c b/arch/arm64/kernel/efi-stub.c
index 60e98a639ac5..e786e6cdc400 100644
--- a/arch/arm64/kernel/efi-stub.c
+++ b/arch/arm64/kernel/efi-stub.c
@@ -12,8 +12,6 @@
 #include <linux/efi.h>
 #include <linux/libfdt.h>
 #include <asm/sections.h>
-#include <generated/compile.h>
-#include <generated/utsrelease.h>
 
 /*
  * AArch64 requires the DTB to be 8-byte aligned in the first 512MiB from
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index fefe7c8bf05f..80b94b0add1f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -145,6 +145,7 @@ config PPC
         select HAVE_IRQ_EXIT_ON_IRQ_STACK
         select ARCH_USE_CMPXCHG_LOCKREF if PPC64
         select HAVE_ARCH_AUDITSYSCALL
+        select ARCH_SUPPORTS_ATOMIC_RMW
 
 config GENERIC_CSUM
         def_bool CPU_LITTLE_ENDIAN
diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
index fddb72b48ce9..d645428a65a4 100644
--- a/arch/powerpc/include/asm/kvm_book3s_64.h
+++ b/arch/powerpc/include/asm/kvm_book3s_64.h
@@ -198,8 +198,10 @@ static inline unsigned long compute_tlbie_rb(unsigned long v, unsigned long r,
         return rb;
 }
 
-static inline unsigned long hpte_page_size(unsigned long h, unsigned long l)
+static inline unsigned long __hpte_page_size(unsigned long h, unsigned long l,
+                                             bool is_base_size)
 {
+
         int size, a_psize;
         /* Look at the 8 bit LP value */
         unsigned int lp = (l >> LP_SHIFT) & ((1 << LP_BITS) - 1);
@@ -214,14 +216,27 @@ static inline unsigned long hpte_page_size(unsigned long h, unsigned long l)
                                 continue;
 
                         a_psize = __hpte_actual_psize(lp, size);
-                        if (a_psize != -1)
+                        if (a_psize != -1) {
+                                if (is_base_size)
+                                        return 1ul << mmu_psize_defs[size].shift;
                                 return 1ul << mmu_psize_defs[a_psize].shift;
+                        }
                 }
 
         }
         return 0;
 }
 
+static inline unsigned long hpte_page_size(unsigned long h, unsigned long l)
+{
+        return __hpte_page_size(h, l, 0);
+}
+
+static inline unsigned long hpte_base_page_size(unsigned long h, unsigned long l)
+{
+        return __hpte_page_size(h, l, 1);
+}
+
 static inline unsigned long hpte_rpn(unsigned long ptel, unsigned long psize)
 {
         return ((ptel & HPTE_R_RPN) & ~(psize - 1)) >> PAGE_SHIFT;
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index 9ea266eae33e..7e4612528546 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -277,6 +277,8 @@ n:
         .globl n;       \
 n:
 
+#define _GLOBAL_TOC(name) _GLOBAL(name)
+
 #define _KPROBE(n)      \
         .section ".kprobes.text","a";   \
         .globl  n;      \
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 80561074078d..68468d695f12 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -1562,7 +1562,7 @@ static ssize_t kvm_htab_write(struct file *file, const char __user *buf,
                                 goto out;
                         }
                         if (!rma_setup && is_vrma_hpte(v)) {
-                                unsigned long psize = hpte_page_size(v, r);
+                                unsigned long psize = hpte_base_page_size(v, r);
                                 unsigned long senc = slb_pgsize_encoding(psize);
                                 unsigned long lpcr;
 
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 6e6224318c36..5a24d3c2b6b8 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -814,13 +814,10 @@ long kvmppc_hv_find_lock_hpte(struct kvm *kvm, gva_t eaddr, unsigned long slb_v,
                         r = hpte[i+1];
 
                         /*
-                         * Check the HPTE again, including large page size
-                         * Since we don't currently allow any MPSS (mixed
-                         * page-size segment) page sizes, it is sufficient
-                         * to check against the actual page size.
+                         * Check the HPTE again, including base page size
                          */
                         if ((v & valid) && (v & mask) == val &&
-                            hpte_page_size(v, r) == (1ul << pshift))
+                            hpte_base_page_size(v, r) == (1ul << pshift))
                                 /* Return with the HPTE still locked */
                                 return (hash << 3) + (i >> 1);
 
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 868347ef09fd..558a67df8126 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -48,7 +48,7 @@
  *
  * LR = return address to continue at after eventually re-enabling MMU
  */
-_GLOBAL(kvmppc_hv_entry_trampoline)
+_GLOBAL_TOC(kvmppc_hv_entry_trampoline)
         mflr    r0
         std     r0, PPC_LR_STKOFF(r1)
         stdu    r1, -112(r1)
diff --git a/arch/powerpc/kvm/book3s_interrupts.S b/arch/powerpc/kvm/book3s_interrupts.S
index e2c29e381dc7..d044b8b7c69d 100644
--- a/arch/powerpc/kvm/book3s_interrupts.S
+++ b/arch/powerpc/kvm/book3s_interrupts.S
@@ -25,7 +25,11 @@
 #include <asm/exception-64s.h>
 
 #if defined(CONFIG_PPC_BOOK3S_64)
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+#define FUNC(name)              name
+#else
 #define FUNC(name)              GLUE(.,name)
+#endif
 #define GET_SHADOW_VCPU(reg)    addi    reg, r13, PACA_SVCPU
 
 #elif defined(CONFIG_PPC_BOOK3S_32)
diff --git a/arch/powerpc/kvm/book3s_rmhandlers.S b/arch/powerpc/kvm/book3s_rmhandlers.S
index 9eec675220e6..16c4d88ba27d 100644
--- a/arch/powerpc/kvm/book3s_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_rmhandlers.S
@@ -36,7 +36,11 @@
 
 #if defined(CONFIG_PPC_BOOK3S_64)
 
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+#define FUNC(name)              name
+#else
 #define FUNC(name)              GLUE(.,name)
+#endif
 
 #elif defined(CONFIG_PPC_BOOK3S_32)
 
@@ -146,7 +150,7 @@ kvmppc_handler_skip_ins:
  * On entry, r4 contains the guest shadow MSR
  * MSR.EE has to be 0 when calling this function
  */
-_GLOBAL(kvmppc_entry_trampoline)
+_GLOBAL_TOC(kvmppc_entry_trampoline)
         mfmsr   r5
         LOAD_REG_ADDR(r7, kvmppc_handler_trampoline_enter)
         toreal(r7)
diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c
index edb14ba992b3..ef27fbd5d9c5 100644
--- a/arch/powerpc/kvm/book3s_rtas.c
+++ b/arch/powerpc/kvm/book3s_rtas.c
@@ -23,20 +23,20 @@ static void kvm_rtas_set_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq, server, priority;
         int rc;
 
-        if (args->nargs != 3 || args->nret != 1) {
+        if (be32_to_cpu(args->nargs) != 3 || be32_to_cpu(args->nret) != 1) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
-        server = args->args[1];
-        priority = args->args[2];
+        irq = be32_to_cpu(args->args[0]);
+        server = be32_to_cpu(args->args[1]);
+        priority = be32_to_cpu(args->args[2]);
 
         rc = kvmppc_xics_set_xive(vcpu->kvm, irq, server, priority);
         if (rc)
                 rc = -3;
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 
 static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
@@ -44,12 +44,12 @@ static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq, server, priority;
         int rc;
 
-        if (args->nargs != 1 || args->nret != 3) {
+        if (be32_to_cpu(args->nargs) != 1 || be32_to_cpu(args->nret) != 3) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
+        irq = be32_to_cpu(args->args[0]);
 
         server = priority = 0;
         rc = kvmppc_xics_get_xive(vcpu->kvm, irq, &server, &priority);
@@ -58,10 +58,10 @@ static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
                 goto out;
         }
 
-        args->rets[1] = server;
-        args->rets[2] = priority;
+        args->rets[1] = cpu_to_be32(server);
+        args->rets[2] = cpu_to_be32(priority);
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 
 static void kvm_rtas_int_off(struct kvm_vcpu *vcpu, struct rtas_args *args)
@@ -69,18 +69,18 @@ static void kvm_rtas_int_off(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq;
         int rc;
 
-        if (args->nargs != 1 || args->nret != 1) {
+        if (be32_to_cpu(args->nargs) != 1 || be32_to_cpu(args->nret) != 1) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
+        irq = be32_to_cpu(args->args[0]);
 
         rc = kvmppc_xics_int_off(vcpu->kvm, irq);
         if (rc)
                 rc = -3;
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 
 static void kvm_rtas_int_on(struct kvm_vcpu *vcpu, struct rtas_args *args)
@@ -88,18 +88,18 @@ static void kvm_rtas_int_on(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq;
         int rc;
 
-        if (args->nargs != 1 || args->nret != 1) {
+        if (be32_to_cpu(args->nargs) != 1 || be32_to_cpu(args->nret) != 1) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
+        irq = be32_to_cpu(args->args[0]);
 
         rc = kvmppc_xics_int_on(vcpu->kvm, irq);
         if (rc)
                 rc = -3;
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 #endif /* CONFIG_KVM_XICS */
 
@@ -205,32 +205,6 @@ int kvm_vm_ioctl_rtas_define_token(struct kvm *kvm, void __user *argp)
         return rc;
 }
 
-static void kvmppc_rtas_swap_endian_in(struct rtas_args *args)
-{
-#ifdef __LITTLE_ENDIAN__
-        int i;
-
-        args->token = be32_to_cpu(args->token);
-        args->nargs = be32_to_cpu(args->nargs);
-        args->nret = be32_to_cpu(args->nret);
-        for (i = 0; i < args->nargs; i++)
-                args->args[i] = be32_to_cpu(args->args[i]);
-#endif
-}
-
-static void kvmppc_rtas_swap_endian_out(struct rtas_args *args)
-{
-#ifdef __LITTLE_ENDIAN__
-        int i;
-
-        for (i = 0; i < args->nret; i++)
-                args->args[i] = cpu_to_be32(args->args[i]);
-        args->token = cpu_to_be32(args->token);
-        args->nargs = cpu_to_be32(args->nargs);
-        args->nret = cpu_to_be32(args->nret);
-#endif
-}
-
 int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
 {
         struct rtas_token_definition *d;
@@ -249,8 +223,6 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
         if (rc)
                 goto fail;
 
-        kvmppc_rtas_swap_endian_in(&args);
-
         /*
          * args->rets is a pointer into args->args. Now that we've
          * copied args we need to fix it up to point into our copy,
@@ -258,13 +230,13 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
          * value so we can restore it on the way out.
          */
         orig_rets = args.rets;
-        args.rets = &args.args[args.nargs];
+        args.rets = &args.args[be32_to_cpu(args.nargs)];
 
         mutex_lock(&vcpu->kvm->lock);
 
         rc = -ENOENT;
         list_for_each_entry(d, &vcpu->kvm->arch.rtas_tokens, list) {
-                if (d->token == args.token) {
+                if (d->token == be32_to_cpu(args.token)) {
                         d->handler->handler(vcpu, &args);
                         rc = 0;
                         break;
@@ -275,7 +247,6 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
 
         if (rc == 0) {
                 args.rets = orig_rets;
-                kvmppc_rtas_swap_endian_out(&args);
                 rc = kvm_write_guest(vcpu->kvm, args_phys, &args, sizeof(args));
                 if (rc)
                         goto fail;
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index dd2cc03f406f..86903d3f5a03 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -473,7 +473,8 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
                 if (printk_ratelimit())
                         pr_err("%s: pte not present: gfn %lx, pfn %lx\n",
                                 __func__, (long)gfn, pfn);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
         kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg);
 
diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
index df38c70cd59e..18ea9e3f8142 100644
--- a/arch/s390/include/asm/switch_to.h
+++ b/arch/s390/include/asm/switch_to.h
@@ -51,8 +51,8 @@ static inline int restore_fp_ctl(u32 *fpc)
                 return 0;
 
         asm volatile(
-                "0:     lfpc    %1\n"
-                "       la      %0,0\n"
+                "       lfpc    %1\n"
+                "0:     la      %0,0\n"
                 "1:\n"
                 EX_TABLE(0b,1b)
                 : "=d" (rc) : "Q" (*fpc), "0" (-EINVAL));
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 7ba7d6784510..e88d35d74950 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -437,11 +437,11 @@ ENTRY(startup_kdump)
 
 #if defined(CONFIG_64BIT)
 #if defined(CONFIG_MARCH_ZEC12)
-        .long 3, 0xc100efea, 0xf46ce800, 0x00400000
+        .long 3, 0xc100eff2, 0xf46ce800, 0x00400000
 #elif defined(CONFIG_MARCH_Z196)
-        .long 2, 0xc100efea, 0xf46c0000
+        .long 2, 0xc100eff2, 0xf46c0000
 #elif defined(CONFIG_MARCH_Z10)
-        .long 2, 0xc100efea, 0xf0680000
+        .long 2, 0xc100eff2, 0xf0680000
 #elif defined(CONFIG_MARCH_Z9_109)
         .long 1, 0xc100efc2
 #elif defined(CONFIG_MARCH_Z990)
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 2d716734b5b1..5dc7ad9e2fbf 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -334,9 +334,14 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
                         unsigned long mask = PSW_MASK_USER;
 
                         mask |= is_ri_task(child) ? PSW_MASK_RI : 0;
-                        if ((data & ~mask) != PSW_USER_BITS)
+                        if ((data ^ PSW_USER_BITS) & ~mask)
+                                /* Invalid psw mask. */
+                                return -EINVAL;
+                        if ((data & PSW_MASK_ASC) == PSW_ASC_HOME)
+                                /* Invalid address-space-control bits */
                                 return -EINVAL;
                         if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))
+                                /* Invalid addressing mode bits */
                                 return -EINVAL;
                 }
                 *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
@@ -672,9 +677,12 @@ static int __poke_user_compat(struct task_struct *child,
 
                         mask |= is_ri_task(child) ? PSW32_MASK_RI : 0;
                         /* Build a 64 bit psw mask from 31 bit mask. */
-                        if ((tmp & ~mask) != PSW32_USER_BITS)
+                        if ((tmp ^ PSW32_USER_BITS) & ~mask)
                                 /* Invalid psw mask. */
                                 return -EINVAL;
+                        if ((data & PSW32_MASK_ASC) == PSW32_ASC_HOME)
+                                /* Invalid address-space-control bits */
+                                return -EINVAL;
                         regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
                                 (regs->psw.mask & PSW_MASK_BA) |
                                 (__u64)(tmp & mask) << 32;
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 9ddc51eeb8d6..30de42730b2f 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -48,13 +48,10 @@
 static LIST_HEAD(zpci_list);
 static DEFINE_SPINLOCK(zpci_list_lock);
 
-static void zpci_enable_irq(struct irq_data *data);
-static void zpci_disable_irq(struct irq_data *data);
-
 static struct irq_chip zpci_irq_chip = {
         .name = "zPCI",
-        .irq_unmask = zpci_enable_irq,
-        .irq_mask = zpci_disable_irq,
+        .irq_unmask = unmask_msi_irq,
+        .irq_mask = mask_msi_irq,
 };
 
 static DECLARE_BITMAP(zpci_domain, ZPCI_NR_DEVICES);
@@ -244,43 +241,6 @@ static int zpci_cfg_store(struct zpci_dev *zdev, int offset, u32 val, u8 len)
         return rc;
 }
 
-static int zpci_msi_set_mask_bits(struct msi_desc *msi, u32 mask, u32 flag)
-{
-        int offset, pos;
-        u32 mask_bits;
-
-        if (msi->msi_attrib.is_msix) {
-                offset = msi->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE +
-                        PCI_MSIX_ENTRY_VECTOR_CTRL;
-                msi->masked = readl(msi->mask_base + offset);
-                writel(flag, msi->mask_base + offset);
-        } else if (msi->msi_attrib.maskbit) {
-                pos = (long) msi->mask_base;
-                pci_read_config_dword(msi->dev, pos, &mask_bits);
-                mask_bits &= ~(mask);
-                mask_bits |= flag & mask;
-                pci_write_config_dword(msi->dev, pos, mask_bits);
-        } else
-                return 0;
-
-        msi->msi_attrib.maskbit = !!flag;
-        return 1;
-}
-
-static void zpci_enable_irq(struct irq_data *data)
-{
-        struct msi_desc *msi = irq_get_msi_desc(data->irq);
-
-        zpci_msi_set_mask_bits(msi, 1, 0);
-}
-
-static void zpci_disable_irq(struct irq_data *data)
-{
-        struct msi_desc *msi = irq_get_msi_desc(data->irq);
-
-        zpci_msi_set_mask_bits(msi, 1, 1);
-}
-
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
 }
@@ -487,7 +447,10 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)
 
         /* Release MSI interrupts */
         list_for_each_entry(msi, &pdev->msi_list, list) {
-                zpci_msi_set_mask_bits(msi, 1, 1);
+                if (msi->msi_attrib.is_msix)
+                        default_msix_mask_irq(msi, 1);
+                else
+                        default_msi_mask_irq(msi, 1, 1);
                 irq_set_msi_desc(msi->irq, NULL);
                 irq_free_desc(msi->irq);
                 msi->msg.address_lo = 0;
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 29f2e988c56a..407c87d9879a 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -78,6 +78,7 @@ config SPARC64
         select HAVE_C_RECORDMCOUNT
         select NO_BOOTMEM
         select HAVE_ARCH_AUDITSYSCALL
+        select ARCH_SUPPORTS_ATOMIC_RMW
 
 config ARCH_DEFCONFIG
         string
diff --git a/arch/sparc/include/uapi/asm/unistd.h b/arch/sparc/include/uapi/asm/unistd.h
index b73274fb961a..42f2bca1d338 100644
--- a/arch/sparc/include/uapi/asm/unistd.h
+++ b/arch/sparc/include/uapi/asm/unistd.h
@@ -410,8 +410,9 @@
 #define __NR_finit_module       342
 #define __NR_sched_setattr      343
 #define __NR_sched_getattr      344
+#define __NR_renameat2          345
 
-#define NR_syscalls             345
+#define NR_syscalls             346
 
 /* Bitmask values returned from kern_features system call.  */
 #define KERN_FEATURE_MIXED_MODE_STACK   0x00000001
diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
index d066eb18650c..f834224208ed 100644
--- a/arch/sparc/kernel/sys32.S
+++ b/arch/sparc/kernel/sys32.S
@@ -48,6 +48,7 @@ SIGN1(sys32_futex, compat_sys_futex, %o1)
 SIGN1(sys32_recvfrom, compat_sys_recvfrom, %o0)
 SIGN1(sys32_recvmsg, compat_sys_recvmsg, %o0)
 SIGN1(sys32_sendmsg, compat_sys_sendmsg, %o0)
+SIGN2(sys32_renameat2, sys_renameat2, %o0, %o2)
 
         .globl          sys32_mmap2
 sys32_mmap2:
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index 151ace8766cc..85fe9b1087cd 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -86,3 +86,4 @@ sys_call_table:
 /*330*/ .long sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
 /*335*/ .long sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .long sys_ni_syscall, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
+/*345*/ .long sys_renameat2
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index 4bd4e2bb26cf..33ecba2826ea 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -87,6 +87,7 @@ sys_call_table32:
 /*330*/ .word compat_sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, compat_sys_open_by_handle_at, compat_sys_clock_adjtime
         .word sys_syncfs, compat_sys_sendmmsg, sys_setns, compat_sys_process_vm_readv, compat_sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
+        .word sys32_renameat2
 
 #endif /* CONFIG_COMPAT */
 
@@ -165,3 +166,4 @@ sys_call_table:
 /*330*/ .word sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
         .word sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
+        .word sys_renameat2
diff --git a/arch/um/kernel/tlb.c b/arch/um/kernel/tlb.c
index 9472079471bb..f1b3eb14b855 100644
--- a/arch/um/kernel/tlb.c
+++ b/arch/um/kernel/tlb.c
@@ -12,6 +12,7 @@
 #include <mem_user.h>
 #include <os.h>
 #include <skas.h>
+#include <kern_util.h>
 
 struct host_vm_change {
         struct host_vm_op {
@@ -124,6 +125,9 @@ static int add_munmap(unsigned long addr, unsigned long len,
         struct host_vm_op *last;
         int ret = 0;
 
+        if ((addr >= STUB_START) && (addr < STUB_END))
+                return -EINVAL;
+
         if (hvc->index != 0) {
                 last = &hvc->ops[hvc->index - 1];
                 if ((last->type == MUNMAP) &&
@@ -283,8 +287,11 @@ void fix_range_common(struct mm_struct *mm, unsigned long start_addr,
         /* This is not an else because ret is modified above */
         if (ret) {
                 printk(KERN_ERR "fix_range_common: failed, killing current "
-                       "process\n");
+                       "process: %d\n", task_tgid_vnr(current));
+                /* We are under mmap_sem, release it such that current can terminate */
+                up_write(&current->mm->mmap_sem);
                 force_sig(SIGKILL, current);
+                do_signal();
         }
 }
 
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index 974b87474a99..5678c3571e7c 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -206,7 +206,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
         int is_write = FAULT_WRITE(fi);
         unsigned long address = FAULT_ADDRESS(fi);
 
-        if (regs)
+        if (!is_user && regs)
                 current->thread.segv_regs = container_of(regs, struct pt_regs, regs);
 
         if (!is_user && (address >= start_vm) && (address < end_vm)) {
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index d531879a4617..908579f2b0ab 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -54,7 +54,7 @@ static int ptrace_dump_regs(int pid)
 
 void wait_stub_done(int pid)
 {
-        int n, status, err, bad_stop = 0;
+        int n, status, err;
 
         while (1) {
                 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
@@ -74,8 +74,6 @@ void wait_stub_done(int pid)
 
         if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0)
                 return;
-        else
-                bad_stop = 1;
 
 bad_wait:
         err = ptrace_dump_regs(pid);
@@ -85,10 +83,7 @@ bad_wait:
         printk(UM_KERN_ERR "wait_stub_done : failed to wait for SIGTRAP, "
                "pid = %d, n = %d, errno = %d, status = 0x%x\n", pid, n, errno,
                status);
-        if (bad_stop)
-                kill(pid, SIGKILL);
-        else
-                fatal_sigsegv();
+        fatal_sigsegv();
 }
 
 extern unsigned long current_stub_stack(void);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index a8f749ef0fdc..d24887b645dc 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -131,6 +131,7 @@ config X86
         select HAVE_CC_STACKPROTECTOR
         select GENERIC_CPU_AUTOPROBE
         select HAVE_ARCH_AUDITSYSCALL
+        select ARCH_SUPPORTS_ATOMIC_RMW
 
 config INSTRUCTION_DECODER
         def_bool y
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 84c223479e3c..7a6d43a554d7 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -91,10 +91,9 @@ bs_die:
 
         .section ".bsdata", "a"
 bugger_off_msg:
-        .ascii  "Direct floppy boot is not supported. "
-        .ascii  "Use a boot loader program instead.\r\n"
+        .ascii  "Use a boot loader.\r\n"
         .ascii  "\n"
-        .ascii  "Remove disk and press any key to reboot ...\r\n"
+        .ascii  "Remove disk and press any key to reboot...\r\n"
         .byte   0
 
 #ifdef CONFIG_EFI_STUB
@@ -108,7 +107,7 @@ coff_header:
 #else
         .word   0x8664                          # x86-64
 #endif
-        .word   3                               # nr_sections
+        .word   4                               # nr_sections
         .long   0                               # TimeDateStamp
         .long   0                               # PointerToSymbolTable
         .long   1                               # NumberOfSymbols
@@ -250,6 +249,25 @@ section_table:
         .word   0                               # NumberOfLineNumbers
         .long   0x60500020                      # Characteristics (section flags)
 
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".bss"
+        .byte   0
+        .byte   0
+        .byte   0
+        .byte   0
+        .long   0
+        .long   0x0
+        .long   0                               # Size of initialized data
+                                                # on disk
+        .long   0x0
+        .long   0                               # PointerToRelocations
+        .long   0                               # PointerToLineNumbers
+        .word   0                               # NumberOfRelocations
+        .word   0                               # NumberOfLineNumbers
+        .long   0xc8000080                      # Characteristics (section flags)
+
 #endif /* CONFIG_EFI_STUB */
 
         # Kernel attributes; used by setup.  This is part 1 of the
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 1a2f2121cada..a7661c430cd9 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -143,7 +143,7 @@ static void usage(void)
 
 #ifdef CONFIG_EFI_STUB
 
-static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+static void update_pecoff_section_header_fields(char *section_name, u32 vma, u32 size, u32 datasz, u32 offset)
 {
         unsigned int pe_header;
         unsigned short num_sections;
@@ -164,10 +164,10 @@ static void update_pecoff_section_header(char *section_name, u32 offset, u32 siz
                         put_unaligned_le32(size, section + 0x8);
 
                         /* section header vma field */
-                        put_unaligned_le32(offset, section + 0xc);
+                        put_unaligned_le32(vma, section + 0xc);
 
                         /* section header 'size of initialised data' field */
-                        put_unaligned_le32(size, section + 0x10);
+                        put_unaligned_le32(datasz, section + 0x10);
 
                         /* section header 'file offset' field */
                         put_unaligned_le32(offset, section + 0x14);
@@ -179,6 +179,11 @@ static void update_pecoff_section_header(char *section_name, u32 offset, u32 siz
         }
 }
 
+static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+{
+        update_pecoff_section_header_fields(section_name, offset, size, size, offset);
+}
+
 static void update_pecoff_setup_and_reloc(unsigned int size)
 {
         u32 setup_offset = 0x200;
@@ -203,9 +208,6 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
 
         pe_header = get_unaligned_le32(&buf[0x3c]);
 
-        /* Size of image */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
-
         /*
          * Size of code: Subtract the size of the first sector (512 bytes)
          * which includes the header.
@@ -220,6 +222,22 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
         update_pecoff_section_header(".text", text_start, text_sz);
 }
 
+static void update_pecoff_bss(unsigned int file_sz, unsigned int init_sz)
+{
+        unsigned int pe_header;
+        unsigned int bss_sz = init_sz - file_sz;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+
+        /* Size of uninitialized data */
+        put_unaligned_le32(bss_sz, &buf[pe_header + 0x24]);
+
+        /* Size of image */
+        put_unaligned_le32(init_sz, &buf[pe_header + 0x50]);
+
+        update_pecoff_section_header_fields(".bss", file_sz, bss_sz, 0, 0);
+}
+
 static int reserve_pecoff_reloc_section(int c)
 {
         /* Reserve 0x20 bytes for .reloc section */
@@ -259,6 +277,8 @@ static void efi_stub_entry_update(void)
 static inline void update_pecoff_setup_and_reloc(unsigned int size) {}
 static inline void update_pecoff_text(unsigned int text_start,
                                       unsigned int file_sz) {}
+static inline void update_pecoff_bss(unsigned int file_sz,
+                                     unsigned int init_sz) {}
 static inline void efi_stub_defaults(void) {}
 static inline void efi_stub_entry_update(void) {}
 
@@ -310,7 +330,7 @@ static void parse_zoffset(char *fname)
 
 int main(int argc, char ** argv)
 {
-        unsigned int i, sz, setup_sectors;
+        unsigned int i, sz, setup_sectors, init_sz;
         int c;
         u32 sys_size;
         struct stat sb;
@@ -376,7 +396,9 @@ int main(int argc, char ** argv)
         buf[0x1f1] = setup_sectors-1;
         put_unaligned_le32(sys_size, &buf[0x1f4]);
 
-        update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+        update_pecoff_text(setup_sectors * 512, i + (sys_size * 16));
+        init_sz = get_unaligned_le32(&buf[0x260]);
+        update_pecoff_bss(i + (sys_size * 16), init_sz);
 
         efi_stub_entry_update();
 
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index f3a1f04ed4cb..584874451414 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -841,7 +841,6 @@ static int apm_do_idle(void)
         u32 eax;
         u8 ret = 0;
         int idled = 0;
-        int polling;
         int err = 0;
 
         if (!need_resched()) {
diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 6afbb16e9b79..94d857fb1033 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -175,7 +175,7 @@ void init_espfix_ap(void)
         if (!pud_present(pud)) {
                 pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
                 pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
-                paravirt_alloc_pud(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
+                paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
                 for (n = 0; n < ESPFIX_PUD_CLONES; n++)
                         set_pud(&pud_p[n], pud);
         }
@@ -185,7 +185,7 @@ void init_espfix_ap(void)
         if (!pmd_present(pmd)) {
                 pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
                 pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
-                paravirt_alloc_pmd(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
+                paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
                 for (n = 0; n < ESPFIX_PMD_CLONES; n++)
                         set_pmd(&pmd_p[n], pmd);
         }
@@ -193,7 +193,6 @@ void init_espfix_ap(void)
         pte_p = pte_offset_kernel(&pmd, addr);
         stack_page = (void *)__get_free_page(GFP_KERNEL);
         pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
-        paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
         for (n = 0; n < ESPFIX_PTE_CLONES; n++)
                 set_pte(&pte_p[n*PTE_STRIDE], pte);
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f6449334ec45..ef432f891d30 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5887,6 +5887,18 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
                         kvm_x86_ops->set_nmi(vcpu);
                 }
         } else if (kvm_cpu_has_injectable_intr(vcpu)) {
+                /*
+                 * Because interrupts can be injected asynchronously, we are
+                 * calling check_nested_events again here to avoid a race condition.
+                 * See https://lkml.org/lkml/2014/7/2/60 for discussion about this
+                 * proposal and current concerns.  Perhaps we should be setting
+                 * KVM_REQ_EVENT only on certain events and not unconditionally?
+                 */
+                if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) {
+                        r = kvm_x86_ops->check_nested_events(vcpu, req_int_win);
+                        if (r != 0)
+                                return r;
+                }
                 if (kvm_x86_ops->interrupt_allowed(vcpu)) {
                         kvm_queue_interrupt(vcpu, kvm_cpu_get_interrupt(vcpu),
                                             false);
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index b9f4cc494ece..28d227c5ca77 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -872,6 +872,13 @@ void blkcg_drain_queue(struct request_queue *q)
 {
         lockdep_assert_held(q->queue_lock);
 
+        /*
+         * @q could be exiting and already have destroyed all blkgs as
+         * indicated by NULL root_blkg.  If so, don't confuse policies.
+         */
+        if (!q->root_blkg)
+                return;
+
         blk_throtl_drain(q);
 }
 
diff --git a/block/blk-tag.c b/block/blk-tag.c
index 3f33d8672268..a185b86741e5 100644
--- a/block/blk-tag.c
+++ b/block/blk-tag.c
@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struct request_queue *q, int tag)
 EXPORT_SYMBOL(blk_queue_find_tag);
 
 /**
- * __blk_free_tags - release a given set of tag maintenance info
+ * blk_free_tags - release a given set of tag maintenance info
  * @bqt:        the tag map to free
  *
- * Tries to free the specified @bqt.  Returns true if it was
- * actually freed and false if there are still references using it
+ * Drop the reference count on @bqt and frees it when the last reference
+ * is dropped.
  */
-static int __blk_free_tags(struct blk_queue_tag *bqt)
+void blk_free_tags(struct blk_queue_tag *bqt)
 {
-        int retval;
-
-        retval = atomic_dec_and_test(&bqt->refcnt);
-        if (retval) {
+        if (atomic_dec_and_test(&bqt->refcnt)) {
                 BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
                                                         bqt->max_depth);
 
@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_queue_tag *bqt)
 
                 kfree(bqt);
         }
-
-        return retval;
 }
+EXPORT_SYMBOL(blk_free_tags);
 
 /**
  * __blk_queue_free_tags - release tag maintenance info
@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct request_queue *q)
         if (!bqt)
                 return;
 
-        __blk_free_tags(bqt);
+        blk_free_tags(bqt);
 
         q->queue_tags = NULL;
         queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
 }
 
 /**
- * blk_free_tags - release a given set of tag maintenance info
- * @bqt:        the tag map to free
- *
- * For externally managed @bqt frees the map.  Callers of this
- * function must guarantee to have released all the queues that
- * might have been using this tag map.
- */
-void blk_free_tags(struct blk_queue_tag *bqt)
-{
-        if (unlikely(!__blk_free_tags(bqt)))
-                BUG();
-}
-EXPORT_SYMBOL(blk_free_tags);
-
-/**
  * blk_queue_free_tags - release tag maintenance info
  * @q:  the request queue for the device
  *
diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
index fbd5a67cb773..a0926a6094b2 100644
--- a/block/compat_ioctl.c
+++ b/block/compat_ioctl.c
@@ -690,6 +690,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
         case BLKROSET:
         case BLKDISCARD:
         case BLKSECDISCARD:
+        case BLKZEROOUT:
         /*
          * the ones below are implemented in blkdev_locked_ioctl,
          * but we call blkdev_ioctl, which gets the lock for us
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 071c1dfb93f3..350d52a8f781 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -68,7 +68,7 @@ MODULE_AUTHOR("Bruno Ducrot");
 MODULE_DESCRIPTION("ACPI Video Driver");
 MODULE_LICENSE("GPL");
 
-static bool brightness_switch_enabled;
+static bool brightness_switch_enabled = 1;
 module_param(brightness_switch_enabled, bool, 0644);
 
 /*
@@ -581,6 +581,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
         },
         {
         .callback = video_set_use_native_backlight,
+        .ident = "HP ProBook 4540s",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "HP ProBook 4540s"),
+                },
+        },
+        {
+        .callback = video_set_use_native_backlight,
         .ident = "HP ProBook 2013 models",
         .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dae5607e1115..4cd52a4541a9 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -456,6 +456,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
 
         /* Promise */
         { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },   /* PDC42819 */
+        { PCI_VDEVICE(PROMISE, 0x3781), board_ahci },   /* FastTrak TX8660 ahci-mode */
 
         /* Asmedia */
         { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },   /* ASM1060 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 18d97d5c7d90..d19c37a7abc9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4787,6 +4787,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
  *      ata_qc_new - Request an available ATA command, for queueing
  *      @ap: target port
  *
+ *      Some ATA host controllers may implement a queue depth which is less
+ *      than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
+ *      the hardware limitation.
+ *
  *      LOCKING:
  *      None.
  */
@@ -4794,14 +4798,16 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
 {
         struct ata_queued_cmd *qc = NULL;
-        unsigned int i, tag;
+        unsigned int i, tag, max_queue;
+
+        max_queue = ap->scsi_host->can_queue;
 
         /* no command while frozen */
         if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
                 return NULL;
 
-        for (i = 0; i < ATA_MAX_QUEUE; i++) {
-                tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
+        for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
+                tag = tag < max_queue ? tag : 0;
 
                 /* the last tag is reserved for internal command. */
                 if (tag == ATA_TAG_INTERNAL)
@@ -6169,6 +6175,16 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
 {
         int i, rc;
 
+        /*
+         * The max queue supported by hardware must not be greater than
+         * ATA_MAX_QUEUE.
+         */
+        if (sht->can_queue > ATA_MAX_QUEUE) {
+                dev_err(host->dev, "BUG: the hardware max queue is too large\n");
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
         /* host must have been started */
         if (!(host->flags & ATA_HOST_STARTED)) {
                 dev_err(host->dev, "BUG: trying to register unstarted host\n");
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 6760fc4e85b8..dad83df555c4 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1811,7 +1811,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
         case ATA_DEV_ATA:
                 if (err & ATA_ICRC)
                         qc->err_mask |= AC_ERR_ATA_BUS;
-                if (err & ATA_UNC)
+                if (err & (ATA_UNC | ATA_AMNF))
                         qc->err_mask |= AC_ERR_MEDIA;
                 if (err & ATA_IDNF)
                         qc->err_mask |= AC_ERR_INVALID;
@@ -2556,11 +2556,12 @@ static void ata_eh_link_report(struct ata_link *link)
                 }
 
                 if (cmd->command != ATA_CMD_PACKET &&
-                    (res->feature & (ATA_ICRC | ATA_UNC | ATA_IDNF |
-                                     ATA_ABORTED)))
-                        ata_dev_err(qc->dev, "error: { %s%s%s%s}\n",
+                    (res->feature & (ATA_ICRC | ATA_UNC | ATA_AMNF |
+                                     ATA_IDNF | ATA_ABORTED)))
+                        ata_dev_err(qc->dev, "error: { %s%s%s%s%s}\n",
                           res->feature & ATA_ICRC ? "ICRC " : "",
                           res->feature & ATA_UNC ? "UNC " : "",
+                          res->feature & ATA_AMNF ? "AMNF " : "",
                           res->feature & ATA_IDNF ? "IDNF " : "",
                           res->feature & ATA_ABORTED ? "ABRT " : "");
 #endif
diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 6ad5c072ce34..4d37c5415fc7 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -915,7 +915,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev)
         struct ep93xx_pata_data *drv_data;
         struct ata_host *host;
         struct ata_port *ap;
-        unsigned int irq;
+        int irq;
         struct resource *mem_res;
         void __iomem *ide_base;
         int err;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 9e9227e1762d..eee48c49f5de 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -89,8 +89,13 @@ int platform_get_irq(struct platform_device *dev, unsigned int num)
         return dev->archdata.irqs[num];
 #else
         struct resource *r;
-        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
-                return of_irq_get(dev->dev.of_node, num);
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
+                int ret;
+
+                ret = of_irq_get(dev->dev.of_node, num);
+                if (ret >= 0 || ret == -EPROBE_DEFER)
+                        return ret;
+        }
 
         r = platform_get_resource(dev, IORESOURCE_IRQ, num);
 
@@ -133,8 +138,13 @@ int platform_get_irq_byname(struct platform_device *dev, const char *name)
 {
         struct resource *r;
 
-        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node)
-                return of_irq_get_byname(dev->dev.of_node, name);
+        if (IS_ENABLED(CONFIG_OF_IRQ) && dev->dev.of_node) {
+                int ret;
+
+                ret = of_irq_get_byname(dev->dev.of_node, name);
+                if (ret >= 0 || ret == -EPROBE_DEFER)
+                        return ret;
+        }
 
         r = platform_get_resource_byname(dev, IORESOURCE_IRQ, name);
         return r ? r->start : -ENXIO;
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 1b35c45c92b7..3f2e16738080 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -544,6 +544,12 @@ void conn_try_outdate_peer_async(struct drbd_connection *connection)
         struct task_struct *opa;
 
         kref_get(&connection->kref);
+        /* We may just have force_sig()'ed this thread
+         * to get it out of some blocking network function.
+         * Clear signals; otherwise kthread_run(), which internally uses
+         * wait_on_completion_killable(), will mistake our pending signal
+         * for a new fatal signal and fail. */
+        flush_signals(current);
         opa = kthread_run(_try_outdate_peer_async, connection, "drbd_async_h");
         if (IS_ERR(opa)) {
                 drbd_err(connection, "out of mem, failed to invoke fence-peer helper\n");
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 334601cc81cf..c4419ea1ab07 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -55,16 +55,41 @@ static DEFINE_MUTEX(rng_mutex);
 static int data_avail;
 static u8 *rng_buffer;
 
+static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
+                               int wait);
+
 static size_t rng_buffer_size(void)
 {
         return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
 }
 
+static void add_early_randomness(struct hwrng *rng)
+{
+        unsigned char bytes[16];
+        int bytes_read;
+
+        /*
+         * Currently only virtio-rng cannot return data during device
+         * probe, and that's handled in virtio-rng.c itself.  If there
+         * are more such devices, this call to rng_get_data can be
+         * made conditional here instead of doing it per-device.
+         */
+        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
+        if (bytes_read > 0)
+                add_device_randomness(bytes, bytes_read);
+}
+
 static inline int hwrng_init(struct hwrng *rng)
 {
-        if (!rng->init)
-                return 0;
-        return rng->init(rng);
+        if (rng->init) {
+                int ret;
+
+                ret =  rng->init(rng);
+                if (ret)
+                        return ret;
+        }
+        add_early_randomness(rng);
+        return 0;
 }
 
 static inline void hwrng_cleanup(struct hwrng *rng)
@@ -304,8 +329,6 @@ int hwrng_register(struct hwrng *rng)
 {
         int err = -EINVAL;
         struct hwrng *old_rng, *tmp;
-        unsigned char bytes[16];
-        int bytes_read;
 
         if (rng->name == NULL ||
             (rng->data_read == NULL && rng->read == NULL))
@@ -347,9 +370,17 @@ int hwrng_register(struct hwrng *rng)
         INIT_LIST_HEAD(&rng->list);
         list_add_tail(&rng->list, &rng_list);
 
-        bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1);
-        if (bytes_read > 0)
-                add_device_randomness(bytes, bytes_read);
+        if (old_rng && !rng->init) {
+                /*
+                 * Use a new device's input to add some randomness to
+                 * the system.  If this rng device isn't going to be
+                 * used right away, its init function hasn't been
+                 * called yet; so only use the randomness from devices
+                 * that don't need an init callback.
+                 */
+                add_early_randomness(rng);
+        }
+
 out_unlock:
         mutex_unlock(&rng_mutex);
 out:
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index f3e71501de54..e9b15bc18b4d 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -38,6 +38,8 @@ struct virtrng_info {
         int index;
 };
 
+static bool probe_done;
+
 static void random_recv_done(struct virtqueue *vq)
 {
         struct virtrng_info *vi = vq->vdev->priv;
@@ -67,6 +69,13 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
         int ret;
         struct virtrng_info *vi = (struct virtrng_info *)rng->priv;
 
+        /*
+         * Don't ask host for data till we're setup.  This call can
+         * happen during hwrng_register(), after commit d9e7972619.
+         */
+        if (unlikely(!probe_done))
+                return 0;
+
         if (!vi->busy) {
                 vi->busy = true;
                 init_completion(&vi->have_data);
@@ -137,6 +146,7 @@ static int probe_common(struct virtio_device *vdev)
                 return err;
         }
 
+        probe_done = true;
         return 0;
 }
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0a7ac0a7b252..71529e196b84 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -641,7 +641,7 @@ retry:
                 } while (unlikely(entropy_count < pool_size-2 && pnfrac));
         }
 
-        if (entropy_count < 0) {
+        if (unlikely(entropy_count < 0)) {
                 pr_warn("random: negative entropy/overflow: pool %s count %d\n",
                         r->name, entropy_count);
                 WARN_ON(1);
@@ -981,7 +981,7 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
                       int reserved)
 {
         int entropy_count, orig;
-        size_t ibytes;
+        size_t ibytes, nfrac;
 
         BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
 
@@ -999,7 +999,17 @@ retry:
         }
         if (ibytes < min)
                 ibytes = 0;
-        if ((entropy_count -= ibytes << (ENTROPY_SHIFT + 3)) < 0)
+
+        if (unlikely(entropy_count < 0)) {
+                pr_warn("random: negative entropy count: pool %s count %d\n",
+                        r->name, entropy_count);
+                WARN_ON(1);
+                entropy_count = 0;
+        }
+        nfrac = ibytes << (ENTROPY_SHIFT + 3);
+        if ((size_t) entropy_count > nfrac)
+                entropy_count -= nfrac;
+        else
                 entropy_count = 0;
 
         if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
@@ -1376,6 +1386,7 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
                             "with %d bits of entropy available\n",
                             current->comm, nonblocking_pool.entropy_total);
 
+        nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
         ret = extract_entropy_user(&nonblocking_pool, buf, nbytes);
 
         trace_urandom_read(8 * nbytes, ENTROPY_BITS(&nonblocking_pool),
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index ebac67115009..7364a538e056 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -104,6 +104,7 @@ config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
         depends on REGULATOR_ANATOP
+        select PM_OPP
         help
           This adds cpufreq driver support for Freescale i.MX6 series SoCs.
 
@@ -118,7 +119,7 @@ config ARM_INTEGRATOR
           If in doubt, say Y.
 
 config ARM_KIRKWOOD_CPUFREQ
-        def_bool MACH_KIRKWOOD
+        def_bool ARCH_KIRKWOOD || MACH_KIRKWOOD
         help
           This adds the CPUFreq driver for Marvell Kirkwood
           SoCs.
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index ee1ae303a07c..86beda9f950b 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -152,11 +152,8 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                 goto out_put_reg;
         }
 
-        ret = of_init_opp_table(cpu_dev);
-        if (ret) {
-                pr_err("failed to init OPP table: %d\n", ret);
-                goto out_put_clk;
-        }
+        /* OPPs might be populated at runtime, don't check for error here */
+        of_init_opp_table(cpu_dev);
 
         ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
         if (ret) {
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 62259d27f03e..6f024852c6fb 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1153,10 +1153,12 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
          * the creation of a brand new one. So we need to perform this update
          * by invoking update_policy_cpu().
          */
-        if (recover_policy && cpu != policy->cpu)
+        if (recover_policy && cpu != policy->cpu) {
                 update_policy_cpu(policy, cpu);
-        else
+                WARN_ON(kobject_move(&policy->kobj, &dev->kobj));
+        } else {
                 policy->cpu = cpu;
+        }
 
         cpumask_copy(policy->cpus, cpumask_of(cpu));
 
diff --git a/drivers/cpufreq/sa1110-cpufreq.c b/drivers/cpufreq/sa1110-cpufreq.c
index 546376719d8f..b5befc211172 100644
--- a/drivers/cpufreq/sa1110-cpufreq.c
+++ b/drivers/cpufreq/sa1110-cpufreq.c
@@ -349,7 +349,7 @@ static int __init sa1110_clk_init(void)
                         name = "K4S641632D";
                 if (machine_is_h3100())
                         name = "KM416S4030CT";
-                if (machine_is_jornada720())
+                if (machine_is_jornada720() || machine_is_h3600())
                         name = "K4S281632B-1H";
                 if (machine_is_nanoengine())
                         name = "MT48LC8M16A2TG-75";
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index eff1a2f22f09..dc79346689e6 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -346,6 +346,7 @@ static __initdata struct {
 
 struct param_info {
         int verbose;
+        int found;
         void *params;
 };
 
@@ -362,16 +363,12 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
             (strcmp(uname, "chosen") != 0 && strcmp(uname, "chosen@0") != 0))
                 return 0;
 
-        pr_info("Getting parameters from FDT:\n");
-
         for (i = 0; i < ARRAY_SIZE(dt_params); i++) {
                 prop = of_get_flat_dt_prop(node, dt_params[i].propname, &len);
-                if (!prop) {
-                        pr_err("Can't find %s in device tree!\n",
-                               dt_params[i].name);
+                if (!prop)
                         return 0;
-                }
                 dest = info->params + dt_params[i].offset;
+                info->found++;
 
                 val = of_read_number(prop, len / sizeof(u32));
 
@@ -390,10 +387,21 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
 int __init efi_get_fdt_params(struct efi_fdt_params *params, int verbose)
 {
         struct param_info info;
+        int ret;
+
+        pr_info("Getting EFI parameters from FDT:\n");
 
         info.verbose = verbose;
+        info.found = 0;
         info.params = params;
 
-        return of_scan_flat_dt(fdt_find_uefi_params, &info);
+        ret = of_scan_flat_dt(fdt_find_uefi_params, &info);
+        if (!info.found)
+                pr_info("UEFI not found.\n");
+        else if (!ret)
+                pr_err("Can't find '%s' in device tree!\n",
+                       dt_params[info.found].name);
+
+        return ret;
 }
 #endif /* CONFIG_EFI_PARAMS_FROM_FDT */
diff --git a/drivers/firmware/efi/fdt.c b/drivers/firmware/efi/fdt.c
index 82d774161cc9..507a3df46a5d 100644
--- a/drivers/firmware/efi/fdt.c
+++ b/drivers/firmware/efi/fdt.c
@@ -23,16 +23,6 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
         u32 fdt_val32;
         u64 fdt_val64;
 
-        /*
-         * Copy definition of linux_banner here.  Since this code is
-         * built as part of the decompressor for ARM v7, pulling
-         * in version.c where linux_banner is defined for the
-         * kernel brings other kernel dependencies with it.
-         */
-        const char linux_banner[] =
-            "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
-            LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
-
         /* Do some checks on provided FDT, if it exists*/
         if (orig_fdt) {
                 if (fdt_check_header(orig_fdt)) {
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e27e7804c0b9..f0be855ddf45 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11673,6 +11673,9 @@ static struct intel_quirk intel_quirks[] = {
 
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
+
+        /* HP Chromebook 14 (Celeron 2955U) */
+        { 0x0a06, 0x103c, 0x21ed, quirk_backlight_present },
 };
 
 static void intel_init_quirks(struct drm_device *dev)
@@ -11911,6 +11914,7 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc)
                  * ...  */
                 plane = crtc->plane;
                 crtc->plane = !plane;
+                crtc->primary_enabled = true;
                 dev_priv->display.crtc_disable(&crtc->base);
                 crtc->plane = plane;
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 075170d1844f..8a1a4fbc06ac 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -906,8 +906,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
                 mode_rate = intel_dp_link_required(adjusted_mode->crtc_clock,
                                                    bpp);
 
-                for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
-                        for (clock = min_clock; clock <= max_clock; clock++) {
+                for (clock = min_clock; clock <= max_clock; clock++) {
+                        for (lane_count = min_lane_count; lane_count <= max_lane_count; lane_count <<= 1) {
                                 link_clock = drm_dp_bw_code_to_link_rate(bws[clock]);
                                 link_avail = intel_dp_max_data_rate(link_clock,
                                                                     lane_count);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 23126023aeba..5e5a72fca5fb 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -111,6 +111,13 @@ static void intel_lvds_get_config(struct intel_encoder *encoder,
 
         pipe_config->adjusted_mode.flags |= flags;
 
+        /* gen2/3 store dither state in pfit control, needs to match */
+        if (INTEL_INFO(dev)->gen < 4) {
+                tmp = I915_READ(PFIT_CONTROL);
+
+                pipe_config->gmch_pfit.control |= tmp & PANEL_8TO6_DITHER_ENABLE;
+        }
+
         dotclock = pipe_config->port_clock;
 
         if (HAS_PCH_SPLIT(dev_priv->dev))
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 628cd8938274..12b02fe1d0ae 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -361,16 +361,16 @@ void intel_gmch_panel_fitting(struct intel_crtc *intel_crtc,
                 pfit_control |= ((intel_crtc->pipe << PFIT_PIPE_SHIFT) |
                                  PFIT_FILTER_FUZZY);
 
-        /* Make sure pre-965 set dither correctly for 18bpp panels. */
-        if (INTEL_INFO(dev)->gen < 4 && pipe_config->pipe_bpp == 18)
-                pfit_control |= PANEL_8TO6_DITHER_ENABLE;
-
 out:
         if ((pfit_control & PFIT_ENABLE) == 0) {
                 pfit_control = 0;
                 pfit_pgm_ratios = 0;
         }
 
+        /* Make sure pre-965 set dither correctly for 18bpp panels. */
+        if (INTEL_INFO(dev)->gen < 4 && pipe_config->pipe_bpp == 18)
+                pfit_control |= PANEL_8TO6_DITHER_ENABLE;
+
         pipe_config->gmch_pfit.control = pfit_control;
         pipe_config->gmch_pfit.pgm_ratios = pfit_pgm_ratios;
         pipe_config->gmch_pfit.lvds_border_bits = border;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
index cfde9eb44ad0..6212537b90c5 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/temp.c
@@ -192,11 +192,11 @@ alarm_timer_callback(struct nouveau_alarm *alarm)
         nouveau_therm_threshold_hyst_polling(therm, &sensor->thrs_shutdown,
                                              NOUVEAU_THERM_THRS_SHUTDOWN);
 
+        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
+
         /* schedule the next poll in one second */
         if (therm->temp_get(therm) >= 0 && list_empty(&alarm->head))
-                ptimer->alarm(ptimer, 1000 * 1000 * 1000, alarm);
-
-        spin_unlock_irqrestore(&priv->sensor.alarm_program_lock, flags);
+                ptimer->alarm(ptimer, 1000000000ULL, alarm);
 }
 
 void
diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c
index 34d6a85e9023..0bf1e20c6e44 100644
--- a/drivers/gpu/drm/qxl/qxl_irq.c
+++ b/drivers/gpu/drm/qxl/qxl_irq.c
@@ -33,6 +33,9 @@ irqreturn_t qxl_irq_handler(int irq, void *arg)
 
         pending = xchg(&qdev->ram_header->int_pending, 0);
 
+        if (!pending)
+                return IRQ_NONE;
+
         atomic_inc(&qdev->irq_received);
 
         if (pending & QXL_INTERRUPT_DISPLAY) {
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index a03c73411a56..30d242b25078 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1414,8 +1414,8 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
         tmp &= ~EVERGREEN_GRPH_SURFACE_UPDATE_H_RETRACE_EN;
         WREG32(EVERGREEN_GRPH_FLIP_CONTROL + radeon_crtc->crtc_offset, tmp);
 
-        /* set pageflip to happen anywhere in vblank interval */
-        WREG32(EVERGREEN_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 0);
+        /* set pageflip to happen only at start of vblank interval (front porch) */
+        WREG32(EVERGREEN_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 3);
 
         if (!atomic && fb && fb != crtc->primary->fb) {
                 radeon_fb = to_radeon_framebuffer(fb);
@@ -1614,8 +1614,8 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
         tmp &= ~AVIVO_D1GRPH_SURFACE_UPDATE_H_RETRACE_EN;
         WREG32(AVIVO_D1GRPH_FLIP_CONTROL + radeon_crtc->crtc_offset, tmp);
 
-        /* set pageflip to happen anywhere in vblank interval */
-        WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 0);
+        /* set pageflip to happen only at start of vblank interval (front porch) */
+        WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + radeon_crtc->crtc_offset, 3);
 
         if (!atomic && fb && fb != crtc->primary->fb) {
                 radeon_fb = to_radeon_framebuffer(fb);
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 2b2908440644..7d68203a3737 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -183,7 +183,6 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
         struct backlight_properties props;
         struct radeon_backlight_privdata *pdata;
         struct radeon_encoder_atom_dig *dig;
-        u8 backlight_level;
         char bl_name[16];
 
         /* Mac laptops with multiple GPUs use the gmux driver for backlight
@@ -222,12 +221,17 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder,
 
         pdata->encoder = radeon_encoder;
 
-        backlight_level = radeon_atom_get_backlight_level_from_reg(rdev);
-
         dig = radeon_encoder->enc_priv;
         dig->bl_dev = bd;
 
         bd->props.brightness = radeon_atom_backlight_get_brightness(bd);
+        /* Set a reasonable default here if the level is 0 otherwise
+         * fbdev will attempt to turn the backlight on after console
+         * unblanking and it will try and restore 0 which turns the backlight
+         * off again.
+         */
+        if (bd->props.brightness == 0)
+                bd->props.brightness = RADEON_MAX_BL_LEVEL;
         bd->props.power = FB_BLANK_UNBLANK;
         backlight_update_status(bd);
 
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f7ece0ff431b..250bac3935a4 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2642,8 +2642,9 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
         for (i = 0; i < rdev->num_crtc; i++) {
                 if (save->crtc_enabled[i]) {
                         tmp = RREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i]);
-                        if ((tmp & 0x3) != 0) {
-                                tmp &= ~0x3;
+                        if ((tmp & 0x7) != 3) {
+                                tmp &= ~0x7;
+                                tmp |= 0x3;
                                 WREG32(EVERGREEN_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
                         }
                         tmp = RREG32(EVERGREEN_GRPH_UPDATE + crtc_offsets[i]);
diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
index 333d143fca2c..23bff590fb6e 100644
--- a/drivers/gpu/drm/radeon/evergreen_reg.h
+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
@@ -239,7 +239,6 @@
 #       define EVERGREEN_CRTC_V_BLANK                   (1 << 0)
 #define EVERGREEN_CRTC_STATUS_POSITION                  0x6e90
 #define EVERGREEN_CRTC_STATUS_HV_COUNT                  0x6ea0
-#define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
 #define EVERGREEN_CRTC_UPDATE_LOCK                      0x6ed4
 #define EVERGREEN_MASTER_UPDATE_LOCK                    0x6ef4
 #define EVERGREEN_MASTER_UPDATE_MODE                    0x6ef8
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 29d9cc04c04e..b7204500a9a6 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -684,10 +684,9 @@ struct radeon_flip_work {
         struct work_struct              unpin_work;
         struct radeon_device            *rdev;
         int                             crtc_id;
-        struct drm_framebuffer          *fb;
+        uint64_t                        base;
         struct drm_pending_vblank_event *event;
         struct radeon_bo                *old_rbo;
-        struct radeon_bo                *new_rbo;
         struct radeon_fence             *fence;
 };
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 13896edcf0b6..bf25061c8ac4 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -366,7 +366,6 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
         spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
 
         drm_vblank_put(rdev->ddev, radeon_crtc->crtc_id);
-        radeon_fence_unref(&work->fence);
         radeon_irq_kms_pflip_irq_put(rdev, work->crtc_id);
         queue_work(radeon_crtc->flip_queue, &work->unpin_work);
 }
@@ -386,51 +385,108 @@ static void radeon_flip_work_func(struct work_struct *__work)
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[work->crtc_id];
 
         struct drm_crtc *crtc = &radeon_crtc->base;
-        struct drm_framebuffer *fb = work->fb;
-
-        uint32_t tiling_flags, pitch_pixels;
-        uint64_t base;
-
         unsigned long flags;
         int r;
 
         down_read(&rdev->exclusive_lock);
-        while (work->fence) {
+        if (work->fence) {
                 r = radeon_fence_wait(work->fence, false);
                 if (r == -EDEADLK) {
                         up_read(&rdev->exclusive_lock);
                         r = radeon_gpu_reset(rdev);
                         down_read(&rdev->exclusive_lock);
                 }
+                if (r)
+                        DRM_ERROR("failed to wait on page flip fence (%d)!\n", r);
 
-                if (r) {
-                        DRM_ERROR("failed to wait on page flip fence (%d)!\n",
-                                  r);
-                        goto cleanup;
-                } else
-                        radeon_fence_unref(&work->fence);
+                /* We continue with the page flip even if we failed to wait on
+                 * the fence, otherwise the DRM core and userspace will be
+                 * confused about which BO the CRTC is scanning out
+                 */
+
+                radeon_fence_unref(&work->fence);
         }
 
+        /* We borrow the event spin lock for protecting flip_status */
+        spin_lock_irqsave(&crtc->dev->event_lock, flags);
+
+        /* set the proper interrupt */
+        radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
+
+        /* do the flip (mmio) */
+        radeon_page_flip(rdev, radeon_crtc->crtc_id, work->base);
+
+        radeon_crtc->flip_status = RADEON_FLIP_SUBMITTED;
+        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+        up_read(&rdev->exclusive_lock);
+}
+
+static int radeon_crtc_page_flip(struct drm_crtc *crtc,
+                                 struct drm_framebuffer *fb,
+                                 struct drm_pending_vblank_event *event,
+                                 uint32_t page_flip_flags)
+{
+        struct drm_device *dev = crtc->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct radeon_framebuffer *old_radeon_fb;
+        struct radeon_framebuffer *new_radeon_fb;
+        struct drm_gem_object *obj;
+        struct radeon_flip_work *work;
+        struct radeon_bo *new_rbo;
+        uint32_t tiling_flags, pitch_pixels;
+        uint64_t base;
+        unsigned long flags;
+        int r;
+
+        work = kzalloc(sizeof *work, GFP_KERNEL);
+        if (work == NULL)
+                return -ENOMEM;
+
+        INIT_WORK(&work->flip_work, radeon_flip_work_func);
+        INIT_WORK(&work->unpin_work, radeon_unpin_work_func);
+
+        work->rdev = rdev;
+        work->crtc_id = radeon_crtc->crtc_id;
+        work->event = event;
+
+        /* schedule unpin of the old buffer */
+        old_radeon_fb = to_radeon_framebuffer(crtc->primary->fb);
+        obj = old_radeon_fb->obj;
+
+        /* take a reference to the old object */
+        drm_gem_object_reference(obj);
+        work->old_rbo = gem_to_radeon_bo(obj);
+
+        new_radeon_fb = to_radeon_framebuffer(fb);
+        obj = new_radeon_fb->obj;
+        new_rbo = gem_to_radeon_bo(obj);
+
+        spin_lock(&new_rbo->tbo.bdev->fence_lock);
+        if (new_rbo->tbo.sync_obj)
+                work->fence = radeon_fence_ref(new_rbo->tbo.sync_obj);
+        spin_unlock(&new_rbo->tbo.bdev->fence_lock);
+
         /* pin the new buffer */
-        DRM_DEBUG_DRIVER("flip-ioctl() cur_fbo = %p, cur_bbo = %p\n",
-                         work->old_rbo, work->new_rbo);
+        DRM_DEBUG_DRIVER("flip-ioctl() cur_rbo = %p, new_rbo = %p\n",
+                         work->old_rbo, new_rbo);
 
-        r = radeon_bo_reserve(work->new_rbo, false);
+        r = radeon_bo_reserve(new_rbo, false);
         if (unlikely(r != 0)) {
                 DRM_ERROR("failed to reserve new rbo buffer before flip\n");
                 goto cleanup;
         }
         /* Only 27 bit offset for legacy CRTC */
-        r = radeon_bo_pin_restricted(work->new_rbo, RADEON_GEM_DOMAIN_VRAM,
+        r = radeon_bo_pin_restricted(new_rbo, RADEON_GEM_DOMAIN_VRAM,
                                      ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27, &base);
         if (unlikely(r != 0)) {
-                radeon_bo_unreserve(work->new_rbo);
+                radeon_bo_unreserve(new_rbo);
                 r = -EINVAL;
                 DRM_ERROR("failed to pin new rbo buffer before flip\n");
                 goto cleanup;
         }
-        radeon_bo_get_tiling_flags(work->new_rbo, &tiling_flags, NULL);
-        radeon_bo_unreserve(work->new_rbo);
+        radeon_bo_get_tiling_flags(new_rbo, &tiling_flags, NULL);
+        radeon_bo_unreserve(new_rbo);
 
         if (!ASIC_IS_AVIVO(rdev)) {
                 /* crtc offset is from display base addr not FB location */
@@ -467,6 +523,7 @@ static void radeon_flip_work_func(struct work_struct *__work)
                 }
                 base &= ~7;
         }
+        work->base = base;
 
         r = drm_vblank_get(crtc->dev, radeon_crtc->crtc_id);
         if (r) {
@@ -477,100 +534,42 @@ static void radeon_flip_work_func(struct work_struct *__work)
         /* We borrow the event spin lock for protecting flip_work */
         spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
-        /* set the proper interrupt */
-        radeon_irq_kms_pflip_irq_get(rdev, radeon_crtc->crtc_id);
+        if (radeon_crtc->flip_status != RADEON_FLIP_NONE) {
+                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
+                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+                r = -EBUSY;
+                goto vblank_cleanup;
+        }
+        radeon_crtc->flip_status = RADEON_FLIP_PENDING;
+        radeon_crtc->flip_work = work;
 
-        /* do the flip (mmio) */
-        radeon_page_flip(rdev, radeon_crtc->crtc_id, base);
+        /* update crtc fb */
+        crtc->primary->fb = fb;
 
-        radeon_crtc->flip_status = RADEON_FLIP_SUBMITTED;
         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-        up_read(&rdev->exclusive_lock);
 
-        return;
+        queue_work(radeon_crtc->flip_queue, &work->flip_work);
+        return 0;
+
+vblank_cleanup:
+        drm_vblank_put(crtc->dev, radeon_crtc->crtc_id);
 
 pflip_cleanup:
-        if (unlikely(radeon_bo_reserve(work->new_rbo, false) != 0)) {
+        if (unlikely(radeon_bo_reserve(new_rbo, false) != 0)) {
                 DRM_ERROR("failed to reserve new rbo in error path\n");
                 goto cleanup;
         }
-        if (unlikely(radeon_bo_unpin(work->new_rbo) != 0)) {
+        if (unlikely(radeon_bo_unpin(new_rbo) != 0)) {
                 DRM_ERROR("failed to unpin new rbo in error path\n");
         }
-        radeon_bo_unreserve(work->new_rbo);
+        radeon_bo_unreserve(new_rbo);
 
 cleanup:
         drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
         radeon_fence_unref(&work->fence);
         kfree(work);
-        up_read(&rdev->exclusive_lock);
-}
-
-static int radeon_crtc_page_flip(struct drm_crtc *crtc,
-                                 struct drm_framebuffer *fb,
-                                 struct drm_pending_vblank_event *event,
-                                 uint32_t page_flip_flags)
-{
-        struct drm_device *dev = crtc->dev;
-        struct radeon_device *rdev = dev->dev_private;
-        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-        struct radeon_framebuffer *old_radeon_fb;
-        struct radeon_framebuffer *new_radeon_fb;
-        struct drm_gem_object *obj;
-        struct radeon_flip_work *work;
-        unsigned long flags;
-
-        work = kzalloc(sizeof *work, GFP_KERNEL);
-        if (work == NULL)
-                return -ENOMEM;
-
-        INIT_WORK(&work->flip_work, radeon_flip_work_func);
-        INIT_WORK(&work->unpin_work, radeon_unpin_work_func);
-
-        work->rdev = rdev;
-        work->crtc_id = radeon_crtc->crtc_id;
-        work->fb = fb;
-        work->event = event;
-
-        /* schedule unpin of the old buffer */
-        old_radeon_fb = to_radeon_framebuffer(crtc->primary->fb);
-        obj = old_radeon_fb->obj;
-
-        /* take a reference to the old object */
-        drm_gem_object_reference(obj);
-        work->old_rbo = gem_to_radeon_bo(obj);
-
-        new_radeon_fb = to_radeon_framebuffer(fb);
-        obj = new_radeon_fb->obj;
-        work->new_rbo = gem_to_radeon_bo(obj);
-
-        spin_lock(&work->new_rbo->tbo.bdev->fence_lock);
-        if (work->new_rbo->tbo.sync_obj)
-                work->fence = radeon_fence_ref(work->new_rbo->tbo.sync_obj);
-        spin_unlock(&work->new_rbo->tbo.bdev->fence_lock);
-
-        /* We borrow the event spin lock for protecting flip_work */
-        spin_lock_irqsave(&crtc->dev->event_lock, flags);
 
-        if (radeon_crtc->flip_status != RADEON_FLIP_NONE) {
-                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
-                spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-                drm_gem_object_unreference_unlocked(&work->old_rbo->gem_base);
-                radeon_fence_unref(&work->fence);
-                kfree(work);
-                return -EBUSY;
-        }
-        radeon_crtc->flip_status = RADEON_FLIP_PENDING;
-        radeon_crtc->flip_work = work;
-
-        /* update crtc fb */
-        crtc->primary->fb = fb;
-
-        spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
-
-        queue_work(radeon_crtc->flip_queue, &work->flip_work);
-
-        return 0;
+        return r;
 }
 
 static int
@@ -830,6 +829,10 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
         struct radeon_device *rdev = dev->dev_private;
         int ret = 0;
 
+        /* don't leak the edid if we already fetched it in detect() */
+        if (radeon_connector->edid)
+                goto got_edid;
+
         /* on hw with routers, select right port */
         if (radeon_connector->router.ddc_valid)
                 radeon_router_select_ddc_port(radeon_connector);
@@ -868,6 +871,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
                         radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev);
         }
         if (radeon_connector->edid) {
+got_edid:
                 drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
                 ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
                 drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 237dd29d9f1c..3e21e869015f 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -406,8 +406,9 @@ void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
         for (i = 0; i < rdev->num_crtc; i++) {
                 if (save->crtc_enabled[i]) {
                         tmp = RREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i]);
-                        if ((tmp & 0x3) != 0) {
-                                tmp &= ~0x3;
+                        if ((tmp & 0x7) != 3) {
+                                tmp &= ~0x7;
+                                tmp |= 0x3;
                                 WREG32(AVIVO_D1MODE_MASTER_UPDATE_MODE + crtc_offsets[i], tmp);
                         }
                         tmp = RREG32(AVIVO_D1GRPH_UPDATE + crtc_offsets[i]);
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index eaaa3d843b80..23b2ce294c4c 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -246,8 +246,8 @@ void hv_fcopy_onchannelcallback(void *context)
                 /*
                  * Send the information to the user-level daemon.
                  */
-                fcopy_send_data();
                 schedule_delayed_work(&fcopy_work, 5*HZ);
+                fcopy_send_data();
                 return;
         }
         icmsghdr->icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE;
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 0f4dea5ccf17..9ee3913850d6 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -515,7 +515,7 @@ static ssize_t set_temp_min(struct device *dev,
                 return -EINVAL;
 
         temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
 
         mutex_lock(&data->lock);
         data->temp_min[attr->index] = temp;
@@ -549,7 +549,7 @@ static ssize_t set_temp_max(struct device *dev,
                 return -EINVAL;
 
         temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
 
         mutex_lock(&data->lock);
         data->temp_max[attr->index] = temp;
@@ -826,7 +826,7 @@ static ssize_t set_pwm_tmin(struct device *dev,
                 return -EINVAL;
 
         temp = DIV_ROUND_CLOSEST(temp, 1000);
-        temp = clamp_val(temp, 0, 255);
+        temp = clamp_val(temp, -128, 127);
 
         mutex_lock(&data->lock);
         data->pwm_tmin[attr->index] = temp;
diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
index afd31042b452..d14ab3c45daa 100644
--- a/drivers/hwmon/da9052-hwmon.c
+++ b/drivers/hwmon/da9052-hwmon.c
@@ -194,7 +194,7 @@ static ssize_t da9052_hwmon_show_name(struct device *dev,
                                       struct device_attribute *devattr,
                                       char *buf)
 {
-        return sprintf(buf, "da9052-hwmon\n");
+        return sprintf(buf, "da9052\n");
 }
 
 static ssize_t show_label(struct device *dev,
diff --git a/drivers/hwmon/da9055-hwmon.c b/drivers/hwmon/da9055-hwmon.c
index 73b3865f1207..35eb7738d711 100644
--- a/drivers/hwmon/da9055-hwmon.c
+++ b/drivers/hwmon/da9055-hwmon.c
@@ -204,7 +204,7 @@ static ssize_t da9055_hwmon_show_name(struct device *dev,
                                       struct device_attribute *devattr,
                                       char *buf)
 {
-        return sprintf(buf, "da9055-hwmon\n");
+        return sprintf(buf, "da9055\n");
 }
 
 static ssize_t show_label(struct device *dev,
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 8fb46aab2d87..a04c49f2a011 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -416,6 +416,7 @@ config BLK_DEV_CY82C693
 
 config BLK_DEV_CS5520
         tristate "Cyrix CS5510/20 MediaGX chipset support (VERY EXPERIMENTAL)"
+        depends on X86_32 || COMPILE_TEST
         select BLK_DEV_IDEDMA_PCI
         help
           Include support for PIO tuning and virtual DMA on the Cyrix MediaGX
@@ -426,6 +427,7 @@ config BLK_DEV_CS5520
 
 config BLK_DEV_CS5530
         tristate "Cyrix/National Semiconductor CS5530 MediaGX chipset support"
+        depends on X86_32 || COMPILE_TEST
         select BLK_DEV_IDEDMA_PCI
         help
           Include support for UDMA on the Cyrix MediaGX 5530 chipset. This
@@ -435,7 +437,7 @@ config BLK_DEV_CS5530
 
 config BLK_DEV_CS5535
         tristate "AMD CS5535 chipset support"
-        depends on X86 && !X86_64
+        depends on X86_32
         select BLK_DEV_IDEDMA_PCI
         help
           Include support for UDMA on the NSC/AMD CS5535 companion chipset.
@@ -486,6 +488,7 @@ config BLK_DEV_JMICRON
 
 config BLK_DEV_SC1200
         tristate "National SCx200 chipset support"
+        depends on X86_32 || COMPILE_TEST
         select BLK_DEV_IDEDMA_PCI
         help
           This driver adds support for the on-board IDE controller on the
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 2a744a91370e..a3d3b1733c49 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -853,8 +853,9 @@ static int init_irq (ide_hwif_t *hwif)
         if (irq_handler == NULL)
                 irq_handler = ide_intr;
 
-        if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
-                goto out_up;
+        if (!host->get_lock)
+                if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
+                        goto out_up;
 
 #if !defined(__mc68000__)
         printk(KERN_INFO "%s at 0x%03lx-0x%03lx,0x%03lx on irq %d", hwif->name,
@@ -1533,7 +1534,8 @@ static void ide_unregister(ide_hwif_t *hwif)
 
         ide_proc_unregister_port(hwif);
 
-        free_irq(hwif->irq, hwif);
+        if (!hwif->host->get_lock)
+                free_irq(hwif->irq, hwif);
 
         device_unregister(hwif->portdev);
         device_unregister(&hwif->gendev);
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 17aeea170566..2a5fa9a436e5 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -111,8 +111,14 @@ static const int mma8452_samp_freq[8][2] = {
         {6, 250000}, {1, 560000}
 };
 
+/* 
+ * Hardware has fullscale of -2G, -4G, -8G corresponding to raw value -2048
+ * The userspace interface uses m/s^2 and we declare micro units
+ * So scale factor is given by:
+ *      g * N * 1000000 / 2048 for N = 2, 4, 8 and g=9.80665
+ */
 static const int mma8452_scales[3][2] = {
-        {0, 977}, {0, 1953}, {0, 3906}
+        {0, 9577}, {0, 19154}, {0, 38307}
 };
 
 static ssize_t mma8452_show_samp_freq_avail(struct device *dev,
diff --git a/drivers/iio/industrialio-event.c b/drivers/iio/industrialio-event.c
index 258a973a1fb8..bfbf4d419f41 100644
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -345,6 +345,9 @@ static int iio_device_add_event(struct iio_dev *indio_dev,
                         &indio_dev->event_interface->dev_attr_list);
                 kfree(postfix);
 
+                if ((ret == -EBUSY) && (shared_by != IIO_SEPARATE))
+                        continue;
+
                 if (ret)
                         return ret;
 
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 6d61a16d1f5c..c2fb71c182a8 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -433,8 +433,17 @@ static void arp_failure_discard(void *handle, struct sk_buff *skb)
  */
 static void act_open_req_arp_failure(void *handle, struct sk_buff *skb)
 {
+        struct c4iw_ep *ep = handle;
+
         printk(KERN_ERR MOD "ARP failure duing connect\n");
         kfree_skb(skb);
+        connect_reply_upcall(ep, -EHOSTUNREACH);
+        state_set(&ep->com, DEAD);
+        remove_handle(ep->com.dev, &ep->com.dev->atid_idr, ep->atid);
+        cxgb4_free_atid(ep->com.dev->rdev.lldi.tids, ep->atid);
+        dst_release(ep->dst);
+        cxgb4_l2t_release(ep->l2t);
+        c4iw_put_ep(&ep->com);
 }
 
 /*
@@ -660,7 +669,7 @@ static int send_connect(struct c4iw_ep *ep)
                 opt2 |= T5_OPT_2_VALID;
                 opt2 |= V_CONG_CNTRL(CONG_ALG_TAHOE);
         }
-        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
+        t4_set_arp_err_handler(skb, ep, act_open_req_arp_failure);
 
         if (is_t4(ep->com.dev->rdev.lldi.adapter_type)) {
                 if (ep->com.remote_addr.ss_family == AF_INET) {
@@ -2219,7 +2228,6 @@ static void reject_cr(struct c4iw_dev *dev, u32 hwtid, struct sk_buff *skb)
         PDBG("%s c4iw_dev %p tid %u\n", __func__, dev, hwtid);
         BUG_ON(skb_cloned(skb));
         skb_trim(skb, sizeof(struct cpl_tid_release));
-        skb_get(skb);
         release_tid(&dev->rdev, hwtid, skb);
         return;
 }
@@ -3969,7 +3977,7 @@ int __init c4iw_cm_init(void)
         return 0;
 }
 
-void __exit c4iw_cm_term(void)
+void c4iw_cm_term(void)
 {
         WARN_ON(!list_empty(&timeout_list));
         flush_workqueue(workq);
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index bda949223637..f25df5276c22 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -844,6 +844,7 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                 pr_err(MOD "error allocating status page\n");
                 goto err4;
         }
+
         if (c4iw_wr_log) {
                 rdev->wr_log = kzalloc((1 << c4iw_wr_log_size_order) *
                                        sizeof(*rdev->wr_log), GFP_KERNEL);
@@ -854,6 +855,9 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
                         pr_err(MOD "error allocating wr_log. Logging disabled\n");
                 }
         }
+
+        rdev->status_page->db_off = 0;
+
         return 0;
 err4:
         c4iw_rqtpool_destroy(rdev);
@@ -888,7 +892,6 @@ static void c4iw_dealloc(struct uld_ctx *ctx)
         if (ctx->dev->rdev.oc_mw_kva)
                 iounmap(ctx->dev->rdev.oc_mw_kva);
         ib_dealloc_device(&ctx->dev->ibdev);
-        iwpm_exit(RDMA_NL_C4IW);
         ctx->dev = NULL;
 }
 
@@ -1007,12 +1010,6 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
                 setup_debugfs(devp);
         }
 
-        ret = iwpm_init(RDMA_NL_C4IW);
-        if (ret) {
-                pr_err("port mapper initialization failed with %d\n", ret);
-                ib_dealloc_device(&devp->ibdev);
-                return ERR_PTR(ret);
-        }
 
         return devp;
 }
@@ -1513,6 +1510,15 @@ static int __init c4iw_init_module(void)
                 pr_err("%s[%u]: Failed to add netlink callback\n"
                        , __func__, __LINE__);
 
+        err = iwpm_init(RDMA_NL_C4IW);
+        if (err) {
+                pr_err("port mapper initialization failed with %d\n", err);
+                ibnl_remove_client(RDMA_NL_C4IW);
+                c4iw_cm_term();
+                debugfs_remove_recursive(c4iw_debugfs_root);
+                return err;
+        }
+
         cxgb4_register_uld(CXGB4_ULD_RDMA, &c4iw_uld_info);
 
         return 0;
@@ -1530,6 +1536,7 @@ static void __exit c4iw_exit_module(void)
         }
         mutex_unlock(&dev_mutex);
         cxgb4_unregister_uld(CXGB4_ULD_RDMA);
+        iwpm_exit(RDMA_NL_C4IW);
         ibnl_remove_client(RDMA_NL_C4IW);
         c4iw_cm_term();
         debugfs_remove_recursive(c4iw_debugfs_root);
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index c378fd25ee0c..b5678ac97393 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -943,7 +943,7 @@ int c4iw_destroy_ctrl_qp(struct c4iw_rdev *rdev);
 int c4iw_register_device(struct c4iw_dev *dev);
 void c4iw_unregister_device(struct c4iw_dev *dev);
 int __init c4iw_cm_init(void);
-void __exit c4iw_cm_term(void);
+void c4iw_cm_term(void);
 void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
                                struct c4iw_dev_ucontext *uctx);
 void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index d13ddf1c0033..bbbcf389272c 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -675,7 +675,7 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev,
         int err;
 
         uuari = &dev->mdev.priv.uuari;
-        if (init_attr->create_flags & ~IB_QP_CREATE_SIGNATURE_EN)
+        if (init_attr->create_flags & ~(IB_QP_CREATE_SIGNATURE_EN | IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK))
                 return -EINVAL;
 
         if (init_attr->qp_type == MLX5_IB_QPT_REG_UMR)
diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c
index b99dd88e31b9..bb446d742a2d 100644
--- a/drivers/iommu/fsl_pamu.c
+++ b/drivers/iommu/fsl_pamu.c
@@ -170,10 +170,10 @@ int pamu_disable_liodn(int liodn)
 static unsigned int map_addrspace_size_to_wse(phys_addr_t addrspace_size)
 {
         /* Bug if not a power of 2 */
-        BUG_ON(!is_power_of_2(addrspace_size));
+        BUG_ON((addrspace_size & (addrspace_size - 1)));
 
         /* window size is 2^(WSE+1) bytes */
-        return __ffs(addrspace_size) - 1;
+        return fls64(addrspace_size) - 2;
 }
 
 /* Derive the PAACE window count encoding for the subwindow count */
@@ -351,7 +351,7 @@ int pamu_config_ppaace(int liodn, phys_addr_t win_addr, phys_addr_t win_size,
         struct paace *ppaace;
         unsigned long fspi;
 
-        if (!is_power_of_2(win_size) || win_size < PAMU_PAGE_SIZE) {
+        if ((win_size & (win_size - 1)) || win_size < PAMU_PAGE_SIZE) {
                 pr_debug("window size too small or not a power of two %llx\n", win_size);
                 return -EINVAL;
         }
@@ -464,7 +464,7 @@ int pamu_config_spaace(int liodn, u32 subwin_cnt, u32 subwin,
                 return -ENOENT;
         }
 
-        if (!is_power_of_2(subwin_size) || subwin_size < PAMU_PAGE_SIZE) {
+        if ((subwin_size & (subwin_size - 1)) || subwin_size < PAMU_PAGE_SIZE) {
                 pr_debug("subwindow size out of range, or not a power of 2\n");
                 return -EINVAL;
         }
diff --git a/drivers/iommu/fsl_pamu_domain.c b/drivers/iommu/fsl_pamu_domain.c
index 93072ba44b1d..af47648301a9 100644
--- a/drivers/iommu/fsl_pamu_domain.c
+++ b/drivers/iommu/fsl_pamu_domain.c
@@ -301,7 +301,7 @@ static int check_size(u64 size, dma_addr_t iova)
          * Size must be a power of two and at least be equal
          * to PAMU page size.
          */
-        if (!is_power_of_2(size) || size < PAMU_PAGE_SIZE) {
+        if ((size & (size - 1)) || size < PAMU_PAGE_SIZE) {
                 pr_debug("%s: size too small or not a power of two\n", __func__);
                 return -EINVAL;
         }
@@ -335,11 +335,6 @@ static struct fsl_dma_domain *iommu_alloc_dma_domain(void)
         return domain;
 }
 
-static inline struct device_domain_info *find_domain(struct device *dev)
-{
-        return dev->archdata.iommu_domain;
-}
-
 static void remove_device_ref(struct device_domain_info *info, u32 win_cnt)
 {
         unsigned long flags;
@@ -380,7 +375,7 @@ static void attach_device(struct fsl_dma_domain *dma_domain, int liodn, struct d
          * Check here if the device is already attached to domain or not.
          * If the device is already attached to a domain detach it.
          */
-        old_domain_info = find_domain(dev);
+        old_domain_info = dev->archdata.iommu_domain;
         if (old_domain_info && old_domain_info->domain != dma_domain) {
                 spin_unlock_irqrestore(&device_domain_lock, flags);
                 detach_device(dev, old_domain_info->domain);
@@ -399,7 +394,7 @@ static void attach_device(struct fsl_dma_domain *dma_domain, int liodn, struct d
          * the info for the first LIODN as all
          * LIODNs share the same domain
          */
-        if (!old_domain_info)
+        if (!dev->archdata.iommu_domain)
                 dev->archdata.iommu_domain = info;
         spin_unlock_irqrestore(&device_domain_lock, flags);
 
@@ -1042,12 +1037,15 @@ root_bus:
                         group = get_shared_pci_device_group(pdev);
         }
 
+        if (!group)
+                group = ERR_PTR(-ENODEV);
+
         return group;
 }
 
 static int fsl_pamu_add_device(struct device *dev)
 {
-        struct iommu_group *group = NULL;
+        struct iommu_group *group = ERR_PTR(-ENODEV);
         struct pci_dev *pdev;
         const u32 *prop;
         int ret, len;
@@ -1070,7 +1068,7 @@ static int fsl_pamu_add_device(struct device *dev)
                         group = get_device_iommu_group(dev);
         }
 
-        if (!group || IS_ERR(group))
+        if (IS_ERR(group))
                 return PTR_ERR(group);
 
         ret = iommu_group_add_device(group, dev);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 7e11c9d6ae8c..7c131cf7cc13 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -42,6 +42,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/irqchip/arm-gic.h>
 
+#include <asm/cputype.h>
 #include <asm/irq.h>
 #include <asm/exception.h>
 #include <asm/smp_plat.h>
@@ -954,7 +955,9 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
                 }
 
                 for_each_possible_cpu(cpu) {
-                        unsigned long offset = percpu_offset * cpu_logical_map(cpu);
+                        u32 mpidr = cpu_logical_map(cpu);
+                        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+                        unsigned long offset = percpu_offset * core_id;
                         *per_cpu_ptr(gic->dist_base.percpu_base, cpu) = dist_base + offset;
                         *per_cpu_ptr(gic->cpu_base.percpu_base, cpu) = cpu_base + offset;
                 }
@@ -1071,8 +1074,10 @@ gic_of_init(struct device_node *node, struct device_node *parent)
         gic_cnt++;
         return 0;
 }
+IRQCHIP_DECLARE(gic_400, "arm,gic-400", gic_of_init);
 IRQCHIP_DECLARE(cortex_a15_gic, "arm,cortex-a15-gic", gic_of_init);
 IRQCHIP_DECLARE(cortex_a9_gic, "arm,cortex-a9-gic", gic_of_init);
+IRQCHIP_DECLARE(cortex_a7_gic, "arm,cortex-a7-gic", gic_of_init);
 IRQCHIP_DECLARE(msm_8660_qgic, "qcom,msm-8660-qgic", gic_of_init);
 IRQCHIP_DECLARE(msm_qgic2, "qcom,msm-qgic2", gic_of_init);
 
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index a333b7f798d1..62f0688d45a5 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -638,9 +638,15 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
                 fprog.len = len;
                 fprog.filter = code;
 
-                if (is->pass_filter)
+                if (is->pass_filter) {
                         sk_unattached_filter_destroy(is->pass_filter);
-                err = sk_unattached_filter_create(&is->pass_filter, &fprog);
+                        is->pass_filter = NULL;
+                }
+                if (fprog.filter != NULL)
+                        err = sk_unattached_filter_create(&is->pass_filter,
+                                                          &fprog);
+                else
+                        err = 0;
                 kfree(code);
 
                 return err;
@@ -657,9 +663,15 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
                 fprog.len = len;
                 fprog.filter = code;
 
-                if (is->active_filter)
+                if (is->active_filter) {
                         sk_unattached_filter_destroy(is->active_filter);
-                err = sk_unattached_filter_create(&is->active_filter, &fprog);
+                        is->active_filter = NULL;
+                }
+                if (fprog.filter != NULL)
+                        err = sk_unattached_filter_create(&is->active_filter,
+                                                          &fprog);
+                else
+                        err = 0;
                 kfree(code);
 
                 return err;
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index 4ead4ba60656..d2899e7eb3aa 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -425,6 +425,15 @@ static int __open_metadata(struct dm_cache_metadata *cmd)
 
         disk_super = dm_block_data(sblock);
 
+        /* Verify the data block size hasn't changed */
+        if (le32_to_cpu(disk_super->data_block_size) != cmd->data_block_size) {
+                DMERR("changing the data block size (from %u to %llu) is not supported",
+                      le32_to_cpu(disk_super->data_block_size),
+                      (unsigned long long)cmd->data_block_size);
+                r = -EINVAL;
+                goto bad;
+        }
+
         r = __check_incompat_features(disk_super, cmd);
         if (r < 0)
                 goto bad;
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index b086a945edcb..e9d33ad59df5 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -613,6 +613,15 @@ static int __open_metadata(struct dm_pool_metadata *pmd)
 
         disk_super = dm_block_data(sblock);
 
+        /* Verify the data block size hasn't changed */
+        if (le32_to_cpu(disk_super->data_block_size) != pmd->data_block_size) {
+                DMERR("changing the data block size (from %u to %llu) is not supported",
+                      le32_to_cpu(disk_super->data_block_size),
+                      (unsigned long long)pmd->data_block_size);
+                r = -EINVAL;
+                goto bad_unlock_sblock;
+        }
+
         r = __check_incompat_features(disk_super, pmd);
         if (r < 0)
                 goto bad_unlock_sblock;
diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
index 8637d2ed7623..2e3cdcfa0a67 100644
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -60,7 +60,7 @@ static int si2168_cmd_execute(struct si2168 *s, struct si2168_cmd *cmd)
                                 jiffies_to_msecs(jiffies) -
                                 (jiffies_to_msecs(timeout) - TIMEOUT));
 
-                if (!(cmd->args[0] >> 7) & 0x01) {
+                if (!((cmd->args[0] >> 7) & 0x01)) {
                         ret = -ETIMEDOUT;
                         goto err_mutex_unlock;
                 }
@@ -485,20 +485,6 @@ static int si2168_init(struct dvb_frontend *fe)
         if (ret)
                 goto err;
 
-        cmd.args[0] = 0x05;
-        cmd.args[1] = 0x00;
-        cmd.args[2] = 0xaa;
-        cmd.args[3] = 0x4d;
-        cmd.args[4] = 0x56;
-        cmd.args[5] = 0x40;
-        cmd.args[6] = 0x00;
-        cmd.args[7] = 0x00;
-        cmd.wlen = 8;
-        cmd.rlen = 1;
-        ret = si2168_cmd_execute(s, &cmd);
-        if (ret)
-                goto err;
-
         /* cold state - try to download firmware */
         dev_info(&s->client->dev, "%s: found a '%s' in cold state\n",
                         KBUILD_MODNAME, si2168_ops.info.name);
diff --git a/drivers/media/dvb-frontends/si2168_priv.h b/drivers/media/dvb-frontends/si2168_priv.h
index 2a343e896f40..53f7f06ae343 100644
--- a/drivers/media/dvb-frontends/si2168_priv.h
+++ b/drivers/media/dvb-frontends/si2168_priv.h
@@ -22,7 +22,7 @@
 #include <linux/firmware.h>
 #include <linux/i2c-mux.h>
 
-#define SI2168_FIRMWARE "dvb-demod-si2168-01.fw"
+#define SI2168_FIRMWARE "dvb-demod-si2168-02.fw"
 
 /* state struct */
 struct si2168 {
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 522fe00f5eee..9619be5d4827 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -668,6 +668,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
         struct dtv_frontend_properties *c = &fe->dtv_property_cache;
         int ret, i;
         u8 mode, rolloff, pilot, inversion, div;
+        fe_modulation_t modulation;
 
         dev_dbg(&priv->i2c->dev,
                         "%s: delivery_system=%d modulation=%d frequency=%d symbol_rate=%d inversion=%d pilot=%d rolloff=%d\n",
@@ -702,10 +703,13 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
 
         switch (c->delivery_system) {
         case SYS_DVBS:
+                modulation = QPSK;
                 rolloff = 0;
                 pilot = 2;
                 break;
         case SYS_DVBS2:
+                modulation = c->modulation;
+
                 switch (c->rolloff) {
                 case ROLLOFF_20:
                         rolloff = 2;
@@ -750,7 +754,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe)
 
         for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
                 if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
-                        c->modulation == TDA10071_MODCOD[i].modulation &&
+                        modulation == TDA10071_MODCOD[i].modulation &&
                         c->fec_inner == TDA10071_MODCOD[i].fec) {
                         mode = TDA10071_MODCOD[i].val;
                         dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n",
@@ -834,10 +838,10 @@ static int tda10071_get_frontend(struct dvb_frontend *fe)
 
         switch ((buf[1] >> 0) & 0x01) {
         case 0:
-                c->inversion = INVERSION_OFF;
+                c->inversion = INVERSION_ON;
                 break;
         case 1:
-                c->inversion = INVERSION_ON;
+                c->inversion = INVERSION_OFF;
                 break;
         }
 
@@ -856,7 +860,7 @@ static int tda10071_get_frontend(struct dvb_frontend *fe)
         if (ret)
                 goto error;
 
-        c->symbol_rate = (buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0);
+        c->symbol_rate = ((buf[0] << 16) | (buf[1] << 8) | (buf[2] << 0)) * 1000;
 
         return ret;
 error:
diff --git a/drivers/media/dvb-frontends/tda10071_priv.h b/drivers/media/dvb-frontends/tda10071_priv.h
index 4baf14bfb65a..420486192736 100644
--- a/drivers/media/dvb-frontends/tda10071_priv.h
+++ b/drivers/media/dvb-frontends/tda10071_priv.h
@@ -55,6 +55,7 @@ static struct tda10071_modcod {
         { SYS_DVBS2, QPSK,  FEC_8_9,  0x0a },
         { SYS_DVBS2, QPSK,  FEC_9_10, 0x0b },
         /* 8PSK */
+        { SYS_DVBS2, PSK_8, FEC_AUTO, 0x00 },
         { SYS_DVBS2, PSK_8, FEC_3_5,  0x0c },
         { SYS_DVBS2, PSK_8, FEC_2_3,  0x0d },
         { SYS_DVBS2, PSK_8, FEC_3_4,  0x0e },
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index e65c760e4e8b..0006d6bf8c18 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -179,7 +179,7 @@ static const struct v4l2_file_operations ts_fops =
         .read     = vb2_fop_read,
         .poll     = vb2_fop_poll,
         .mmap     = vb2_fop_mmap,
-        .ioctl    = video_ioctl2,
+        .unlocked_ioctl = video_ioctl2,
 };
 
 static const struct v4l2_ioctl_ops ts_ioctl_ops = {
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index a7ed16497903..1e4ec697fb10 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -269,6 +269,7 @@ err:
                 list_del(&buf->list);
                 vb2_buffer_done(&buf->vb, VB2_BUF_STATE_QUEUED);
         }
+        spin_unlock_irqrestore(&common->irqlock, flags);
 
         return ret;
 }
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index 5bb085b19bcb..b431b58f39e3 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -233,6 +233,7 @@ err:
                 list_del(&buf->list);
                 vb2_buffer_done(&buf->vb, VB2_BUF_STATE_QUEUED);
         }
+        spin_unlock_irqrestore(&common->irqlock, flags);
 
         return ret;
 }
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
index 271a752cee54..fa4cc7b880aa 100644
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -57,7 +57,7 @@ static int si2157_cmd_execute(struct si2157 *s, struct si2157_cmd *cmd)
                         jiffies_to_msecs(jiffies) -
                         (jiffies_to_msecs(timeout) - TIMEOUT));
 
-        if (!(buf[0] >> 7) & 0x01) {
+        if (!((buf[0] >> 7) & 0x01)) {
                 ret = -ETIMEDOUT;
                 goto err_mutex_unlock;
         } else {
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 021e4d35e4d7..7b9b75f60774 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -704,15 +704,41 @@ static int af9035_read_config(struct dvb_usb_device *d)
                 if (ret < 0)
                         goto err;
 
-                if (tmp == 0x00)
-                        dev_dbg(&d->udev->dev,
-                                        "%s: [%d]tuner not set, using default\n",
-                                        __func__, i);
-                else
+                dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
+                                __func__, i, tmp);
+
+                /* tuner sanity check */
+                if (state->chip_type == 0x9135) {
+                        if (state->chip_version == 0x02) {
+                                /* IT9135 BX (v2) */
+                                switch (tmp) {
+                                case AF9033_TUNER_IT9135_60:
+                                case AF9033_TUNER_IT9135_61:
+                                case AF9033_TUNER_IT9135_62:
+                                        state->af9033_config[i].tuner = tmp;
+                                        break;
+                                }
+                        } else {
+                                /* IT9135 AX (v1) */
+                                switch (tmp) {
+                                case AF9033_TUNER_IT9135_38:
+                                case AF9033_TUNER_IT9135_51:
+                                case AF9033_TUNER_IT9135_52:
+                                        state->af9033_config[i].tuner = tmp;
+                                        break;
+                                }
+                        }
+                } else {
+                        /* AF9035 */
                         state->af9033_config[i].tuner = tmp;
+                }
 
-                dev_dbg(&d->udev->dev, "%s: [%d]tuner=%02x\n",
-                                __func__, i, state->af9033_config[i].tuner);
+                if (state->af9033_config[i].tuner != tmp) {
+                        dev_info(&d->udev->dev,
+                                        "%s: [%d] overriding tuner from %02x to %02x\n",
+                                        KBUILD_MODNAME, i, tmp,
+                                        state->af9033_config[i].tuner);
+                }
 
                 switch (state->af9033_config[i].tuner) {
                 case AF9033_TUNER_TUA9001:
diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c
index 2fd1c5e31a0f..339adce7c7a5 100644
--- a/drivers/media/usb/gspca/pac7302.c
+++ b/drivers/media/usb/gspca/pac7302.c
@@ -928,6 +928,7 @@ static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x093a, 0x2620)},
         {USB_DEVICE(0x093a, 0x2621)},
         {USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP},
+        {USB_DEVICE(0x093a, 0x2623), .driver_info = FL_VFLIP},
         {USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP},
         {USB_DEVICE(0x093a, 0x2625)},
         {USB_DEVICE(0x093a, 0x2626)},
diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c
index 0500c4175d5f..6bce01a674f9 100644
--- a/drivers/media/usb/hdpvr/hdpvr-video.c
+++ b/drivers/media/usb/hdpvr/hdpvr-video.c
@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(struct urb *urb)
 }
 
 /*=========================================================================*/
-/* bufffer bits */
+/* buffer bits */
 
 /* function expects dev->io_mutex to be hold by caller */
 int hdpvr_cancel_queue(struct hdpvr_device *dev)
@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl *ctrl)
         case V4L2_CID_MPEG_AUDIO_ENCODING:
                 if (dev->flags & HDPVR_FLAG_AC3_CAP) {
                         opt->audio_codec = ctrl->val;
-                        return hdpvr_set_audio(dev, opt->audio_input,
+                        return hdpvr_set_audio(dev, opt->audio_input + 1,
                                               opt->audio_codec);
                 }
                 return 0;
@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
         v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
                 V4L2_CID_MPEG_AUDIO_ENCODING,
                 ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC,
-                0x7, V4L2_MPEG_AUDIO_ENCODING_AAC);
+                0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC);
         v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops,
                 V4L2_CID_MPEG_VIDEO_ENCODING,
                 V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3,
diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
index 4ae54caadd03..ce1c9f5d9dee 100644
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -610,10 +610,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio(u8 hor_landscape, u8 vert_portrait)
                 aspect.denominator = 9;
         } else if (ratio == 34) {
                 aspect.numerator = 4;
-                aspect.numerator = 3;
+                aspect.denominator = 3;
         } else if (ratio == 68) {
                 aspect.numerator = 15;
-                aspect.numerator = 9;
+                aspect.denominator = 9;
         } else {
                 aspect.numerator = hor_landscape + 99;
                 aspect.denominator = 100;
diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index b04e7d059888..0431b46d9fd9 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -125,7 +125,7 @@ static struct ubi_ainf_volume *add_vol(struct ubi_attach_info *ai, int vol_id,
                 parent = *p;
                 av = rb_entry(parent, struct ubi_ainf_volume, rb);
 
-                if (vol_id < av->vol_id)
+                if (vol_id > av->vol_id)
                         p = &(*p)->rb_left;
                 else
                         p = &(*p)->rb_right;
@@ -423,7 +423,7 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
                                 pnum, err);
                         ret = err > 0 ? UBI_BAD_FASTMAP : err;
                         goto out;
-                } else if (ret == UBI_IO_BITFLIPS)
+                } else if (err == UBI_IO_BITFLIPS)
                         scrub = 1;
 
                 /*
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 14c00048bbec..82322b1c8411 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -129,14 +129,15 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq,
                                                   name);
                                 }
 
-                                cq->irq_desc =
-                                        irq_to_desc(mlx4_eq_get_irq(mdev->dev,
-                                                                    cq->vector));
                         }
                 } else {
                         cq->vector = (cq->ring + 1 + priv->port) %
                                 mdev->dev->caps.num_comp_vectors;
                 }
+
+                cq->irq_desc =
+                        irq_to_desc(mlx4_eq_get_irq(mdev->dev,
+                                                    cq->vector));
         } else {
                 /* For TX we use the same irq per
                 ring we assigned for the RX    */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mr.c b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
index ba0401d4af50..184c3615f479 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
@@ -94,6 +94,11 @@ int mlx5_core_create_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr,
         write_lock_irq(&table->lock);
         err = radix_tree_insert(&table->tree, mlx5_base_mkey(mr->key), mr);
         write_unlock_irq(&table->lock);
+        if (err) {
+                mlx5_core_warn(dev, "failed radix tree insert of mr 0x%x, %d\n",
+                               mlx5_base_mkey(mr->key), err);
+                mlx5_core_destroy_mkey(dev, mr);
+        }
 
         return err;
 }
@@ -104,12 +109,22 @@ int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr)
         struct mlx5_mr_table *table = &dev->priv.mr_table;
         struct mlx5_destroy_mkey_mbox_in in;
         struct mlx5_destroy_mkey_mbox_out out;
+        struct mlx5_core_mr *deleted_mr;
         unsigned long flags;
         int err;
 
         memset(&in, 0, sizeof(in));
         memset(&out, 0, sizeof(out));
 
+        write_lock_irqsave(&table->lock, flags);
+        deleted_mr = radix_tree_delete(&table->tree, mlx5_base_mkey(mr->key));
+        write_unlock_irqrestore(&table->lock, flags);
+        if (!deleted_mr) {
+                mlx5_core_warn(dev, "failed radix tree delete of mr 0x%x\n",
+                               mlx5_base_mkey(mr->key));
+                return -ENOENT;
+        }
+
         in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_DESTROY_MKEY);
         in.mkey = cpu_to_be32(mlx5_mkey_to_idx(mr->key));
         err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
@@ -119,10 +134,6 @@ int mlx5_core_destroy_mkey(struct mlx5_core_dev *dev, struct mlx5_core_mr *mr)
         if (out.hdr.status)
                 return mlx5_cmd_status_to_err(&out.hdr);
 
-        write_lock_irqsave(&table->lock, flags);
-        radix_tree_delete(&table->tree, mlx5_base_mkey(mr->key));
-        write_unlock_irqrestore(&table->lock, flags);
-
         return err;
 }
 EXPORT_SYMBOL(mlx5_core_destroy_mkey);
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 6175bd59190a..9887bcb45b84 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4226,6 +4226,8 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
                 RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                 break;
         case RTL_GIGA_MAC_VER_40:
+                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+                break;
         case RTL_GIGA_MAC_VER_41:
         case RTL_GIGA_MAC_VER_42:
         case RTL_GIGA_MAC_VER_43:
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 1c24a8f368bd..fd411d6e19a2 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -1083,6 +1083,24 @@ static struct vnet *vnet_find_or_create(const u64 *local_mac)
         return vp;
 }
 
+static void vnet_cleanup(void)
+{
+        struct vnet *vp;
+        struct net_device *dev;
+
+        mutex_lock(&vnet_list_mutex);
+        while (!list_empty(&vnet_list)) {
+                vp = list_first_entry(&vnet_list, struct vnet, list);
+                list_del(&vp->list);
+                dev = vp->dev;
+                /* vio_unregister_driver() should have cleaned up port_list */
+                BUG_ON(!list_empty(&vp->port_list));
+                unregister_netdev(dev);
+                free_netdev(dev);
+        }
+        mutex_unlock(&vnet_list_mutex);
+}
+
 static const char *local_mac_prop = "local-mac-address";
 
 static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
@@ -1240,7 +1258,6 @@ static int vnet_port_remove(struct vio_dev *vdev)
 
                 kfree(port);
 
-                unregister_netdev(vp->dev);
         }
         return 0;
 }
@@ -1268,6 +1285,7 @@ static int __init vnet_init(void)
 static void __exit vnet_exit(void)
 {
         vio_unregister_driver(&vnet_port_driver);
+        vnet_cleanup();
 }
 
 module_init(vnet_init);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 2031ce4051dc..765248b42a0a 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -761,10 +761,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         };
 
                         ppp_lock(ppp);
-                        if (ppp->pass_filter)
+                        if (ppp->pass_filter) {
                                 sk_unattached_filter_destroy(ppp->pass_filter);
-                        err = sk_unattached_filter_create(&ppp->pass_filter,
-                                                          &fprog);
+                                ppp->pass_filter = NULL;
+                        }
+                        if (fprog.filter != NULL)
+                                err = sk_unattached_filter_create(&ppp->pass_filter,
+                                                                  &fprog);
+                        else
+                                err = 0;
                         kfree(code);
                         ppp_unlock(ppp);
                 }
@@ -782,10 +787,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         };
 
                         ppp_lock(ppp);
-                        if (ppp->active_filter)
+                        if (ppp->active_filter) {
                                 sk_unattached_filter_destroy(ppp->active_filter);
-                        err = sk_unattached_filter_create(&ppp->active_filter,
-                                                          &fprog);
+                                ppp->active_filter = NULL;
+                        }
+                        if (fprog.filter != NULL)
+                                err = sk_unattached_filter_create(&ppp->active_filter,
+                                                                  &fprog);
+                        else
+                                err = 0;
                         kfree(code);
                         ppp_unlock(ppp);
                 }
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index 5d95a13dbe2a..735f7dadb9a0 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -194,6 +194,9 @@ static const struct usb_device_id huawei_cdc_ncm_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
           .driver_info = (unsigned long)&huawei_cdc_ncm_info,
         },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x03, 0x16),
+          .driver_info = (unsigned long)&huawei_cdc_ncm_info,
+        },
 
         /* Terminating entry */
         {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c4638c67f6b9..22756db53dca 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -667,6 +667,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+        {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
         {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
         {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
         {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
@@ -757,6 +758,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9055, 8)},    /* Netgear AirCard 341U */
         {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index df6c07357556..5c47b011a9d7 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -122,8 +122,12 @@ static int x25_asy_change_mtu(struct net_device *dev, int newmtu)
 {
         struct x25_asy *sl = netdev_priv(dev);
         unsigned char *xbuff, *rbuff;
-        int len = 2 * newmtu;
+        int len;
 
+        if (newmtu > 65534)
+                return -EINVAL;
+
+        len = 2 * newmtu;
         xbuff = kmalloc(len + 4, GFP_ATOMIC);
         rbuff = kmalloc(len + 4, GFP_ATOMIC);
 
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 77127ca08ca4..769e553d3f45 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1030,14 +1030,21 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
 {
         struct gnttab_map_grant_ref *gop_map = *gopp_map;
         u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
+        /* This always points to the shinfo of the skb being checked, which
+         * could be either the first or the one on the frag_list
+         */
         struct skb_shared_info *shinfo = skb_shinfo(skb);
+        /* If this is non-NULL, we are currently checking the frag_list skb, and
+         * this points to the shinfo of the first one
+         */
+        struct skb_shared_info *first_shinfo = NULL;
         int nr_frags = shinfo->nr_frags;
+        const bool sharedslot = nr_frags &&
+                                frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
         int i, err;
-        struct sk_buff *first_skb = NULL;
 
         /* Check status of header. */
         err = (*gopp_copy)->status;
-        (*gopp_copy)++;
         if (unlikely(err)) {
                 if (net_ratelimit())
                         netdev_dbg(queue->vif->dev,
@@ -1045,8 +1052,12 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
                                    (*gopp_copy)->status,
                                    pending_idx,
                                    (*gopp_copy)->source.u.ref);
-                xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
+                /* The first frag might still have this slot mapped */
+                if (!sharedslot)
+                        xenvif_idx_release(queue, pending_idx,
+                                           XEN_NETIF_RSP_ERROR);
         }
+        (*gopp_copy)++;
 
 check_frags:
         for (i = 0; i < nr_frags; i++, gop_map++) {
@@ -1062,8 +1073,19 @@ check_frags:
                                                 pending_idx,
                                                 gop_map->handle);
                         /* Had a previous error? Invalidate this fragment. */
-                        if (unlikely(err))
+                        if (unlikely(err)) {
                                 xenvif_idx_unmap(queue, pending_idx);
+                                /* If the mapping of the first frag was OK, but
+                                 * the header's copy failed, and they are
+                                 * sharing a slot, send an error
+                                 */
+                                if (i == 0 && sharedslot)
+                                        xenvif_idx_release(queue, pending_idx,
+                                                           XEN_NETIF_RSP_ERROR);
+                                else
+                                        xenvif_idx_release(queue, pending_idx,
+                                                           XEN_NETIF_RSP_OKAY);
+                        }
                         continue;
                 }
 
@@ -1075,42 +1097,53 @@ check_frags:
                                    gop_map->status,
                                    pending_idx,
                                    gop_map->ref);
+
                 xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
 
                 /* Not the first error? Preceding frags already invalidated. */
                 if (err)
                         continue;
-                /* First error: invalidate preceding fragments. */
+
+                /* First error: if the header haven't shared a slot with the
+                 * first frag, release it as well.
+                 */
+                if (!sharedslot)
+                        xenvif_idx_release(queue,
+                                           XENVIF_TX_CB(skb)->pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
+
+                /* Invalidate preceding fragments of this skb. */
                 for (j = 0; j < i; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
                         xenvif_idx_unmap(queue, pending_idx);
+                        xenvif_idx_release(queue, pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
+                }
+
+                /* And if we found the error while checking the frag_list, unmap
+                 * the first skb's frags
+                 */
+                if (first_shinfo) {
+                        for (j = 0; j < first_shinfo->nr_frags; j++) {
+                                pending_idx = frag_get_pending_idx(&first_shinfo->frags[j]);
+                                xenvif_idx_unmap(queue, pending_idx);
+                                xenvif_idx_release(queue, pending_idx,
+                                                   XEN_NETIF_RSP_OKAY);
+                        }
                 }
 
                 /* Remember the error: invalidate all subsequent fragments. */
                 err = newerr;
         }
 
-        if (skb_has_frag_list(skb)) {
-                first_skb = skb;
-                skb = shinfo->frag_list;
-                shinfo = skb_shinfo(skb);
+        if (skb_has_frag_list(skb) && !first_shinfo) {
+                first_shinfo = skb_shinfo(skb);
+                shinfo = skb_shinfo(skb_shinfo(skb)->frag_list);
                 nr_frags = shinfo->nr_frags;
 
                 goto check_frags;
         }
 
-        /* There was a mapping error in the frag_list skb. We have to unmap
-         * the first skb's frags
-         */
-        if (first_skb && err) {
-                int j;
-                shinfo = skb_shinfo(first_skb);
-                for (j = 0; j < shinfo->nr_frags; j++) {
-                        pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xenvif_idx_unmap(queue, pending_idx);
-                }
-        }
-
         *gopp_map = gop_map;
         return err;
 }
@@ -1518,7 +1551,16 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
 
                 /* Check the remap error code. */
                 if (unlikely(xenvif_tx_check_gop(queue, skb, &gop_map, &gop_copy))) {
+                        /* If there was an error, xenvif_tx_check_gop is
+                         * expected to release all the frags which were mapped,
+                         * so kfree_skb shouldn't do it again
+                         */
                         skb_shinfo(skb)->nr_frags = 0;
+                        if (skb_has_frag_list(skb)) {
+                                struct sk_buff *nskb =
+                                                skb_shinfo(skb)->frag_list;
+                                skb_shinfo(nskb)->nr_frags = 0;
+                        }
                         kfree_skb(skb);
                         continue;
                 }
@@ -1822,8 +1864,6 @@ void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
                            tx_unmap_op.status);
                 BUG();
         }
-
-        xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_OKAY);
 }
 
 static inline int rx_work_todo(struct xenvif_queue *queue)
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index 15b3459f8656..220acb4cbee5 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -633,7 +633,6 @@ raw3270_reset_device_cb(struct raw3270_request *rq, void *data)
         } else
                 raw3270_writesf_readpart(rp);
         memset(&rp->init_reset, 0, sizeof(rp->init_reset));
-        memset(&rp->init_data, 0, sizeof(rp->init_data));
 }
 
 static int
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 69ef4f8cfac8..4038437ff033 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -901,10 +901,15 @@ static int ap_device_probe(struct device *dev)
         int rc;
 
         ap_dev->drv = ap_drv;
+
+        spin_lock_bh(&ap_device_list_lock);
+        list_add(&ap_dev->list, &ap_device_list);
+        spin_unlock_bh(&ap_device_list_lock);
+
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (!rc) {
+        if (rc) {
                 spin_lock_bh(&ap_device_list_lock);
-                list_add(&ap_dev->list, &ap_device_list);
+                list_del_init(&ap_dev->list);
                 spin_unlock_bh(&ap_device_list_lock);
         }
         return rc;
diff --git a/drivers/staging/media/omap4iss/Kconfig b/drivers/staging/media/omap4iss/Kconfig
index 78b0fba7047e..8afc6fee40c5 100644
--- a/drivers/staging/media/omap4iss/Kconfig
+++ b/drivers/staging/media/omap4iss/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_OMAP4
         bool "OMAP 4 Camera support"
-        depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API && I2C && ARCH_OMAP4
+        depends on VIDEO_V4L2=y && VIDEO_V4L2_SUBDEV_API && I2C=y && ARCH_OMAP4
         select VIDEOBUF2_DMA_CONTIG
         ---help---
           Driver for an OMAP 4 ISS controller.
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 9d2b673f90e3..b8125aa64ad8 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1169,8 +1169,8 @@ static int ep_enable(struct usb_ep *ep,
 
         if (hwep->type == USB_ENDPOINT_XFER_CONTROL)
                 cap |= QH_IOS;
-        if (hwep->num)
-                cap |= QH_ZLT;
+
+        cap |= QH_ZLT;
         cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT;
         /*
          * For ISO-TX, we set mult at QH as the largest value, and use
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 21b99b4b4082..0e950ad8cb25 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -889,6 +889,25 @@ static int hub_usb3_port_disable(struct usb_hub *hub, int port1)
         if (!hub_is_superspeed(hub->hdev))
                 return -EINVAL;
 
+        ret = hub_port_status(hub, port1, &portstatus, &portchange);
+        if (ret < 0)
+                return ret;
+
+        /*
+         * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI
+         * Controller [1022:7814] will have spurious result making the following
+         * usb 3.0 device hotplugging route to the 2.0 root hub and recognized
+         * as high-speed device if we set the usb 3.0 port link state to
+         * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we
+         * check the state here to avoid the bug.
+         */
+        if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+                                USB_SS_PORT_LS_RX_DETECT) {
+                dev_dbg(&hub->ports[port1 - 1]->dev,
+                         "Not disabling port; link state is RxDetect\n");
+                return ret;
+        }
+
         ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
         if (ret)
                 return ret;
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index b7a506f2bb14..5c660c77f03b 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -426,20 +426,18 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                  * p2m are consistent.
                  */
                 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                        unsigned long p;
-                        struct page   *scratch_page = get_balloon_scratch_page();
-
                         if (!PageHighMem(page)) {
+                                struct page *scratch_page = get_balloon_scratch_page();
+
                                 ret = HYPERVISOR_update_va_mapping(
                                                 (unsigned long)__va(pfn << PAGE_SHIFT),
                                                 pfn_pte(page_to_pfn(scratch_page),
                                                         PAGE_KERNEL_RO), 0);
                                 BUG_ON(ret);
-                        }
-                        p = page_to_pfn(scratch_page);
-                        __set_phys_to_machine(pfn, pfn_to_mfn(p));
 
-                        put_balloon_scratch_page();
+                                put_balloon_scratch_page();
+                        }
+                        __set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
                 }
 #endif
 
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index c3667b202f2f..5f1e1f3cd186 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -88,7 +88,6 @@ static int xen_suspend(void *data)
 
         if (!si->cancelled) {
                 xen_irq_resume();
-                xen_console_resume();
                 xen_timer_resume();
         }
 
@@ -135,6 +134,10 @@ static void do_suspend(void)
 
         err = stop_machine(xen_suspend, &si, cpumask_of(0));
 
+        /* Resume console as early as possible. */
+        if (!si.cancelled)
+                xen_console_resume();
+
         raw_notifier_call_chain(&xen_resume_notifier, 0, NULL);
 
         dpm_resume_start(si.cancelled ? PMSG_THAW : PMSG_RESTORE);
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index e12441c7cf1d..7187b14faa6c 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -484,8 +484,19 @@ void btrfs_wait_logged_extents(struct btrfs_root *log, u64 transid)
                                            log_list);
                 list_del_init(&ordered->log_list);
                 spin_unlock_irq(&log->log_extents_lock[index]);
+
+                if (!test_bit(BTRFS_ORDERED_IO_DONE, &ordered->flags) &&
+                    !test_bit(BTRFS_ORDERED_DIRECT, &ordered->flags)) {
+                        struct inode *inode = ordered->inode;
+                        u64 start = ordered->file_offset;
+                        u64 end = ordered->file_offset + ordered->len - 1;
+
+                        WARN_ON(!inode);
+                        filemap_fdatawrite_range(inode->i_mapping, start, end);
+                }
                 wait_event(ordered->wait, test_bit(BTRFS_ORDERED_IO_DONE,
                                                    &ordered->flags));
+
                 btrfs_put_ordered_extent(ordered);
                 spin_lock_irq(&log->log_extents_lock[index]);
         }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 6104676857f5..6cb82f62cb7c 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1680,11 +1680,11 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         if (device->bdev == root->fs_info->fs_devices->latest_bdev)
                 root->fs_info->fs_devices->latest_bdev = next_device->bdev;
 
-        if (device->bdev)
+        if (device->bdev) {
                 device->fs_devices->open_devices--;
-
-        /* remove sysfs entry */
-        btrfs_kobj_rm_device(root->fs_info, device);
+                /* remove sysfs entry */
+                btrfs_kobj_rm_device(root->fs_info, device);
+        }
 
         call_rcu(&device->rcu, free_device);
 
diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index 4fc3a3046174..26b3f952e6b1 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -981,7 +981,7 @@ static int do_flock(struct file *file, int cmd, struct file_lock *fl)
         int error = 0;
 
         state = (fl->fl_type == F_WRLCK) ? LM_ST_EXCLUSIVE : LM_ST_SHARED;
-        flags = (IS_SETLKW(cmd) ? 0 : LM_FLAG_TRY) | GL_EXACT | GL_NOCACHE;
+        flags = (IS_SETLKW(cmd) ? 0 : LM_FLAG_TRY) | GL_EXACT;
 
         mutex_lock(&fp->f_fl_mutex);
 
@@ -991,7 +991,7 @@ static int do_flock(struct file *file, int cmd, struct file_lock *fl)
                         goto out;
                 flock_lock_file_wait(file,
                                      &(struct file_lock){.fl_type = F_UNLCK});
-                gfs2_glock_dq_wait(fl_gh);
+                gfs2_glock_dq(fl_gh);
                 gfs2_holder_reinit(state, flags, fl_gh);
         } else {
                 error = gfs2_glock_get(GFS2_SB(&ip->i_inode), ip->i_no_addr,
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index c355f7320e44..ee4e04fe60fc 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -731,14 +731,14 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
                 cachep = gfs2_glock_aspace_cachep;
         else
                 cachep = gfs2_glock_cachep;
-        gl = kmem_cache_alloc(cachep, GFP_KERNEL);
+        gl = kmem_cache_alloc(cachep, GFP_NOFS);
         if (!gl)
                 return -ENOMEM;
 
         memset(&gl->gl_lksb, 0, sizeof(struct dlm_lksb));
 
         if (glops->go_flags & GLOF_LVB) {
-                gl->gl_lksb.sb_lvbptr = kzalloc(GFS2_MIN_LVB_SIZE, GFP_KERNEL);
+                gl->gl_lksb.sb_lvbptr = kzalloc(GFS2_MIN_LVB_SIZE, GFP_NOFS);
                 if (!gl->gl_lksb.sb_lvbptr) {
                         kmem_cache_free(cachep, gl);
                         return -ENOMEM;
@@ -1404,12 +1404,16 @@ __acquires(&lru_lock)
                 gl = list_entry(list->next, struct gfs2_glock, gl_lru);
                 list_del_init(&gl->gl_lru);
                 if (!spin_trylock(&gl->gl_spin)) {
+add_back_to_lru:
                         list_add(&gl->gl_lru, &lru_list);
                         atomic_inc(&lru_count);
                         continue;
                 }
+                if (test_and_set_bit(GLF_LOCK, &gl->gl_flags)) {
+                        spin_unlock(&gl->gl_spin);
+                        goto add_back_to_lru;
+                }
                 clear_bit(GLF_LRU, &gl->gl_flags);
-                spin_unlock(&lru_lock);
                 gl->gl_lockref.count++;
                 if (demote_ok(gl))
                         handle_callback(gl, LM_ST_UNLOCKED, 0, false);
@@ -1417,7 +1421,7 @@ __acquires(&lru_lock)
                 if (queue_delayed_work(glock_workqueue, &gl->gl_work, 0) == 0)
                         gl->gl_lockref.count--;
                 spin_unlock(&gl->gl_spin);
-                spin_lock(&lru_lock);
+                cond_resched_lock(&lru_lock);
         }
 }
 
@@ -1442,7 +1446,7 @@ static long gfs2_scan_glock_lru(int nr)
                 gl = list_entry(lru_list.next, struct gfs2_glock, gl_lru);
 
                 /* Test for being demotable */
-                if (!test_and_set_bit(GLF_LOCK, &gl->gl_flags)) {
+                if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
                         list_move(&gl->gl_lru, &dispose);
                         atomic_dec(&lru_count);
                         freed++;
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index fc1100781bbc..2ffc67dce87f 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -234,8 +234,8 @@ static void inode_go_sync(struct gfs2_glock *gl)
  * inode_go_inval - prepare a inode glock to be released
  * @gl: the glock
  * @flags:
- * 
- * Normally we invlidate everything, but if we are moving into
+ *
+ * Normally we invalidate everything, but if we are moving into
  * LM_ST_DEFERRED from LM_ST_SHARED or LM_ST_EXCLUSIVE then we
  * can keep hold of the metadata, since it won't have changed.
  *
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 91f274de1246..4fafea1c9ecf 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -1036,8 +1036,8 @@ static int set_recover_size(struct gfs2_sbd *sdp, struct dlm_slot *slots,
 
         new_size = old_size + RECOVER_SIZE_INC;
 
-        submit = kzalloc(new_size * sizeof(uint32_t), GFP_NOFS);
-        result = kzalloc(new_size * sizeof(uint32_t), GFP_NOFS);
+        submit = kcalloc(new_size, sizeof(uint32_t), GFP_NOFS);
+        result = kcalloc(new_size, sizeof(uint32_t), GFP_NOFS);
         if (!submit || !result) {
                 kfree(submit);
                 kfree(result);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index db629d1bd1bd..f4cb9c0d6bbd 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -337,7 +337,7 @@ static bool gfs2_unaligned_extlen(struct gfs2_rbm *rbm, u32 n_unaligned, u32 *le
 
 /**
  * gfs2_free_extlen - Return extent length of free blocks
- * @rbm: Starting position
+ * @rrbm: Starting position
  * @len: Max length to check
  *
  * Starting at the block specified by the rbm, see how many free blocks
@@ -2522,7 +2522,7 @@ void gfs2_rlist_alloc(struct gfs2_rgrp_list *rlist, unsigned int state)
 
 /**
  * gfs2_rlist_free - free a resource group list
- * @list: the list of resource groups
+ * @rlist: the list of resource groups
  *
  */
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 8f98138cbc43..f11b9eed0de1 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -756,7 +756,6 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
         spin_unlock(&dreq->lock);
 
         while (!list_empty(&hdr->pages)) {
-                bool do_destroy = true;
 
                 req = nfs_list_entry(hdr->pages.next);
                 nfs_list_remove_request(req);
@@ -765,7 +764,6 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
                 case NFS_IOHDR_NEED_COMMIT:
                         kref_get(&req->wb_kref);
                         nfs_mark_request_commit(req, hdr->lseg, &cinfo);
-                        do_destroy = false;
                 }
                 nfs_unlock_and_release_request(req);
         }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 82ddbf46660e..f415cbf9f6c3 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -244,6 +244,7 @@ void nfs_pgio_data_release(struct nfs_pgio_data *);
 int nfs_generic_pgio(struct nfs_pageio_descriptor *, struct nfs_pgio_header *);
 int nfs_initiate_pgio(struct rpc_clnt *, struct nfs_pgio_data *,
                       const struct rpc_call_ops *, int, int);
+void nfs_free_request(struct nfs_page *req);
 
 static inline void nfs_iocounter_init(struct nfs_io_counter *c)
 {
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index 871d6eda8dba..8f854dde4150 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -247,3 +247,46 @@ const struct xattr_handler *nfs3_xattr_handlers[] = {
         &posix_acl_default_xattr_handler,
         NULL,
 };
+
+static int
+nfs3_list_one_acl(struct inode *inode, int type, const char *name, void *data,
+                size_t size, ssize_t *result)
+{
+        struct posix_acl *acl;
+        char *p = data + *result;
+
+        acl = get_acl(inode, type);
+        if (!acl)
+                return 0;
+
+        posix_acl_release(acl);
+
+        *result += strlen(name);
+        *result += 1;
+        if (!size)
+                return 0;
+        if (*result > size)
+                return -ERANGE;
+
+        strcpy(p, name);
+        return 0;
+}
+
+ssize_t
+nfs3_listxattr(struct dentry *dentry, char *data, size_t size)
+{
+        struct inode *inode = dentry->d_inode;
+        ssize_t result = 0;
+        int error;
+
+        error = nfs3_list_one_acl(inode, ACL_TYPE_ACCESS,
+                        POSIX_ACL_XATTR_ACCESS, data, size, &result);
+        if (error)
+                return error;
+
+        error = nfs3_list_one_acl(inode, ACL_TYPE_DEFAULT,
+                        POSIX_ACL_XATTR_DEFAULT, data, size, &result);
+        if (error)
+                return error;
+        return result;
+}
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index e7daa42bbc86..f0afa291fd58 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -885,7 +885,7 @@ static const struct inode_operations nfs3_dir_inode_operations = {
         .getattr        = nfs_getattr,
         .setattr        = nfs_setattr,
 #ifdef CONFIG_NFS_V3_ACL
-        .listxattr      = generic_listxattr,
+        .listxattr      = nfs3_listxattr,
         .getxattr       = generic_getxattr,
         .setxattr       = generic_setxattr,
         .removexattr    = generic_removexattr,
@@ -899,7 +899,7 @@ static const struct inode_operations nfs3_file_inode_operations = {
         .getattr        = nfs_getattr,
         .setattr        = nfs_setattr,
 #ifdef CONFIG_NFS_V3_ACL
-        .listxattr      = generic_listxattr,
+        .listxattr      = nfs3_listxattr,
         .getxattr       = generic_getxattr,
         .setxattr       = generic_setxattr,
         .removexattr    = generic_removexattr,
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index b6ee3a6ee96d..17fab89f6358 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -29,8 +29,6 @@
 static struct kmem_cache *nfs_page_cachep;
 static const struct rpc_call_ops nfs_pgio_common_ops;
 
-static void nfs_free_request(struct nfs_page *);
-
 static bool nfs_pgarray_set(struct nfs_page_array *p, unsigned int pagecount)
 {
         p->npages = pagecount;
@@ -239,20 +237,28 @@ nfs_page_group_init(struct nfs_page *req, struct nfs_page *prev)
         WARN_ON_ONCE(prev == req);
 
         if (!prev) {
+                /* a head request */
                 req->wb_head = req;
                 req->wb_this_page = req;
         } else {
+                /* a subrequest */
                 WARN_ON_ONCE(prev->wb_this_page != prev->wb_head);
                 WARN_ON_ONCE(!test_bit(PG_HEADLOCK, &prev->wb_head->wb_flags));
                 req->wb_head = prev->wb_head;
                 req->wb_this_page = prev->wb_this_page;
                 prev->wb_this_page = req;
 
+                /* All subrequests take a ref on the head request until
+                 * nfs_page_group_destroy is called */
+                kref_get(&req->wb_head->wb_kref);
+
                 /* grab extra ref if head request has extra ref from
                  * the write/commit path to handle handoff between write
                  * and commit lists */
-                if (test_bit(PG_INODE_REF, &prev->wb_head->wb_flags))
+                if (test_bit(PG_INODE_REF, &prev->wb_head->wb_flags)) {
+                        set_bit(PG_INODE_REF, &req->wb_flags);
                         kref_get(&req->wb_kref);
+                }
         }
 }
 
@@ -269,6 +275,10 @@ nfs_page_group_destroy(struct kref *kref)
         struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
         struct nfs_page *tmp, *next;
 
+        /* subrequests must release the ref on the head request */
+        if (req->wb_head != req)
+                nfs_release_request(req->wb_head);
+
         if (!nfs_page_group_sync_on_bit(req, PG_TEARDOWN))
                 return;
 
@@ -394,7 +404,7 @@ static void nfs_clear_request(struct nfs_page *req)
  *
  * Note: Should never be called with the spinlock held!
  */
-static void nfs_free_request(struct nfs_page *req)
+void nfs_free_request(struct nfs_page *req)
 {
         WARN_ON_ONCE(req->wb_this_page != req);
 
@@ -925,7 +935,6 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
                         nfs_pageio_doio(desc);
                         if (desc->pg_error < 0)
                                 return 0;
-                        desc->pg_moreio = 0;
                         if (desc->pg_recoalesce)
                                 return 0;
                         /* retry add_request for this subreq */
@@ -972,6 +981,7 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
                 desc->pg_count = 0;
                 desc->pg_base = 0;
                 desc->pg_recoalesce = 0;
+                desc->pg_moreio = 0;
 
                 while (!list_empty(&head)) {
                         struct nfs_page *req;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 98ff061ccaf3..5e2f10304548 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -46,6 +46,7 @@ static const struct rpc_call_ops nfs_commit_ops;
 static const struct nfs_pgio_completion_ops nfs_async_write_completion_ops;
 static const struct nfs_commit_completion_ops nfs_commit_completion_ops;
 static const struct nfs_rw_ops nfs_rw_write_ops;
+static void nfs_clear_request_commit(struct nfs_page *req);
 
 static struct kmem_cache *nfs_wdata_cachep;
 static mempool_t *nfs_wdata_mempool;
@@ -91,8 +92,15 @@ static void nfs_context_set_write_error(struct nfs_open_context *ctx, int error)
         set_bit(NFS_CONTEXT_ERROR_WRITE, &ctx->flags);
 }
 
+/*
+ * nfs_page_find_head_request_locked - find head request associated with @page
+ *
+ * must be called while holding the inode lock.
+ *
+ * returns matching head request with reference held, or NULL if not found.
+ */
 static struct nfs_page *
-nfs_page_find_request_locked(struct nfs_inode *nfsi, struct page *page)
+nfs_page_find_head_request_locked(struct nfs_inode *nfsi, struct page *page)
 {
         struct nfs_page *req = NULL;
 
@@ -104,25 +112,33 @@ nfs_page_find_request_locked(struct nfs_inode *nfsi, struct page *page)
                 /* Linearly search the commit list for the correct req */
                 list_for_each_entry_safe(freq, t, &nfsi->commit_info.list, wb_list) {
                         if (freq->wb_page == page) {
-                                req = freq;
+                                req = freq->wb_head;
                                 break;
                         }
                 }
         }
 
-        if (req)
+        if (req) {
+                WARN_ON_ONCE(req->wb_head != req);
+
                 kref_get(&req->wb_kref);
+        }
 
         return req;
 }
 
-static struct nfs_page *nfs_page_find_request(struct page *page)
+/*
+ * nfs_page_find_head_request - find head request associated with @page
+ *
+ * returns matching head request with reference held, or NULL if not found.
+ */
+static struct nfs_page *nfs_page_find_head_request(struct page *page)
 {
         struct inode *inode = page_file_mapping(page)->host;
         struct nfs_page *req = NULL;
 
         spin_lock(&inode->i_lock);
-        req = nfs_page_find_request_locked(NFS_I(inode), page);
+        req = nfs_page_find_head_request_locked(NFS_I(inode), page);
         spin_unlock(&inode->i_lock);
         return req;
 }
@@ -274,36 +290,246 @@ static void nfs_end_page_writeback(struct nfs_page *req)
                 clear_bdi_congested(&nfss->backing_dev_info, BLK_RW_ASYNC);
 }
 
-static struct nfs_page *nfs_find_and_lock_request(struct page *page, bool nonblock)
+
+/* nfs_page_group_clear_bits
+ *   @req - an nfs request
+ * clears all page group related bits from @req
+ */
+static void
+nfs_page_group_clear_bits(struct nfs_page *req)
+{
+        clear_bit(PG_TEARDOWN, &req->wb_flags);
+        clear_bit(PG_UNLOCKPAGE, &req->wb_flags);
+        clear_bit(PG_UPTODATE, &req->wb_flags);
+        clear_bit(PG_WB_END, &req->wb_flags);
+        clear_bit(PG_REMOVE, &req->wb_flags);
+}
+
+
+/*
+ * nfs_unroll_locks_and_wait -  unlock all newly locked reqs and wait on @req
+ *
+ * this is a helper function for nfs_lock_and_join_requests
+ *
+ * @inode - inode associated with request page group, must be holding inode lock
+ * @head  - head request of page group, must be holding head lock
+ * @req   - request that couldn't lock and needs to wait on the req bit lock
+ * @nonblock - if true, don't actually wait
+ *
+ * NOTE: this must be called holding page_group bit lock and inode spin lock
+ *       and BOTH will be released before returning.
+ *
+ * returns 0 on success, < 0 on error.
+ */
+static int
+nfs_unroll_locks_and_wait(struct inode *inode, struct nfs_page *head,
+                          struct nfs_page *req, bool nonblock)
+        __releases(&inode->i_lock)
+{
+        struct nfs_page *tmp;
+        int ret;
+
+        /* relinquish all the locks successfully grabbed this run */
+        for (tmp = head ; tmp != req; tmp = tmp->wb_this_page)
+                nfs_unlock_request(tmp);
+
+        WARN_ON_ONCE(test_bit(PG_TEARDOWN, &req->wb_flags));
+
+        /* grab a ref on the request that will be waited on */
+        kref_get(&req->wb_kref);
+
+        nfs_page_group_unlock(head);
+        spin_unlock(&inode->i_lock);
+
+        /* release ref from nfs_page_find_head_request_locked */
+        nfs_release_request(head);
+
+        if (!nonblock)
+                ret = nfs_wait_on_request(req);
+        else
+                ret = -EAGAIN;
+        nfs_release_request(req);
+
+        return ret;
+}
+
+/*
+ * nfs_destroy_unlinked_subrequests - destroy recently unlinked subrequests
+ *
+ * @destroy_list - request list (using wb_this_page) terminated by @old_head
+ * @old_head - the old head of the list
+ *
+ * All subrequests must be locked and removed from all lists, so at this point
+ * they are only "active" in this function, and possibly in nfs_wait_on_request
+ * with a reference held by some other context.
+ */
+static void
+nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,
+                                 struct nfs_page *old_head)
+{
+        while (destroy_list) {
+                struct nfs_page *subreq = destroy_list;
+
+                destroy_list = (subreq->wb_this_page == old_head) ?
+                                   NULL : subreq->wb_this_page;
+
+                WARN_ON_ONCE(old_head != subreq->wb_head);
+
+                /* make sure old group is not used */
+                subreq->wb_head = subreq;
+                subreq->wb_this_page = subreq;
+
+                nfs_clear_request_commit(subreq);
+
+                /* subreq is now totally disconnected from page group or any
+                 * write / commit lists. last chance to wake any waiters */
+                nfs_unlock_request(subreq);
+
+                if (!test_bit(PG_TEARDOWN, &subreq->wb_flags)) {
+                        /* release ref on old head request */
+                        nfs_release_request(old_head);
+
+                        nfs_page_group_clear_bits(subreq);
+
+                        /* release the PG_INODE_REF reference */
+                        if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags))
+                                nfs_release_request(subreq);
+                        else
+                                WARN_ON_ONCE(1);
+                } else {
+                        WARN_ON_ONCE(test_bit(PG_CLEAN, &subreq->wb_flags));
+                        /* zombie requests have already released the last
+                         * reference and were waiting on the rest of the
+                         * group to complete. Since it's no longer part of a
+                         * group, simply free the request */
+                        nfs_page_group_clear_bits(subreq);
+                        nfs_free_request(subreq);
+                }
+        }
+}
+
+/*
+ * nfs_lock_and_join_requests - join all subreqs to the head req and return
+ *                              a locked reference, cancelling any pending
+ *                              operations for this page.
+ *
+ * @page - the page used to lookup the "page group" of nfs_page structures
+ * @nonblock - if true, don't block waiting for request locks
+ *
+ * This function joins all sub requests to the head request by first
+ * locking all requests in the group, cancelling any pending operations
+ * and finally updating the head request to cover the whole range covered by
+ * the (former) group.  All subrequests are removed from any write or commit
+ * lists, unlinked from the group and destroyed.
+ *
+ * Returns a locked, referenced pointer to the head request - which after
+ * this call is guaranteed to be the only request associated with the page.
+ * Returns NULL if no requests are found for @page, or a ERR_PTR if an
+ * error was encountered.
+ */
+static struct nfs_page *
+nfs_lock_and_join_requests(struct page *page, bool nonblock)
 {
         struct inode *inode = page_file_mapping(page)->host;
-        struct nfs_page *req;
+        struct nfs_page *head, *subreq;
+        struct nfs_page *destroy_list = NULL;
+        unsigned int total_bytes;
         int ret;
 
+try_again:
+        total_bytes = 0;
+
+        WARN_ON_ONCE(destroy_list);
+
         spin_lock(&inode->i_lock);
-        for (;;) {
-                req = nfs_page_find_request_locked(NFS_I(inode), page);
-                if (req == NULL)
-                        break;
-                if (nfs_lock_request(req))
-                        break;
-                /* Note: If we hold the page lock, as is the case in nfs_writepage,
-                 *       then the call to nfs_lock_request() will always
-                 *       succeed provided that someone hasn't already marked the
-                 *       request as dirty (in which case we don't care).
-                 */
+
+        /*
+         * A reference is taken only on the head request which acts as a
+         * reference to the whole page group - the group will not be destroyed
+         * until the head reference is released.
+         */
+        head = nfs_page_find_head_request_locked(NFS_I(inode), page);
+
+        if (!head) {
                 spin_unlock(&inode->i_lock);
-                if (!nonblock)
-                        ret = nfs_wait_on_request(req);
-                else
-                        ret = -EAGAIN;
-                nfs_release_request(req);
-                if (ret != 0)
+                return NULL;
+        }
+
+        /* lock each request in the page group */
+        nfs_page_group_lock(head);
+        subreq = head;
+        do {
+                /*
+                 * Subrequests are always contiguous, non overlapping
+                 * and in order. If not, it's a programming error.
+                 */
+                WARN_ON_ONCE(subreq->wb_offset !=
+                     (head->wb_offset + total_bytes));
+
+                /* keep track of how many bytes this group covers */
+                total_bytes += subreq->wb_bytes;
+
+                if (!nfs_lock_request(subreq)) {
+                        /* releases page group bit lock and
+                         * inode spin lock and all references */
+                        ret = nfs_unroll_locks_and_wait(inode, head,
+                                subreq, nonblock);
+
+                        if (ret == 0)
+                                goto try_again;
+
                         return ERR_PTR(ret);
-                spin_lock(&inode->i_lock);
+                }
+
+                subreq = subreq->wb_this_page;
+        } while (subreq != head);
+
+        /* Now that all requests are locked, make sure they aren't on any list.
+         * Commit list removal accounting is done after locks are dropped */
+        subreq = head;
+        do {
+                nfs_list_remove_request(subreq);
+                subreq = subreq->wb_this_page;
+        } while (subreq != head);
+
+        /* unlink subrequests from head, destroy them later */
+        if (head->wb_this_page != head) {
+                /* destroy list will be terminated by head */
+                destroy_list = head->wb_this_page;
+                head->wb_this_page = head;
+
+                /* change head request to cover whole range that
+                 * the former page group covered */
+                head->wb_bytes = total_bytes;
         }
+
+        /*
+         * prepare head request to be added to new pgio descriptor
+         */
+        nfs_page_group_clear_bits(head);
+
+        /*
+         * some part of the group was still on the inode list - otherwise
+         * the group wouldn't be involved in async write.
+         * grab a reference for the head request, iff it needs one.
+         */
+        if (!test_and_set_bit(PG_INODE_REF, &head->wb_flags))
+                kref_get(&head->wb_kref);
+
+        nfs_page_group_unlock(head);
+
+        /* drop lock to clear_request_commit the head req and clean up
+         * requests on destroy list */
         spin_unlock(&inode->i_lock);
-        return req;
+
+        nfs_destroy_unlinked_subrequests(destroy_list, head);
+
+        /* clean up commit list state */
+        nfs_clear_request_commit(head);
+
+        /* still holds ref on head from nfs_page_find_head_request_locked
+         * and still has lock on head from lock loop */
+        return head;
 }
 
 /*
@@ -316,7 +542,7 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
         struct nfs_page *req;
         int ret = 0;
 
-        req = nfs_find_and_lock_request(page, nonblock);
+        req = nfs_lock_and_join_requests(page, nonblock);
         if (!req)
                 goto out;
         ret = PTR_ERR(req);
@@ -448,7 +674,9 @@ static void nfs_inode_add_request(struct inode *inode, struct nfs_page *req)
                 set_page_private(req->wb_page, (unsigned long)req);
         }
         nfsi->npages++;
-        set_bit(PG_INODE_REF, &req->wb_flags);
+        /* this a head request for a page group - mark it as having an
+         * extra reference so sub groups can follow suit */
+        WARN_ON(test_and_set_bit(PG_INODE_REF, &req->wb_flags));
         kref_get(&req->wb_kref);
         spin_unlock(&inode->i_lock);
 }
@@ -474,7 +702,9 @@ static void nfs_inode_remove_request(struct nfs_page *req)
                 nfsi->npages--;
                 spin_unlock(&inode->i_lock);
         }
-        nfs_release_request(req);
+
+        if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags))
+                nfs_release_request(req);
 }
 
 static void
@@ -638,7 +868,6 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr)
 {
         struct nfs_commit_info cinfo;
         unsigned long bytes = 0;
-        bool do_destroy;
 
         if (test_bit(NFS_IOHDR_REDO, &hdr->flags))
                 goto out;
@@ -668,7 +897,6 @@ remove_req:
 next:
                 nfs_unlock_request(req);
                 nfs_end_page_writeback(req);
-                do_destroy = !test_bit(NFS_IOHDR_NEED_COMMIT, &hdr->flags);
                 nfs_release_request(req);
         }
 out:
@@ -769,7 +997,7 @@ static struct nfs_page *nfs_try_to_update_request(struct inode *inode,
         spin_lock(&inode->i_lock);
 
         for (;;) {
-                req = nfs_page_find_request_locked(NFS_I(inode), page);
+                req = nfs_page_find_head_request_locked(NFS_I(inode), page);
                 if (req == NULL)
                         goto out_unlock;
 
@@ -877,7 +1105,7 @@ int nfs_flush_incompatible(struct file *file, struct page *page)
          * dropped page.
          */
         do {
-                req = nfs_page_find_request(page);
+                req = nfs_page_find_head_request(page);
                 if (req == NULL)
                         return 0;
                 l_ctx = req->wb_lock_context;
@@ -1569,27 +1797,28 @@ int nfs_wb_page_cancel(struct inode *inode, struct page *page)
         struct nfs_page *req;
         int ret = 0;
 
-        for (;;) {
-                wait_on_page_writeback(page);
-                req = nfs_page_find_request(page);
-                if (req == NULL)
-                        break;
-                if (nfs_lock_request(req)) {
-                        nfs_clear_request_commit(req);
-                        nfs_inode_remove_request(req);
-                        /*
-                         * In case nfs_inode_remove_request has marked the
-                         * page as being dirty
-                         */
-                        cancel_dirty_page(page, PAGE_CACHE_SIZE);
-                        nfs_unlock_and_release_request(req);
-                        break;
-                }
-                ret = nfs_wait_on_request(req);
-                nfs_release_request(req);
-                if (ret < 0)
-                        break;
+        wait_on_page_writeback(page);
+
+        /* blocking call to cancel all requests and join to a single (head)
+         * request */
+        req = nfs_lock_and_join_requests(page, false);
+
+        if (IS_ERR(req)) {
+                ret = PTR_ERR(req);
+        } else if (req) {
+                /* all requests from this page have been cancelled by
+                 * nfs_lock_and_join_requests, so just remove the head
+                 * request from the inode / page_private pointer and
+                 * release it */
+                nfs_inode_remove_request(req);
+                /*
+                 * In case nfs_inode_remove_request has marked the
+                 * page as being dirty
+                 */
+                cancel_dirty_page(page, PAGE_CACHE_SIZE);
+                nfs_unlock_and_release_request(req);
         }
+
         return ret;
 }
 
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 96175df211b1..75c3fe5f3d9d 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -4298,8 +4298,8 @@ xfs_bmapi_delay(
 }
 
 
-int
-__xfs_bmapi_allocate(
+static int
+xfs_bmapi_allocate(
         struct xfs_bmalloca     *bma)
 {
         struct xfs_mount        *mp = bma->ip->i_mount;
@@ -4578,9 +4578,6 @@ xfs_bmapi_write(
         bma.flist = flist;
         bma.firstblock = firstblock;
 
-        if (flags & XFS_BMAPI_STACK_SWITCH)
-                bma.stack_switch = 1;
-
         while (bno < end && n < *nmap) {
                 inhole = eof || bma.got.br_startoff > bno;
                 wasdelay = !inhole && isnullstartblock(bma.got.br_startblock);
diff --git a/fs/xfs/xfs_bmap.h b/fs/xfs/xfs_bmap.h
index 38ba36e9b2f0..b879ca56a64c 100644
--- a/fs/xfs/xfs_bmap.h
+++ b/fs/xfs/xfs_bmap.h
@@ -77,7 +77,6 @@ typedef	struct xfs_bmap_free
  * from written to unwritten, otherwise convert from unwritten to written.
  */
 #define XFS_BMAPI_CONVERT       0x040
-#define XFS_BMAPI_STACK_SWITCH  0x080
 
 #define XFS_BMAPI_FLAGS \
         { XFS_BMAPI_ENTIRE,     "ENTIRE" }, \
@@ -86,8 +85,7 @@ typedef	struct xfs_bmap_free
         { XFS_BMAPI_PREALLOC,   "PREALLOC" }, \
         { XFS_BMAPI_IGSTATE,    "IGSTATE" }, \
         { XFS_BMAPI_CONTIG,     "CONTIG" }, \
-        { XFS_BMAPI_CONVERT,    "CONVERT" }, \
-        { XFS_BMAPI_STACK_SWITCH, "STACK_SWITCH" }
+        { XFS_BMAPI_CONVERT,    "CONVERT" }
 
 
 static inline int xfs_bmapi_aflag(int w)
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 703b3ec1796c..64731ef3324d 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -249,59 +249,6 @@ xfs_bmap_rtalloc(
 }
 
 /*
- * Stack switching interfaces for allocation
- */
-static void
-xfs_bmapi_allocate_worker(
-        struct work_struct      *work)
-{
-        struct xfs_bmalloca     *args = container_of(work,
-                                                struct xfs_bmalloca, work);
-        unsigned long           pflags;
-        unsigned long           new_pflags = PF_FSTRANS;
-
-        /*
-         * we are in a transaction context here, but may also be doing work
-         * in kswapd context, and hence we may need to inherit that state
-         * temporarily to ensure that we don't block waiting for memory reclaim
-         * in any way.
-         */
-        if (args->kswapd)
-                new_pflags |= PF_MEMALLOC | PF_SWAPWRITE | PF_KSWAPD;
-
-        current_set_flags_nested(&pflags, new_pflags);
-
-        args->result = __xfs_bmapi_allocate(args);
-        complete(args->done);
-
-        current_restore_flags_nested(&pflags, new_pflags);
-}
-
-/*
- * Some allocation requests often come in with little stack to work on. Push
- * them off to a worker thread so there is lots of stack to use. Otherwise just
- * call directly to avoid the context switch overhead here.
- */
-int
-xfs_bmapi_allocate(
-        struct xfs_bmalloca     *args)
-{
-        DECLARE_COMPLETION_ONSTACK(done);
-
-        if (!args->stack_switch)
-                return __xfs_bmapi_allocate(args);
-
-
-        args->done = &done;
-        args->kswapd = current_is_kswapd();
-        INIT_WORK_ONSTACK(&args->work, xfs_bmapi_allocate_worker);
-        queue_work(xfs_alloc_wq, &args->work);
-        wait_for_completion(&done);
-        destroy_work_on_stack(&args->work);
-        return args->result;
-}
-
-/*
  * Check if the endoff is outside the last extent. If so the caller will grow
  * the allocation to a stripe unit boundary.  All offsets are considered outside
  * the end of file for an empty fork, so 1 is returned in *eof in that case.
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 075f72232a64..2fdb72d2c908 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -55,8 +55,6 @@ struct xfs_bmalloca {
         bool                    userdata;/* set if is user data */
         bool                    aeof;   /* allocated space at eof */
         bool                    conv;   /* overwriting unwritten extents */
-        bool                    stack_switch;
-        bool                    kswapd; /* allocation in kswapd context */
         int                     flags;
         struct completion       *done;
         struct work_struct      work;
@@ -66,8 +64,6 @@ struct xfs_bmalloca {
 int     xfs_bmap_finish(struct xfs_trans **tp, struct xfs_bmap_free *flist,
                         int *committed);
 int     xfs_bmap_rtalloc(struct xfs_bmalloca *ap);
-int     xfs_bmapi_allocate(struct xfs_bmalloca *args);
-int     __xfs_bmapi_allocate(struct xfs_bmalloca *args);
 int     xfs_bmap_eof(struct xfs_inode *ip, xfs_fileoff_t endoff,
                      int whichfork, int *eof);
 int     xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip,
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index bf810c6baf2b..cf893bc1e373 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -33,6 +33,7 @@
 #include "xfs_error.h"
 #include "xfs_trace.h"
 #include "xfs_cksum.h"
+#include "xfs_alloc.h"
 
 /*
  * Cursor allocation zone.
@@ -2323,7 +2324,7 @@ error1:
  * record (to be inserted into parent).
  */
 STATIC int                                      /* error */
-xfs_btree_split(
+__xfs_btree_split(
         struct xfs_btree_cur    *cur,
         int                     level,
         union xfs_btree_ptr     *ptrp,
@@ -2503,6 +2504,85 @@ error0:
         return error;
 }
 
+struct xfs_btree_split_args {
+        struct xfs_btree_cur    *cur;
+        int                     level;
+        union xfs_btree_ptr     *ptrp;
+        union xfs_btree_key     *key;
+        struct xfs_btree_cur    **curp;
+        int                     *stat;          /* success/failure */
+        int                     result;
+        bool                    kswapd; /* allocation in kswapd context */
+        struct completion       *done;
+        struct work_struct      work;
+};
+
+/*
+ * Stack switching interfaces for allocation
+ */
+static void
+xfs_btree_split_worker(
+        struct work_struct      *work)
+{
+        struct xfs_btree_split_args     *args = container_of(work,
+                                                struct xfs_btree_split_args, work);
+        unsigned long           pflags;
+        unsigned long           new_pflags = PF_FSTRANS;
+
+        /*
+         * we are in a transaction context here, but may also be doing work
+         * in kswapd context, and hence we may need to inherit that state
+         * temporarily to ensure that we don't block waiting for memory reclaim
+         * in any way.
+         */
+        if (args->kswapd)
+                new_pflags |= PF_MEMALLOC | PF_SWAPWRITE | PF_KSWAPD;
+
+        current_set_flags_nested(&pflags, new_pflags);
+
+        args->result = __xfs_btree_split(args->cur, args->level, args->ptrp,
+                                         args->key, args->curp, args->stat);
+        complete(args->done);
+
+        current_restore_flags_nested(&pflags, new_pflags);
+}
+
+/*
+ * BMBT split requests often come in with little stack to work on. Push
+ * them off to a worker thread so there is lots of stack to use. For the other
+ * btree types, just call directly to avoid the context switch overhead here.
+ */
+STATIC int                                      /* error */
+xfs_btree_split(
+        struct xfs_btree_cur    *cur,
+        int                     level,
+        union xfs_btree_ptr     *ptrp,
+        union xfs_btree_key     *key,
+        struct xfs_btree_cur    **curp,
+        int                     *stat)          /* success/failure */
+{
+        struct xfs_btree_split_args     args;
+        DECLARE_COMPLETION_ONSTACK(done);
+
+        if (cur->bc_btnum != XFS_BTNUM_BMAP)
+                return __xfs_btree_split(cur, level, ptrp, key, curp, stat);
+
+        args.cur = cur;
+        args.level = level;
+        args.ptrp = ptrp;
+        args.key = key;
+        args.curp = curp;
+        args.stat = stat;
+        args.done = &done;
+        args.kswapd = current_is_kswapd();
+        INIT_WORK_ONSTACK(&args.work, xfs_btree_split_worker);
+        queue_work(xfs_alloc_wq, &args.work);
+        wait_for_completion(&done);
+        destroy_work_on_stack(&args.work);
+        return args.result;
+}
+
+
 /*
  * Copy the old inode root contents into a real block and make the
  * broot point to it.
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 6c5eb4c551e3..6d3ec2b6ee29 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -749,8 +749,7 @@ xfs_iomap_write_allocate(
                          * pointer that the caller gave to us.
                          */
                         error = xfs_bmapi_write(tp, ip, map_start_fsb,
-                                                count_fsb,
-                                                XFS_BMAPI_STACK_SWITCH,
+                                                count_fsb, 0,
                                                 &first_block, 1,
                                                 imap, &nimaps, &free_list);
                         if (error)
diff --git a/fs/xfs/xfs_sb.c b/fs/xfs/xfs_sb.c
index c3453b11f563..7703fa6770ff 100644
--- a/fs/xfs/xfs_sb.c
+++ b/fs/xfs/xfs_sb.c
@@ -483,10 +483,16 @@ xfs_sb_quota_to_disk(
         }
 
         /*
-         * GQUOTINO and PQUOTINO cannot be used together in versions
-         * of superblock that do not have pquotino. from->sb_flags
-         * tells us which quota is active and should be copied to
-         * disk.
+         * GQUOTINO and PQUOTINO cannot be used together in versions of
+         * superblock that do not have pquotino. from->sb_flags tells us which
+         * quota is active and should be copied to disk. If neither are active,
+         * make sure we write NULLFSINO to the sb_gquotino field as a quota
+         * inode value of "0" is invalid when the XFS_SB_VERSION_QUOTA feature
+         * bit is set.
+         *
+         * Note that we don't need to handle the sb_uquotino or sb_pquotino here
+         * as they do not require any translation. Hence the main sb field loop
+         * will write them appropriately from the in-core superblock.
          */
         if ((*fields & XFS_SB_GQUOTINO) &&
                                 (from->sb_qflags & XFS_GQUOTA_ACCT))
@@ -494,6 +500,17 @@ xfs_sb_quota_to_disk(
         else if ((*fields & XFS_SB_PQUOTINO) &&
                                 (from->sb_qflags & XFS_PQUOTA_ACCT))
                 to->sb_gquotino = cpu_to_be64(from->sb_pquotino);
+        else {
+                /*
+                 * We can't rely on just the fields being logged to tell us
+                 * that it is safe to write NULLFSINO - we should only do that
+                 * if quotas are not actually enabled. Hence only write
+                 * NULLFSINO if both in-core quota inodes are NULL.
+                 */
+                if (from->sb_gquotino == NULLFSINO &&
+                    from->sb_pquotino == NULLFSINO)
+                        to->sb_gquotino = cpu_to_be64(NULLFSINO);
+        }
 
         *fields &= ~(XFS_SB_PQUOTINO | XFS_SB_GQUOTINO);
 }
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index ec4112d257bc..8f8ae95c6e27 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -482,8 +482,8 @@ extern struct cpufreq_governor cpufreq_gov_conservative;
  *********************************************************************/
 
 /* Special Values of .frequency field */
-#define CPUFREQ_ENTRY_INVALID   ~0
-#define CPUFREQ_TABLE_END       ~1
+#define CPUFREQ_ENTRY_INVALID   ~0u
+#define CPUFREQ_TABLE_END       ~1u
 /* Special Values of .flags field */
 #define CPUFREQ_BOOST_FREQ      (1 << 0)
 
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index 11692dea18aa..42aa9b9ecd5f 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -17,6 +17,7 @@
 #include <linux/lockdep.h>
 #include <linux/atomic.h>
 #include <asm/processor.h>
+#include <linux/osq_lock.h>
 
 /*
  * Simple, straightforward mutexes with strict semantics:
@@ -46,7 +47,6 @@
  * - detects multi-task circular deadlocks and prints out all affected
  *   locks and tasks (and only those tasks)
  */
-struct optimistic_spin_queue;
 struct mutex {
         /* 1: unlocked, 0: locked, negative: locked, possible waiters */
         atomic_t                count;
@@ -56,7 +56,7 @@ struct mutex {
         struct task_struct      *owner;
 #endif
 #ifdef CONFIG_MUTEX_SPIN_ON_OWNER
-        struct optimistic_spin_queue    *osq;   /* Spinner MCS lock */
+        struct optimistic_spin_queue osq; /* Spinner MCS lock */
 #endif
 #ifdef CONFIG_DEBUG_MUTEXES
         const char              *name;
diff --git a/include/linux/osq_lock.h b/include/linux/osq_lock.h
new file mode 100644
index 000000000000..90230d5811c5
--- /dev/null
+++ b/include/linux/osq_lock.h
@@ -0,0 +1,27 @@
+#ifndef __LINUX_OSQ_LOCK_H
+#define __LINUX_OSQ_LOCK_H
+
+/*
+ * An MCS like lock especially tailored for optimistic spinning for sleeping
+ * lock implementations (mutex, rwsem, etc).
+ */
+
+#define OSQ_UNLOCKED_VAL (0)
+
+struct optimistic_spin_queue {
+        /*
+         * Stores an encoded value of the CPU # of the tail node in the queue.
+         * If the queue is empty, then it's set to OSQ_UNLOCKED_VAL.
+         */
+        atomic_t tail;
+};
+
+/* Init macro and function. */
+#define OSQ_LOCK_UNLOCKED { ATOMIC_INIT(OSQ_UNLOCKED_VAL) }
+
+static inline void osq_lock_init(struct optimistic_spin_queue *lock)
+{
+        atomic_set(&lock->tail, OSQ_UNLOCKED_VAL);
+}
+
+#endif
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 5a75d19aa661..6a94cc8b1ca0 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -44,7 +44,6 @@
 #include <linux/debugobjects.h>
 #include <linux/bug.h>
 #include <linux/compiler.h>
-#include <linux/percpu.h>
 #include <asm/barrier.h>
 
 extern int rcu_expedited; /* for sysctl */
@@ -300,41 +299,6 @@ bool __rcu_is_watching(void);
 #endif /* #if defined(CONFIG_DEBUG_LOCK_ALLOC) || defined(CONFIG_RCU_TRACE) || defined(CONFIG_SMP) */
 
 /*
- * Hooks for cond_resched() and friends to avoid RCU CPU stall warnings.
- */
-
-#define RCU_COND_RESCHED_LIM 256        /* ms vs. 100s of ms. */
-DECLARE_PER_CPU(int, rcu_cond_resched_count);
-void rcu_resched(void);
-
-/*
- * Is it time to report RCU quiescent states?
- *
- * Note unsynchronized access to rcu_cond_resched_count.  Yes, we might
- * increment some random CPU's count, and possibly also load the result from
- * yet another CPU's count.  We might even clobber some other CPU's attempt
- * to zero its counter.  This is all OK because the goal is not precision,
- * but rather reasonable amortization of rcu_note_context_switch() overhead
- * and extremely high probability of avoiding RCU CPU stall warnings.
- * Note that this function has to be preempted in just the wrong place,
- * many thousands of times in a row, for anything bad to happen.
- */
-static inline bool rcu_should_resched(void)
-{
-        return raw_cpu_inc_return(rcu_cond_resched_count) >=
-               RCU_COND_RESCHED_LIM;
-}
-
-/*
- * Report quiscent states to RCU if it is time to do so.
- */
-static inline void rcu_cond_resched(void)
-{
-        if (unlikely(rcu_should_resched()))
-                rcu_resched();
-}
-
-/*
  * Infrastructure to implement the synchronize_() primitives in
  * TREE_RCU and rcu_barrier_() primitives in TINY_RCU.
  */
@@ -358,9 +322,19 @@ void wait_rcu_gp(call_rcu_func_t crf);
  * initialization.
  */
 #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD
+void init_rcu_head(struct rcu_head *head);
+void destroy_rcu_head(struct rcu_head *head);
 void init_rcu_head_on_stack(struct rcu_head *head);
 void destroy_rcu_head_on_stack(struct rcu_head *head);
 #else /* !CONFIG_DEBUG_OBJECTS_RCU_HEAD */
+static inline void init_rcu_head(struct rcu_head *head)
+{
+}
+
+static inline void destroy_rcu_head(struct rcu_head *head)
+{
+}
+
 static inline void init_rcu_head_on_stack(struct rcu_head *head)
 {
 }
diff --git a/include/linux/rwsem-spinlock.h b/include/linux/rwsem-spinlock.h
index d5b13bc07a0b..561e8615528d 100644
--- a/include/linux/rwsem-spinlock.h
+++ b/include/linux/rwsem-spinlock.h
@@ -15,13 +15,13 @@
 #ifdef __KERNEL__
 /*
  * the rw-semaphore definition
- * - if activity is 0 then there are no active readers or writers
- * - if activity is +ve then that is the number of active readers
- * - if activity is -1 then there is one active writer
+ * - if count is 0 then there are no active readers or writers
+ * - if count is +ve then that is the number of active readers
+ * - if count is -1 then there is one active writer
  * - if wait_list is not empty, then there are processes waiting for the semaphore
  */
 struct rw_semaphore {
-        __s32                   activity;
+        __s32                   count;
         raw_spinlock_t          wait_lock;
         struct list_head        wait_list;
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
diff --git a/include/linux/rwsem.h b/include/linux/rwsem.h
index 8d79708146aa..035d3c57fc8a 100644
--- a/include/linux/rwsem.h
+++ b/include/linux/rwsem.h
@@ -13,10 +13,11 @@
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
-
 #include <linux/atomic.h>
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
+#include <linux/osq_lock.h>
+#endif
 
-struct optimistic_spin_queue;
 struct rw_semaphore;
 
 #ifdef CONFIG_RWSEM_GENERIC_SPINLOCK
@@ -25,15 +26,15 @@ struct rw_semaphore;
 /* All arch specific implementations share the same struct */
 struct rw_semaphore {
         long count;
-        raw_spinlock_t wait_lock;
         struct list_head wait_list;
-#ifdef CONFIG_SMP
+        raw_spinlock_t wait_lock;
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
+        struct optimistic_spin_queue osq; /* spinner MCS lock */
         /*
          * Write owner. Used as a speculative check to see
          * if the owner is running on the cpu.
          */
         struct task_struct *owner;
-        struct optimistic_spin_queue *osq; /* spinner MCS lock */
 #endif
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
         struct lockdep_map      dep_map;
@@ -64,22 +65,19 @@ static inline int rwsem_is_locked(struct rw_semaphore *sem)
 # define __RWSEM_DEP_MAP_INIT(lockname)
 #endif
 
-#if defined(CONFIG_SMP) && !defined(CONFIG_RWSEM_GENERIC_SPINLOCK)
-#define __RWSEM_INITIALIZER(name)                       \
-        { RWSEM_UNLOCKED_VALUE,                         \
-          __RAW_SPIN_LOCK_UNLOCKED(name.wait_lock),     \
-          LIST_HEAD_INIT((name).wait_list),             \
-          NULL, /* owner */                             \
-          NULL /* mcs lock */                           \
-          __RWSEM_DEP_MAP_INIT(name) }
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
+#define __RWSEM_OPT_INIT(lockname) , .osq = OSQ_LOCK_UNLOCKED, .owner = NULL
 #else
-#define __RWSEM_INITIALIZER(name)                       \
-        { RWSEM_UNLOCKED_VALUE,                         \
-          __RAW_SPIN_LOCK_UNLOCKED(name.wait_lock),     \
-          LIST_HEAD_INIT((name).wait_list)              \
-          __RWSEM_DEP_MAP_INIT(name) }
+#define __RWSEM_OPT_INIT(lockname)
 #endif
 
+#define __RWSEM_INITIALIZER(name)                               \
+        { .count = RWSEM_UNLOCKED_VALUE,                        \
+          .wait_list = LIST_HEAD_INIT((name).wait_list),        \
+          .wait_lock = __RAW_SPIN_LOCK_UNLOCKED(name.wait_lock) \
+          __RWSEM_OPT_INIT(name)                                \
+          __RWSEM_DEP_MAP_INIT(name) }
+
 #define DECLARE_RWSEM(name) \
         struct rw_semaphore name = __RWSEM_INITIALIZER(name)
 
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 713b0b88bd5a..c4d86198d3d6 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -6,6 +6,7 @@
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/nf_tables.h>
+#include <linux/u64_stats_sync.h>
 #include <net/netlink.h>
 
 #define NFT_JUMP_STACK_SIZE     16
@@ -528,8 +529,9 @@ enum nft_chain_type {
 };
 
 struct nft_stats {
-        u64 bytes;
-        u64 pkts;
+        u64                     bytes;
+        u64                     pkts;
+        struct u64_stats_sync   syncp;
 };
 
 #define NFT_HOOK_OPS_MAX                2
diff --git a/include/net/netns/nftables.h b/include/net/netns/nftables.h
index 26a394cb91a8..eee608b12cc9 100644
--- a/include/net/netns/nftables.h
+++ b/include/net/netns/nftables.h
@@ -13,8 +13,8 @@ struct netns_nftables {
         struct nft_af_info      *inet;
         struct nft_af_info      *arp;
         struct nft_af_info      *bridge;
+        unsigned int            base_seq;
         u8                      gencursor;
-        u8                      genctr;
 };
 
 #endif
diff --git a/kernel/Kconfig.locks b/kernel/Kconfig.locks
index 35536d9c0964..76768ee812b2 100644
--- a/kernel/Kconfig.locks
+++ b/kernel/Kconfig.locks
@@ -220,9 +220,16 @@ config INLINE_WRITE_UNLOCK_IRQRESTORE
 
 endif
 
+config ARCH_SUPPORTS_ATOMIC_RMW
+        bool
+
 config MUTEX_SPIN_ON_OWNER
         def_bool y
-        depends on SMP && !DEBUG_MUTEXES
+        depends on SMP && !DEBUG_MUTEXES && ARCH_SUPPORTS_ATOMIC_RMW
+
+config RWSEM_SPIN_ON_OWNER
+       def_bool y
+       depends on SMP && RWSEM_XCHGADD_ALGORITHM && ARCH_SUPPORTS_ATOMIC_RMW
 
 config ARCH_USE_QUEUE_RWLOCK
         bool
diff --git a/kernel/locking/mcs_spinlock.c b/kernel/locking/mcs_spinlock.c
index 838dc9e00669..be9ee1559fca 100644
--- a/kernel/locking/mcs_spinlock.c
+++ b/kernel/locking/mcs_spinlock.c
@@ -14,21 +14,47 @@
  * called from interrupt context and we have preemption disabled while
  * spinning.
  */
-static DEFINE_PER_CPU_SHARED_ALIGNED(struct optimistic_spin_queue, osq_node);
+static DEFINE_PER_CPU_SHARED_ALIGNED(struct optimistic_spin_node, osq_node);
+
+/*
+ * We use the value 0 to represent "no CPU", thus the encoded value
+ * will be the CPU number incremented by 1.
+ */
+static inline int encode_cpu(int cpu_nr)
+{
+        return cpu_nr + 1;
+}
+
+static inline struct optimistic_spin_node *decode_cpu(int encoded_cpu_val)
+{
+        int cpu_nr = encoded_cpu_val - 1;
+
+        return per_cpu_ptr(&osq_node, cpu_nr);
+}
 
 /*
  * Get a stable @node->next pointer, either for unlock() or unqueue() purposes.
  * Can return NULL in case we were the last queued and we updated @lock instead.
  */
-static inline struct optimistic_spin_queue *
-osq_wait_next(struct optimistic_spin_queue **lock,
-              struct optimistic_spin_queue *node,
-              struct optimistic_spin_queue *prev)
+static inline struct optimistic_spin_node *
+osq_wait_next(struct optimistic_spin_queue *lock,
+              struct optimistic_spin_node *node,
+              struct optimistic_spin_node *prev)
 {
-        struct optimistic_spin_queue *next = NULL;
+        struct optimistic_spin_node *next = NULL;
+        int curr = encode_cpu(smp_processor_id());
+        int old;
+
+        /*
+         * If there is a prev node in queue, then the 'old' value will be
+         * the prev node's CPU #, else it's set to OSQ_UNLOCKED_VAL since if
+         * we're currently last in queue, then the queue will then become empty.
+         */
+        old = prev ? prev->cpu : OSQ_UNLOCKED_VAL;
 
         for (;;) {
-                if (*lock == node && cmpxchg(lock, node, prev) == node) {
+                if (atomic_read(&lock->tail) == curr &&
+                    atomic_cmpxchg(&lock->tail, curr, old) == curr) {
                         /*
                          * We were the last queued, we moved @lock back. @prev
                          * will now observe @lock and will complete its
@@ -59,18 +85,23 @@ osq_wait_next(struct optimistic_spin_queue **lock,
         return next;
 }
 
-bool osq_lock(struct optimistic_spin_queue **lock)
+bool osq_lock(struct optimistic_spin_queue *lock)
 {
-        struct optimistic_spin_queue *node = this_cpu_ptr(&osq_node);
-        struct optimistic_spin_queue *prev, *next;
+        struct optimistic_spin_node *node = this_cpu_ptr(&osq_node);
+        struct optimistic_spin_node *prev, *next;
+        int curr = encode_cpu(smp_processor_id());
+        int old;
 
         node->locked = 0;
         node->next = NULL;
+        node->cpu = curr;
 
-        node->prev = prev = xchg(lock, node);
-        if (likely(prev == NULL))
+        old = atomic_xchg(&lock->tail, curr);
+        if (old == OSQ_UNLOCKED_VAL)
                 return true;
 
+        prev = decode_cpu(old);
+        node->prev = prev;
         ACCESS_ONCE(prev->next) = node;
 
         /*
@@ -149,20 +180,21 @@ unqueue:
         return false;
 }
 
-void osq_unlock(struct optimistic_spin_queue **lock)
+void osq_unlock(struct optimistic_spin_queue *lock)
 {
-        struct optimistic_spin_queue *node = this_cpu_ptr(&osq_node);
-        struct optimistic_spin_queue *next;
+        struct optimistic_spin_node *node, *next;
+        int curr = encode_cpu(smp_processor_id());
 
         /*
          * Fast path for the uncontended case.
          */
-        if (likely(cmpxchg(lock, node, NULL) == node))
+        if (likely(atomic_cmpxchg(&lock->tail, curr, OSQ_UNLOCKED_VAL) == curr))
                 return;
 
         /*
          * Second most likely case.
          */
+        node = this_cpu_ptr(&osq_node);
         next = xchg(&node->next, NULL);
         if (next) {
                 ACCESS_ONCE(next->locked) = 1;
diff --git a/kernel/locking/mcs_spinlock.h b/kernel/locking/mcs_spinlock.h
index a2dbac4aca6b..74356dc0ce29 100644
--- a/kernel/locking/mcs_spinlock.h
+++ b/kernel/locking/mcs_spinlock.h
@@ -118,12 +118,13 @@ void mcs_spin_unlock(struct mcs_spinlock **lock, struct mcs_spinlock *node)
  * mutex_lock()/rwsem_down_{read,write}() etc.
  */
 
-struct optimistic_spin_queue {
-        struct optimistic_spin_queue *next, *prev;
+struct optimistic_spin_node {
+        struct optimistic_spin_node *next, *prev;
         int locked; /* 1 if lock acquired */
+        int cpu; /* encoded CPU # value */
 };
 
-extern bool osq_lock(struct optimistic_spin_queue **lock);
-extern void osq_unlock(struct optimistic_spin_queue **lock);
+extern bool osq_lock(struct optimistic_spin_queue *lock);
+extern void osq_unlock(struct optimistic_spin_queue *lock);
 
 #endif /* __LINUX_MCS_SPINLOCK_H */
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index bc73d33c6760..acca2c1a3c5e 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -60,7 +60,7 @@ __mutex_init(struct mutex *lock, const char *name, struct lock_class_key *key)
         INIT_LIST_HEAD(&lock->wait_list);
         mutex_clear_owner(lock);
 #ifdef CONFIG_MUTEX_SPIN_ON_OWNER
-        lock->osq = NULL;
+        osq_lock_init(&lock->osq);
 #endif
 
         debug_mutex_init(lock, name, key);
diff --git a/kernel/locking/rwsem-spinlock.c b/kernel/locking/rwsem-spinlock.c
index 9be8a9144978..2c93571162cb 100644
--- a/kernel/locking/rwsem-spinlock.c
+++ b/kernel/locking/rwsem-spinlock.c
@@ -26,7 +26,7 @@ int rwsem_is_locked(struct rw_semaphore *sem)
         unsigned long flags;
 
         if (raw_spin_trylock_irqsave(&sem->wait_lock, flags)) {
-                ret = (sem->activity != 0);
+                ret = (sem->count != 0);
                 raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
         }
         return ret;
@@ -46,7 +46,7 @@ void __init_rwsem(struct rw_semaphore *sem, const char *name,
         debug_check_no_locks_freed((void *)sem, sizeof(*sem));
         lockdep_init_map(&sem->dep_map, name, key, 0);
 #endif
-        sem->activity = 0;
+        sem->count = 0;
         raw_spin_lock_init(&sem->wait_lock);
         INIT_LIST_HEAD(&sem->wait_list);
 }
@@ -95,7 +95,7 @@ __rwsem_do_wake(struct rw_semaphore *sem, int wakewrite)
                 waiter = list_entry(next, struct rwsem_waiter, list);
         } while (waiter->type != RWSEM_WAITING_FOR_WRITE);
 
-        sem->activity += woken;
+        sem->count += woken;
 
  out:
         return sem;
@@ -126,9 +126,9 @@ void __sched __down_read(struct rw_semaphore *sem)
 
         raw_spin_lock_irqsave(&sem->wait_lock, flags);
 
-        if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
+        if (sem->count >= 0 && list_empty(&sem->wait_list)) {
                 /* granted */
-                sem->activity++;
+                sem->count++;
                 raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
                 goto out;
         }
@@ -170,9 +170,9 @@ int __down_read_trylock(struct rw_semaphore *sem)
 
         raw_spin_lock_irqsave(&sem->wait_lock, flags);
 
-        if (sem->activity >= 0 && list_empty(&sem->wait_list)) {
+        if (sem->count >= 0 && list_empty(&sem->wait_list)) {
                 /* granted */
-                sem->activity++;
+                sem->count++;
                 ret = 1;
         }
 
@@ -206,7 +206,7 @@ void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
                  * itself into sleep and waiting for system woke it or someone
                  * else in the head of the wait list up.
                  */
-                if (sem->activity == 0)
+                if (sem->count == 0)
                         break;
                 set_task_state(tsk, TASK_UNINTERRUPTIBLE);
                 raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
@@ -214,7 +214,7 @@ void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
                 raw_spin_lock_irqsave(&sem->wait_lock, flags);
         }
         /* got the lock */
-        sem->activity = -1;
+        sem->count = -1;
         list_del(&waiter.list);
 
         raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
@@ -235,9 +235,9 @@ int __down_write_trylock(struct rw_semaphore *sem)
 
         raw_spin_lock_irqsave(&sem->wait_lock, flags);
 
-        if (sem->activity == 0) {
+        if (sem->count == 0) {
                 /* got the lock */
-                sem->activity = -1;
+                sem->count = -1;
                 ret = 1;
         }
 
@@ -255,7 +255,7 @@ void __up_read(struct rw_semaphore *sem)
 
         raw_spin_lock_irqsave(&sem->wait_lock, flags);
 
-        if (--sem->activity == 0 && !list_empty(&sem->wait_list))
+        if (--sem->count == 0 && !list_empty(&sem->wait_list))
                 sem = __rwsem_wake_one_writer(sem);
 
         raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
@@ -270,7 +270,7 @@ void __up_write(struct rw_semaphore *sem)
 
         raw_spin_lock_irqsave(&sem->wait_lock, flags);
 
-        sem->activity = 0;
+        sem->count = 0;
         if (!list_empty(&sem->wait_list))
                 sem = __rwsem_do_wake(sem, 1);
 
@@ -287,7 +287,7 @@ void __downgrade_write(struct rw_semaphore *sem)
 
         raw_spin_lock_irqsave(&sem->wait_lock, flags);
 
-        sem->activity = 1;
+        sem->count = 1;
         if (!list_empty(&sem->wait_list))
                 sem = __rwsem_do_wake(sem, 0);
 
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index dacc32142fcc..a2391ac135c8 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -82,9 +82,9 @@ void __init_rwsem(struct rw_semaphore *sem, const char *name,
         sem->count = RWSEM_UNLOCKED_VALUE;
         raw_spin_lock_init(&sem->wait_lock);
         INIT_LIST_HEAD(&sem->wait_list);
-#ifdef CONFIG_SMP
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
         sem->owner = NULL;
-        sem->osq = NULL;
+        osq_lock_init(&sem->osq);
 #endif
 }
 
@@ -262,7 +262,7 @@ static inline bool rwsem_try_write_lock(long count, struct rw_semaphore *sem)
         return false;
 }
 
-#ifdef CONFIG_SMP
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
 /*
  * Try to acquire write lock before the writer has been put on wait queue.
  */
@@ -285,10 +285,10 @@ static inline bool rwsem_try_write_lock_unqueued(struct rw_semaphore *sem)
 static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem)
 {
         struct task_struct *owner;
-        bool on_cpu = true;
+        bool on_cpu = false;
 
         if (need_resched())
-                return 0;
+                return false;
 
         rcu_read_lock();
         owner = ACCESS_ONCE(sem->owner);
@@ -297,9 +297,9 @@ static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem)
         rcu_read_unlock();
 
         /*
-         * If sem->owner is not set, the rwsem owner may have
-         * just acquired it and not set the owner yet or the rwsem
-         * has been released.
+         * If sem->owner is not set, yet we have just recently entered the
+         * slowpath, then there is a possibility reader(s) may have the lock.
+         * To be safe, avoid spinning in these situations.
          */
         return on_cpu;
 }
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index 42f806de49d4..e2d3bc7f03b4 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -12,7 +12,7 @@
 
 #include <linux/atomic.h>
 
-#if defined(CONFIG_SMP) && defined(CONFIG_RWSEM_XCHGADD_ALGORITHM)
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
 static inline void rwsem_set_owner(struct rw_semaphore *sem)
 {
         sem->owner = current;
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 0ca8d83e2369..4ee194eb524b 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -186,6 +186,7 @@ void thaw_processes(void)
 
         printk("Restarting tasks ... ");
 
+        __usermodehelper_set_disable_depth(UMH_FREEZING);
         thaw_workqueues();
 
         read_lock(&tasklist_lock);
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 4dd8822f732a..ed35a4790afe 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -306,7 +306,7 @@ int suspend_devices_and_enter(suspend_state_t state)
                 error = suspend_ops->begin(state);
                 if (error)
                         goto Close;
-        } else if (state == PM_SUSPEND_FREEZE && freeze_ops->begin) {
+        } else if (state == PM_SUSPEND_FREEZE && freeze_ops && freeze_ops->begin) {
                 error = freeze_ops->begin();
                 if (error)
                         goto Close;
@@ -335,7 +335,7 @@ int suspend_devices_and_enter(suspend_state_t state)
  Close:
         if (need_suspend_ops(state) && suspend_ops->end)
                 suspend_ops->end();
-        else if (state == PM_SUSPEND_FREEZE && freeze_ops->end)
+        else if (state == PM_SUSPEND_FREEZE && freeze_ops && freeze_ops->end)
                 freeze_ops->end();
 
         return error;
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index f1ba77363fbb..625d0b0cd75a 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -206,6 +206,70 @@ void rcu_bh_qs(int cpu)
         rdp->passed_quiesce = 1;
 }
 
+static DEFINE_PER_CPU(int, rcu_sched_qs_mask);
+
+static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = {
+        .dynticks_nesting = DYNTICK_TASK_EXIT_IDLE,
+        .dynticks = ATOMIC_INIT(1),
+#ifdef CONFIG_NO_HZ_FULL_SYSIDLE
+        .dynticks_idle_nesting = DYNTICK_TASK_NEST_VALUE,
+        .dynticks_idle = ATOMIC_INIT(1),
+#endif /* #ifdef CONFIG_NO_HZ_FULL_SYSIDLE */
+};
+
+/*
+ * Let the RCU core know that this CPU has gone through the scheduler,
+ * which is a quiescent state.  This is called when the need for a
+ * quiescent state is urgent, so we burn an atomic operation and full
+ * memory barriers to let the RCU core know about it, regardless of what
+ * this CPU might (or might not) do in the near future.
+ *
+ * We inform the RCU core by emulating a zero-duration dyntick-idle
+ * period, which we in turn do by incrementing the ->dynticks counter
+ * by two.
+ */
+static void rcu_momentary_dyntick_idle(void)
+{
+        unsigned long flags;
+        struct rcu_data *rdp;
+        struct rcu_dynticks *rdtp;
+        int resched_mask;
+        struct rcu_state *rsp;
+
+        local_irq_save(flags);
+
+        /*
+         * Yes, we can lose flag-setting operations.  This is OK, because
+         * the flag will be set again after some delay.
+         */
+        resched_mask = raw_cpu_read(rcu_sched_qs_mask);
+        raw_cpu_write(rcu_sched_qs_mask, 0);
+
+        /* Find the flavor that needs a quiescent state. */
+        for_each_rcu_flavor(rsp) {
+                rdp = raw_cpu_ptr(rsp->rda);
+                if (!(resched_mask & rsp->flavor_mask))
+                        continue;
+                smp_mb(); /* rcu_sched_qs_mask before cond_resched_completed. */
+                if (ACCESS_ONCE(rdp->mynode->completed) !=
+                    ACCESS_ONCE(rdp->cond_resched_completed))
+                        continue;
+
+                /*
+                 * Pretend to be momentarily idle for the quiescent state.
+                 * This allows the grace-period kthread to record the
+                 * quiescent state, with no need for this CPU to do anything
+                 * further.
+                 */
+                rdtp = this_cpu_ptr(&rcu_dynticks);
+                smp_mb__before_atomic(); /* Earlier stuff before QS. */
+                atomic_add(2, &rdtp->dynticks);  /* QS. */
+                smp_mb__after_atomic(); /* Later stuff after QS. */
+                break;
+        }
+        local_irq_restore(flags);
+}
+
 /*
  * Note a context switch.  This is a quiescent state for RCU-sched,
  * and requires special handling for preemptible RCU.
@@ -216,19 +280,12 @@ void rcu_note_context_switch(int cpu)
         trace_rcu_utilization(TPS("Start context switch"));
         rcu_sched_qs(cpu);
         rcu_preempt_note_context_switch(cpu);
+        if (unlikely(raw_cpu_read(rcu_sched_qs_mask)))
+                rcu_momentary_dyntick_idle();
         trace_rcu_utilization(TPS("End context switch"));
 }
 EXPORT_SYMBOL_GPL(rcu_note_context_switch);
 
-static DEFINE_PER_CPU(struct rcu_dynticks, rcu_dynticks) = {
-        .dynticks_nesting = DYNTICK_TASK_EXIT_IDLE,
-        .dynticks = ATOMIC_INIT(1),
-#ifdef CONFIG_NO_HZ_FULL_SYSIDLE
-        .dynticks_idle_nesting = DYNTICK_TASK_NEST_VALUE,
-        .dynticks_idle = ATOMIC_INIT(1),
-#endif /* #ifdef CONFIG_NO_HZ_FULL_SYSIDLE */
-};
-
 static long blimit = 10;        /* Maximum callbacks per rcu_do_batch. */
 static long qhimark = 10000;    /* If this many pending, ignore blimit. */
 static long qlowmark = 100;     /* Once only this many pending, use blimit. */
@@ -243,6 +300,13 @@ static ulong jiffies_till_next_fqs = ULONG_MAX;
 module_param(jiffies_till_first_fqs, ulong, 0644);
 module_param(jiffies_till_next_fqs, ulong, 0644);
 
+/*
+ * How long the grace period must be before we start recruiting
+ * quiescent-state help from rcu_note_context_switch().
+ */
+static ulong jiffies_till_sched_qs = HZ / 20;
+module_param(jiffies_till_sched_qs, ulong, 0644);
+
 static bool rcu_start_gp_advanced(struct rcu_state *rsp, struct rcu_node *rnp,
                                   struct rcu_data *rdp);
 static void force_qs_rnp(struct rcu_state *rsp,
@@ -853,6 +917,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp,
                                     bool *isidle, unsigned long *maxj)
 {
         unsigned int curr;
+        int *rcrmp;
         unsigned int snap;
 
         curr = (unsigned int)atomic_add_return(0, &rdp->dynticks->dynticks);
@@ -893,27 +958,43 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp,
         }
 
         /*
-         * There is a possibility that a CPU in adaptive-ticks state
-         * might run in the kernel with the scheduling-clock tick disabled
-         * for an extended time period.  Invoke rcu_kick_nohz_cpu() to
-         * force the CPU to restart the scheduling-clock tick in this
-         * CPU is in this state.
-         */
-        rcu_kick_nohz_cpu(rdp->cpu);
-
-        /*
-         * Alternatively, the CPU might be running in the kernel
-         * for an extended period of time without a quiescent state.
-         * Attempt to force the CPU through the scheduler to gain the
-         * needed quiescent state, but only if the grace period has gone
-         * on for an uncommonly long time.  If there are many stuck CPUs,
-         * we will beat on the first one until it gets unstuck, then move
-         * to the next.  Only do this for the primary flavor of RCU.
+         * A CPU running for an extended time within the kernel can
+         * delay RCU grace periods.  When the CPU is in NO_HZ_FULL mode,
+         * even context-switching back and forth between a pair of
+         * in-kernel CPU-bound tasks cannot advance grace periods.
+         * So if the grace period is old enough, make the CPU pay attention.
+         * Note that the unsynchronized assignments to the per-CPU
+         * rcu_sched_qs_mask variable are safe.  Yes, setting of
+         * bits can be lost, but they will be set again on the next
+         * force-quiescent-state pass.  So lost bit sets do not result
+         * in incorrect behavior, merely in a grace period lasting
+         * a few jiffies longer than it might otherwise.  Because
+         * there are at most four threads involved, and because the
+         * updates are only once every few jiffies, the probability of
+         * lossage (and thus of slight grace-period extension) is
+         * quite low.
+         *
+         * Note that if the jiffies_till_sched_qs boot/sysfs parameter
+         * is set too high, we override with half of the RCU CPU stall
+         * warning delay.
          */
-        if (rdp->rsp == rcu_state_p &&
+        rcrmp = &per_cpu(rcu_sched_qs_mask, rdp->cpu);
+        if (ULONG_CMP_GE(jiffies,
+                         rdp->rsp->gp_start + jiffies_till_sched_qs) ||
             ULONG_CMP_GE(jiffies, rdp->rsp->jiffies_resched)) {
-                rdp->rsp->jiffies_resched += 5;
-                resched_cpu(rdp->cpu);
+                if (!(ACCESS_ONCE(*rcrmp) & rdp->rsp->flavor_mask)) {
+                        ACCESS_ONCE(rdp->cond_resched_completed) =
+                                ACCESS_ONCE(rdp->mynode->completed);
+                        smp_mb(); /* ->cond_resched_completed before *rcrmp. */
+                        ACCESS_ONCE(*rcrmp) =
+                                ACCESS_ONCE(*rcrmp) + rdp->rsp->flavor_mask;
+                        resched_cpu(rdp->cpu);  /* Force CPU into scheduler. */
+                        rdp->rsp->jiffies_resched += 5; /* Enable beating. */
+                } else if (ULONG_CMP_GE(jiffies, rdp->rsp->jiffies_resched)) {
+                        /* Time to beat on that CPU again! */
+                        resched_cpu(rdp->cpu);  /* Force CPU into scheduler. */
+                        rdp->rsp->jiffies_resched += 5; /* Re-enable beating. */
+                }
         }
 
         return 0;
@@ -3491,6 +3572,7 @@ static void __init rcu_init_one(struct rcu_state *rsp,
                                "rcu_node_fqs_1",
                                "rcu_node_fqs_2",
                                "rcu_node_fqs_3" };  /* Match MAX_RCU_LVLS */
+        static u8 fl_mask = 0x1;
         int cpustride = 1;
         int i;
         int j;
@@ -3509,6 +3591,8 @@ static void __init rcu_init_one(struct rcu_state *rsp,
         for (i = 1; i < rcu_num_lvls; i++)
                 rsp->level[i] = rsp->level[i - 1] + rsp->levelcnt[i - 1];
         rcu_init_levelspread(rsp);
+        rsp->flavor_mask = fl_mask;
+        fl_mask <<= 1;
 
         /* Initialize the elements themselves, starting from the leaves. */
 
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index bf2c1e669691..0f69a79c5b7d 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -307,6 +307,9 @@ struct rcu_data {
         /* 4) reasons this CPU needed to be kicked by force_quiescent_state */
         unsigned long dynticks_fqs;     /* Kicked due to dynticks idle. */
         unsigned long offline_fqs;      /* Kicked due to being offline. */
+        unsigned long cond_resched_completed;
+                                        /* Grace period that needs help */
+                                        /*  from cond_resched(). */
 
         /* 5) __rcu_pending() statistics. */
         unsigned long n_rcu_pending;    /* rcu_pending() calls since boot. */
@@ -392,6 +395,7 @@ struct rcu_state {
         struct rcu_node *level[RCU_NUM_LVLS];   /* Hierarchy levels. */
         u32 levelcnt[MAX_RCU_LVLS + 1];         /* # nodes in each level. */
         u8 levelspread[RCU_NUM_LVLS];           /* kids/node in each level. */
+        u8 flavor_mask;                         /* bit in flavor mask. */
         struct rcu_data __percpu *rda;          /* pointer of percu rcu_data. */
         void (*call)(struct rcu_head *head,     /* call_rcu() flavor. */
                      void (*func)(struct rcu_head *head));
@@ -563,7 +567,7 @@ static bool rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp);
 static void do_nocb_deferred_wakeup(struct rcu_data *rdp);
 static void rcu_boot_init_nocb_percpu_data(struct rcu_data *rdp);
 static void rcu_spawn_nocb_kthreads(struct rcu_state *rsp);
-static void rcu_kick_nohz_cpu(int cpu);
+static void __maybe_unused rcu_kick_nohz_cpu(int cpu);
 static bool init_nocb_callback_list(struct rcu_data *rdp);
 static void rcu_sysidle_enter(struct rcu_dynticks *rdtp, int irq);
 static void rcu_sysidle_exit(struct rcu_dynticks *rdtp, int irq);
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index cbc2c45265e2..02ac0fb186b8 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2404,7 +2404,7 @@ static bool init_nocb_callback_list(struct rcu_data *rdp)
  * if an adaptive-ticks CPU is failing to respond to the current grace
  * period and has not be idle from an RCU perspective, kick it.
  */
-static void rcu_kick_nohz_cpu(int cpu)
+static void __maybe_unused rcu_kick_nohz_cpu(int cpu)
 {
 #ifdef CONFIG_NO_HZ_FULL
         if (tick_nohz_full_cpu(cpu))
diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
index a2aeb4df0f60..bc7883570530 100644
--- a/kernel/rcu/update.c
+++ b/kernel/rcu/update.c
@@ -200,12 +200,12 @@ void wait_rcu_gp(call_rcu_func_t crf)
 EXPORT_SYMBOL_GPL(wait_rcu_gp);
 
 #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD
-static inline void debug_init_rcu_head(struct rcu_head *head)
+void init_rcu_head(struct rcu_head *head)
 {
         debug_object_init(head, &rcuhead_debug_descr);
 }
 
-static inline void debug_rcu_head_free(struct rcu_head *head)
+void destroy_rcu_head(struct rcu_head *head)
 {
         debug_object_free(head, &rcuhead_debug_descr);
 }
@@ -350,21 +350,3 @@ static int __init check_cpu_stall_init(void)
 early_initcall(check_cpu_stall_init);
 
 #endif /* #ifdef CONFIG_RCU_STALL_COMMON */
-
-/*
- * Hooks for cond_resched() and friends to avoid RCU CPU stall warnings.
- */
-
-DEFINE_PER_CPU(int, rcu_cond_resched_count);
-
-/*
- * Report a set of RCU quiescent states, for use by cond_resched()
- * and friends.  Out of line due to being called infrequently.
- */
-void rcu_resched(void)
-{
-        preempt_disable();
-        __this_cpu_write(rcu_cond_resched_count, 0);
-        rcu_note_context_switch(smp_processor_id());
-        preempt_enable();
-}
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 3bdf01b494fe..bc1638b33449 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4147,7 +4147,6 @@ static void __cond_resched(void)
 
 int __sched _cond_resched(void)
 {
-        rcu_cond_resched();
         if (should_resched()) {
                 __cond_resched();
                 return 1;
@@ -4166,18 +4165,15 @@ EXPORT_SYMBOL(_cond_resched);
  */
 int __cond_resched_lock(spinlock_t *lock)
 {
-        bool need_rcu_resched = rcu_should_resched();
         int resched = should_resched();
         int ret = 0;
 
         lockdep_assert_held(lock);
 
-        if (spin_needbreak(lock) || resched || need_rcu_resched) {
+        if (spin_needbreak(lock) || resched) {
                 spin_unlock(lock);
                 if (resched)
                         __cond_resched();
-                else if (unlikely(need_rcu_resched))
-                        rcu_resched();
                 else
                         cpu_relax();
                 ret = 1;
@@ -4191,7 +4187,6 @@ int __sched __cond_resched_softirq(void)
 {
         BUG_ON(!in_softirq());
 
-        rcu_cond_resched();  /* BH disabled OK, just recording QSes. */
         if (should_resched()) {
                 local_bh_enable();
                 __cond_resched();
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 695f9773bb60..627b3c34b821 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -608,7 +608,7 @@ void proc_sched_show_task(struct task_struct *p, struct seq_file *m)
 
                 avg_atom = p->se.sum_exec_runtime;
                 if (nr_switches)
-                        do_div(avg_atom, nr_switches);
+                        avg_atom = div64_ul(avg_atom, nr_switches);
                 else
                         avg_atom = -1LL;
 
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 88c9c65a430d..fe75444ae7ec 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -585,9 +585,14 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
                                 struct itimerspec *new_setting,
                                 struct itimerspec *old_setting)
 {
+        ktime_t exp;
+
         if (!rtcdev)
                 return -ENOTSUPP;
 
+        if (flags & ~TIMER_ABSTIME)
+                return -EINVAL;
+
         if (old_setting)
                 alarm_timer_get(timr, old_setting);
 
@@ -597,8 +602,16 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
 
         /* start the timer */
         timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval);
-        alarm_start(&timr->it.alarm.alarmtimer,
-                        timespec_to_ktime(new_setting->it_value));
+        exp = timespec_to_ktime(new_setting->it_value);
+        /* Convert (if necessary) to absolute time */
+        if (flags != TIMER_ABSTIME) {
+                ktime_t now;
+
+                now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
+                exp = ktime_add(now, exp);
+        }
+
+        alarm_start(&timr->it.alarm.alarmtimer, exp);
         return 0;
 }
 
@@ -730,6 +743,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
         if (!alarmtimer_get_rtcdev())
                 return -ENOTSUPP;
 
+        if (flags & ~TIMER_ABSTIME)
+                return -EINVAL;
+
         if (!capable(CAP_WAKE_ALARM))
                 return -EPERM;
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 5b372e3ed675..ac9d1dad630b 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -265,12 +265,12 @@ static void update_ftrace_function(void)
                 func = ftrace_ops_list_func;
         }
 
+        update_function_graph_func();
+
         /* If there's no change, then do nothing more here */
         if (ftrace_trace_function == func)
                 return;
 
-        update_function_graph_func();
-
         /*
          * If we are using the list function, it doesn't care
          * about the function_trace_ops.
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 7c56c3d06943..ff7027199a9a 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -616,10 +616,6 @@ int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
         struct ring_buffer_per_cpu *cpu_buffer;
         struct rb_irq_work *work;
 
-        if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) ||
-            (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu)))
-                return POLLIN | POLLRDNORM;
-
         if (cpu == RING_BUFFER_ALL_CPUS)
                 work = &buffer->irq_work;
         else {
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index f243444a3772..291397e66669 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -466,6 +466,12 @@ int __trace_puts(unsigned long ip, const char *str, int size)
         struct print_entry *entry;
         unsigned long irq_flags;
         int alloc;
+        int pc;
+
+        if (!(trace_flags & TRACE_ITER_PRINTK))
+                return 0;
+
+        pc = preempt_count();
 
         if (unlikely(tracing_selftest_running || tracing_disabled))
                 return 0;
@@ -475,7 +481,7 @@ int __trace_puts(unsigned long ip, const char *str, int size)
         local_save_flags(irq_flags);
         buffer = global_trace.trace_buffer.buffer;
         event = trace_buffer_lock_reserve(buffer, TRACE_PRINT, alloc, 
-                                          irq_flags, preempt_count());
+                                          irq_flags, pc);
         if (!event)
                 return 0;
 
@@ -492,6 +498,7 @@ int __trace_puts(unsigned long ip, const char *str, int size)
                 entry->buf[size] = '\0';
 
         __buffer_unlock_commit(buffer, event);
+        ftrace_trace_stack(buffer, irq_flags, 4, pc);
 
         return size;
 }
@@ -509,6 +516,12 @@ int __trace_bputs(unsigned long ip, const char *str)
         struct bputs_entry *entry;
         unsigned long irq_flags;
         int size = sizeof(struct bputs_entry);
+        int pc;
+
+        if (!(trace_flags & TRACE_ITER_PRINTK))
+                return 0;
+
+        pc = preempt_count();
 
         if (unlikely(tracing_selftest_running || tracing_disabled))
                 return 0;
@@ -516,7 +529,7 @@ int __trace_bputs(unsigned long ip, const char *str)
         local_save_flags(irq_flags);
         buffer = global_trace.trace_buffer.buffer;
         event = trace_buffer_lock_reserve(buffer, TRACE_BPUTS, size,
-                                          irq_flags, preempt_count());
+                                          irq_flags, pc);
         if (!event)
                 return 0;
 
@@ -525,6 +538,7 @@ int __trace_bputs(unsigned long ip, const char *str)
         entry->str                      = str;
 
         __buffer_unlock_commit(buffer, event);
+        ftrace_trace_stack(buffer, irq_flags, 4, pc);
 
         return 1;
 }
@@ -809,7 +823,7 @@ static struct {
         { trace_clock_local,    "local",        1 },
         { trace_clock_global,   "global",       1 },
         { trace_clock_counter,  "counter",      0 },
-        { trace_clock_jiffies,  "uptime",       1 },
+        { trace_clock_jiffies,  "uptime",       0 },
         { trace_clock,          "perf",         1 },
         ARCH_TRACE_CLOCKS
 };
diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
index 26dc348332b7..57b67b1f24d1 100644
--- a/kernel/trace/trace_clock.c
+++ b/kernel/trace/trace_clock.c
@@ -59,13 +59,14 @@ u64 notrace trace_clock(void)
 
 /*
  * trace_jiffy_clock(): Simply use jiffies as a clock counter.
+ * Note that this use of jiffies_64 is not completely safe on
+ * 32-bit systems. But the window is tiny, and the effect if
+ * we are affected is that we will have an obviously bogus
+ * timestamp on a trace event - i.e. not life threatening.
  */
 u64 notrace trace_clock_jiffies(void)
 {
-        u64 jiffy = jiffies - INITIAL_JIFFIES;
-
-        /* Return nsecs */
-        return (u64)jiffies_to_usecs(jiffy) * 1000ULL;
+        return jiffies_64_to_clock_t(jiffies_64 - INITIAL_JIFFIES);
 }
 
 /*
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index f99e0b3bca8c..2de53628689f 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -470,6 +470,7 @@ static void remove_event_file_dir(struct ftrace_event_file *file)
 
         list_del(&file->list);
         remove_subsystem(file->system);
+        free_event_filter(file->filter);
         kmem_cache_free(file_cachep, file);
 }
 
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 6f0d9ec37950..a957c8140721 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -800,11 +800,6 @@ static int batadv_check_claim_group(struct batadv_priv *bat_priv,
         bla_dst = (struct batadv_bla_claim_dst *)hw_dst;
         bla_dst_own = &bat_priv->bla.claim_dest;
 
-        /* check if it is a claim packet in general */
-        if (memcmp(bla_dst->magic, bla_dst_own->magic,
-                   sizeof(bla_dst->magic)) != 0)
-                return 0;
-
         /* if announcement packet, use the source,
          * otherwise assume it is in the hw_src
          */
@@ -866,12 +861,13 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
                                     struct batadv_hard_iface *primary_if,
                                     struct sk_buff *skb)
 {
-        struct batadv_bla_claim_dst *bla_dst;
+        struct batadv_bla_claim_dst *bla_dst, *bla_dst_own;
         uint8_t *hw_src, *hw_dst;
-        struct vlan_ethhdr *vhdr;
+        struct vlan_hdr *vhdr, vhdr_buf;
         struct ethhdr *ethhdr;
         struct arphdr *arphdr;
         unsigned short vid;
+        int vlan_depth = 0;
         __be16 proto;
         int headlen;
         int ret;
@@ -882,9 +878,24 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
         proto = ethhdr->h_proto;
         headlen = ETH_HLEN;
         if (vid & BATADV_VLAN_HAS_TAG) {
-                vhdr = vlan_eth_hdr(skb);
-                proto = vhdr->h_vlan_encapsulated_proto;
-                headlen += VLAN_HLEN;
+                /* Traverse the VLAN/Ethertypes.
+                 *
+                 * At this point it is known that the first protocol is a VLAN
+                 * header, so start checking at the encapsulated protocol.
+                 *
+                 * The depth of the VLAN headers is recorded to drop BLA claim
+                 * frames encapsulated into multiple VLAN headers (QinQ).
+                 */
+                do {
+                        vhdr = skb_header_pointer(skb, headlen, VLAN_HLEN,
+                                                  &vhdr_buf);
+                        if (!vhdr)
+                                return 0;
+
+                        proto = vhdr->h_vlan_encapsulated_proto;
+                        headlen += VLAN_HLEN;
+                        vlan_depth++;
+                } while (proto == htons(ETH_P_8021Q));
         }
 
         if (proto != htons(ETH_P_ARP))
@@ -914,6 +925,19 @@ static int batadv_bla_process_claim(struct batadv_priv *bat_priv,
         hw_src = (uint8_t *)arphdr + sizeof(struct arphdr);
         hw_dst = hw_src + ETH_ALEN + 4;
         bla_dst = (struct batadv_bla_claim_dst *)hw_dst;
+        bla_dst_own = &bat_priv->bla.claim_dest;
+
+        /* check if it is a claim frame in general */
+        if (memcmp(bla_dst->magic, bla_dst_own->magic,
+                   sizeof(bla_dst->magic)) != 0)
+                return 0;
+
+        /* check if there is a claim frame encapsulated deeper in (QinQ) and
+         * drop that, as this is not supported by BLA but should also not be
+         * sent via the mesh.
+         */
+        if (vlan_depth > 1)
+                return 1;
 
         /* check if it is a claim frame. */
         ret = batadv_check_claim_group(bat_priv, primary_if, hw_src, hw_dst,
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index d551e6302cf3..e0a723991c54 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -448,10 +448,15 @@ out:
  *  possibly free it
  * @softif_vlan: the vlan object to release
  */
-void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *softif_vlan)
+void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
 {
-        if (atomic_dec_and_test(&softif_vlan->refcount))
-                kfree_rcu(softif_vlan, rcu);
+        if (atomic_dec_and_test(&vlan->refcount)) {
+                spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
+                hlist_del_rcu(&vlan->list);
+                spin_unlock_bh(&vlan->bat_priv->softif_vlan_list_lock);
+
+                kfree_rcu(vlan, rcu);
+        }
 }
 
 /**
@@ -505,6 +510,7 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
         if (!vlan)
                 return -ENOMEM;
 
+        vlan->bat_priv = bat_priv;
         vlan->vid = vid;
         atomic_set(&vlan->refcount, 1);
 
@@ -516,6 +522,10 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
                 return err;
         }
 
+        spin_lock_bh(&bat_priv->softif_vlan_list_lock);
+        hlist_add_head_rcu(&vlan->list, &bat_priv->softif_vlan_list);
+        spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
+
         /* add a new TT local entry. This one will be marked with the NOPURGE
          * flag
          */
@@ -523,10 +533,6 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
                             bat_priv->soft_iface->dev_addr, vid,
                             BATADV_NULL_IFINDEX, BATADV_NO_MARK);
 
-        spin_lock_bh(&bat_priv->softif_vlan_list_lock);
-        hlist_add_head_rcu(&vlan->list, &bat_priv->softif_vlan_list);
-        spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
-
         return 0;
 }
 
@@ -538,18 +544,13 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
 static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
                                        struct batadv_softif_vlan *vlan)
 {
-        spin_lock_bh(&bat_priv->softif_vlan_list_lock);
-        hlist_del_rcu(&vlan->list);
-        spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
-
-        batadv_sysfs_del_vlan(bat_priv, vlan);
-
         /* explicitly remove the associated TT local entry because it is marked
          * with the NOPURGE flag
          */
         batadv_tt_local_remove(bat_priv, bat_priv->soft_iface->dev_addr,
                                vlan->vid, "vlan interface destroyed", false);
 
+        batadv_sysfs_del_vlan(bat_priv, vlan);
         batadv_softif_vlan_free_ref(vlan);
 }
 
@@ -567,6 +568,8 @@ static int batadv_interface_add_vid(struct net_device *dev, __be16 proto,
                                     unsigned short vid)
 {
         struct batadv_priv *bat_priv = netdev_priv(dev);
+        struct batadv_softif_vlan *vlan;
+        int ret;
 
         /* only 802.1Q vlans are supported.
          * batman-adv does not know how to handle other types
@@ -576,7 +579,36 @@ static int batadv_interface_add_vid(struct net_device *dev, __be16 proto,
 
         vid |= BATADV_VLAN_HAS_TAG;
 
-        return batadv_softif_create_vlan(bat_priv, vid);
+        /* if a new vlan is getting created and it already exists, it means that
+         * it was not deleted yet. batadv_softif_vlan_get() increases the
+         * refcount in order to revive the object.
+         *
+         * if it does not exist then create it.
+         */
+        vlan = batadv_softif_vlan_get(bat_priv, vid);
+        if (!vlan)
+                return batadv_softif_create_vlan(bat_priv, vid);
+
+        /* recreate the sysfs object if it was already destroyed (and it should
+         * be since we received a kill_vid() for this vlan
+         */
+        if (!vlan->kobj) {
+                ret = batadv_sysfs_add_vlan(bat_priv->soft_iface, vlan);
+                if (ret) {
+                        batadv_softif_vlan_free_ref(vlan);
+                        return ret;
+                }
+        }
+
+        /* add a new TT local entry. This one will be marked with the NOPURGE
+         * flag. This must be added again, even if the vlan object already
+         * exists, because the entry was deleted by kill_vid()
+         */
+        batadv_tt_local_add(bat_priv->soft_iface,
+                            bat_priv->soft_iface->dev_addr, vid,
+                            BATADV_NULL_IFINDEX, BATADV_NO_MARK);
+
+        return 0;
 }
 
 /**
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index d636bde72c9a..5f59e7f899a0 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -511,6 +511,7 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         struct batadv_tt_local_entry *tt_local;
         struct batadv_tt_global_entry *tt_global = NULL;
+        struct batadv_softif_vlan *vlan;
         struct net_device *in_dev = NULL;
         struct hlist_head *head;
         struct batadv_tt_orig_list_entry *orig_entry;
@@ -572,6 +573,9 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         if (!tt_local)
                 goto out;
 
+        /* increase the refcounter of the related vlan */
+        vlan = batadv_softif_vlan_get(bat_priv, vid);
+
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
                    addr, BATADV_PRINT_VID(vid),
@@ -604,6 +608,7 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         if (unlikely(hash_added != 0)) {
                 /* remove the reference for the hash */
                 batadv_tt_local_entry_free_ref(tt_local);
+                batadv_softif_vlan_free_ref(vlan);
                 goto out;
         }
 
@@ -1009,6 +1014,7 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
 {
         struct batadv_tt_local_entry *tt_local_entry;
         uint16_t flags, curr_flags = BATADV_NO_FLAGS;
+        struct batadv_softif_vlan *vlan;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
         if (!tt_local_entry)
@@ -1039,6 +1045,11 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
         hlist_del_rcu(&tt_local_entry->common.hash_entry);
         batadv_tt_local_entry_free_ref(tt_local_entry);
 
+        /* decrease the reference held for this vlan */
+        vlan = batadv_softif_vlan_get(bat_priv, vid);
+        batadv_softif_vlan_free_ref(vlan);
+        batadv_softif_vlan_free_ref(vlan);
+
 out:
         if (tt_local_entry)
                 batadv_tt_local_entry_free_ref(tt_local_entry);
@@ -1111,6 +1122,7 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
+        struct batadv_softif_vlan *vlan;
         struct hlist_node *node_tmp;
         struct hlist_head *head;
         uint32_t i;
@@ -1131,6 +1143,13 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
                         tt_local = container_of(tt_common_entry,
                                                 struct batadv_tt_local_entry,
                                                 common);
+
+                        /* decrease the reference held for this vlan */
+                        vlan = batadv_softif_vlan_get(bat_priv,
+                                                      tt_common_entry->vid);
+                        batadv_softif_vlan_free_ref(vlan);
+                        batadv_softif_vlan_free_ref(vlan);
+
                         batadv_tt_local_entry_free_ref(tt_local);
                 }
                 spin_unlock_bh(list_lock);
@@ -3139,6 +3158,7 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
         struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_local_entry *tt_local;
+        struct batadv_softif_vlan *vlan;
         struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
@@ -3167,6 +3187,12 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                         tt_local = container_of(tt_common,
                                                 struct batadv_tt_local_entry,
                                                 common);
+
+                        /* decrease the reference held for this vlan */
+                        vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
+                        batadv_softif_vlan_free_ref(vlan);
+                        batadv_softif_vlan_free_ref(vlan);
+
                         batadv_tt_local_entry_free_ref(tt_local);
                 }
                 spin_unlock_bh(list_lock);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 34891a56773f..8854c05622a9 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -687,6 +687,7 @@ struct batadv_priv_nc {
 
 /**
  * struct batadv_softif_vlan - per VLAN attributes set
+ * @bat_priv: pointer to the mesh object
  * @vid: VLAN identifier
  * @kobj: kobject for sysfs vlan subdirectory
  * @ap_isolation: AP isolation state
@@ -696,6 +697,7 @@ struct batadv_priv_nc {
  * @rcu: struct used for freeing in a RCU-safe manner
  */
 struct batadv_softif_vlan {
+        struct batadv_priv *bat_priv;
         unsigned short vid;
         struct kobject *kobj;
         atomic_t ap_isolation;          /* boolean */
diff --git a/net/core/dev.c b/net/core/dev.c
index e52a3788d18d..e1b7cfaccd65 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4106,6 +4106,8 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
+        skb->encapsulation = 0;
+        skb_shinfo(skb)->gso_type = 0;
         skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
 
         napi->skb = skb;
diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
index 9acec61f5433..dd8696a3dbec 100644
--- a/net/dns_resolver/dns_query.c
+++ b/net/dns_resolver/dns_query.c
@@ -150,7 +150,7 @@ int dns_query(const char *type, const char *name, size_t namelen,
                 goto put;
 
         memcpy(*_result, upayload->data, len);
-        *_result[len] = '\0';
+        (*_result)[len] = '\0';
 
         if (_expiry)
                 *_expiry = rkey->expiry;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index d5e6836cf772..d156b3c5f363 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1429,6 +1429,9 @@ static int inet_gro_complete(struct sk_buff *skb, int nhoff)
         int proto = iph->protocol;
         int err = -ENOSYS;
 
+        if (skb->encapsulation)
+                skb_set_inner_network_header(skb, nhoff);
+
         csum_replace2(&iph->check, iph->tot_len, newlen);
         iph->tot_len = newlen;
 
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index eb92deb12666..f0bdd47bbbcb 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -263,6 +263,9 @@ static int gre_gro_complete(struct sk_buff *skb, int nhoff)
         int err = -ENOENT;
         __be16 type;
 
+        skb->encapsulation = 1;
+        skb_shinfo(skb)->gso_type = SKB_GSO_GRE;
+
         type = greh->protocol;
         if (greh->flags & GRE_KEY)
                 grehlen += GRE_HEADER_SECTION;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 5e7aecea05cd..ad382499bace 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -288,6 +288,10 @@ int ip_options_compile(struct net *net,
                         optptr++;
                         continue;
                 }
+                if (unlikely(l < 2)) {
+                        pp_ptr = optptr;
+                        goto error;
+                }
                 optlen = optptr[1];
                 if (optlen < 2 || optlen > l) {
                         pp_ptr = optptr;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 4e86c59ec7f7..55046ecd083e 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -309,7 +309,7 @@ static int tcp4_gro_complete(struct sk_buff *skb, int thoff)
 
         th->check = ~tcp_v4_check(skb->len - thoff, iph->saddr,
                                   iph->daddr, 0);
-        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+        skb_shinfo(skb)->gso_type |= SKB_GSO_TCPV4;
 
         return tcp_gro_complete(skb);
 }
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index 8517d3cd1aed..01b0ff9a0c2c 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -73,7 +73,7 @@ static int tcp6_gro_complete(struct sk_buff *skb, int thoff)
 
         th->check = ~tcp_v6_check(skb->len - thoff, &iph->saddr,
                                   &iph->daddr, 0);
-        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+        skb_shinfo(skb)->gso_type |= SKB_GSO_TCPV6;
 
         return tcp_gro_complete(skb);
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ab4566cfcbe4..8746ff9a8357 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -35,7 +35,7 @@ int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
 {
         INIT_LIST_HEAD(&afi->tables);
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_add_tail(&afi->list, &net->nft.af_info);
+        list_add_tail_rcu(&afi->list, &net->nft.af_info);
         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
         return 0;
 }
@@ -51,7 +51,7 @@ EXPORT_SYMBOL_GPL(nft_register_afinfo);
 void nft_unregister_afinfo(struct nft_af_info *afi)
 {
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_del(&afi->list);
+        list_del_rcu(&afi->list);
         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 }
 EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
@@ -277,11 +277,14 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
         struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
 
-        list_for_each_entry(afi, &net->nft.af_info, list) {
+        rcu_read_lock();
+        cb->seq = net->nft.base_seq;
+
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
                 if (family != NFPROTO_UNSPEC && family != afi->family)
                         continue;
 
-                list_for_each_entry(table, &afi->tables, list) {
+                list_for_each_entry_rcu(table, &afi->tables, list) {
                         if (idx < s_idx)
                                 goto cont;
                         if (idx > s_idx)
@@ -294,11 +297,14 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
                                                       NLM_F_MULTI,
                                                       afi->family, table) < 0)
                                 goto done;
+
+                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                         idx++;
                 }
         }
 done:
+        rcu_read_unlock();
         cb->args[0] = idx;
         return skb->len;
 }
@@ -407,6 +413,9 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
         if (flags & ~NFT_TABLE_F_DORMANT)
                 return -EINVAL;
 
+        if (flags == ctx->table->flags)
+                return 0;
+
         trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
                                 sizeof(struct nft_trans_table));
         if (trans == NULL)
@@ -514,7 +523,7 @@ static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
                 module_put(afi->owner);
                 return err;
         }
-        list_add_tail(&table->list, &afi->tables);
+        list_add_tail_rcu(&table->list, &afi->tables);
         return 0;
 }
 
@@ -546,7 +555,7 @@ static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        list_del(&table->list);
+        list_del_rcu(&table->list);
         return 0;
 }
 
@@ -635,13 +644,20 @@ static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
 {
         struct nft_stats *cpu_stats, total;
         struct nlattr *nest;
+        unsigned int seq;
+        u64 pkts, bytes;
         int cpu;
 
         memset(&total, 0, sizeof(total));
         for_each_possible_cpu(cpu) {
                 cpu_stats = per_cpu_ptr(stats, cpu);
-                total.pkts += cpu_stats->pkts;
-                total.bytes += cpu_stats->bytes;
+                do {
+                        seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
+                        pkts = cpu_stats->pkts;
+                        bytes = cpu_stats->bytes;
+                } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
+                total.pkts += pkts;
+                total.bytes += bytes;
         }
         nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
         if (nest == NULL)
@@ -761,12 +777,15 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
         struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
 
-        list_for_each_entry(afi, &net->nft.af_info, list) {
+        rcu_read_lock();
+        cb->seq = net->nft.base_seq;
+
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
                 if (family != NFPROTO_UNSPEC && family != afi->family)
                         continue;
 
-                list_for_each_entry(table, &afi->tables, list) {
-                        list_for_each_entry(chain, &table->chains, list) {
+                list_for_each_entry_rcu(table, &afi->tables, list) {
+                        list_for_each_entry_rcu(chain, &table->chains, list) {
                                 if (idx < s_idx)
                                         goto cont;
                                 if (idx > s_idx)
@@ -778,17 +797,19 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
                                                               NLM_F_MULTI,
                                                               afi->family, table, chain) < 0)
                                         goto done;
+
+                                nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                                 idx++;
                         }
                 }
         }
 done:
+        rcu_read_unlock();
         cb->args[0] = idx;
         return skb->len;
 }
 
-
 static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb,
                               const struct nlmsghdr *nlh,
                               const struct nlattr * const nla[])
@@ -861,7 +882,7 @@ static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
         if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
                 return ERR_PTR(-EINVAL);
 
-        newstats = alloc_percpu(struct nft_stats);
+        newstats = netdev_alloc_pcpu_stats(struct nft_stats);
         if (newstats == NULL)
                 return ERR_PTR(-ENOMEM);
 
@@ -1077,7 +1098,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                         }
                         basechain->stats = stats;
                 } else {
-                        stats = alloc_percpu(struct nft_stats);
+                        stats = netdev_alloc_pcpu_stats(struct nft_stats);
                         if (IS_ERR(stats)) {
                                 module_put(type->owner);
                                 kfree(basechain);
@@ -1130,7 +1151,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
                 goto err2;
 
         table->use++;
-        list_add_tail(&chain->list, &table->chains);
+        list_add_tail_rcu(&chain->list, &table->chains);
         return 0;
 err2:
         if (!(table->flags & NFT_TABLE_F_DORMANT) &&
@@ -1180,7 +1201,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
                 return err;
 
         table->use--;
-        list_del(&chain->list);
+        list_del_rcu(&chain->list);
         return 0;
 }
 
@@ -1199,9 +1220,9 @@ int nft_register_expr(struct nft_expr_type *type)
 {
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
         if (type->family == NFPROTO_UNSPEC)
-                list_add_tail(&type->list, &nf_tables_expressions);
+                list_add_tail_rcu(&type->list, &nf_tables_expressions);
         else
-                list_add(&type->list, &nf_tables_expressions);
+                list_add_rcu(&type->list, &nf_tables_expressions);
         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
         return 0;
 }
@@ -1216,7 +1237,7 @@ EXPORT_SYMBOL_GPL(nft_register_expr);
 void nft_unregister_expr(struct nft_expr_type *type)
 {
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_del(&type->list);
+        list_del_rcu(&type->list);
         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 }
 EXPORT_SYMBOL_GPL(nft_unregister_expr);
@@ -1549,16 +1570,17 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
         unsigned int idx = 0, s_idx = cb->args[0];
         struct net *net = sock_net(skb->sk);
         int family = nfmsg->nfgen_family;
-        u8 genctr = ACCESS_ONCE(net->nft.genctr);
-        u8 gencursor = ACCESS_ONCE(net->nft.gencursor);
 
-        list_for_each_entry(afi, &net->nft.af_info, list) {
+        rcu_read_lock();
+        cb->seq = net->nft.base_seq;
+
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
                 if (family != NFPROTO_UNSPEC && family != afi->family)
                         continue;
 
-                list_for_each_entry(table, &afi->tables, list) {
-                        list_for_each_entry(chain, &table->chains, list) {
-                                list_for_each_entry(rule, &chain->rules, list) {
+                list_for_each_entry_rcu(table, &afi->tables, list) {
+                        list_for_each_entry_rcu(chain, &table->chains, list) {
+                                list_for_each_entry_rcu(rule, &chain->rules, list) {
                                         if (!nft_rule_is_active(net, rule))
                                                 goto cont;
                                         if (idx < s_idx)
@@ -1572,6 +1594,8 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
                                                                       NLM_F_MULTI | NLM_F_APPEND,
                                                                       afi->family, table, chain, rule) < 0)
                                                 goto done;
+
+                                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                                         idx++;
                                 }
@@ -1579,9 +1603,7 @@ cont:
                 }
         }
 done:
-        /* Invalidate this dump, a transition to the new generation happened */
-        if (gencursor != net->nft.gencursor || genctr != net->nft.genctr)
-                return -EBUSY;
+        rcu_read_unlock();
 
         cb->args[0] = idx;
         return skb->len;
@@ -1932,7 +1954,7 @@ static LIST_HEAD(nf_tables_set_ops);
 int nft_register_set(struct nft_set_ops *ops)
 {
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_add_tail(&ops->list, &nf_tables_set_ops);
+        list_add_tail_rcu(&ops->list, &nf_tables_set_ops);
         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
         return 0;
 }
@@ -1941,7 +1963,7 @@ EXPORT_SYMBOL_GPL(nft_register_set);
 void nft_unregister_set(struct nft_set_ops *ops)
 {
         nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_del(&ops->list);
+        list_del_rcu(&ops->list);
         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 }
 EXPORT_SYMBOL_GPL(nft_unregister_set);
@@ -2234,7 +2256,10 @@ static int nf_tables_dump_sets_table(struct nft_ctx *ctx, struct sk_buff *skb,
         if (cb->args[1])
                 return skb->len;
 
-        list_for_each_entry(set, &ctx->table->sets, list) {
+        rcu_read_lock();
+        cb->seq = ctx->net->nft.base_seq;
+
+        list_for_each_entry_rcu(set, &ctx->table->sets, list) {
                 if (idx < s_idx)
                         goto cont;
                 if (nf_tables_fill_set(skb, ctx, set, NFT_MSG_NEWSET,
@@ -2242,11 +2267,13 @@ static int nf_tables_dump_sets_table(struct nft_ctx *ctx, struct sk_buff *skb,
                         cb->args[0] = idx;
                         goto done;
                 }
+                nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                 idx++;
         }
         cb->args[1] = 1;
 done:
+        rcu_read_unlock();
         return skb->len;
 }
 
@@ -2260,7 +2287,10 @@ static int nf_tables_dump_sets_family(struct nft_ctx *ctx, struct sk_buff *skb,
         if (cb->args[1])
                 return skb->len;
 
-        list_for_each_entry(table, &ctx->afi->tables, list) {
+        rcu_read_lock();
+        cb->seq = ctx->net->nft.base_seq;
+
+        list_for_each_entry_rcu(table, &ctx->afi->tables, list) {
                 if (cur_table) {
                         if (cur_table != table)
                                 continue;
@@ -2269,7 +2299,7 @@ static int nf_tables_dump_sets_family(struct nft_ctx *ctx, struct sk_buff *skb,
                 }
                 ctx->table = table;
                 idx = 0;
-                list_for_each_entry(set, &ctx->table->sets, list) {
+                list_for_each_entry_rcu(set, &ctx->table->sets, list) {
                         if (idx < s_idx)
                                 goto cont;
                         if (nf_tables_fill_set(skb, ctx, set, NFT_MSG_NEWSET,
@@ -2278,12 +2308,14 @@ static int nf_tables_dump_sets_family(struct nft_ctx *ctx, struct sk_buff *skb,
                                 cb->args[2] = (unsigned long) table;
                                 goto done;
                         }
+                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                         idx++;
                 }
         }
         cb->args[1] = 1;
 done:
+        rcu_read_unlock();
         return skb->len;
 }
 
@@ -2300,7 +2332,10 @@ static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
         if (cb->args[1])
                 return skb->len;
 
-        list_for_each_entry(afi, &net->nft.af_info, list) {
+        rcu_read_lock();
+        cb->seq = net->nft.base_seq;
+
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
                 if (cur_family) {
                         if (afi->family != cur_family)
                                 continue;
@@ -2308,7 +2343,7 @@ static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
                         cur_family = 0;
                 }
 
-                list_for_each_entry(table, &afi->tables, list) {
+                list_for_each_entry_rcu(table, &afi->tables, list) {
                         if (cur_table) {
                                 if (cur_table != table)
                                         continue;
@@ -2319,7 +2354,7 @@ static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
                         ctx->table = table;
                         ctx->afi = afi;
                         idx = 0;
-                        list_for_each_entry(set, &ctx->table->sets, list) {
+                        list_for_each_entry_rcu(set, &ctx->table->sets, list) {
                                 if (idx < s_idx)
                                         goto cont;
                                 if (nf_tables_fill_set(skb, ctx, set,
@@ -2330,6 +2365,7 @@ static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
                                         cb->args[3] = afi->family;
                                         goto done;
                                 }
+                                nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
                                 idx++;
                         }
@@ -2339,6 +2375,7 @@ cont:
         }
         cb->args[1] = 1;
 done:
+        rcu_read_unlock();
         return skb->len;
 }
 
@@ -2597,7 +2634,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
         if (err < 0)
                 goto err2;
 
-        list_add_tail(&set->list, &table->sets);
+        list_add_tail_rcu(&set->list, &table->sets);
         table->use++;
         return 0;
 
@@ -2617,7 +2654,7 @@ static void nft_set_destroy(struct nft_set *set)
 
 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
 {
-        list_del(&set->list);
+        list_del_rcu(&set->list);
         nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
         nft_set_destroy(set);
 }
@@ -2652,7 +2689,7 @@ static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        list_del(&set->list);
+        list_del_rcu(&set->list);
         ctx.table->use--;
         return 0;
 }
@@ -2704,14 +2741,14 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
         }
 bind:
         binding->chain = ctx->chain;
-        list_add_tail(&binding->list, &set->bindings);
+        list_add_tail_rcu(&binding->list, &set->bindings);
         return 0;
 }
 
 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
                           struct nft_set_binding *binding)
 {
-        list_del(&binding->list);
+        list_del_rcu(&binding->list);
 
         if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
             !(set->flags & NFT_SET_INACTIVE))
@@ -3346,7 +3383,7 @@ static int nf_tables_commit(struct sk_buff *skb)
         struct nft_set *set;
 
         /* Bump generation counter, invalidate any dump in progress */
-        net->nft.genctr++;
+        while (++net->nft.base_seq == 0);
 
         /* A new generation has just started */
         net->nft.gencursor = gencursor_next(net);
@@ -3491,12 +3528,12 @@ static int nf_tables_abort(struct sk_buff *skb)
                                 }
                                 nft_trans_destroy(trans);
                         } else {
-                                list_del(&trans->ctx.table->list);
+                                list_del_rcu(&trans->ctx.table->list);
                         }
                         break;
                 case NFT_MSG_DELTABLE:
-                        list_add_tail(&trans->ctx.table->list,
-                                      &trans->ctx.afi->tables);
+                        list_add_tail_rcu(&trans->ctx.table->list,
+                                          &trans->ctx.afi->tables);
                         nft_trans_destroy(trans);
                         break;
                 case NFT_MSG_NEWCHAIN:
@@ -3507,7 +3544,7 @@ static int nf_tables_abort(struct sk_buff *skb)
                                 nft_trans_destroy(trans);
                         } else {
                                 trans->ctx.table->use--;
-                                list_del(&trans->ctx.chain->list);
+                                list_del_rcu(&trans->ctx.chain->list);
                                 if (!(trans->ctx.table->flags & NFT_TABLE_F_DORMANT) &&
                                     trans->ctx.chain->flags & NFT_BASE_CHAIN) {
                                         nf_unregister_hooks(nft_base_chain(trans->ctx.chain)->ops,
@@ -3517,8 +3554,8 @@ static int nf_tables_abort(struct sk_buff *skb)
                         break;
                 case NFT_MSG_DELCHAIN:
                         trans->ctx.table->use++;
-                        list_add_tail(&trans->ctx.chain->list,
-                                      &trans->ctx.table->chains);
+                        list_add_tail_rcu(&trans->ctx.chain->list,
+                                          &trans->ctx.table->chains);
                         nft_trans_destroy(trans);
                         break;
                 case NFT_MSG_NEWRULE:
@@ -3532,12 +3569,12 @@ static int nf_tables_abort(struct sk_buff *skb)
                         break;
                 case NFT_MSG_NEWSET:
                         trans->ctx.table->use--;
-                        list_del(&nft_trans_set(trans)->list);
+                        list_del_rcu(&nft_trans_set(trans)->list);
                         break;
                 case NFT_MSG_DELSET:
                         trans->ctx.table->use++;
-                        list_add_tail(&nft_trans_set(trans)->list,
-                                      &trans->ctx.table->sets);
+                        list_add_tail_rcu(&nft_trans_set(trans)->list,
+                                          &trans->ctx.table->sets);
                         nft_trans_destroy(trans);
                         break;
                 case NFT_MSG_NEWSETELEM:
@@ -3951,6 +3988,7 @@ static int nf_tables_init_net(struct net *net)
 {
         INIT_LIST_HEAD(&net->nft.af_info);
         INIT_LIST_HEAD(&net->nft.commit_list);
+        net->nft.base_seq = 1;
         return 0;
 }
 
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 345acfb1720b..3b90eb2b2c55 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -109,7 +109,7 @@ nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)
         struct nft_data data[NFT_REG_MAX + 1];
         unsigned int stackptr = 0;
         struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
-        struct nft_stats __percpu *stats;
+        struct nft_stats *stats;
         int rulenum;
         /*
          * Cache cursor to avoid problems in case that the cursor is updated
@@ -205,9 +205,11 @@ next_rule:
                 nft_trace_packet(pkt, basechain, -1, NFT_TRACE_POLICY);
 
         rcu_read_lock_bh();
-        stats = rcu_dereference(nft_base_chain(basechain)->stats);
-        __this_cpu_inc(stats->pkts);
-        __this_cpu_add(stats->bytes, pkt->skb->len);
+        stats = this_cpu_ptr(rcu_dereference(nft_base_chain(basechain)->stats));
+        u64_stats_update_begin(&stats->syncp);
+        stats->pkts++;
+        stats->bytes += pkt->skb->len;
+        u64_stats_update_end(&stats->syncp);
         rcu_read_unlock_bh();
 
         return nft_base_chain(basechain)->policy;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index c39b583ace32..70c0be8d0121 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -38,6 +38,7 @@
 #include <linux/errno.h>
 #include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
+#include <linux/bitmap.h>
 #include <net/netlink.h>
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
@@ -460,17 +461,25 @@ static int u32_delete(struct tcf_proto *tp, unsigned long arg)
         return 0;
 }
 
+#define NR_U32_NODE (1<<12)
 static u32 gen_new_kid(struct tc_u_hnode *ht, u32 handle)
 {
         struct tc_u_knode *n;
-        unsigned int i = 0x7FF;
+        unsigned long i;
+        unsigned long *bitmap = kzalloc(BITS_TO_LONGS(NR_U32_NODE) * sizeof(unsigned long),
+                                        GFP_KERNEL);
+        if (!bitmap)
+                return handle | 0xFFF;
 
         for (n = ht->ht[TC_U32_HASH(handle)]; n; n = n->next)
-                if (i < TC_U32_NODE(n->handle))
-                        i = TC_U32_NODE(n->handle);
-        i++;
+                set_bit(TC_U32_NODE(n->handle), bitmap);
 
-        return handle | (i > 0xFFF ? 0xFFF : i);
+        i = find_next_zero_bit(bitmap, NR_U32_NODE, 0x800);
+        if (i >= NR_U32_NODE)
+                i = find_next_zero_bit(bitmap, NR_U32_NODE, 1);
+
+        kfree(bitmap);
+        return handle | (i >= NR_U32_NODE ? 0xFFF : i);
 }
 
 static const struct nla_policy u32_policy[TCA_U32_MAX + 1] = {
diff --git a/tools/lib/lockdep/include/liblockdep/mutex.h b/tools/lib/lockdep/include/liblockdep/mutex.h
index c342f7087147..ee53a42818ca 100644
--- a/tools/lib/lockdep/include/liblockdep/mutex.h
+++ b/tools/lib/lockdep/include/liblockdep/mutex.h
@@ -35,7 +35,7 @@ static inline int __mutex_init(liblockdep_pthread_mutex_t *lock,
 
 static inline int liblockdep_pthread_mutex_lock(liblockdep_pthread_mutex_t *lock)
 {
-        lock_acquire(&lock->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&lock->dep_map, 0, 0, 0, 1, NULL, (unsigned long)_RET_IP_);
         return pthread_mutex_lock(&lock->mutex);
 }
 
@@ -47,7 +47,7 @@ static inline int liblockdep_pthread_mutex_unlock(liblockdep_pthread_mutex_t *lo
 
 static inline int liblockdep_pthread_mutex_trylock(liblockdep_pthread_mutex_t *lock)
 {
-        lock_acquire(&lock->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&lock->dep_map, 0, 1, 0, 1, NULL, (unsigned long)_RET_IP_);
         return pthread_mutex_trylock(&lock->mutex) == 0 ? 1 : 0;
 }
 
diff --git a/tools/lib/lockdep/include/liblockdep/rwlock.h b/tools/lib/lockdep/include/liblockdep/rwlock.h
index a680ab8c2e36..4ec03f861551 100644
--- a/tools/lib/lockdep/include/liblockdep/rwlock.h
+++ b/tools/lib/lockdep/include/liblockdep/rwlock.h
@@ -36,7 +36,7 @@ static inline int __rwlock_init(liblockdep_pthread_rwlock_t *lock,
 
 static inline int liblockdep_pthread_rwlock_rdlock(liblockdep_pthread_rwlock_t *lock)
 {
-        lock_acquire(&lock->dep_map, 0, 0, 2, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&lock->dep_map, 0, 0, 2, 1, NULL, (unsigned long)_RET_IP_);
         return pthread_rwlock_rdlock(&lock->rwlock);
 
 }
@@ -49,19 +49,19 @@ static inline int liblockdep_pthread_rwlock_unlock(liblockdep_pthread_rwlock_t *
 
 static inline int liblockdep_pthread_rwlock_wrlock(liblockdep_pthread_rwlock_t *lock)
 {
-        lock_acquire(&lock->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&lock->dep_map, 0, 0, 0, 1, NULL, (unsigned long)_RET_IP_);
         return pthread_rwlock_wrlock(&lock->rwlock);
 }
 
 static inline int liblockdep_pthread_rwlock_tryrdlock(liblockdep_pthread_rwlock_t *lock)
 {
-        lock_acquire(&lock->dep_map, 0, 1, 2, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&lock->dep_map, 0, 1, 2, 1, NULL, (unsigned long)_RET_IP_);
         return pthread_rwlock_tryrdlock(&lock->rwlock) == 0 ? 1 : 0;
 }
 
 static inline int liblockdep_pthread_rwlock_trywlock(liblockdep_pthread_rwlock_t *lock)
 {
-        lock_acquire(&lock->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&lock->dep_map, 0, 1, 0, 1, NULL, (unsigned long)_RET_IP_);
         return pthread_rwlock_trywlock(&lock->rwlock) == 0 ? 1 : 0;
 }
 
diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
index 23bd69cb5ade..6f803609e498 100644
--- a/tools/lib/lockdep/preload.c
+++ b/tools/lib/lockdep/preload.c
@@ -92,7 +92,7 @@ enum { none, prepare, done, } __init_state;
 static void init_preload(void);
 static void try_init_preload(void)
 {
-        if (!__init_state != done)
+        if (__init_state != done)
                 init_preload();
 }
 
@@ -252,7 +252,7 @@ int pthread_mutex_lock(pthread_mutex_t *mutex)
 
         try_init_preload();
 
-        lock_acquire(&__get_lock(mutex)->dep_map, 0, 0, 0, 2, NULL,
+        lock_acquire(&__get_lock(mutex)->dep_map, 0, 0, 0, 1, NULL,
                         (unsigned long)_RET_IP_);
         /*
          * Here's the thing with pthread mutexes: unlike the kernel variant,
@@ -281,7 +281,7 @@ int pthread_mutex_trylock(pthread_mutex_t *mutex)
 
         try_init_preload();
 
-        lock_acquire(&__get_lock(mutex)->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&__get_lock(mutex)->dep_map, 0, 1, 0, 1, NULL, (unsigned long)_RET_IP_);
         r = ll_pthread_mutex_trylock(mutex);
         if (r)
                 lock_release(&__get_lock(mutex)->dep_map, 0, (unsigned long)_RET_IP_);
@@ -303,7 +303,7 @@ int pthread_mutex_unlock(pthread_mutex_t *mutex)
          */
         r = ll_pthread_mutex_unlock(mutex);
         if (r)
-                lock_acquire(&__get_lock(mutex)->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+                lock_acquire(&__get_lock(mutex)->dep_map, 0, 0, 0, 1, NULL, (unsigned long)_RET_IP_);
 
         return r;
 }
@@ -352,7 +352,7 @@ int pthread_rwlock_rdlock(pthread_rwlock_t *rwlock)
 
         init_preload();
 
-        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 2, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 2, 1, NULL, (unsigned long)_RET_IP_);
         r = ll_pthread_rwlock_rdlock(rwlock);
         if (r)
                 lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
@@ -366,7 +366,7 @@ int pthread_rwlock_tryrdlock(pthread_rwlock_t *rwlock)
 
         init_preload();
 
-        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 1, 2, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 1, 2, 1, NULL, (unsigned long)_RET_IP_);
         r = ll_pthread_rwlock_tryrdlock(rwlock);
         if (r)
                 lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
@@ -380,7 +380,7 @@ int pthread_rwlock_trywrlock(pthread_rwlock_t *rwlock)
 
         init_preload();
 
-        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 1, 0, 1, NULL, (unsigned long)_RET_IP_);
         r = ll_pthread_rwlock_trywrlock(rwlock);
         if (r)
                 lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
@@ -394,7 +394,7 @@ int pthread_rwlock_wrlock(pthread_rwlock_t *rwlock)
 
         init_preload();
 
-        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 0, 1, NULL, (unsigned long)_RET_IP_);
         r = ll_pthread_rwlock_wrlock(rwlock);
         if (r)
                 lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
@@ -411,7 +411,7 @@ int pthread_rwlock_unlock(pthread_rwlock_t *rwlock)
         lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
         r = ll_pthread_rwlock_unlock(rwlock);
         if (r)
-                lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+                lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 0, 1, NULL, (unsigned long)_RET_IP_);
 
         return r;
 }
@@ -439,8 +439,6 @@ __attribute__((constructor)) static void init_preload(void)
         ll_pthread_rwlock_unlock = dlsym(RTLD_NEXT, "pthread_rwlock_unlock");
 #endif
 
-        printf("%p\n", ll_pthread_mutex_trylock);fflush(stdout);
-
         lockdep_init();
 
         __init_state = done;