553 files changed, 5639 insertions, 3301 deletions

diff --git a/.gitignore b/.gitignore
index 3b8b9b33be38..7e9932e55475 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,7 @@ modules.builtin
 *.bz2
 *.lzma
 *.xz
+*.lz4
 *.lzo
 *.patch
 *.gcno
diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index cbfdf5486639..fe397f90a34f 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -84,7 +84,7 @@ X!Iinclude/linux/kobject.h
 
      <sect1><title>Kernel utility functions</title>
 !Iinclude/linux/kernel.h
-!Ekernel/printk.c
+!Ekernel/printk/printk.c
 !Ekernel/panic.c
 !Ekernel/sys.c
 !Ekernel/rcupdate.c
diff --git a/Documentation/DocBook/media_api.tmpl b/Documentation/DocBook/media_api.tmpl
index 6a8b7158697f..9c92bb879b6d 100644
--- a/Documentation/DocBook/media_api.tmpl
+++ b/Documentation/DocBook/media_api.tmpl
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
-        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+        "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
 <!ENTITY % media-entities SYSTEM "./media-entities.tmpl"> %media-entities;
 <!ENTITY media-indices SYSTEM "./media-indices.tmpl">
 
diff --git a/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt b/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
index a1ee681942cc..6113f9275f42 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-mv64xxx.txt
@@ -4,7 +4,7 @@
 Required properties :
 
  - reg             : Offset and length of the register set for the device
- - compatible      : Should be "marvell,mv64xxx-i2c"
+ - compatible      : Should be "marvell,mv64xxx-i2c" or "allwinner,sun4i-i2c"
  - interrupts      : The interrupt number
 
 Optional properties :
diff --git a/Documentation/devicetree/bindings/regulator/palmas-pmic.txt b/Documentation/devicetree/bindings/regulator/palmas-pmic.txt
index d5a308629c57..30b0581bb1ce 100644
--- a/Documentation/devicetree/bindings/regulator/palmas-pmic.txt
+++ b/Documentation/devicetree/bindings/regulator/palmas-pmic.txt
@@ -31,9 +31,8 @@ Optional nodes:
                Optional sub-node properties:
                ti,warm-reset - maintain voltage during warm reset(boolean)
                ti,roof-floor - control voltage selection by pin(boolean)
-               ti,sleep-mode - mode to adopt in pmic sleep 0 - off, 1 - auto,
+               ti,mode-sleep - mode to adopt in pmic sleep 0 - off, 1 - auto,
                2 - eco, 3 - forced pwm
-               ti,tstep - slope control 0 - Jump, 1 10mV/us, 2 5mV/us, 3 2.5mV/us
                ti,smps-range - OTP has the wrong range set for the hardware so override
                0 - low range, 1 - high range.
 
@@ -59,7 +58,6 @@ pmic {
                         ti,warm-reset;
                         ti,roof-floor;
                         ti,mode-sleep = <0>;
-                        ti,tstep = <0>;
                         ti,smps-range = <1>;
                 };
 
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
index 1c15043aaee4..d569f2a424d5 100644
--- a/Documentation/sysctl/net.txt
+++ b/Documentation/sysctl/net.txt
@@ -52,7 +52,7 @@ Default: 64
 
 busy_read
 ----------------
-Low latency busy poll timeout for socket reads. (needs CONFIG_NET_LL_RX_POLL)
+Low latency busy poll timeout for socket reads. (needs CONFIG_NET_RX_BUSY_POLL)
 Approximate time in us to busy loop waiting for packets on the device queue.
 This sets the default value of the SO_BUSY_POLL socket option.
 Can be set or overridden per socket by setting socket option SO_BUSY_POLL,
@@ -63,7 +63,7 @@ Default: 0 (off)
 
 busy_poll
 ----------------
-Low latency busy poll timeout for poll and select. (needs CONFIG_NET_LL_RX_POLL)
+Low latency busy poll timeout for poll and select. (needs CONFIG_NET_RX_BUSY_POLL)
 Approximate time in us to busy loop waiting for events.
 Recommended value depends on the number of sockets you poll on.
 For several sockets 50, for several hundreds 100.
diff --git a/MAINTAINERS b/MAINTAINERS
index a26b10e52aea..7cacc88dc79c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -965,6 +965,12 @@ M:	Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 
+ARM/TEXAS INSTRUMENT KEYSTONE ARCHITECTURE
+M:      Santosh Shilimkar <santosh.shilimkar@ti.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-keystone/
+
 ARM/LOGICPD PXA270 MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1259,7 +1265,6 @@ F:	drivers/rtc/rtc-coh901331.c
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson.git
 
 ARM/Ux500 ARM ARCHITECTURE
-M:      Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
 M:      Linus Walleij <linus.walleij@linaro.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -1406,7 +1411,7 @@ ATHEROS ATH6KL WIRELESS DRIVER
 M:      Kalle Valo <kvalo@qca.qualcomm.com>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath6kl
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath6kl.git
+T:      git git://github.com/kvalo/ath.git
 S:      Supported
 F:      drivers/net/wireless/ath/ath6kl/
 
@@ -2871,7 +2876,7 @@ F:	drivers/media/usb/dvb-usb-v2/dvb_usb*
 F:      drivers/media/usb/dvb-usb-v2/usb_urb.c
 
 DYNAMIC DEBUG
-M:      Jason Baron <jbaron@redhat.com>
+M:      Jason Baron <jbaron@akamai.com>
 S:      Maintained
 F:      lib/dynamic_debug.c
 F:      include/linux/dynamic_debug.h
@@ -6726,6 +6731,14 @@ T:	git git://linuxtv.org/anttip/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/qt1010*
 
+QUALCOMM ATHEROS ATH10K WIRELESS DRIVER
+M:      Kalle Valo <kvalo@qca.qualcomm.com>
+L:      ath10k@lists.infradead.org
+W:      http://wireless.kernel.org/en/users/Drivers/ath10k
+T:      git git://github.com/kvalo/ath.git
+S:      Supported
+F:      drivers/net/wireless/ath/ath10k/
+
 QUALCOMM HEXAGON ARCHITECTURE
 M:      Richard Kuo <rkuo@codeaurora.org>
 L:      linux-hexagon@vger.kernel.org
@@ -8270,7 +8283,7 @@ S:	Maintained
 F:      sound/soc/codecs/twl4030*
 
 TI WILINK WIRELESS DRIVERS
-M:      Luciano Coelho <coelho@ti.com>
+M:      Luciano Coelho <luca@coelho.fi>
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/wl12xx
 W:      http://wireless.kernel.org/en/users/Drivers/wl1251
@@ -8656,6 +8669,11 @@ T:	git git://git.alsa-project.org/alsa-kernel.git
 S:      Maintained
 F:      sound/usb/midi.*
 
+USB NETWORKING DRIVERS
+L:      linux-usb@vger.kernel.org
+S:      Odd Fixes
+F:      drivers/net/usb/
+
 USB OHCI DRIVER
 M:      Alan Stern <stern@rowland.harvard.edu>
 L:      linux-usb@vger.kernel.org
diff --git a/Makefile b/Makefile
index 95a8e55feceb..f93d4f7a90c2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Linux for Workgroups
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 37c0f4e978d4..43594d5116ef 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -20,7 +20,6 @@ config ARM
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select HARDIRQS_SW_RESEND
-        select HAVE_AOUT
         select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_SECCOMP_FILTER
@@ -218,7 +217,8 @@ config VECTORS_BASE
         default DRAM_BASE if REMAP_VECTORS_TO_RAM
         default 0x00000000
         help
-          The base address of exception vectors.
+          The base address of exception vectors.  This must be two pages
+          in size.
 
 config ARM_PATCH_PHYS_VIRT
         bool "Patch physical to virtual translations at runtime" if EMBEDDED
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index e401a766c0bd..583f4a00ec32 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -804,9 +804,19 @@ config DEBUG_LL_INCLUDE
 
 config DEBUG_UNCOMPRESS
         bool
-        default y if ARCH_MULTIPLATFORM && DEBUG_LL && \
-                     !DEBUG_OMAP2PLUS_UART && \
+        depends on ARCH_MULTIPLATFORM
+        default y if DEBUG_LL && !DEBUG_OMAP2PLUS_UART && \
                      !DEBUG_TEGRA_UART
+        help
+          This option influences the normal decompressor output for
+          multiplatform kernels.  Normally, multiplatform kernels disable
+          decompressor output because it is not possible to know where to
+          send the decompressor output.
+
+          When this option is set, the selected DEBUG_LL output method
+          will be re-used for normal decompressor output on multiplatform
+          kernels.
+          
 
 config UNCOMPRESS_INCLUDE
         string
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index c0ac0f5e5e5c..6fd2ceae305a 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -153,6 +153,7 @@ machine-$(CONFIG_ARCH_DAVINCI)		+= davinci
 machine-$(CONFIG_ARCH_DOVE)             += dove
 machine-$(CONFIG_ARCH_EBSA110)          += ebsa110
 machine-$(CONFIG_ARCH_EP93XX)           += ep93xx
+machine-$(CONFIG_ARCH_EXYNOS)           += exynos
 machine-$(CONFIG_ARCH_GEMINI)           += gemini
 machine-$(CONFIG_ARCH_HIGHBANK)         += highbank
 machine-$(CONFIG_ARCH_INTEGRATOR)       += integrator
@@ -160,15 +161,16 @@ machine-$(CONFIG_ARCH_IOP13XX)		+= iop13xx
 machine-$(CONFIG_ARCH_IOP32X)           += iop32x
 machine-$(CONFIG_ARCH_IOP33X)           += iop33x
 machine-$(CONFIG_ARCH_IXP4XX)           += ixp4xx
+machine-$(CONFIG_ARCH_KEYSTONE)         += keystone
 machine-$(CONFIG_ARCH_KIRKWOOD)         += kirkwood
 machine-$(CONFIG_ARCH_KS8695)           += ks8695
 machine-$(CONFIG_ARCH_LPC32XX)          += lpc32xx
 machine-$(CONFIG_ARCH_MMP)              += mmp
 machine-$(CONFIG_ARCH_MSM)              += msm
 machine-$(CONFIG_ARCH_MV78XX0)          += mv78xx0
+machine-$(CONFIG_ARCH_MVEBU)            += mvebu
 machine-$(CONFIG_ARCH_MXC)              += imx
 machine-$(CONFIG_ARCH_MXS)              += mxs
-machine-$(CONFIG_ARCH_MVEBU)            += mvebu
 machine-$(CONFIG_ARCH_NETX)             += netx
 machine-$(CONFIG_ARCH_NOMADIK)          += nomadik
 machine-$(CONFIG_ARCH_NSPIRE)           += nspire
@@ -176,7 +178,6 @@ machine-$(CONFIG_ARCH_OMAP1)		+= omap1
 machine-$(CONFIG_ARCH_OMAP2PLUS)        += omap2
 machine-$(CONFIG_ARCH_ORION5X)          += orion5x
 machine-$(CONFIG_ARCH_PICOXCELL)        += picoxcell
-machine-$(CONFIG_ARCH_SIRF)             += prima2
 machine-$(CONFIG_ARCH_PXA)              += pxa
 machine-$(CONFIG_ARCH_REALVIEW)         += realview
 machine-$(CONFIG_ARCH_ROCKCHIP)         += rockchip
@@ -186,25 +187,24 @@ machine-$(CONFIG_ARCH_S3C64XX)		+= s3c64xx
 machine-$(CONFIG_ARCH_S5P64X0)          += s5p64x0
 machine-$(CONFIG_ARCH_S5PC100)          += s5pc100
 machine-$(CONFIG_ARCH_S5PV210)          += s5pv210
-machine-$(CONFIG_ARCH_EXYNOS)           += exynos
 machine-$(CONFIG_ARCH_SA1100)           += sa1100
 machine-$(CONFIG_ARCH_SHARK)            += shark
 machine-$(CONFIG_ARCH_SHMOBILE)         += shmobile
+machine-$(CONFIG_ARCH_SIRF)             += prima2
+machine-$(CONFIG_ARCH_SOCFPGA)          += socfpga
+machine-$(CONFIG_ARCH_STI)              += sti
+machine-$(CONFIG_ARCH_SUNXI)            += sunxi
 machine-$(CONFIG_ARCH_TEGRA)            += tegra
 machine-$(CONFIG_ARCH_U300)             += u300
 machine-$(CONFIG_ARCH_U8500)            += ux500
 machine-$(CONFIG_ARCH_VERSATILE)        += versatile
 machine-$(CONFIG_ARCH_VEXPRESS)         += vexpress
+machine-$(CONFIG_ARCH_VIRT)             += virt
 machine-$(CONFIG_ARCH_VT8500)           += vt8500
 machine-$(CONFIG_ARCH_W90X900)          += w90x900
+machine-$(CONFIG_ARCH_ZYNQ)             += zynq
 machine-$(CONFIG_FOOTBRIDGE)            += footbridge
-machine-$(CONFIG_ARCH_SOCFPGA)          += socfpga
 machine-$(CONFIG_PLAT_SPEAR)            += spear
-machine-$(CONFIG_ARCH_STI)              += sti
-machine-$(CONFIG_ARCH_VIRT)             += virt
-machine-$(CONFIG_ARCH_ZYNQ)             += zynq
-machine-$(CONFIG_ARCH_SUNXI)            += sunxi
-machine-$(CONFIG_ARCH_KEYSTONE)         += keystone
 
 # Platform directory name.  This list is sorted alphanumerically
 # by CONFIG_* macro name.
diff --git a/arch/arm/boot/dts/msm8960-cdp.dts b/arch/arm/boot/dts/msm8960-cdp.dts
index db2060c46540..9c1167b0459b 100644
--- a/arch/arm/boot/dts/msm8960-cdp.dts
+++ b/arch/arm/boot/dts/msm8960-cdp.dts
@@ -26,7 +26,7 @@
                 cpu-offset = <0x80000>;
         };
 
-        msmgpio: gpio@fd510000 {
+        msmgpio: gpio@800000 {
                 compatible = "qcom,msm-gpio";
                 gpio-controller;
                 #gpio-cells = <2>;
@@ -34,7 +34,7 @@
                 interrupts = <0 32 0x4>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
-                reg = <0xfd510000 0x4000>;
+                reg = <0x800000 0x4000>;
         };
 
         serial@16440000 {
diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts
index 08b72678abff..65d7b601651c 100644
--- a/arch/arm/boot/dts/omap5-uevm.dts
+++ b/arch/arm/boot/dts/omap5-uevm.dts
@@ -235,7 +235,7 @@
 };
 
 &mmc1 {
-        vmmc-supply = <&vmmcsd_fixed>;
+        vmmc-supply = <&ldo9_reg>;
         bus-width = <4>;
 };
 
@@ -282,6 +282,7 @@
 
                         regulators {
                                 smps123_reg: smps123 {
+                                        /* VDD_OPP_MPU */
                                         regulator-name = "smps123";
                                         regulator-min-microvolt = < 600000>;
                                         regulator-max-microvolt = <1500000>;
@@ -290,6 +291,7 @@
                                 };
 
                                 smps45_reg: smps45 {
+                                        /* VDD_OPP_MM */
                                         regulator-name = "smps45";
                                         regulator-min-microvolt = < 600000>;
                                         regulator-max-microvolt = <1310000>;
@@ -298,6 +300,7 @@
                                 };
 
                                 smps6_reg: smps6 {
+                                        /* VDD_DDR3 - over VDD_SMPS6 */
                                         regulator-name = "smps6";
                                         regulator-min-microvolt = <1200000>;
                                         regulator-max-microvolt = <1200000>;
@@ -306,6 +309,7 @@
                                 };
 
                                 smps7_reg: smps7 {
+                                        /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */
                                         regulator-name = "smps7";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -314,6 +318,7 @@
                                 };
 
                                 smps8_reg: smps8 {
+                                        /* VDD_OPP_CORE */
                                         regulator-name = "smps8";
                                         regulator-min-microvolt = < 600000>;
                                         regulator-max-microvolt = <1310000>;
@@ -322,15 +327,15 @@
                                 };
 
                                 smps9_reg: smps9 {
+                                        /* VDDA_2v1_AUD over VDD_2v1 */
                                         regulator-name = "smps9";
                                         regulator-min-microvolt = <2100000>;
                                         regulator-max-microvolt = <2100000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
                                         ti,smps-range = <0x80>;
                                 };
 
                                 smps10_reg: smps10 {
+                                        /* VBUS_5V_OTG */
                                         regulator-name = "smps10";
                                         regulator-min-microvolt = <5000000>;
                                         regulator-max-microvolt = <5000000>;
@@ -339,38 +344,40 @@
                                 };
 
                                 ldo1_reg: ldo1 {
+                                        /* VDDAPHY_CAM: vdda_csiport */
                                         regulator-name = "ldo1";
-                                        regulator-min-microvolt = <2800000>;
-                                        regulator-max-microvolt = <2800000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <1500000>;
+                                        regulator-max-microvolt = <1800000>;
                                 };
 
                                 ldo2_reg: ldo2 {
+                                        /* VCC_2V8_DISP: Does not go anywhere */
                                         regulator-name = "ldo2";
-                                        regulator-min-microvolt = <2900000>;
-                                        regulator-max-microvolt = <2900000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <2800000>;
+                                        regulator-max-microvolt = <2800000>;
+                                        /* Unused */
+                                        status = "disabled";
                                 };
 
                                 ldo3_reg: ldo3 {
+                                        /* VDDAPHY_MDM: vdda_lli */
                                         regulator-name = "ldo3";
-                                        regulator-min-microvolt = <3000000>;
-                                        regulator-max-microvolt = <3000000>;
-                                        regulator-always-on;
+                                        regulator-min-microvolt = <1500000>;
+                                        regulator-max-microvolt = <1500000>;
                                         regulator-boot-on;
+                                        /* Only if Modem is used */
+                                        status = "disabled";
                                 };
 
                                 ldo4_reg: ldo4 {
+                                        /* VDDAPHY_DISP: vdda_dsiport/hdmi */
                                         regulator-name = "ldo4";
-                                        regulator-min-microvolt = <2200000>;
-                                        regulator-max-microvolt = <2200000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <1500000>;
+                                        regulator-max-microvolt = <1800000>;
                                 };
 
                                 ldo5_reg: ldo5 {
+                                        /* VDDA_1V8_PHY: usb/sata/hdmi.. */
                                         regulator-name = "ldo5";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -379,38 +386,43 @@
                                 };
 
                                 ldo6_reg: ldo6 {
+                                        /* VDDS_1V2_WKUP: hsic/ldo_emu_wkup */
                                         regulator-name = "ldo6";
-                                        regulator-min-microvolt = <1500000>;
-                                        regulator-max-microvolt = <1500000>;
+                                        regulator-min-microvolt = <1200000>;
+                                        regulator-max-microvolt = <1200000>;
                                         regulator-always-on;
                                         regulator-boot-on;
                                 };
 
                                 ldo7_reg: ldo7 {
+                                        /* VDD_VPP: vpp1 */
                                         regulator-name = "ldo7";
-                                        regulator-min-microvolt = <1500000>;
-                                        regulator-max-microvolt = <1500000>;
-                                        regulator-always-on;
-                                        regulator-boot-on;
+                                        regulator-min-microvolt = <2000000>;
+                                        regulator-max-microvolt = <2000000>;
+                                        /* Only for efuse reprograming! */
+                                        status = "disabled";
                                 };
 
                                 ldo8_reg: ldo8 {
+                                        /* VDD_3v0: Does not go anywhere */
                                         regulator-name = "ldo8";
-                                        regulator-min-microvolt = <1500000>;
-                                        regulator-max-microvolt = <1500000>;
-                                        regulator-always-on;
+                                        regulator-min-microvolt = <3000000>;
+                                        regulator-max-microvolt = <3000000>;
                                         regulator-boot-on;
+                                        /* Unused */
+                                        status = "disabled";
                                 };
 
                                 ldo9_reg: ldo9 {
+                                        /* VCC_DV_SDIO: vdds_sdcard */
                                         regulator-name = "ldo9";
                                         regulator-min-microvolt = <1800000>;
-                                        regulator-max-microvolt = <3300000>;
-                                        regulator-always-on;
+                                        regulator-max-microvolt = <3000000>;
                                         regulator-boot-on;
                                 };
 
                                 ldoln_reg: ldoln {
+                                        /* VDDA_1v8_REF: vdds_osc/mm_l4per.. */
                                         regulator-name = "ldoln";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -419,12 +431,20 @@
                                 };
 
                                 ldousb_reg: ldousb {
+                                        /* VDDA_3V_USB: VDDA_USBHS33 */
                                         regulator-name = "ldousb";
                                         regulator-min-microvolt = <3250000>;
                                         regulator-max-microvolt = <3250000>;
                                         regulator-always-on;
                                         regulator-boot-on;
                                 };
+
+                                regen3_reg: regen3 {
+                                        /* REGEN3 controls LDO9 supply to card */
+                                        regulator-name = "regen3";
+                                        regulator-always-on;
+                                        regulator-boot-on;
+                                };
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/stih41x.dtsi b/arch/arm/boot/dts/stih41x.dtsi
index 7321403cab8a..f5b9898d9c6e 100644
--- a/arch/arm/boot/dts/stih41x.dtsi
+++ b/arch/arm/boot/dts/stih41x.dtsi
@@ -6,10 +6,12 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
                 cpu@0 {
+                        device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0>;
                 };
                 cpu@1 {
+                        device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <1>;
                 };
diff --git a/arch/arm/boot/dts/tegra20-colibri-512.dtsi b/arch/arm/boot/dts/tegra20-colibri-512.dtsi
index 2fcb3f2ca160..5592be6f2f7a 100644
--- a/arch/arm/boot/dts/tegra20-colibri-512.dtsi
+++ b/arch/arm/boot/dts/tegra20-colibri-512.dtsi
@@ -457,6 +457,7 @@
         };
 
         usb-phy@c5004000 {
+                status = "okay";
                 nvidia,phy-reset-gpio = <&gpio TEGRA_GPIO(V, 1)
                         GPIO_ACTIVE_LOW>;
         };
diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h
deleted file mode 100644
index 92f10cb5c70c..000000000000
--- a/arch/arm/include/asm/a.out-core.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/* a.out coredump register dumper
- *
- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-
-#ifndef _ASM_A_OUT_CORE_H
-#define _ASM_A_OUT_CORE_H
-
-#ifdef __KERNEL__
-
-#include <linux/user.h>
-#include <linux/elfcore.h>
-
-/*
- * fill in the user structure for an a.out core dump
- */
-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
-{
-        struct task_struct *tsk = current;
-
-        dump->magic = CMAGIC;
-        dump->start_code = tsk->mm->start_code;
-        dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1);
-
-        dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT;
-        dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        dump->u_ssize = 0;
-
-        memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg));
-
-        if (dump->start_stack < 0x04000000)
-                dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT;
-
-        dump->regs = *regs;
-        dump->u_fpvalid = dump_fpu (regs, &dump->u_fp);
-}
-
-#endif /* __KERNEL__ */
-#endif /* _ASM_A_OUT_CORE_H */
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 8c25dc4e9851..9672e978d50d 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -89,13 +89,18 @@ extern unsigned int processor_id;
                 __val;                                                  \
         })
 
+/*
+ * The memory clobber prevents gcc 4.5 from reordering the mrc before
+ * any is_smp() tests, which can cause undefined instruction aborts on
+ * ARM1136 r0 due to the missing extended CP15 registers.
+ */
 #define read_cpuid_ext(ext_reg)                                         \
         ({                                                              \
                 unsigned int __val;                                     \
                 asm("mrc        p15, 0, %0, c0, " ext_reg               \
                     : "=r" (__val)                                      \
                     :                                                   \
-                    : "cc");                                            \
+                    : "memory");                                        \
                 __val;                                                  \
         })
 
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index 38050b1c4800..56211f2084ef 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -130,4 +130,10 @@ struct mm_struct;
 extern unsigned long arch_randomize_brk(struct mm_struct *mm);
 #define arch_randomize_brk arch_randomize_brk
 
+#ifdef CONFIG_MMU
+#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
+struct linux_binprm;
+int arch_setup_additional_pages(struct linux_binprm *, int);
+#endif
+
 #endif
diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
index e3d55547e755..6f18da09668b 100644
--- a/arch/arm/include/asm/mmu.h
+++ b/arch/arm/include/asm/mmu.h
@@ -6,8 +6,11 @@
 typedef struct {
 #ifdef CONFIG_CPU_HAS_ASID
         atomic64_t      id;
+#else
+        int             switch_pending;
 #endif
         unsigned int    vmalloc_seq;
+        unsigned long   sigpage;
 } mm_context_t;
 
 #ifdef CONFIG_CPU_HAS_ASID
diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
index b5792b7fd8d3..9b32f76bb0dd 100644
--- a/arch/arm/include/asm/mmu_context.h
+++ b/arch/arm/include/asm/mmu_context.h
@@ -56,7 +56,7 @@ static inline void check_and_switch_context(struct mm_struct *mm,
                  * on non-ASID CPUs, the old mm will remain valid until the
                  * finish_arch_post_lock_switch() call.
                  */
-                set_ti_thread_flag(task_thread_info(tsk), TIF_SWITCH_MM);
+                mm->context.switch_pending = 1;
         else
                 cpu_switch_mm(mm->pgd, mm);
 }
@@ -65,9 +65,21 @@ static inline void check_and_switch_context(struct mm_struct *mm,
         finish_arch_post_lock_switch
 static inline void finish_arch_post_lock_switch(void)
 {
-        if (test_and_clear_thread_flag(TIF_SWITCH_MM)) {
-                struct mm_struct *mm = current->mm;
-                cpu_switch_mm(mm->pgd, mm);
+        struct mm_struct *mm = current->mm;
+
+        if (mm && mm->context.switch_pending) {
+                /*
+                 * Preemption must be disabled during cpu_switch_mm() as we
+                 * have some stateful cache flush implementations. Check
+                 * switch_pending again in case we were preempted and the
+                 * switch to this mm was already done.
+                 */
+                preempt_disable();
+                if (mm->context.switch_pending) {
+                        mm->context.switch_pending = 0;
+                        cpu_switch_mm(mm->pgd, mm);
+                }
+                preempt_enable_no_resched();
         }
 }
 
diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
index 6363f3d1d505..4355f0ec44d6 100644
--- a/arch/arm/include/asm/page.h
+++ b/arch/arm/include/asm/page.h
@@ -142,7 +142,9 @@ extern void __cpu_copy_user_highpage(struct page *to, struct page *from,
 #define clear_page(page)        memset((void *)(page), 0, PAGE_SIZE)
 extern void copy_page(void *to, const void *from);
 
+#ifdef CONFIG_KUSER_HELPERS
 #define __HAVE_ARCH_GATE_AREA 1
+#endif
 
 #ifdef CONFIG_ARM_LPAE
 #include <asm/pgtable-3level-types.h>
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 06e7d509eaac..413f3876341c 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -54,7 +54,6 @@ struct thread_struct {
 
 #define start_thread(regs,pc,sp)                                        \
 ({                                                                      \
-        unsigned long *stack = (unsigned long *)sp;                     \
         memset(regs->uregs, 0, sizeof(regs->uregs));                    \
         if (current->personality & ADDR_LIMIT_32BIT)                    \
                 regs->ARM_cpsr = USR_MODE;                              \
@@ -65,9 +64,6 @@ struct thread_struct {
         regs->ARM_cpsr |= PSR_ENDSTATE;                                 \
         regs->ARM_pc = pc & ~1;         /* pc */                        \
         regs->ARM_sp = sp;              /* sp */                        \
-        regs->ARM_r2 = stack[2];        /* r2 (envp) */                 \
-        regs->ARM_r1 = stack[1];        /* r1 (argv) */                 \
-        regs->ARM_r0 = stack[0];        /* r0 (argc) */                 \
         nommu_start_thread(regs);                                       \
 })
 
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 214d4158089a..2b8114fcba09 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -156,7 +156,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define TIF_USING_IWMMXT        17
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
 #define TIF_RESTORE_SIGMASK     20
-#define TIF_SWITCH_MM           22      /* deferred switch_mm */
 
 #define _TIF_SIGPENDING         (1 << TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1 << TIF_NEED_RESCHED)
diff --git a/arch/arm/include/asm/tlbflush.h b/arch/arm/include/asm/tlbflush.h
index fdbb9e369745..f467e9b3f8d5 100644
--- a/arch/arm/include/asm/tlbflush.h
+++ b/arch/arm/include/asm/tlbflush.h
@@ -443,7 +443,18 @@ static inline void local_flush_bp_all(void)
                 isb();
 }
 
+#include <asm/cputype.h>
 #ifdef CONFIG_ARM_ERRATA_798181
+static inline int erratum_a15_798181(void)
+{
+        unsigned int midr = read_cpuid_id();
+
+        /* Cortex-A15 r0p0..r3p2 affected */
+        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
+                return 0;
+        return 1;
+}
+
 static inline void dummy_flush_tlb_a15_erratum(void)
 {
         /*
@@ -453,6 +464,11 @@ static inline void dummy_flush_tlb_a15_erratum(void)
         dsb();
 }
 #else
+static inline int erratum_a15_798181(void)
+{
+        return 0;
+}
+
 static inline void dummy_flush_tlb_a15_erratum(void)
 {
 }
diff --git a/arch/arm/include/asm/virt.h b/arch/arm/include/asm/virt.h
index 50af92bac737..4371f45c5784 100644
--- a/arch/arm/include/asm/virt.h
+++ b/arch/arm/include/asm/virt.h
@@ -29,6 +29,7 @@
 #define BOOT_CPU_MODE_MISMATCH  PSR_N_BIT
 
 #ifndef __ASSEMBLY__
+#include <asm/cacheflush.h>
 
 #ifdef CONFIG_ARM_VIRT_EXT
 /*
@@ -41,10 +42,21 @@
  */
 extern int __boot_cpu_mode;
 
+static inline void sync_boot_mode(void)
+{
+        /*
+         * As secondaries write to __boot_cpu_mode with caches disabled, we
+         * must flush the corresponding cache entries to ensure the visibility
+         * of their writes.
+         */
+        sync_cache_r(&__boot_cpu_mode);
+}
+
 void __hyp_set_vectors(unsigned long phys_vector_base);
 unsigned long __hyp_get_vectors(void);
 #else
 #define __boot_cpu_mode (SVC_MODE)
+#define sync_boot_mode()
 #endif
 
 #ifndef ZIMAGE
diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
index 47bcb2d254af..18d76fd5a2af 100644
--- a/arch/arm/include/uapi/asm/Kbuild
+++ b/arch/arm/include/uapi/asm/Kbuild
@@ -1,7 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
-header-y += a.out.h
 header-y += byteorder.h
 header-y += fcntl.h
 header-y += hwcap.h
diff --git a/arch/arm/include/uapi/asm/a.out.h b/arch/arm/include/uapi/asm/a.out.h
deleted file mode 100644
index 083894b2e3bc..000000000000
--- a/arch/arm/include/uapi/asm/a.out.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#ifndef __ARM_A_OUT_H__
-#define __ARM_A_OUT_H__
-
-#include <linux/personality.h>
-#include <linux/types.h>
-
-struct exec
-{
-  __u32 a_info;         /* Use macros N_MAGIC, etc for access */
-  __u32 a_text;         /* length of text, in bytes */
-  __u32 a_data;         /* length of data, in bytes */
-  __u32 a_bss;          /* length of uninitialized data area for file, in bytes */
-  __u32 a_syms;         /* length of symbol table data in file, in bytes */
-  __u32 a_entry;        /* start address */
-  __u32 a_trsize;       /* length of relocation info for text, in bytes */
-  __u32 a_drsize;       /* length of relocation info for data, in bytes */
-};
-
-/*
- * This is always the same
- */
-#define N_TXTADDR(a)    (0x00008000)
-
-#define N_TRSIZE(a)     ((a).a_trsize)
-#define N_DRSIZE(a)     ((a).a_drsize)
-#define N_SYMSIZE(a)    ((a).a_syms)
-
-#define M_ARM 103
-
-#ifndef LIBRARY_START_TEXT
-#define LIBRARY_START_TEXT      (0x00c00000)
-#endif
-
-#endif /* __A_OUT_GNU_H__ */
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index a39cfc2a1f90..d40d0ef389db 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -742,6 +742,18 @@ ENDPROC(__switch_to)
 #endif
         .endm
 
+        .macro  kuser_pad, sym, size
+        .if     (. - \sym) & 3
+        .rept   4 - (. - \sym) & 3
+        .byte   0
+        .endr
+        .endif
+        .rept   (\size - (. - \sym)) / 4
+        .word   0xe7fddef1
+        .endr
+        .endm
+
+#ifdef CONFIG_KUSER_HELPERS
         .align  5
         .globl  __kuser_helper_start
 __kuser_helper_start:
@@ -832,18 +844,13 @@ kuser_cmpxchg64_fixup:
 #error "incoherent kernel configuration"
 #endif
 
-        /* pad to next slot */
-        .rept   (16 - (. - __kuser_cmpxchg64)/4)
-        .word   0
-        .endr
-
-        .align  5
+        kuser_pad __kuser_cmpxchg64, 64
 
 __kuser_memory_barrier:                         @ 0xffff0fa0
         smp_dmb arm
         usr_ret lr
 
-        .align  5
+        kuser_pad __kuser_memory_barrier, 32
 
 __kuser_cmpxchg:                                @ 0xffff0fc0
 
@@ -916,13 +923,14 @@ kuser_cmpxchg32_fixup:
 
 #endif
 
-        .align  5
+        kuser_pad __kuser_cmpxchg, 32
 
 __kuser_get_tls:                                @ 0xffff0fe0
         ldr     r0, [pc, #(16 - 8)]     @ read TLS, set in kuser_get_tls_init
         usr_ret lr
         mrc     p15, 0, r0, c13, c0, 3  @ 0xffff0fe8 hardware TLS code
-        .rep    4
+        kuser_pad __kuser_get_tls, 16
+        .rep    3
         .word   0                       @ 0xffff0ff0 software TLS value, then
         .endr                           @ pad up to __kuser_helper_version
 
@@ -932,14 +940,16 @@ __kuser_helper_version:				@ 0xffff0ffc
         .globl  __kuser_helper_end
 __kuser_helper_end:
 
+#endif
+
  THUMB( .thumb  )
 
 /*
  * Vector stubs.
  *
- * This code is copied to 0xffff0200 so we can use branches in the
- * vectors, rather than ldr's.  Note that this code must not
- * exceed 0x300 bytes.
+ * This code is copied to 0xffff1000 so we can use branches in the
+ * vectors, rather than ldr's.  Note that this code must not exceed
+ * a page size.
  *
  * Common stub entry macro:
  *   Enter in IRQ mode, spsr = SVC/USR CPSR, lr = SVC/USR PC
@@ -986,8 +996,17 @@ ENDPROC(vector_\name)
 1:
         .endm
 
-        .globl  __stubs_start
+        .section .stubs, "ax", %progbits
 __stubs_start:
+        @ This must be the first word
+        .word   vector_swi
+
+vector_rst:
+ ARM(   swi     SYS_ERROR0      )
+ THUMB( svc     #0              )
+ THUMB( nop                     )
+        b       vector_und
+
 /*
  * Interrupt dispatcher
  */
@@ -1082,6 +1101,16 @@ __stubs_start:
         .align  5
 
 /*=============================================================================
+ * Address exception handler
+ *-----------------------------------------------------------------------------
+ * These aren't too critical.
+ * (they're not supposed to happen, and won't happen in 32-bit data mode).
+ */
+
+vector_addrexcptn:
+        b       vector_addrexcptn
+
+/*=============================================================================
  * Undefined FIQs
  *-----------------------------------------------------------------------------
  * Enter in FIQ mode, spsr = ANY CPSR, lr = ANY PC
@@ -1094,45 +1123,19 @@ __stubs_start:
 vector_fiq:
         subs    pc, lr, #4
 
-/*=============================================================================
- * Address exception handler
- *-----------------------------------------------------------------------------
- * These aren't too critical.
- * (they're not supposed to happen, and won't happen in 32-bit data mode).
- */
-
-vector_addrexcptn:
-        b       vector_addrexcptn
-
-/*
- * We group all the following data together to optimise
- * for CPUs with separate I & D caches.
- */
-        .align  5
-
-.LCvswi:
-        .word   vector_swi
-
-        .globl  __stubs_end
-__stubs_end:
-
-        .equ    stubs_offset, __vectors_start + 0x200 - __stubs_start
+        .globl  vector_fiq_offset
+        .equ    vector_fiq_offset, vector_fiq
 
-        .globl  __vectors_start
+        .section .vectors, "ax", %progbits
 __vectors_start:
- ARM(   swi     SYS_ERROR0      )
- THUMB( svc     #0              )
- THUMB( nop                     )
-        W(b)    vector_und + stubs_offset
-        W(ldr)  pc, .LCvswi + stubs_offset
-        W(b)    vector_pabt + stubs_offset
-        W(b)    vector_dabt + stubs_offset
-        W(b)    vector_addrexcptn + stubs_offset
-        W(b)    vector_irq + stubs_offset
-        W(b)    vector_fiq + stubs_offset
-
-        .globl  __vectors_end
-__vectors_end:
+        W(b)    vector_rst
+        W(b)    vector_und
+        W(ldr)  pc, __vectors_start + 0x1000
+        W(b)    vector_pabt
+        W(b)    vector_dabt
+        W(b)    vector_addrexcptn
+        W(b)    vector_irq
+        W(b)    vector_fiq
 
         .data
 
diff --git a/arch/arm/kernel/entry-v7m.S b/arch/arm/kernel/entry-v7m.S
index e00621f1403f..52b26432c9a9 100644
--- a/arch/arm/kernel/entry-v7m.S
+++ b/arch/arm/kernel/entry-v7m.S
@@ -49,7 +49,7 @@ __irq_entry:
         mov     r1, sp
         stmdb   sp!, {lr}
         @ routine called with r0 = irq number, r1 = struct pt_regs *
-        bl      nvic_do_IRQ
+        bl      nvic_handle_irq
 
         pop     {lr}
         @
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index 2adda11f712f..25442f451148 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -47,6 +47,11 @@
 #include <asm/irq.h>
 #include <asm/traps.h>
 
+#define FIQ_OFFSET ({                                   \
+                extern void *vector_fiq_offset;         \
+                (unsigned)&vector_fiq_offset;           \
+        })
+
 static unsigned long no_fiq_insn;
 
 /* Default reacquire function
@@ -80,13 +85,16 @@ int show_fiq_list(struct seq_file *p, int prec)
 void set_fiq_handler(void *start, unsigned int length)
 {
 #if defined(CONFIG_CPU_USE_DOMAINS)
-        memcpy((void *)0xffff001c, start, length);
+        void *base = (void *)0xffff0000;
 #else
-        memcpy(vectors_page + 0x1c, start, length);
+        void *base = vectors_page;
 #endif
-        flush_icache_range(0xffff001c, 0xffff001c + length);
+        unsigned offset = FIQ_OFFSET;
+
+        memcpy(base + offset, start, length);
+        flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
         if (!vectors_high())
-                flush_icache_range(0x1c, 0x1c + length);
+                flush_icache_range(offset, offset + length);
 }
 
 int claim_fiq(struct fiq_handler *f)
@@ -144,6 +152,7 @@ EXPORT_SYMBOL(disable_fiq);
 
 void __init init_FIQ(int start)
 {
-        no_fiq_insn = *(unsigned long *)0xffff001c;
+        unsigned offset = FIQ_OFFSET;
+        no_fiq_insn = *(unsigned long *)(0xffff0000 + offset);
         fiq_start = start;
 }
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b361de143756..14235ba64a90 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -87,6 +87,7 @@ ENTRY(stext)
 ENDPROC(stext)
 
 #ifdef CONFIG_SMP
+        .text
 ENTRY(secondary_startup)
         /*
          * Common entry point for secondary CPUs.
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 9cf6063020ae..2c7cc1e03473 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -343,6 +343,7 @@ __turn_mmu_on_loc:
         .long   __turn_mmu_on_end
 
 #if defined(CONFIG_SMP)
+        .text
 ENTRY(secondary_startup)
         /*
          * Common entry point for secondary CPUs.
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 4910232c4833..797b1a6a4906 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -56,8 +56,8 @@ ENTRY(__boot_cpu_mode)
         ldr     \reg3, [\reg2]
         ldr     \reg1, [\reg2, \reg3]
         cmp     \mode, \reg1            @ matches primary CPU boot mode?
-        orrne   r7, r7, #BOOT_CPU_MODE_MISMATCH
-        strne   r7, [r5, r6]            @ record what happened and give up
+        orrne   \reg1, \reg1, #BOOT_CPU_MODE_MISMATCH
+        strne   \reg1, [\reg2, \reg3]   @ record what happened and give up
         .endm
 
 #else   /* ZIMAGE */
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index d3ca4f6915af..536c85fe72a8 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -197,6 +197,7 @@ void machine_shutdown(void)
  */
 void machine_halt(void)
 {
+        local_irq_disable();
         smp_send_stop();
 
         local_irq_disable();
@@ -211,6 +212,7 @@ void machine_halt(void)
  */
 void machine_power_off(void)
 {
+        local_irq_disable();
         smp_send_stop();
 
         if (pm_power_off)
@@ -230,6 +232,7 @@ void machine_power_off(void)
  */
 void machine_restart(char *cmd)
 {
+        local_irq_disable();
         smp_send_stop();
 
         arm_pm_restart(reboot_mode, cmd);
@@ -426,10 +429,11 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 }
 
 #ifdef CONFIG_MMU
+#ifdef CONFIG_KUSER_HELPERS
 /*
  * The vectors page is always readable from user space for the
- * atomic helpers and the signal restart code. Insert it into the
- * gate_vma so that it is visible through ptrace and /proc/<pid>/mem.
+ * atomic helpers. Insert it into the gate_vma so that it is visible
+ * through ptrace and /proc/<pid>/mem.
  */
 static struct vm_area_struct gate_vma = {
         .vm_start       = 0xffff0000,
@@ -458,9 +462,48 @@ int in_gate_area_no_mm(unsigned long addr)
 {
         return in_gate_area(NULL, addr);
 }
+#define is_gate_vma(vma)        ((vma) = &gate_vma)
+#else
+#define is_gate_vma(vma)        0
+#endif
 
 const char *arch_vma_name(struct vm_area_struct *vma)
 {
-        return (vma == &gate_vma) ? "[vectors]" : NULL;
+        return is_gate_vma(vma) ? "[vectors]" :
+                (vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
+                 "[sigpage]" : NULL;
+}
+
+static struct page *signal_page;
+extern struct page *get_signal_page(void);
+
+int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+{
+        struct mm_struct *mm = current->mm;
+        unsigned long addr;
+        int ret;
+
+        if (!signal_page)
+                signal_page = get_signal_page();
+        if (!signal_page)
+                return -ENOMEM;
+
+        down_write(&mm->mmap_sem);
+        addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
+        if (IS_ERR_VALUE(addr)) {
+                ret = addr;
+                goto up_fail;
+        }
+
+        ret = install_special_mapping(mm, addr, PAGE_SIZE,
+                VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
+                &signal_page);
+
+        if (ret == 0)
+                mm->context.sigpage = addr;
+
+ up_fail:
+        up_write(&mm->mmap_sem);
+        return ret;
 }
 #endif
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 63af9a7ae512..afc2489ee13b 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -836,6 +836,8 @@ static int __init meminfo_cmp(const void *_a, const void *_b)
 void __init hyp_mode_check(void)
 {
 #ifdef CONFIG_ARM_VIRT_EXT
+        sync_boot_mode();
+
         if (is_hyp_mode_available()) {
                 pr_info("CPU: All CPU(s) started in HYP mode.\n");
                 pr_info("CPU: Virtualization extensions available.\n");
@@ -971,6 +973,7 @@ static const char *hwcap_str[] = {
         "vfpv4",
         "idiva",
         "idivt",
+        "vfpd32",
         "lpae",
         NULL
 };
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 1c16c35c271a..ab3304225272 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -8,6 +8,7 @@
  * published by the Free Software Foundation.
  */
 #include <linux/errno.h>
+#include <linux/random.h>
 #include <linux/signal.h>
 #include <linux/personality.h>
 #include <linux/uaccess.h>
@@ -15,12 +16,11 @@
 
 #include <asm/elf.h>
 #include <asm/cacheflush.h>
+#include <asm/traps.h>
 #include <asm/ucontext.h>
 #include <asm/unistd.h>
 #include <asm/vfp.h>
 
-#include "signal.h"
-
 /*
  * For ARM syscalls, we encode the syscall number into the instruction.
  */
@@ -40,11 +40,13 @@
 #define SWI_THUMB_SIGRETURN     (0xdf00 << 16 | 0x2700 | (__NR_sigreturn - __NR_SYSCALL_BASE))
 #define SWI_THUMB_RT_SIGRETURN  (0xdf00 << 16 | 0x2700 | (__NR_rt_sigreturn - __NR_SYSCALL_BASE))
 
-const unsigned long sigreturn_codes[7] = {
+static const unsigned long sigreturn_codes[7] = {
         MOV_R7_NR_SIGRETURN,    SWI_SYS_SIGRETURN,    SWI_THUMB_SIGRETURN,
         MOV_R7_NR_RT_SIGRETURN, SWI_SYS_RT_SIGRETURN, SWI_THUMB_RT_SIGRETURN,
 };
 
+static unsigned long signal_return_offset;
+
 #ifdef CONFIG_CRUNCH
 static int preserve_crunch_context(struct crunch_sigframe __user *frame)
 {
@@ -400,14 +402,20 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
                     __put_user(sigreturn_codes[idx+1], rc+1))
                         return 1;
 
-                if ((cpsr & MODE32_BIT) && !IS_ENABLED(CONFIG_ARM_MPU)) {
+#ifdef CONFIG_MMU
+                if (cpsr & MODE32_BIT) {
+                        struct mm_struct *mm = current->mm;
+
                         /*
-                         * 32-bit code can use the new high-page
-                         * signal return code support except when the MPU has
-                         * protected the vectors page from PL0
+                         * 32-bit code can use the signal return page
+                         * except when the MPU has protected the vectors
+                         * page from PL0
                          */
-                        retcode = KERN_SIGRETURN_CODE + (idx << 2) + thumb;
-                } else {
+                        retcode = mm->context.sigpage + signal_return_offset +
+                                  (idx << 2) + thumb;
+                } else
+#endif
+                {
                         /*
                          * Ensure that the instruction cache sees
                          * the return code written onto the stack.
@@ -608,3 +616,33 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
         } while (thread_flags & _TIF_WORK_MASK);
         return 0;
 }
+
+struct page *get_signal_page(void)
+{
+        unsigned long ptr;
+        unsigned offset;
+        struct page *page;
+        void *addr;
+
+        page = alloc_pages(GFP_KERNEL, 0);
+
+        if (!page)
+                return NULL;
+
+        addr = page_address(page);
+
+        /* Give the signal return code some randomness */
+        offset = 0x200 + (get_random_int() & 0x7fc);
+        signal_return_offset = offset;
+
+        /*
+         * Copy signal return handlers into the vector page, and
+         * set sigreturn to be a pointer to these.
+         */
+        memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
+
+        ptr = (unsigned long)addr + offset;
+        flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
+
+        return page;
+}
diff --git a/arch/arm/kernel/signal.h b/arch/arm/kernel/signal.h
deleted file mode 100644
index 5ff067b7c752..000000000000
--- a/arch/arm/kernel/signal.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- *  linux/arch/arm/kernel/signal.h
- *
- *  Copyright (C) 2005-2009 Russell King.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define KERN_SIGRETURN_CODE     (CONFIG_VECTORS_BASE + 0x00000500)
-
-extern const unsigned long sigreturn_codes[7];
diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
index a98b62dca2fa..c2edfff573c2 100644
--- a/arch/arm/kernel/smp_tlb.c
+++ b/arch/arm/kernel/smp_tlb.c
@@ -70,23 +70,6 @@ static inline void ipi_flush_bp_all(void *ignored)
         local_flush_bp_all();
 }
 
-#ifdef CONFIG_ARM_ERRATA_798181
-static int erratum_a15_798181(void)
-{
-        unsigned int midr = read_cpuid_id();
-
-        /* Cortex-A15 r0p0..r3p2 affected */
-        if ((midr & 0xff0ffff0) != 0x410fc0f0 || midr > 0x413fc0f2)
-                return 0;
-        return 1;
-}
-#else
-static int erratum_a15_798181(void)
-{
-        return 0;
-}
-#endif
-
 static void ipi_flush_tlb_a15_erratum(void *arg)
 {
         dmb();
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index cab094c234ee..ab517fcce21b 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -35,8 +35,6 @@
 #include <asm/tls.h>
 #include <asm/system_misc.h>
 
-#include "signal.h"
-
 static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
 
 void *vectors_page;
@@ -800,15 +798,26 @@ void __init trap_init(void)
         return;
 }
 
-static void __init kuser_get_tls_init(unsigned long vectors)
+#ifdef CONFIG_KUSER_HELPERS
+static void __init kuser_init(void *vectors)
 {
+        extern char __kuser_helper_start[], __kuser_helper_end[];
+        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
+
+        memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
+
         /*
          * vectors + 0xfe0 = __kuser_get_tls
          * vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8
          */
         if (tls_emu || has_tls_reg)
-                memcpy((void *)vectors + 0xfe0, (void *)vectors + 0xfe8, 4);
+                memcpy(vectors + 0xfe0, vectors + 0xfe8, 4);
 }
+#else
+static void __init kuser_init(void *vectors)
+{
+}
+#endif
 
 void __init early_trap_init(void *vectors_base)
 {
@@ -816,33 +825,30 @@ void __init early_trap_init(void *vectors_base)
         unsigned long vectors = (unsigned long)vectors_base;
         extern char __stubs_start[], __stubs_end[];
         extern char __vectors_start[], __vectors_end[];
-        extern char __kuser_helper_start[], __kuser_helper_end[];
-        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
+        unsigned i;
 
         vectors_page = vectors_base;
 
         /*
+         * Poison the vectors page with an undefined instruction.  This
+         * instruction is chosen to be undefined for both ARM and Thumb
+         * ISAs.  The Thumb version is an undefined instruction with a
+         * branch back to the undefined instruction.
+         */
+        for (i = 0; i < PAGE_SIZE / sizeof(u32); i++)
+                ((u32 *)vectors_base)[i] = 0xe7fddef1;
+
+        /*
          * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
          * into the vector page, mapped at 0xffff0000, and ensure these
          * are visible to the instruction stream.
          */
         memcpy((void *)vectors, __vectors_start, __vectors_end - __vectors_start);
-        memcpy((void *)vectors + 0x200, __stubs_start, __stubs_end - __stubs_start);
-        memcpy((void *)vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz);
+        memcpy((void *)vectors + 0x1000, __stubs_start, __stubs_end - __stubs_start);
 
-        /*
-         * Do processor specific fixups for the kuser helpers
-         */
-        kuser_get_tls_init(vectors);
-
-        /*
-         * Copy signal return handlers into the vector page, and
-         * set sigreturn to be a pointer to these.
-         */
-        memcpy((void *)(vectors + KERN_SIGRETURN_CODE - CONFIG_VECTORS_BASE),
-               sigreturn_codes, sizeof(sigreturn_codes));
+        kuser_init(vectors_base);
 
-        flush_icache_range(vectors, vectors + PAGE_SIZE);
+        flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
         modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
 #else /* ifndef CONFIG_CPU_V7M */
         /*
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index fa25e4e425f6..7bcee5c9b604 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -148,6 +148,23 @@ SECTIONS
         . = ALIGN(PAGE_SIZE);
         __init_begin = .;
 #endif
+        /*
+         * The vectors and stubs are relocatable code, and the
+         * only thing that matters is their relative offsets
+         */
+        __vectors_start = .;
+        .vectors 0 : AT(__vectors_start) {
+                *(.vectors)
+        }
+        . = __vectors_start + SIZEOF(.vectors);
+        __vectors_end = .;
+
+        __stubs_start = .;
+        .stubs 0x1000 : AT(__stubs_start) {
+                *(.stubs)
+        }
+        . = __stubs_start + SIZEOF(.stubs);
+        __stubs_end = .;
 
         INIT_TEXT_SECTION(8)
         .exit.text : {
diff --git a/arch/arm/mach-msm/Kconfig b/arch/arm/mach-msm/Kconfig
index 614e41e7881b..905efc8cac79 100644
--- a/arch/arm/mach-msm/Kconfig
+++ b/arch/arm/mach-msm/Kconfig
@@ -121,8 +121,7 @@ config MSM_SMD
         bool
 
 config MSM_GPIOMUX
-        depends on !(ARCH_MSM8X60 || ARCH_MSM8960)
-        bool "MSM V1 TLMM GPIOMUX architecture"
+        bool
         help
           Support for MSM V1 TLMM GPIOMUX architecture.
 
diff --git a/arch/arm/mach-msm/gpiomux-v1.c b/arch/arm/mach-msm/gpiomux-v1.c
deleted file mode 100644
index 27de2abd7144..000000000000
--- a/arch/arm/mach-msm/gpiomux-v1.c
+++ /dev/null
@@ -1,33 +0,0 @@
-/* Copyright (c) 2010, Code Aurora Forum. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 and
- * only version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-#include <linux/kernel.h>
-#include "gpiomux.h"
-#include "proc_comm.h"
-
-void __msm_gpiomux_write(unsigned gpio, gpiomux_config_t val)
-{
-        unsigned tlmm_config  = (val & ~GPIOMUX_CTL_MASK) |
-                                ((gpio & 0x3ff) << 4);
-        unsigned tlmm_disable = 0;
-        int rc;
-
-        rc = msm_proc_comm(PCOM_RPC_GPIO_TLMM_CONFIG_EX,
-                           &tlmm_config, &tlmm_disable);
-        if (rc)
-                pr_err("%s: unexpected proc_comm failure %d: %08x %08x\n",
-                       __func__, rc, tlmm_config, tlmm_disable);
-}
diff --git a/arch/arm/mach-msm/gpiomux.h b/arch/arm/mach-msm/gpiomux.h
index 8e82f41a8923..4410d7766f93 100644
--- a/arch/arm/mach-msm/gpiomux.h
+++ b/arch/arm/mach-msm/gpiomux.h
@@ -73,16 +73,6 @@ extern struct msm_gpiomux_config msm_gpiomux_configs[GPIOMUX_NGPIOS];
 int msm_gpiomux_write(unsigned gpio,
                       gpiomux_config_t active,
                       gpiomux_config_t suspended);
-
-/* Architecture-internal function for use by the framework only.
- * This function can assume the following:
- * - the gpio value has passed a bounds-check
- * - the gpiomux spinlock has been obtained
- *
- * This function is not for public consumption.  External users
- * should use msm_gpiomux_write.
- */
-void __msm_gpiomux_write(unsigned gpio, gpiomux_config_t val);
 #else
 static inline int msm_gpiomux_write(unsigned gpio,
                                     gpiomux_config_t active,
diff --git a/arch/arm/mach-omap2/dss-common.c b/arch/arm/mach-omap2/dss-common.c
index 393aeefaebb0..043e5705f2a6 100644
--- a/arch/arm/mach-omap2/dss-common.c
+++ b/arch/arm/mach-omap2/dss-common.c
@@ -42,7 +42,7 @@
 
 /* Using generic display panel */
 static struct tfp410_platform_data omap4_dvi_panel = {
-        .i2c_bus_num            = 3,
+        .i2c_bus_num            = 2,
         .power_down_gpio        = PANDA_DVI_TFP410_POWER_DOWN_GPIO,
 };
 
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index 5cc92874be7e..f99f68e1e85b 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -129,6 +129,7 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
         struct device_node *node = pdev->dev.of_node;
         const char *oh_name;
         int oh_cnt, i, ret = 0;
+        bool device_active = false;
 
         oh_cnt = of_property_count_strings(node, "ti,hwmods");
         if (oh_cnt <= 0) {
@@ -152,6 +153,8 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
                         goto odbfd_exit1;
                 }
                 hwmods[i] = oh;
+                if (oh->flags & HWMOD_INIT_NO_IDLE)
+                        device_active = true;
         }
 
         od = omap_device_alloc(pdev, hwmods, oh_cnt);
@@ -172,6 +175,11 @@ static int omap_device_build_from_dt(struct platform_device *pdev)
 
         pdev->dev.pm_domain = &omap_device_pm_domain;
 
+        if (device_active) {
+                omap_device_enable(pdev);
+                pm_runtime_set_active(&pdev->dev);
+        }
+
 odbfd_exit1:
         kfree(hwmods);
 odbfd_exit:
@@ -842,6 +850,7 @@ static int __init omap_device_late_idle(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_device *od = to_omap_device(pdev);
+        int i;
 
         if (!od)
                 return 0;
@@ -850,6 +859,15 @@ static int __init omap_device_late_idle(struct device *dev, void *data)
          * If omap_device state is enabled, but has no driver bound,
          * idle it.
          */
+
+        /*
+         * Some devices (like memory controllers) are always kept
+         * enabled, and should not be idled even with no drivers.
+         */
+        for (i = 0; i < od->hwmods_cnt; i++)
+                if (od->hwmods[i]->flags & HWMOD_INIT_NO_IDLE)
+                        return 0;
+
         if (od->_driver_status != BUS_NOTIFY_BOUND_DRIVER) {
                 if (od->_state == OMAP_DEVICE_STATE_ENABLED) {
                         dev_warn(dev, "%s: enabled but no driver.  Idling\n",
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 7341eff63f56..7f4db12b1459 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2386,7 +2386,7 @@ static void __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data)
 
                 np = of_dev_hwmod_lookup(of_find_node_by_name(NULL, "ocp"), oh);
                 if (np)
-                        va_start = of_iomap(np, 0);
+                        va_start = of_iomap(np, oh->mpu_rt_idx);
         } else {
                 va_start = ioremap(mem->pa_start, mem->pa_end - mem->pa_start);
         }
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index aab33fd814c0..e1482a9b3bc2 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -95,6 +95,54 @@ extern struct omap_hwmod_sysc_fields omap_hwmod_sysc_type3;
 #define MODULEMODE_HWCTRL               1
 #define MODULEMODE_SWCTRL               2
 
+#define DEBUG_OMAP2UART1_FLAGS  0
+#define DEBUG_OMAP2UART2_FLAGS  0
+#define DEBUG_OMAP2UART3_FLAGS  0
+#define DEBUG_OMAP3UART3_FLAGS  0
+#define DEBUG_OMAP3UART4_FLAGS  0
+#define DEBUG_OMAP4UART3_FLAGS  0
+#define DEBUG_OMAP4UART4_FLAGS  0
+#define DEBUG_TI81XXUART1_FLAGS 0
+#define DEBUG_TI81XXUART2_FLAGS 0
+#define DEBUG_TI81XXUART3_FLAGS 0
+#define DEBUG_AM33XXUART1_FLAGS 0
+
+#define DEBUG_OMAPUART_FLAGS    (HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET)
+
+#if defined(CONFIG_DEBUG_OMAP2UART1)
+#undef DEBUG_OMAP2UART1_FLAGS
+#define DEBUG_OMAP2UART1_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP2UART2)
+#undef DEBUG_OMAP2UART2_FLAGS
+#define DEBUG_OMAP2UART2_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP2UART3)
+#undef DEBUG_OMAP2UART3_FLAGS
+#define DEBUG_OMAP2UART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP3UART3)
+#undef DEBUG_OMAP3UART3_FLAGS
+#define DEBUG_OMAP3UART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP3UART4)
+#undef DEBUG_OMAP3UART4_FLAGS
+#define DEBUG_OMAP3UART4_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP4UART3)
+#undef DEBUG_OMAP4UART3_FLAGS
+#define DEBUG_OMAP4UART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_OMAP4UART4)
+#undef DEBUG_OMAP4UART4_FLAGS
+#define DEBUG_OMAP4UART4_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_TI81XXUART1)
+#undef DEBUG_TI81XXUART1_FLAGS
+#define DEBUG_TI81XXUART1_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_TI81XXUART2)
+#undef DEBUG_TI81XXUART2_FLAGS
+#define DEBUG_TI81XXUART2_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_TI81XXUART3)
+#undef DEBUG_TI81XXUART3_FLAGS
+#define DEBUG_TI81XXUART3_FLAGS DEBUG_OMAPUART_FLAGS
+#elif defined(CONFIG_DEBUG_AM33XXUART1)
+#undef DEBUG_AM33XXUART1_FLAGS
+#define DEBUG_AM33XXUART1_FLAGS DEBUG_OMAPUART_FLAGS
+#endif
 
 /**
  * struct omap_hwmod_mux_info - hwmod specific mux configuration
@@ -568,6 +616,7 @@ struct omap_hwmod_link {
  * @voltdm: pointer to voltage domain (filled in at runtime)
  * @dev_attr: arbitrary device attributes that can be passed to the driver
  * @_sysc_cache: internal-use hwmod flags
+ * @mpu_rt_idx: index of device address space for register target (for DT boot)
  * @_mpu_rt_va: cached register target start address (internal use)
  * @_mpu_port: cached MPU register target slave (internal use)
  * @opt_clks_cnt: number of @opt_clks
@@ -617,6 +666,7 @@ struct omap_hwmod {
         struct list_head                node;
         struct omap_hwmod_ocp_if        *_mpu_port;
         u16                             flags;
+        u8                              mpu_rt_idx;
         u8                              response_lat;
         u8                              rst_lines_cnt;
         u8                              opt_clks_cnt;
diff --git a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
index d05fc7b54567..56cebb05509e 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
@@ -512,7 +512,7 @@ struct omap_hwmod omap2xxx_uart1_hwmod = {
         .mpu_irqs       = omap2_uart1_mpu_irqs,
         .sdma_reqs      = omap2_uart1_sdma_reqs,
         .main_clk       = "uart1_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP2UART1_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -532,7 +532,7 @@ struct omap_hwmod omap2xxx_uart2_hwmod = {
         .mpu_irqs       = omap2_uart2_mpu_irqs,
         .sdma_reqs      = omap2_uart2_sdma_reqs,
         .main_clk       = "uart2_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP2UART2_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -552,7 +552,7 @@ struct omap_hwmod omap2xxx_uart3_hwmod = {
         .mpu_irqs       = omap2_uart3_mpu_irqs,
         .sdma_reqs      = omap2_uart3_sdma_reqs,
         .main_clk       = "uart3_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP2UART3_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
index 28bbd56346a9..eb2f3b93b51c 100644
--- a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
@@ -562,6 +562,7 @@ static struct omap_hwmod am33xx_cpgmac0_hwmod = {
         .clkdm_name     = "cpsw_125mhz_clkdm",
         .flags          = (HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY),
         .main_clk       = "cpsw_125mhz_gclk",
+        .mpu_rt_idx     = 1,
         .prcm           = {
                 .omap4  = {
                         .clkctrl_offs   = AM33XX_CM_PER_CPGMAC0_CLKCTRL_OFFSET,
@@ -1512,7 +1513,7 @@ static struct omap_hwmod am33xx_uart1_hwmod = {
         .name           = "uart1",
         .class          = &uart_class,
         .clkdm_name     = "l4_wkup_clkdm",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_AM33XXUART1_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .main_clk       = "dpll_per_m2_div4_wkupdm_ck",
         .prcm           = {
                 .omap4  = {
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index f7a3df2fb579..0c3a427da544 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -490,7 +490,7 @@ static struct omap_hwmod omap3xxx_uart1_hwmod = {
         .mpu_irqs       = omap2_uart1_mpu_irqs,
         .sdma_reqs      = omap2_uart1_sdma_reqs,
         .main_clk       = "uart1_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_TI81XXUART1_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -509,7 +509,7 @@ static struct omap_hwmod omap3xxx_uart2_hwmod = {
         .mpu_irqs       = omap2_uart2_mpu_irqs,
         .sdma_reqs      = omap2_uart2_sdma_reqs,
         .main_clk       = "uart2_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_TI81XXUART2_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = CORE_MOD,
@@ -528,7 +528,8 @@ static struct omap_hwmod omap3xxx_uart3_hwmod = {
         .mpu_irqs       = omap2_uart3_mpu_irqs,
         .sdma_reqs      = omap2_uart3_sdma_reqs,
         .main_clk       = "uart3_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP3UART3_FLAGS | DEBUG_TI81XXUART3_FLAGS |
+                                HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = OMAP3430_PER_MOD,
@@ -558,7 +559,7 @@ static struct omap_hwmod omap36xx_uart4_hwmod = {
         .mpu_irqs       = uart4_mpu_irqs,
         .sdma_reqs      = uart4_sdma_reqs,
         .main_clk       = "uart4_fck",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP3UART4_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .prcm           = {
                 .omap2 = {
                         .module_offs = OMAP3430_PER_MOD,
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index d04b5e60fdbe..9c3b504477d7 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -2858,8 +2858,7 @@ static struct omap_hwmod omap44xx_uart3_hwmod = {
         .name           = "uart3",
         .class          = &omap44xx_uart_hwmod_class,
         .clkdm_name     = "l4_per_clkdm",
-        .flags          = HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET |
-                                HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP4UART3_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
@@ -2875,7 +2874,7 @@ static struct omap_hwmod omap44xx_uart4_hwmod = {
         .name           = "uart4",
         .class          = &omap44xx_uart_hwmod_class,
         .clkdm_name     = "l4_per_clkdm",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = DEBUG_OMAP4UART4_FLAGS | HWMOD_SWSUP_SIDLE_ACT,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
index f37ae96b70a1..3c70f5c1860f 100644
--- a/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_54xx_data.c
@@ -1375,7 +1375,7 @@ static struct omap_hwmod omap54xx_uart3_hwmod = {
         .name           = "uart3",
         .class          = &omap54xx_uart_hwmod_class,
         .clkdm_name     = "l4per_clkdm",
-        .flags          = HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET,
+        .flags          = DEBUG_OMAP4UART3_FLAGS,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
@@ -1391,6 +1391,7 @@ static struct omap_hwmod omap54xx_uart4_hwmod = {
         .name           = "uart4",
         .class          = &omap54xx_uart_hwmod_class,
         .clkdm_name     = "l4per_clkdm",
+        .flags          = DEBUG_OMAP4UART4_FLAGS,
         .main_clk       = "func_48m_fclk",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 3a674de6cb63..a388f8c1bcb3 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -208,17 +208,6 @@ static int __init omap_serial_early_init(void)
                                 pr_info("%s used as console in debug mode: uart%d clocks will not be gated",
                                         uart_name, uart->num);
                         }
-
-                        /*
-                         * omap-uart can be used for earlyprintk logs
-                         * So if omap-uart is used as console then prevent
-                         * uart reset and idle to get logs from omap-uart
-                         * until uart console driver is available to take
-                         * care for console messages.
-                         * Idling or resetting omap-uart while printing logs
-                         * early boot logs can stall the boot-up.
-                         */
-                        oh->flags |= HWMOD_INIT_NO_IDLE | HWMOD_INIT_NO_RESET;
                 }
         } while (1);
 
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index e115f6742107..c5be60d85e4b 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -1162,9 +1162,6 @@ static void __init eva_init(void)
         gpio_request_one(61, GPIOF_OUT_INIT_HIGH, NULL); /* LCDDON */
         gpio_request_one(202, GPIOF_OUT_INIT_LOW, NULL); /* LCD0_LED_CONT */
 
-        /* Touchscreen */
-        gpio_request_one(166, GPIOF_OUT_INIT_HIGH, NULL); /* TP_RST_B */
-
         /* GETHER */
         gpio_request_one(18, GPIOF_OUT_INIT_HIGH, NULL); /* PHY_RST */
 
diff --git a/arch/arm/mach-shmobile/board-bockw.c b/arch/arm/mach-shmobile/board-bockw.c
index d5554646916c..3354a85c90f7 100644
--- a/arch/arm/mach-shmobile/board-bockw.c
+++ b/arch/arm/mach-shmobile/board-bockw.c
@@ -167,7 +167,13 @@ static const struct pinctrl_map bockw_pinctrl_map[] = {
                                   "usb1", "usb1"),
         /* SDHI0 */
         PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
-                                  "sdhi0", "sdhi0"),
+                                  "sdhi0_data4", "sdhi0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
+                                  "sdhi0_ctrl", "sdhi0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
+                                  "sdhi0_cd", "sdhi0"),
+        PIN_MAP_MUX_GROUP_DEFAULT("sh_mobile_sdhi.0", "pfc-r8a7778",
+                                  "sdhi0_wp", "sdhi0"),
 };
 
 #define FPGA    0x18200000
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index d73e21d3ea8a..8d6bd5c5efb9 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -59,7 +59,7 @@ static __initdata struct gpio_led_platform_data lager_leds_pdata = {
 #define GPIO_KEY(c, g, d, ...) \
         { .code = c, .gpio = g, .desc = d, .active_low = 1 }
 
-static __initdata struct gpio_keys_button gpio_buttons[] = {
+static struct gpio_keys_button gpio_buttons[] = {
         GPIO_KEY(KEY_4,         RCAR_GP_PIN(1, 28),     "SW2-pin4"),
         GPIO_KEY(KEY_3,         RCAR_GP_PIN(1, 26),     "SW2-pin3"),
         GPIO_KEY(KEY_2,         RCAR_GP_PIN(1, 24),     "SW2-pin2"),
diff --git a/arch/arm/mach-sti/headsmp.S b/arch/arm/mach-sti/headsmp.S
index 78ebc7559f53..4c09bae86edf 100644
--- a/arch/arm/mach-sti/headsmp.S
+++ b/arch/arm/mach-sti/headsmp.S
@@ -16,8 +16,6 @@
 #include <linux/linkage.h>
 #include <linux/init.h>
 
-        __INIT
-
 /*
  * ST specific entry point for secondary CPUs.  This provides
  * a "holding pen" into which all secondary cores are held until we're
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 6cacdc8dd654..db5c2cab8fda 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -421,24 +421,28 @@ config CPU_32v3
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v4
         bool
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v4T
         bool
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v5
         bool
         select CPU_USE_DOMAINS if MMU
         select NEEDS_SYSCALL_FOR_CMPXCHG if SMP
         select TLS_REG_EMUL if SMP || !MMU
+        select NEED_KUSER_HELPERS
 
 config CPU_32v6
         bool
@@ -776,6 +780,7 @@ config CPU_BPREDICT_DISABLE
 
 config TLS_REG_EMUL
         bool
+        select NEED_KUSER_HELPERS
         help
           An SMP system using a pre-ARMv6 processor (there are apparently
           a few prototypes like that in existence) and therefore access to
@@ -783,11 +788,40 @@ config TLS_REG_EMUL
 
 config NEEDS_SYSCALL_FOR_CMPXCHG
         bool
+        select NEED_KUSER_HELPERS
         help
           SMP on a pre-ARMv6 processor?  Well OK then.
           Forget about fast user space cmpxchg support.
           It is just not possible.
 
+config NEED_KUSER_HELPERS
+        bool
+
+config KUSER_HELPERS
+        bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
+        default y
+        help
+          Warning: disabling this option may break user programs.
+
+          Provide kuser helpers in the vector page.  The kernel provides
+          helper code to userspace in read only form at a fixed location
+          in the high vector page to allow userspace to be independent of
+          the CPU type fitted to the system.  This permits binaries to be
+          run on ARMv4 through to ARMv7 without modification.
+
+          However, the fixed address nature of these helpers can be used
+          by ROP (return orientated programming) authors when creating
+          exploits.
+
+          If all of the binaries and libraries which run on your platform
+          are built specifically for your platform, and make no use of
+          these helpers, then you can turn this option off.  However,
+          when such an binary or library is run, it will receive a SIGILL
+          signal, which will terminate the program.
+
+          Say N here only if you are absolutely certain that you do not
+          need these helpers; otherwise, the safe option is to say Y.
+
 config DMA_CACHE_RWFO
         bool "Enable read/write for ownership DMA cache maintenance"
         depends on CPU_V6K && SMP
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index b55b1015724b..4a0544492f10 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -245,7 +245,8 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
         if (cpumask_test_and_clear_cpu(cpu, &tlb_flush_pending)) {
                 local_flush_bp_all();
                 local_flush_tlb_all();
-                dummy_flush_tlb_a15_erratum();
+                if (erratum_a15_798181())
+                        dummy_flush_tlb_a15_erratum();
         }
 
         atomic64_set(&per_cpu(active_asids, cpu), asid);
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4f56617a2392..53cdbd39ec8e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -989,6 +989,7 @@ phys_addr_t arm_lowmem_limit __initdata = 0;
 
 void __init sanity_check_meminfo(void)
 {
+        phys_addr_t memblock_limit = 0;
         int i, j, highmem = 0;
         phys_addr_t vmalloc_limit = __pa(vmalloc_min - 1) + 1;
 
@@ -1052,9 +1053,32 @@ void __init sanity_check_meminfo(void)
                         bank->size = size_limit;
                 }
 #endif
-                if (!bank->highmem && bank->start + bank->size > arm_lowmem_limit)
-                        arm_lowmem_limit = bank->start + bank->size;
+                if (!bank->highmem) {
+                        phys_addr_t bank_end = bank->start + bank->size;
 
+                        if (bank_end > arm_lowmem_limit)
+                                arm_lowmem_limit = bank_end;
+
+                        /*
+                         * Find the first non-section-aligned page, and point
+                         * memblock_limit at it. This relies on rounding the
+                         * limit down to be section-aligned, which happens at
+                         * the end of this function.
+                         *
+                         * With this algorithm, the start or end of almost any
+                         * bank can be non-section-aligned. The only exception
+                         * is that the start of the bank 0 must be section-
+                         * aligned, since otherwise memory would need to be
+                         * allocated when mapping the start of bank 0, which
+                         * occurs before any free memory is mapped.
+                         */
+                        if (!memblock_limit) {
+                                if (!IS_ALIGNED(bank->start, SECTION_SIZE))
+                                        memblock_limit = bank->start;
+                                else if (!IS_ALIGNED(bank_end, SECTION_SIZE))
+                                        memblock_limit = bank_end;
+                        }
+                }
                 j++;
         }
 #ifdef CONFIG_HIGHMEM
@@ -1079,7 +1103,18 @@ void __init sanity_check_meminfo(void)
 #endif
         meminfo.nr_banks = j;
         high_memory = __va(arm_lowmem_limit - 1) + 1;
-        memblock_set_current_limit(arm_lowmem_limit);
+
+        /*
+         * Round the memblock limit down to a section size.  This
+         * helps to ensure that we will allocate memory from the
+         * last full section, which should be mapped.
+         */
+        if (memblock_limit)
+                memblock_limit = round_down(memblock_limit, SECTION_SIZE);
+        if (!memblock_limit)
+                memblock_limit = arm_lowmem_limit;
+
+        memblock_set_current_limit(memblock_limit);
 }
 
 static inline void prepare_page_table(void)
@@ -1160,7 +1195,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
         /*
          * Allocate the vector page early.
          */
-        vectors = early_alloc(PAGE_SIZE);
+        vectors = early_alloc(PAGE_SIZE * 2);
 
         early_trap_init(vectors);
 
@@ -1205,15 +1240,27 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
         map.pfn = __phys_to_pfn(virt_to_phys(vectors));
         map.virtual = 0xffff0000;
         map.length = PAGE_SIZE;
+#ifdef CONFIG_KUSER_HELPERS
         map.type = MT_HIGH_VECTORS;
+#else
+        map.type = MT_LOW_VECTORS;
+#endif
         create_mapping(&map);
 
         if (!vectors_high()) {
                 map.virtual = 0;
+                map.length = PAGE_SIZE * 2;
                 map.type = MT_LOW_VECTORS;
                 create_mapping(&map);
         }
 
+        /* Now create a kernel read-only mapping */
+        map.pfn += 1;
+        map.virtual = 0xffff0000 + PAGE_SIZE;
+        map.length = PAGE_SIZE;
+        map.type = MT_LOW_VECTORS;
+        create_mapping(&map);
+
         /*
          * Ask the machine support to map in the statically mapped devices.
          */
@@ -1276,8 +1323,6 @@ void __init paging_init(struct machine_desc *mdesc)
 {
         void *zero_page;
 
-        memblock_set_current_limit(arm_lowmem_limit);
-
         build_mem_type_table();
         prepare_page_table();
         map_lowmem();
diff --git a/arch/arm/mm/proc-v7-2level.S b/arch/arm/mm/proc-v7-2level.S
index f64afb9f1bd5..bdd3be4be77a 100644
--- a/arch/arm/mm/proc-v7-2level.S
+++ b/arch/arm/mm/proc-v7-2level.S
@@ -110,7 +110,7 @@ ENTRY(cpu_v7_set_pte_ext)
  ARM(   str     r3, [r0, #2048]! )
  THUMB( add     r0, r0, #2048 )
  THUMB( str     r3, [r0] )
-        ALT_SMP(mov     pc,lr)
+        ALT_SMP(W(nop))
         ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
         mov     pc, lr
diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
index c36ac69488c8..01a719e18bb0 100644
--- a/arch/arm/mm/proc-v7-3level.S
+++ b/arch/arm/mm/proc-v7-3level.S
@@ -81,7 +81,7 @@ ENTRY(cpu_v7_set_pte_ext)
         tst     r3, #1 << (55 - 32)             @ L_PTE_DIRTY
         orreq   r2, #L_PTE_RDONLY
 1:      strd    r2, r3, [r0]
-        ALT_SMP(mov     pc, lr)
+        ALT_SMP(W(nop))
         ALT_UP (mcr     p15, 0, r0, c7, c10, 1)         @ flush_pte
 #endif
         mov     pc, lr
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 5c6d5a3050ea..73398bcf9bd8 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -75,13 +75,14 @@ ENTRY(cpu_v7_do_idle)
 ENDPROC(cpu_v7_do_idle)
 
 ENTRY(cpu_v7_dcache_clean_area)
-        ALT_SMP(mov     pc, lr)                 @ MP extensions imply L1 PTW
-        ALT_UP(W(nop))
-        dcache_line_size r2, r3
-1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
+        ALT_SMP(W(nop))                 @ MP extensions imply L1 PTW
+        ALT_UP_B(1f)
+        mov     pc, lr
+1:      dcache_line_size r2, r3
+2:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
         add     r0, r0, r2
         subs    r1, r1, r2
-        bhi     1b
+        bhi     2b
         dsb
         mov     pc, lr
 ENDPROC(cpu_v7_dcache_clean_area)
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index f71c37edca26..c9770ba5c7df 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -172,7 +172,7 @@ static void __init xen_percpu_init(void *unused)
         enable_percpu_irq(xen_events_irq, 0);
 }
 
-static void xen_restart(char str, const char *cmd)
+static void xen_restart(enum reboot_mode reboot_mode, const char *cmd)
 {
         struct sched_shutdown r = { .reason = SHUTDOWN_reboot };
         int rc;
diff --git a/arch/avr32/boards/atngw100/mrmt.c b/arch/avr32/boards/atngw100/mrmt.c
index f91431963452..7de083d19b7e 100644
--- a/arch/avr32/boards/atngw100/mrmt.c
+++ b/arch/avr32/boards/atngw100/mrmt.c
@@ -150,7 +150,6 @@ static struct ac97c_platform_data __initdata ac97c0_data = {
 static struct platform_device rmt_ts_device = {
         .name   = "ucb1400_ts",
         .id     = -1,
-        }
 };
 #endif
 
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 7913695b2fcb..efbd2929aeb7 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -31,7 +31,7 @@ CONFIG_ACPI_FAN=m
 CONFIG_ACPI_DOCK=y
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/gensparse_defconfig b/arch/ia64/configs/gensparse_defconfig
index f8e913365423..f64980dd20c3 100644
--- a/arch/ia64/configs/gensparse_defconfig
+++ b/arch/ia64/configs/gensparse_defconfig
@@ -25,7 +25,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/tiger_defconfig b/arch/ia64/configs/tiger_defconfig
index a5a9e02e60a0..0f4e9e41f130 100644
--- a/arch/ia64/configs/tiger_defconfig
+++ b/arch/ia64/configs/tiger_defconfig
@@ -31,7 +31,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/ia64/configs/xen_domu_defconfig b/arch/ia64/configs/xen_domu_defconfig
index 37b9b422caad..b025acfde5c1 100644
--- a/arch/ia64/configs/xen_domu_defconfig
+++ b/arch/ia64/configs/xen_domu_defconfig
@@ -32,7 +32,7 @@ CONFIG_ACPI_BUTTON=m
 CONFIG_ACPI_FAN=m
 CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=m
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c3abed332301..e12764c2a9d0 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -114,6 +114,7 @@ config BCM47XX
         select FW_CFE
         select HW_HAS_PCI
         select IRQ_CPU
+        select SYS_HAS_CPU_MIPS32_R1
         select NO_EXCEPT_FILL
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_LITTLE_ENDIAN
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index ba611927749b..2b8b118398c4 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -2,7 +2,6 @@ if BCM47XX
 
 config BCM47XX_SSB
         bool "SSB Support for Broadcom BCM47XX"
-        select SYS_HAS_CPU_MIPS32_R1
         select SSB
         select SSB_DRIVER_MIPS
         select SSB_DRIVER_EXTIF
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 1dc086087a72..fa44f3ec5302 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -17,6 +17,8 @@
 #define current_cpu_type()      current_cpu_data.cputype
 #endif
 
+#define boot_cpu_type()         cpu_data[0].cputype
+
 /*
  * SMP assumption: Options of CPU 0 are a superset of all processors.
  * This is true for all known MIPS systems.
diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
index 5b2f2e68e57f..9488fa5f8866 100644
--- a/arch/mips/include/asm/mach-generic/spaces.h
+++ b/arch/mips/include/asm/mach-generic/spaces.h
@@ -25,8 +25,12 @@
 #else
 #define CAC_BASE                _AC(0x80000000, UL)
 #endif
+#ifndef IO_BASE
 #define IO_BASE                 _AC(0xa0000000, UL)
+#endif
+#ifndef UNCAC_BASE
 #define UNCAC_BASE              _AC(0xa0000000, UL)
+#endif
 
 #ifndef MAP_BASE
 #ifdef CONFIG_KVM_GUEST
diff --git a/arch/mips/include/uapi/asm/siginfo.h b/arch/mips/include/uapi/asm/siginfo.h
index b7a23064841f..88e292b7719e 100644
--- a/arch/mips/include/uapi/asm/siginfo.h
+++ b/arch/mips/include/uapi/asm/siginfo.h
@@ -25,11 +25,12 @@ struct siginfo;
 /*
  * Careful to keep union _sifields from shifting ...
  */
-#if __SIZEOF_LONG__ == 4
+#if _MIPS_SZLONG == 32
 #define __ARCH_SI_PREAMBLE_SIZE (3 * sizeof(int))
-#endif
-#if __SIZEOF_LONG__ == 8
+#elif _MIPS_SZLONG == 64
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
+#else
+#error _MIPS_SZLONG neither 32 nor 64
 #endif
 
 #include <asm-generic/siginfo.h>
diff --git a/arch/mips/kernel/bmips_vec.S b/arch/mips/kernel/bmips_vec.S
index f739aedcb509..bd79c4f9bff4 100644
--- a/arch/mips/kernel/bmips_vec.S
+++ b/arch/mips/kernel/bmips_vec.S
@@ -54,7 +54,11 @@ LEAF(bmips_smp_movevec)
         /* set up CPU1 CBR; move BASE to 0xa000_0000 */
         li      k0, 0xff400000
         mtc0    k0, $22, 6
-        li      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_1
+        /* set up relocation vector address based on thread ID */
+        mfc0    k1, $22, 3
+        srl     k1, 16
+        andi    k1, 0x8000
+        or      k1, CKSEG1 | BMIPS_RELO_VECTOR_CONTROL_0
         or      k0, k1
         li      k1, 0xa0080000
         sw      k1, 0(k0)
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index c0bb4d59076a..126da74d4c55 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -66,6 +66,8 @@ static void __init bmips_smp_setup(void)
         int i, cpu = 1, boot_cpu = 0;
 
 #if defined(CONFIG_CPU_BMIPS4350) || defined(CONFIG_CPU_BMIPS4380)
+        int cpu_hw_intr;
+
         /* arbitration priority */
         clear_c0_brcm_cmt_ctrl(0x30);
 
@@ -79,15 +81,13 @@ static void __init bmips_smp_setup(void)
          * MIPS interrupts 0,1 (SW INT 0,1) cross over to the other thread
          * MIPS interrupt 2 (HW INT 0) is the CPU0 L1 controller output
          * MIPS interrupt 3 (HW INT 1) is the CPU1 L1 controller output
-         *
-         * If booting from TP1, leave the existing CMT interrupt routing
-         * such that TP0 responds to SW1 and TP1 responds to SW0.
          */
         if (boot_cpu == 0)
-                change_c0_brcm_cmt_intr(0xf8018000,
-                                        (0x02 << 27) | (0x03 << 15));
+                cpu_hw_intr = 0x02;
         else
-                change_c0_brcm_cmt_intr(0xf8018000, (0x1d << 27));
+                cpu_hw_intr = 0x1d;
+
+        change_c0_brcm_cmt_intr(0xf8018000, (cpu_hw_intr << 27) | (0x03 << 15));
 
         /* single core, 2 threads (2 pipelines) */
         max_cpus = 2;
@@ -202,9 +202,15 @@ static void bmips_init_secondary(void)
 #if defined(CONFIG_CPU_BMIPS4350) || defined(CONFIG_CPU_BMIPS4380)
         void __iomem *cbr = BMIPS_GET_CBR();
         unsigned long old_vec;
+        unsigned long relo_vector;
+        int boot_cpu;
+
+        boot_cpu = !!(read_c0_brcm_cmt_local() & (1 << 31));
+        relo_vector = boot_cpu ? BMIPS_RELO_VECTOR_CONTROL_0 :
+                          BMIPS_RELO_VECTOR_CONTROL_1;
 
-        old_vec = __raw_readl(cbr + BMIPS_RELO_VECTOR_CONTROL_1);
-        __raw_writel(old_vec & ~0x20000000, cbr + BMIPS_RELO_VECTOR_CONTROL_1);
+        old_vec = __raw_readl(cbr + relo_vector);
+        __raw_writel(old_vec & ~0x20000000, cbr + relo_vector);
 
         clear_c0_cause(smp_processor_id() ? C_SW1 : C_SW0);
 #elif defined(CONFIG_CPU_BMIPS5000)
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index e4b1140cdae0..3a2b6e9f25cf 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -166,7 +166,7 @@ static void mipsxx_reg_setup(struct op_counter_config *ctr)
                         reg.control[i] |= M_PERFCTL_USER;
                 if (ctr[i].exl)
                         reg.control[i] |= M_PERFCTL_EXL;
-                if (current_cpu_type() == CPU_XLR)
+                if (boot_cpu_type() == CPU_XLR)
                         reg.control[i] |= M_PERFCTL_COUNT_ALL_THREADS;
                 reg.counter[i] = 0x80000000 - ctr[i].count;
         }
diff --git a/arch/mips/pnx833x/common/platform.c b/arch/mips/pnx833x/common/platform.c
index d22dc0d6f289..2b7e837dc2e2 100644
--- a/arch/mips/pnx833x/common/platform.c
+++ b/arch/mips/pnx833x/common/platform.c
@@ -206,11 +206,13 @@ static struct resource pnx833x_ethernet_resources[] = {
                 .end   = PNX8335_IP3902_PORTS_END,
                 .flags = IORESOURCE_MEM,
         },
+#ifdef CONFIG_SOC_PNX8335
         [1] = {
                 .start = PNX8335_PIC_ETHERNET_INT,
                 .end   = PNX8335_PIC_ETHERNET_INT,
                 .flags = IORESOURCE_IRQ,
         },
+#endif
 };
 
 static struct platform_device pnx833x_ethernet_device = {
diff --git a/arch/mips/powertv/asic/asic_devices.c b/arch/mips/powertv/asic/asic_devices.c
index 9f64c2387808..0238af1ba503 100644
--- a/arch/mips/powertv/asic/asic_devices.c
+++ b/arch/mips/powertv/asic/asic_devices.c
@@ -529,8 +529,7 @@ EXPORT_SYMBOL(asic_resource_get);
  */
 void platform_release_memory(void *ptr, int size)
 {
-        free_reserved_area((unsigned long)ptr, (unsigned long)(ptr + size),
-                           -1, NULL);
+        free_reserved_area(ptr, ptr + size, -1, NULL);
 }
 EXPORT_SYMBOL(platform_release_memory);
 
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
new file mode 100644
index 000000000000..f11006361297
--- /dev/null
+++ b/arch/parisc/configs/c8000_defconfig
@@ -0,0 +1,279 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_LZMA=y
+CONFIG_RD_LZO=y
+CONFIG_EXPERT=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SLAB=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_PA8X00=y
+CONFIG_MLONGCALLS=y
+CONFIG_64BIT=y
+CONFIG_SMP=y
+CONFIG_PREEMPT=y
+# CONFIG_CROSS_MEMORY_ATTACH is not set
+CONFIG_IOMMU_CCIO=y
+CONFIG_PCI=y
+CONFIG_PCI_LBA=y
+# CONFIG_SUPERIO is not set
+# CONFIG_CHASSIS_LCD_LED is not set
+# CONFIG_PDC_CHASSIS is not set
+# CONFIG_PDC_CHASSIS_WARN is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_BINFMT_MISC=m
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=m
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+# CONFIG_IPV6 is not set
+CONFIG_IP_DCCP=m
+# CONFIG_IP_DCCP_CCID3 is not set
+CONFIG_TIPC=m
+CONFIG_LLC2=m
+CONFIG_DNS_RESOLVER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_STANDALONE is not set
+CONFIG_PARPORT=y
+CONFIG_PARPORT_PC=y
+CONFIG_PARPORT_PC_FIFO=y
+CONFIG_BLK_DEV_UMEM=m
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_SX8=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=6144
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_CDROM_PKTCDVD_WCACHE=y
+CONFIG_ATA_OVER_ETH=m
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDECD=y
+CONFIG_BLK_DEV_PLATFORM=y
+CONFIG_BLK_DEV_GENERIC=y
+CONFIG_BLK_DEV_SIIMAGE=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_SCH=m
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_FC_ATTRS=y
+CONFIG_SCSI_SAS_LIBSAS=m
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_FUSION=y
+CONFIG_FUSION_SPI=y
+CONFIG_FUSION_SAS=y
+CONFIG_NETDEVICES=y
+CONFIG_DUMMY=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=y
+CONFIG_E1000=y
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_MPPE=m
+CONFIG_PPPOE=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+# CONFIG_WLAN is not set
+CONFIG_INPUT_FF_MEMLESS=m
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_HIL_OLD is not set
+# CONFIG_KEYBOARD_HIL is not set
+CONFIG_MOUSE_PS2=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_CM109=m
+CONFIG_SERIO_SERPORT=m
+CONFIG_SERIO_PARKBD=m
+CONFIG_SERIO_GSCPS2=m
+# CONFIG_HP_SDC is not set
+CONFIG_SERIO_PCIPS2=m
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_RAW=m
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=8
+CONFIG_SERIAL_8250_RUNTIME_UARTS=8
+CONFIG_SERIAL_8250_EXTENDED=y
+# CONFIG_SERIAL_MUX is not set
+CONFIG_SERIAL_JSM=m
+CONFIG_PRINTER=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=m
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_SSB=m
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_AGP=y
+CONFIG_AGP_PARISC=y
+CONFIG_DRM=y
+CONFIG_DRM_RADEON=y
+CONFIG_FIRMWARE_EDID=y
+CONFIG_FB_FOREIGN_ENDIAN=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
+# CONFIG_FB_STI is not set
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_STI_CONSOLE is not set
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+# CONFIG_LOGO_LINUX_CLUT224 is not set
+CONFIG_SOUND=m
+CONFIG_SND=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_VERBOSE_PRINTK=y
+CONFIG_SND_AD1889=m
+# CONFIG_SND_USB is not set
+# CONFIG_SND_GSC is not set
+CONFIG_HID_A4TECH=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_KYE=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_USB_HID=m
+CONFIG_USB=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_STORAGE=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT3_FS=y
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+CONFIG_EXT4_FS=m
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_PROC_INFO=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_QUOTA=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=m
+CONFIG_FUSE_FS=m
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_PROC_KCORE=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_NFS_FS=m
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=m
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_DEBUG_FS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_SLAB=y
+CONFIG_DEBUG_SLAB_LEAK=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_STACKOVERFLOW=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_DEBUG_RT_MUTEXES=y
+CONFIG_RT_MUTEX_TESTER=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_BLOCK_EXT_DEVT=y
+CONFIG_LATENCYTOP=y
+CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
+CONFIG_KEYS=y
+# CONFIG_CRYPTO_HW is not set
+CONFIG_FONTS=y
diff --git a/arch/parisc/include/asm/parisc-device.h b/arch/parisc/include/asm/parisc-device.h
index 9afdad6c2ffb..eaf4dc1c7294 100644
--- a/arch/parisc/include/asm/parisc-device.h
+++ b/arch/parisc/include/asm/parisc-device.h
@@ -23,6 +23,7 @@ struct parisc_device {
         /* generic info returned from pdc_pat_cell_module() */
         unsigned long   mod_info;       /* PAT specific - Misc Module info */
         unsigned long   pmod_loc;       /* physical Module location */
+        unsigned long   mod0;
 #endif
         u64             dma_mask;       /* DMA mask for I/O */
         struct device   dev;
@@ -61,4 +62,6 @@ parisc_get_drvdata(struct parisc_device *d)
 
 extern struct bus_type parisc_bus_type;
 
+int iosapic_serial_irq(struct parisc_device *dev);
+
 #endif /*_ASM_PARISC_PARISC_DEVICE_H_*/
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 2e65aa54bd10..c035673209f7 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -71,18 +71,27 @@ flush_cache_all_local(void)
 }
 EXPORT_SYMBOL(flush_cache_all_local);
 
+/* Virtual address of pfn.  */
+#define pfn_va(pfn)     __va(PFN_PHYS(pfn))
+
 void
 update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
 {
-        struct page *page = pte_page(*ptep);
+        unsigned long pfn = pte_pfn(*ptep);
+        struct page *page;
 
-        if (pfn_valid(page_to_pfn(page)) && page_mapping(page) &&
-            test_bit(PG_dcache_dirty, &page->flags)) {
+        /* We don't have pte special.  As a result, we can be called with
+           an invalid pfn and we don't need to flush the kernel dcache page.
+           This occurs with FireGL card in C8000.  */
+        if (!pfn_valid(pfn))
+                return;
 
-                flush_kernel_dcache_page(page);
+        page = pfn_to_page(pfn);
+        if (page_mapping(page) && test_bit(PG_dcache_dirty, &page->flags)) {
+                flush_kernel_dcache_page_addr(pfn_va(pfn));
                 clear_bit(PG_dcache_dirty, &page->flags);
         } else if (parisc_requires_coherency())
-                flush_kernel_dcache_page(page);
+                flush_kernel_dcache_page_addr(pfn_va(pfn));
 }
 
 void
@@ -495,44 +504,42 @@ static inline pte_t *get_ptep(pgd_t *pgd, unsigned long addr)
 
 void flush_cache_mm(struct mm_struct *mm)
 {
+        struct vm_area_struct *vma;
+        pgd_t *pgd;
+
         /* Flushing the whole cache on each cpu takes forever on
            rp3440, etc.  So, avoid it if the mm isn't too big.  */
-        if (mm_total_size(mm) < parisc_cache_flush_threshold) {
-                struct vm_area_struct *vma;
-
-                if (mm->context == mfsp(3)) {
-                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                flush_user_dcache_range_asm(vma->vm_start,
-                                        vma->vm_end);
-                                if (vma->vm_flags & VM_EXEC)
-                                        flush_user_icache_range_asm(
-                                          vma->vm_start, vma->vm_end);
-                        }
-                } else {
-                        pgd_t *pgd = mm->pgd;
-
-                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
-                                unsigned long addr;
-
-                                for (addr = vma->vm_start; addr < vma->vm_end;
-                                     addr += PAGE_SIZE) {
-                                        pte_t *ptep = get_ptep(pgd, addr);
-                                        if (ptep != NULL) {
-                                                pte_t pte = *ptep;
-                                                __flush_cache_page(vma, addr,
-                                                  page_to_phys(pte_page(pte)));
-                                        }
-                                }
-                        }
+        if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
+                flush_cache_all();
+                return;
+        }
+
+        if (mm->context == mfsp(3)) {
+                for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                        flush_user_dcache_range_asm(vma->vm_start, vma->vm_end);
+                        if ((vma->vm_flags & VM_EXEC) == 0)
+                                continue;
+                        flush_user_icache_range_asm(vma->vm_start, vma->vm_end);
                 }
                 return;
         }
 
-#ifdef CONFIG_SMP
-        flush_cache_all();
-#else
-        flush_cache_all_local();
-#endif
+        pgd = mm->pgd;
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                unsigned long addr;
+
+                for (addr = vma->vm_start; addr < vma->vm_end;
+                     addr += PAGE_SIZE) {
+                        unsigned long pfn;
+                        pte_t *ptep = get_ptep(pgd, addr);
+                        if (!ptep)
+                                continue;
+                        pfn = pte_pfn(*ptep);
+                        if (!pfn_valid(pfn))
+                                continue;
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
+                }
+        }
 }
 
 void
@@ -556,33 +563,32 @@ flush_user_icache_range(unsigned long start, unsigned long end)
 void flush_cache_range(struct vm_area_struct *vma,
                 unsigned long start, unsigned long end)
 {
+        unsigned long addr;
+        pgd_t *pgd;
+
         BUG_ON(!vma->vm_mm->context);
 
-        if ((end - start) < parisc_cache_flush_threshold) {
-                if (vma->vm_mm->context == mfsp(3)) {
-                        flush_user_dcache_range_asm(start, end);
-                        if (vma->vm_flags & VM_EXEC)
-                                flush_user_icache_range_asm(start, end);
-                } else {
-                        unsigned long addr;
-                        pgd_t *pgd = vma->vm_mm->pgd;
-
-                        for (addr = start & PAGE_MASK; addr < end;
-                             addr += PAGE_SIZE) {
-                                pte_t *ptep = get_ptep(pgd, addr);
-                                if (ptep != NULL) {
-                                        pte_t pte = *ptep;
-                                        flush_cache_page(vma,
-                                           addr, pte_pfn(pte));
-                                }
-                        }
-                }
-        } else {
-#ifdef CONFIG_SMP
+        if ((end - start) >= parisc_cache_flush_threshold) {
                 flush_cache_all();
-#else
-                flush_cache_all_local();
-#endif
+                return;
+        }
+
+        if (vma->vm_mm->context == mfsp(3)) {
+                flush_user_dcache_range_asm(start, end);
+                if (vma->vm_flags & VM_EXEC)
+                        flush_user_icache_range_asm(start, end);
+                return;
+        }
+
+        pgd = vma->vm_mm->pgd;
+        for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
+                unsigned long pfn;
+                pte_t *ptep = get_ptep(pgd, addr);
+                if (!ptep)
+                        continue;
+                pfn = pte_pfn(*ptep);
+                if (pfn_valid(pfn))
+                        __flush_cache_page(vma, addr, PFN_PHYS(pfn));
         }
 }
 
@@ -591,9 +597,10 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 {
         BUG_ON(!vma->vm_mm->context);
 
-        flush_tlb_page(vma, vmaddr);
-        __flush_cache_page(vma, vmaddr, page_to_phys(pfn_to_page(pfn)));
-
+        if (pfn_valid(pfn)) {
+                flush_tlb_page(vma, vmaddr);
+                __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
+        }
 }
 
 #ifdef CONFIG_PARISC_TMPALIAS
diff --git a/arch/parisc/kernel/inventory.c b/arch/parisc/kernel/inventory.c
index 3295ef4a185d..f0b6722fc706 100644
--- a/arch/parisc/kernel/inventory.c
+++ b/arch/parisc/kernel/inventory.c
@@ -211,6 +211,7 @@ pat_query_module(ulong pcell_loc, ulong mod_index)
         /* REVISIT: who is the consumer of this? not sure yet... */
         dev->mod_info = pa_pdc_cell->mod_info;  /* pass to PAT_GET_ENTITY() */
         dev->pmod_loc = pa_pdc_cell->mod_location;
+        dev->mod0 = pa_pdc_cell->mod[0];
 
         register_parisc_device(dev);    /* advertise device */
 
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 940188d1942c..07349b002687 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -56,13 +56,6 @@
 #define A(__x)  ((unsigned long)(__x))
 
 /*
- * Atomically swap in the new signal mask, and wait for a signal.
- */
-#ifdef CONFIG_64BIT
-#include "sys32.h"
-#endif
-
-/*
  * Do a signal return - restore sigcontext.
  */
 
diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
index 33eca1b04926..6c6a271a6140 100644
--- a/arch/parisc/kernel/signal32.c
+++ b/arch/parisc/kernel/signal32.c
@@ -34,7 +34,6 @@
 #include <asm/uaccess.h>
 
 #include "signal32.h"
-#include "sys32.h"
 
 #define DEBUG_COMPAT_SIG 0 
 #define DEBUG_COMPAT_SIG_LEVEL 2
diff --git a/arch/parisc/kernel/sys32.h b/arch/parisc/kernel/sys32.h
deleted file mode 100644
index 60dd470f39f8..000000000000
--- a/arch/parisc/kernel/sys32.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* 
- *    Copyright (C) 2002 Richard Hirst <rhirst at parisc-linux.org>
- *    Copyright (C) 2003 James Bottomley <jejb at parisc-linux.org>
- *    Copyright (C) 2003 Randolph Chung <tausq with parisc-linux.org>
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-#ifndef _PARISC64_KERNEL_SYS32_H
-#define _PARISC64_KERNEL_SYS32_H
-
-#include <linux/compat.h>
-
-/* Call a kernel syscall which will use kernel space instead of user
- * space for its copy_to/from_user.
- */
-#define KERNEL_SYSCALL(ret, syscall, args...) \
-{ \
-    mm_segment_t old_fs = get_fs(); \
-    set_fs(KERNEL_DS); \
-    ret = syscall(args); \
-    set_fs (old_fs); \
-}
-
-#endif
diff --git a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
index a134ff4da12e..bb9f3b64de55 100644
--- a/arch/parisc/kernel/sys_parisc32.c
+++ b/arch/parisc/kernel/sys_parisc32.c
@@ -42,8 +42,6 @@
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
 
-#include "sys32.h"
-
 #undef DEBUG
 
 #ifdef DEBUG
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 3bf72cd2c8fc..dbd9d3c991e8 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -566,7 +566,7 @@ config SCHED_SMT
 config PPC_DENORMALISATION
         bool "PowerPC denormalisation exception handling"
         depends on PPC_BOOK3S_64
-        default "n"
+        default "y" if PPC_POWERNV
         ---help---
           Add support for handling denormalisation of single precision
           values.  Useful for bare metal only.  If unsure say Y here.
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index c86fcb92358e..0e8cfd09da2f 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -58,7 +58,7 @@ CONFIG_SCHED_SMT=y
 CONFIG_PPC_DENORMALISATION=y
 CONFIG_PCCARD=y
 CONFIG_ELECTRA_CF=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_RPA=m
 CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
 CONFIG_PACKET=y
diff --git a/arch/powerpc/configs/ppc64e_defconfig b/arch/powerpc/configs/ppc64e_defconfig
index 4b20f76172e2..0085dc4642c5 100644
--- a/arch/powerpc/configs/ppc64e_defconfig
+++ b/arch/powerpc/configs/ppc64e_defconfig
@@ -32,7 +32,7 @@ CONFIG_IRQ_ALL_CPUS=y
 CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_PCI_MSI=y
 CONFIG_PCCARD=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM_USER=m
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index bea8587c3af5..1d4b9763895d 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -53,7 +53,7 @@ CONFIG_PPC_64K_PAGES=y
 CONFIG_PPC_SUBPAGE_PROT=y
 CONFIG_SCHED_SMT=y
 CONFIG_PPC_DENORMALISATION=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_RPA=m
 CONFIG_HOTPLUG_PCI_RPA_DLPAR=m
 CONFIG_PACKET=y
diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
index 2dd7bfc459be..8b2492644754 100644
--- a/arch/powerpc/include/asm/perf_event_server.h
+++ b/arch/powerpc/include/asm/perf_event_server.h
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <asm/hw_irq.h>
 #include <linux/device.h>
+#include <uapi/asm/perf_event.h>
 
 #define MAX_HWEVENTS            8
 #define MAX_EVENT_ALTERNATIVES  8
@@ -69,11 +70,6 @@ struct power_pmu {
 #define PPMU_LIMITED_PMC_REQD   2       /* have to put this on a limited PMC */
 #define PPMU_ONLY_COUNT_RUN     4       /* only counting in run state */
 
-/*
- * We use the event config bit 63 as a flag to request EBB.
- */
-#define EVENT_CONFIG_EBB_SHIFT  63
-
 extern int register_power_pmu(struct power_pmu *);
 
 struct pt_regs;
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index 47a35b08b963..e378cccfca55 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -247,6 +247,10 @@ struct thread_struct {
         unsigned long   tm_orig_msr;    /* Thread's MSR on ctx switch */
         struct pt_regs  ckpt_regs;      /* Checkpointed registers */
 
+        unsigned long   tm_tar;
+        unsigned long   tm_ppr;
+        unsigned long   tm_dscr;
+
         /*
          * Transactional FP and VSX 0-31 register set.
          * NOTE: the sense of these is the opposite of the integer ckpt_regs!
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index a6840e4e24f7..99222e27f173 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -254,19 +254,28 @@
 #define SPRN_HRMOR      0x139   /* Real mode offset register */
 #define SPRN_HSRR0      0x13A   /* Hypervisor Save/Restore 0 */
 #define SPRN_HSRR1      0x13B   /* Hypervisor Save/Restore 1 */
+/* HFSCR and FSCR bit numbers are the same */
+#define FSCR_TAR_LG     8       /* Enable Target Address Register */
+#define FSCR_EBB_LG     7       /* Enable Event Based Branching */
+#define FSCR_TM_LG      5       /* Enable Transactional Memory */
+#define FSCR_PM_LG      4       /* Enable prob/priv access to PMU SPRs */
+#define FSCR_BHRB_LG    3       /* Enable Branch History Rolling Buffer*/
+#define FSCR_DSCR_LG    2       /* Enable Data Stream Control Register */
+#define FSCR_VECVSX_LG  1       /* Enable VMX/VSX  */
+#define FSCR_FP_LG      0       /* Enable Floating Point */
 #define SPRN_FSCR       0x099   /* Facility Status & Control Register */
-#define   FSCR_TAR      (1 << (63-55)) /* Enable Target Address Register */
-#define   FSCR_EBB      (1 << (63-56)) /* Enable Event Based Branching */
-#define   FSCR_DSCR     (1 << (63-61)) /* Enable Data Stream Control Register */
+#define   FSCR_TAR      __MASK(FSCR_TAR_LG)
+#define   FSCR_EBB      __MASK(FSCR_EBB_LG)
+#define   FSCR_DSCR     __MASK(FSCR_DSCR_LG)
 #define SPRN_HFSCR      0xbe    /* HV=1 Facility Status & Control Register */
-#define   HFSCR_TAR     (1 << (63-55)) /* Enable Target Address Register */
-#define   HFSCR_EBB     (1 << (63-56)) /* Enable Event Based Branching */
-#define   HFSCR_TM      (1 << (63-58)) /* Enable Transactional Memory */
-#define   HFSCR_PM      (1 << (63-60)) /* Enable prob/priv access to PMU SPRs */
-#define   HFSCR_BHRB    (1 << (63-59)) /* Enable Branch History Rolling Buffer*/
-#define   HFSCR_DSCR    (1 << (63-61)) /* Enable Data Stream Control Register */
-#define   HFSCR_VECVSX  (1 << (63-62)) /* Enable VMX/VSX  */
-#define   HFSCR_FP      (1 << (63-63)) /* Enable Floating Point */
+#define   HFSCR_TAR     __MASK(FSCR_TAR_LG)
+#define   HFSCR_EBB     __MASK(FSCR_EBB_LG)
+#define   HFSCR_TM      __MASK(FSCR_TM_LG)
+#define   HFSCR_PM      __MASK(FSCR_PM_LG)
+#define   HFSCR_BHRB    __MASK(FSCR_BHRB_LG)
+#define   HFSCR_DSCR    __MASK(FSCR_DSCR_LG)
+#define   HFSCR_VECVSX  __MASK(FSCR_VECVSX_LG)
+#define   HFSCR_FP      __MASK(FSCR_FP_LG)
 #define SPRN_TAR        0x32f   /* Target Address Register */
 #define SPRN_LPCR       0x13E   /* LPAR Control Register */
 #define   LPCR_VPM0     (1ul << (63-0))
diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
index ffbaabebcdca..48cfc858abd6 100644
--- a/arch/powerpc/include/asm/smp.h
+++ b/arch/powerpc/include/asm/smp.h
@@ -145,6 +145,10 @@ extern void __cpu_die(unsigned int cpu);
 #define smp_setup_cpu_maps()
 static inline void inhibit_secondary_onlining(void) {}
 static inline void uninhibit_secondary_onlining(void) {}
+static inline const struct cpumask *cpu_sibling_mask(int cpu)
+{
+        return cpumask_of(cpu);
+}
 
 #endif /* CONFIG_SMP */
 
diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h
index 49a13e0ef234..294c2cedcf7a 100644
--- a/arch/powerpc/include/asm/switch_to.h
+++ b/arch/powerpc/include/asm/switch_to.h
@@ -15,6 +15,15 @@ extern struct task_struct *__switch_to(struct task_struct *,
 struct thread_struct;
 extern struct task_struct *_switch(struct thread_struct *prev,
                                    struct thread_struct *next);
+#ifdef CONFIG_PPC_BOOK3S_64
+static inline void save_tar(struct thread_struct *prev)
+{
+        if (cpu_has_feature(CPU_FTR_ARCH_207S))
+                prev->tar = mfspr(SPRN_TAR);
+}
+#else
+static inline void save_tar(struct thread_struct *prev) {}
+#endif
 
 extern void giveup_fpu(struct task_struct *);
 extern void load_up_fpu(void);
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index 5182c8622b54..48be855ef37b 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -20,6 +20,7 @@ header-y += mman.h
 header-y += msgbuf.h
 header-y += nvram.h
 header-y += param.h
+header-y += perf_event.h
 header-y += poll.h
 header-y += posix_types.h
 header-y += ps3fb.h
diff --git a/arch/powerpc/include/uapi/asm/perf_event.h b/arch/powerpc/include/uapi/asm/perf_event.h
new file mode 100644
index 000000000000..80a4d40cf5bc
--- /dev/null
+++ b/arch/powerpc/include/uapi/asm/perf_event.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright 2013 Michael Ellerman, IBM Corp.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ */
+
+#ifndef _UAPI_ASM_POWERPC_PERF_EVENT_H
+#define _UAPI_ASM_POWERPC_PERF_EVENT_H
+
+/*
+ * We use bit 63 of perf_event_attr.config as a flag to request EBB.
+ */
+#define PERF_EVENT_CONFIG_EBB_SHIFT     63
+
+#endif /* _UAPI_ASM_POWERPC_PERF_EVENT_H */
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index c7e8afc2ead0..8207459efe56 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -138,6 +138,9 @@ int main(void)
         DEFINE(THREAD_TM_TFHAR, offsetof(struct thread_struct, tm_tfhar));
         DEFINE(THREAD_TM_TEXASR, offsetof(struct thread_struct, tm_texasr));
         DEFINE(THREAD_TM_TFIAR, offsetof(struct thread_struct, tm_tfiar));
+        DEFINE(THREAD_TM_TAR, offsetof(struct thread_struct, tm_tar));
+        DEFINE(THREAD_TM_PPR, offsetof(struct thread_struct, tm_ppr));
+        DEFINE(THREAD_TM_DSCR, offsetof(struct thread_struct, tm_dscr));
         DEFINE(PT_CKPT_REGS, offsetof(struct thread_struct, ckpt_regs));
         DEFINE(THREAD_TRANSACT_VR0, offsetof(struct thread_struct,
                                          transact_vr[0]));
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index ea9414c8088d..55593ee2d5aa 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -1061,7 +1061,7 @@ static const struct file_operations proc_eeh_operations = {
 
 static int __init eeh_init_proc(void)
 {
-        if (machine_is(pseries))
+        if (machine_is(pseries) || machine_is(powernv))
                 proc_create("powerpc/eeh", 0, NULL, &proc_eeh_operations);
         return 0;
 }
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index ab15b8d057ad..2bd0b885b0fe 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -449,15 +449,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_DSCR)
 
 #ifdef CONFIG_PPC_BOOK3S_64
 BEGIN_FTR_SECTION
-        /*
-         * Back up the TAR across context switches.  Note that the TAR is not
-         * available for use in the kernel.  (To provide this, the TAR should
-         * be backed up/restored on exception entry/exit instead, and be in
-         * pt_regs.  FIXME, this should be in pt_regs anyway (for debug).)
-         */
-        mfspr   r0,SPRN_TAR
-        std     r0,THREAD_TAR(r3)
-
         /* Event based branch registers */
         mfspr   r0, SPRN_BESCR
         std     r0, THREAD_BESCR(r3)
@@ -584,9 +575,34 @@ BEGIN_FTR_SECTION
         ld      r7,DSCR_DEFAULT@toc(2)
         ld      r0,THREAD_DSCR(r4)
         cmpwi   r6,0
+        li      r8, FSCR_DSCR
         bne     1f
         ld      r0,0(r7)
-1:      cmpd    r0,r25
+        b       3f
+1:
+  BEGIN_FTR_SECTION_NESTED(70)
+        mfspr   r6, SPRN_FSCR
+        or      r6, r6, r8
+        mtspr   SPRN_FSCR, r6
+    BEGIN_FTR_SECTION_NESTED(69)
+        mfspr   r6, SPRN_HFSCR
+        or      r6, r6, r8
+        mtspr   SPRN_HFSCR, r6
+    END_FTR_SECTION_NESTED(CPU_FTR_HVMODE, CPU_FTR_HVMODE, 69)
+        b       4f
+  END_FTR_SECTION_NESTED(CPU_FTR_ARCH_207S, CPU_FTR_ARCH_207S, 70)
+3:
+  BEGIN_FTR_SECTION_NESTED(70)
+        mfspr   r6, SPRN_FSCR
+        andc    r6, r6, r8
+        mtspr   SPRN_FSCR, r6
+    BEGIN_FTR_SECTION_NESTED(69)
+        mfspr   r6, SPRN_HFSCR
+        andc    r6, r6, r8
+        mtspr   SPRN_HFSCR, r6
+    END_FTR_SECTION_NESTED(CPU_FTR_HVMODE, CPU_FTR_HVMODE, 69)
+  END_FTR_SECTION_NESTED(CPU_FTR_ARCH_207S, CPU_FTR_ARCH_207S, 70)
+4:      cmpd    r0,r25
         beq     2f
         mtspr   SPRN_DSCR,r0
 2:
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 4e00d223b2e3..902ca3c6b4b6 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -848,7 +848,7 @@ hv_facility_unavailable_relon_trampoline:
         . = 0x4f80
         SET_SCRATCH0(r13)
         EXCEPTION_PROLOG_0(PACA_EXGEN)
-        b       facility_unavailable_relon_hv
+        b       hv_facility_unavailable_relon_hv
 
         STD_RELON_EXCEPTION_PSERIES(0x5300, 0x1300, instruction_breakpoint)
 #ifdef CONFIG_PPC_DENORMALISATION
@@ -1175,6 +1175,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_VSX)
         b       .ret_from_except
 
         STD_EXCEPTION_COMMON(0xf60, facility_unavailable, .facility_unavailable_exception)
+        STD_EXCEPTION_COMMON(0xf80, hv_facility_unavailable, .facility_unavailable_exception)
 
         .align  7
         .globl  __end_handlers
@@ -1188,7 +1189,7 @@ __end_handlers:
         STD_RELON_EXCEPTION_PSERIES_OOL(0xf20, altivec_unavailable)
         STD_RELON_EXCEPTION_PSERIES_OOL(0xf40, vsx_unavailable)
         STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
-        STD_RELON_EXCEPTION_HV_OOL(0xf80, facility_unavailable)
+        STD_RELON_EXCEPTION_HV_OOL(0xf80, hv_facility_unavailable)
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
 /*
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 2e51cde616d2..c69440cef7af 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -362,7 +362,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
                 seq_printf(p, "%10u ", per_cpu(irq_stat, j).spurious_irqs);
         seq_printf(p, "  Spurious interrupts\n");
 
-        seq_printf(p, "%*s: ", prec, "CNT");
+        seq_printf(p, "%*s: ", prec, "PMI");
         for_each_online_cpu(j)
                 seq_printf(p, "%10u ", per_cpu(irq_stat, j).pmu_irqs);
         seq_printf(p, "  Performance monitoring interrupts\n");
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index c517dbe705fd..8083be20fe5e 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -600,6 +600,16 @@ struct task_struct *__switch_to(struct task_struct *prev,
         struct ppc64_tlb_batch *batch;
 #endif
 
+        /* Back up the TAR across context switches.
+         * Note that the TAR is not available for use in the kernel.  (To
+         * provide this, the TAR should be backed up/restored on exception
+         * entry/exit instead, and be in pt_regs.  FIXME, this should be in
+         * pt_regs anyway (for debug).)
+         * Save the TAR here before we do treclaim/trecheckpoint as these
+         * will change the TAR.
+         */
+        save_tar(&prev->thread);
+
         __switch_to_tm(prev);
 
 #ifdef CONFIG_SMP
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 51be8fb24803..0554d1f6d70d 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -233,6 +233,16 @@ dont_backup_fp:
         std     r5, _CCR(r7)
         std     r6, _XER(r7)
 
+
+        /* ******************** TAR, PPR, DSCR ********** */
+        mfspr   r3, SPRN_TAR
+        mfspr   r4, SPRN_PPR
+        mfspr   r5, SPRN_DSCR
+
+        std     r3, THREAD_TM_TAR(r12)
+        std     r4, THREAD_TM_PPR(r12)
+        std     r5, THREAD_TM_DSCR(r12)
+
         /* MSR and flags:  We don't change CRs, and we don't need to alter
          * MSR.
          */
@@ -347,6 +357,16 @@ dont_restore_fp:
         mtmsr   r6                              /* FP/Vec off again! */
 
 restore_gprs:
+
+        /* ******************** TAR, PPR, DSCR ********** */
+        ld      r4, THREAD_TM_TAR(r3)
+        ld      r5, THREAD_TM_PPR(r3)
+        ld      r6, THREAD_TM_DSCR(r3)
+
+        mtspr   SPRN_TAR,       r4
+        mtspr   SPRN_PPR,       r5
+        mtspr   SPRN_DSCR,      r6
+
         /* ******************** CR,LR,CCR,MSR ********** */
         ld      r3, _CTR(r7)
         ld      r4, _LINK(r7)
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index bf33c22e38a4..e435bc089ea3 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -44,9 +44,7 @@
 #include <asm/machdep.h>
 #include <asm/rtas.h>
 #include <asm/pmc.h>
-#ifdef CONFIG_PPC32
 #include <asm/reg.h>
-#endif
 #ifdef CONFIG_PMAC_BACKLIGHT
 #include <asm/backlight.h>
 #endif
@@ -1296,43 +1294,54 @@ void vsx_unavailable_exception(struct pt_regs *regs)
         die("Unrecoverable VSX Unavailable Exception", regs, SIGABRT);
 }
 
+#ifdef CONFIG_PPC64
 void facility_unavailable_exception(struct pt_regs *regs)
 {
         static char *facility_strings[] = {
-                "FPU",
-                "VMX/VSX",
-                "DSCR",
-                "PMU SPRs",
-                "BHRB",
-                "TM",
-                "AT",
-                "EBB",
-                "TAR",
+                [FSCR_FP_LG] = "FPU",
+                [FSCR_VECVSX_LG] = "VMX/VSX",
+                [FSCR_DSCR_LG] = "DSCR",
+                [FSCR_PM_LG] = "PMU SPRs",
+                [FSCR_BHRB_LG] = "BHRB",
+                [FSCR_TM_LG] = "TM",
+                [FSCR_EBB_LG] = "EBB",
+                [FSCR_TAR_LG] = "TAR",
         };
-        char *facility, *prefix;
+        char *facility = "unknown";
         u64 value;
+        u8 status;
+        bool hv;
 
-        if (regs->trap == 0xf60) {
-                value = mfspr(SPRN_FSCR);
-                prefix = "";
-        } else {
+        hv = (regs->trap == 0xf80);
+        if (hv)
                 value = mfspr(SPRN_HFSCR);
-                prefix = "Hypervisor ";
+        else
+                value = mfspr(SPRN_FSCR);
+
+        status = value >> 56;
+        if (status == FSCR_DSCR_LG) {
+                /* User is acessing the DSCR.  Set the inherit bit and allow
+                 * the user to set it directly in future by setting via the
+                 * H/FSCR DSCR bit.
+                 */
+                current->thread.dscr_inherit = 1;
+                if (hv)
+                        mtspr(SPRN_HFSCR, value | HFSCR_DSCR);
+                else
+                        mtspr(SPRN_FSCR,  value | FSCR_DSCR);
+                return;
         }
 
-        value = value >> 56;
+        if ((status < ARRAY_SIZE(facility_strings)) &&
+            facility_strings[status])
+                facility = facility_strings[status];
 
         /* We restore the interrupt state now */
         if (!arch_irq_disabled_regs(regs))
                 local_irq_enable();
 
-        if (value < ARRAY_SIZE(facility_strings))
-                facility = facility_strings[value];
-        else
-                facility = "unknown";
-
         pr_err("%sFacility '%s' unavailable, exception at 0x%lx, MSR=%lx\n",
-                prefix, facility, regs->nip, regs->msr);
+               hv ? "Hypervisor " : "", facility, regs->nip, regs->msr);
 
         if (user_mode(regs)) {
                 _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
@@ -1341,6 +1350,7 @@ void facility_unavailable_exception(struct pt_regs *regs)
 
         die("Unexpected facility unavailable exception", regs, SIGABRT);
 }
+#endif
 
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
 
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 2efa9dde741a..7629cd3eb91a 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1809,7 +1809,7 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
                 rma_size <<= PAGE_SHIFT;
                 rmls = lpcr_rmls(rma_size);
                 err = -EINVAL;
-                if (rmls < 0) {
+                if ((long)rmls < 0) {
                         pr_err("KVM: Can't use RMA of 0x%lx bytes\n", rma_size);
                         goto out_srcu;
                 }
@@ -1874,7 +1874,7 @@ int kvmppc_core_init_vm(struct kvm *kvm)
         /* Allocate the guest's logical partition ID */
 
         lpid = kvmppc_alloc_lpid();
-        if (lpid < 0)
+        if ((long)lpid < 0)
                 return -ENOMEM;
         kvm->arch.lpid = lpid;
 
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index 19498a567a81..c6e13d9a9e15 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -1047,11 +1047,12 @@ struct kvm_vcpu *kvmppc_core_vcpu_create(struct kvm *kvm, unsigned int id)
         if (err)
                 goto free_shadow_vcpu;
 
+        err = -ENOMEM;
         p = __get_free_page(GFP_KERNEL|__GFP_ZERO);
-        /* the real shared page fills the last 4k of our page */
-        vcpu->arch.shared = (void*)(p + PAGE_SIZE - 4096);
         if (!p)
                 goto uninit_vcpu;
+        /* the real shared page fills the last 4k of our page */
+        vcpu->arch.shared = (void *)(p + PAGE_SIZE - 4096);
 
 #ifdef CONFIG_PPC_BOOK3S_64
         /* default to book3s_64 (970fx) */
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 08397217e8ac..5850798826cd 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -27,6 +27,7 @@
 #include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <asm/cputhreads.h>
 #include <asm/sparsemem.h>
 #include <asm/prom.h>
 #include <asm/smp.h>
@@ -1318,7 +1319,8 @@ static int update_cpu_associativity_changes_mask(void)
                         }
                 }
                 if (changed) {
-                        cpumask_set_cpu(cpu, changes);
+                        cpumask_or(changes, changes, cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
                 }
         }
 
@@ -1426,7 +1428,7 @@ static int update_cpu_topology(void *data)
         if (!data)
                 return -EINVAL;
 
-        cpu = get_cpu();
+        cpu = smp_processor_id();
 
         for (update = data; update; update = update->next) {
                 if (cpu != update->cpu)
@@ -1446,12 +1448,12 @@ static int update_cpu_topology(void *data)
  */
 int arch_update_cpu_topology(void)
 {
-        unsigned int cpu, changed = 0;
+        unsigned int cpu, sibling, changed = 0;
         struct topology_update_data *updates, *ud;
         unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
         cpumask_t updated_cpus;
         struct device *dev;
-        int weight, i = 0;
+        int weight, new_nid, i = 0;
 
         weight = cpumask_weight(&cpu_associativity_changes_mask);
         if (!weight)
@@ -1464,19 +1466,46 @@ int arch_update_cpu_topology(void)
         cpumask_clear(&updated_cpus);
 
         for_each_cpu(cpu, &cpu_associativity_changes_mask) {
-                ud = &updates[i++];
-                ud->cpu = cpu;
-                vphn_get_associativity(cpu, associativity);
-                ud->new_nid = associativity_to_nid(associativity);
-
-                if (ud->new_nid < 0 || !node_online(ud->new_nid))
-                        ud->new_nid = first_online_node;
+                /*
+                 * If siblings aren't flagged for changes, updates list
+                 * will be too short. Skip on this update and set for next
+                 * update.
+                 */
+                if (!cpumask_subset(cpu_sibling_mask(cpu),
+                                        &cpu_associativity_changes_mask)) {
+                        pr_info("Sibling bits not set for associativity "
+                                        "change, cpu%d\n", cpu);
+                        cpumask_or(&cpu_associativity_changes_mask,
+                                        &cpu_associativity_changes_mask,
+                                        cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
+                        continue;
+                }
 
-                ud->old_nid = numa_cpu_lookup_table[cpu];
-                cpumask_set_cpu(cpu, &updated_cpus);
+                /* Use associativity from first thread for all siblings */
+                vphn_get_associativity(cpu, associativity);
+                new_nid = associativity_to_nid(associativity);
+                if (new_nid < 0 || !node_online(new_nid))
+                        new_nid = first_online_node;
+
+                if (new_nid == numa_cpu_lookup_table[cpu]) {
+                        cpumask_andnot(&cpu_associativity_changes_mask,
+                                        &cpu_associativity_changes_mask,
+                                        cpu_sibling_mask(cpu));
+                        cpu = cpu_last_thread_sibling(cpu);
+                        continue;
+                }
 
-                if (i < weight)
-                        ud->next = &updates[i];
+                for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
+                        ud = &updates[i++];
+                        ud->cpu = sibling;
+                        ud->new_nid = new_nid;
+                        ud->old_nid = numa_cpu_lookup_table[sibling];
+                        cpumask_set_cpu(sibling, &updated_cpus);
+                        if (i < weight)
+                                ud->next = &updates[i];
+                }
+                cpu = cpu_last_thread_sibling(cpu);
         }
 
         stop_machine(update_cpu_topology, &updates[0], &updated_cpus);
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 24a45f91c65f..eeae308cf982 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -484,7 +484,7 @@ static bool is_ebb_event(struct perf_event *event)
          * use bit 63 of the event code for something else if they wish.
          */
         return (ppmu->flags & PPMU_EBB) &&
-               ((event->attr.config >> EVENT_CONFIG_EBB_SHIFT) & 1);
+               ((event->attr.config >> PERF_EVENT_CONFIG_EBB_SHIFT) & 1);
 }
 
 static int ebb_event_check(struct perf_event *event)
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index 7466374d2787..2ee4a707f0df 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -118,7 +118,7 @@
          (EVENT_UNIT_MASK      << EVENT_UNIT_SHIFT)             |       \
          (EVENT_COMBINE_MASK   << EVENT_COMBINE_SHIFT)          |       \
          (EVENT_MARKED_MASK    << EVENT_MARKED_SHIFT)           |       \
-         (EVENT_EBB_MASK       << EVENT_CONFIG_EBB_SHIFT)       |       \
+         (EVENT_EBB_MASK       << PERF_EVENT_CONFIG_EBB_SHIFT)  |       \
           EVENT_PSEL_MASK)
 
 /* MMCRA IFM bits - POWER8 */
@@ -233,10 +233,10 @@ static int power8_get_constraint(u64 event, unsigned long *maskp, unsigned long
         pmc   = (event >> EVENT_PMC_SHIFT)        & EVENT_PMC_MASK;
         unit  = (event >> EVENT_UNIT_SHIFT)       & EVENT_UNIT_MASK;
         cache = (event >> EVENT_CACHE_SEL_SHIFT)  & EVENT_CACHE_SEL_MASK;
-        ebb   = (event >> EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
+        ebb   = (event >> PERF_EVENT_CONFIG_EBB_SHIFT) & EVENT_EBB_MASK;
 
         /* Clear the EBB bit in the event, so event checks work below */
-        event &= ~(EVENT_EBB_MASK << EVENT_CONFIG_EBB_SHIFT);
+        event &= ~(EVENT_EBB_MASK << PERF_EVENT_CONFIG_EBB_SHIFT);
 
         if (pmc) {
                 if (pmc > 6)
diff --git a/arch/powerpc/platforms/pseries/nvram.c b/arch/powerpc/platforms/pseries/nvram.c
index 9f8671a44551..6a5f2b1f32ca 100644
--- a/arch/powerpc/platforms/pseries/nvram.c
+++ b/arch/powerpc/platforms/pseries/nvram.c
@@ -569,35 +569,6 @@ error:
         return ret;
 }
 
-static int unzip_oops(char *oops_buf, char *big_buf)
-{
-        struct oops_log_info *oops_hdr = (struct oops_log_info *)oops_buf;
-        u64 timestamp = oops_hdr->timestamp;
-        char *big_oops_data = NULL;
-        char *oops_data_buf = NULL;
-        size_t big_oops_data_sz;
-        int unzipped_len;
-
-        big_oops_data = big_buf + sizeof(struct oops_log_info);
-        big_oops_data_sz = big_oops_buf_sz - sizeof(struct oops_log_info);
-        oops_data_buf = oops_buf + sizeof(struct oops_log_info);
-
-        unzipped_len = nvram_decompress(oops_data_buf, big_oops_data,
-                                        oops_hdr->report_length,
-                                        big_oops_data_sz);
-
-        if (unzipped_len < 0) {
-                pr_err("nvram: decompression failed; returned %d\n",
-                                                                unzipped_len);
-                return -1;
-        }
-        oops_hdr = (struct oops_log_info *)big_buf;
-        oops_hdr->version = OOPS_HDR_VERSION;
-        oops_hdr->report_length = (u16) unzipped_len;
-        oops_hdr->timestamp = timestamp;
-        return 0;
-}
-
 static int nvram_pstore_open(struct pstore_info *psi)
 {
         /* Reset the iterator to start reading partitions again */
@@ -685,10 +656,9 @@ static ssize_t nvram_pstore_read(u64 *id, enum pstore_type_id *type,
         unsigned int err_type, id_no, size = 0;
         struct nvram_os_partition *part = NULL;
         char *buff = NULL, *big_buff = NULL;
-        int rc, sig = 0;
+        int sig = 0;
         loff_t p;
 
-read_partition:
         read_type++;
 
         switch (nvram_type_ids[read_type]) {
@@ -749,30 +719,46 @@ read_partition:
                 *id = id_no;
 
         if (nvram_type_ids[read_type] == PSTORE_TYPE_DMESG) {
+                int length, unzipped_len;
+                size_t hdr_size;
+
                 oops_hdr = (struct oops_log_info *)buff;
-                *buf = buff + sizeof(*oops_hdr);
+                if (oops_hdr->version < OOPS_HDR_VERSION) {
+                        /* Old format oops header had 2-byte record size */
+                        hdr_size = sizeof(u16);
+                        length = oops_hdr->version;
+                        time->tv_sec = 0;
+                        time->tv_nsec = 0;
+                } else {
+                        hdr_size = sizeof(*oops_hdr);
+                        length = oops_hdr->report_length;
+                        time->tv_sec = oops_hdr->timestamp;
+                        time->tv_nsec = 0;
+                }
+                *buf = kmalloc(length, GFP_KERNEL);
+                if (*buf == NULL)
+                        return -ENOMEM;
+                memcpy(*buf, buff + hdr_size, length);
+                kfree(buff);
 
                 if (err_type == ERR_TYPE_KERNEL_PANIC_GZ) {
                         big_buff = kmalloc(big_oops_buf_sz, GFP_KERNEL);
                         if (!big_buff)
                                 return -ENOMEM;
 
-                        rc = unzip_oops(buff, big_buff);
+                        unzipped_len = nvram_decompress(*buf, big_buff,
+                                                length, big_oops_buf_sz);
 
-                        if (rc != 0) {
-                                kfree(buff);
+                        if (unzipped_len < 0) {
+                                pr_err("nvram: decompression failed, returned "
+                                        "rc %d\n", unzipped_len);
                                 kfree(big_buff);
-                                goto read_partition;
+                        } else {
+                                *buf = big_buff;
+                                length = unzipped_len;
                         }
-
-                        oops_hdr = (struct oops_log_info *)big_buff;
-                        *buf = big_buff + sizeof(*oops_hdr);
-                        kfree(buff);
                 }
-
-                time->tv_sec = oops_hdr->timestamp;
-                time->tv_nsec = 0;
-                return oops_hdr->report_length;
+                return length;
         }
 
         *buf = buff;
@@ -816,6 +802,7 @@ static int nvram_pstore_init(void)
 static void __init nvram_init_oops_partition(int rtas_partition_exists)
 {
         int rc;
+        size_t size;
 
         rc = pseries_nvram_init_os_partition(&oops_log_partition);
         if (rc != 0) {
@@ -844,8 +831,9 @@ static void __init nvram_init_oops_partition(int rtas_partition_exists)
         big_oops_buf_sz = (oops_data_sz * 100) / 45;
         big_oops_buf = kmalloc(big_oops_buf_sz, GFP_KERNEL);
         if (big_oops_buf) {
-                stream.workspace = kmalloc(zlib_deflate_workspacesize(
-                                WINDOW_BITS, MEM_LEVEL), GFP_KERNEL);
+                size = max(zlib_deflate_workspacesize(WINDOW_BITS, MEM_LEVEL),
+                        zlib_inflate_workspacesize());
+                stream.workspace = kmalloc(size, GFP_KERNEL);
                 if (!stream.workspace) {
                         pr_err("nvram: No memory for compression workspace; "
                                 "skipping compression of %s partition data\n",
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 22f75b504f7f..8a4cae78f03c 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -118,6 +118,7 @@ config S390
         select HAVE_FUNCTION_TRACE_MCOUNT_TEST
         select HAVE_KERNEL_BZIP2
         select HAVE_KERNEL_GZIP
+        select HAVE_KERNEL_LZ4
         select HAVE_KERNEL_LZMA
         select HAVE_KERNEL_LZO
         select HAVE_KERNEL_XZ
@@ -227,11 +228,12 @@ config MARCH_Z196
           not work on older machines.
 
 config MARCH_ZEC12
-        bool "IBM zEC12"
+        bool "IBM zBC12 and zEC12"
         select HAVE_MARCH_ZEC12_FEATURES if 64BIT
         help
-          Select this to enable optimizations for IBM zEC12 (2827 series). The
-          kernel will be slightly faster but will not work on older machines.
+          Select this to enable optimizations for IBM zBC12 and zEC12 (2828 and
+          2827 series). The kernel will be slightly faster but will not work on
+          older machines.
 
 endchoice
 
@@ -709,6 +711,7 @@ config S390_GUEST
         def_bool y
         prompt "s390 support for virtio devices"
         depends on 64BIT
+        select TTY
         select VIRTUALIZATION
         select VIRTIO
         select VIRTIO_CONSOLE
diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile
index 3ad8f61c9985..866ecbe670e4 100644
--- a/arch/s390/boot/compressed/Makefile
+++ b/arch/s390/boot/compressed/Makefile
@@ -6,9 +6,9 @@
 
 BITS := $(if $(CONFIG_64BIT),64,31)
 
-targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 \
-           vmlinux.bin.xz vmlinux.bin.lzma vmlinux.bin.lzo misc.o piggy.o \
-           sizes.h head$(BITS).o
+targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2
+targets += vmlinux.bin.xz vmlinux.bin.lzma vmlinux.bin.lzo vmlinux.bin.lz4
+targets += misc.o piggy.o sizes.h head$(BITS).o
 
 KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
@@ -48,6 +48,7 @@ vmlinux.bin.all-y := $(obj)/vmlinux.bin
 
 suffix-$(CONFIG_KERNEL_GZIP)  := gz
 suffix-$(CONFIG_KERNEL_BZIP2) := bz2
+suffix-$(CONFIG_KERNEL_LZ4)  := lz4
 suffix-$(CONFIG_KERNEL_LZMA)  := lzma
 suffix-$(CONFIG_KERNEL_LZO)  := lzo
 suffix-$(CONFIG_KERNEL_XZ)  := xz
@@ -56,6 +57,8 @@ $(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y)
         $(call if_changed,gzip)
 $(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y)
         $(call if_changed,bzip2)
+$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y)
+        $(call if_changed,lz4)
 $(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y)
         $(call if_changed,lzma)
 $(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y)
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index c4c6a1cf221b..57cbaff1f397 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -47,6 +47,10 @@ static unsigned long free_mem_end_ptr;
 #include "../../../../lib/decompress_bunzip2.c"
 #endif
 
+#ifdef CONFIG_KERNEL_LZ4
+#include "../../../../lib/decompress_unlz4.c"
+#endif
+
 #ifdef CONFIG_KERNEL_LZMA
 #include "../../../../lib/decompress_unlzma.c"
 #endif
diff --git a/arch/s390/include/asm/bitops.h b/arch/s390/include/asm/bitops.h
index 4d8604e311f3..7d4676758733 100644
--- a/arch/s390/include/asm/bitops.h
+++ b/arch/s390/include/asm/bitops.h
@@ -693,7 +693,7 @@ static inline int find_next_bit_left(const unsigned long *addr,
         size -= offset;
         p = addr + offset / BITS_PER_LONG;
         if (bit) {
-                set = __flo_word(0, *p & (~0UL << bit));
+                set = __flo_word(0, *p & (~0UL >> bit));
                 if (set >= size)
                         return size + offset;
                 if (set < BITS_PER_LONG)
diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
index a6fc037671b1..500aa1029bcb 100644
--- a/arch/s390/kernel/perf_event.c
+++ b/arch/s390/kernel/perf_event.c
@@ -52,12 +52,13 @@ static struct kvm_s390_sie_block *sie_block(struct pt_regs *regs)
 
 static bool is_in_guest(struct pt_regs *regs)
 {
-        unsigned long ip = instruction_pointer(regs);
-
         if (user_mode(regs))
                 return false;
-
-        return ip == (unsigned long) &sie_exit;
+#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+        return instruction_pointer(regs) == (unsigned long) &sie_exit;
+#else
+        return false;
+#endif
 }
 
 static unsigned long guest_is_user_mode(struct pt_regs *regs)
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 497451ec5e26..aeed8a61fa0d 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -994,6 +994,7 @@ static void __init setup_hwcaps(void)
                 strcpy(elf_platform, "z196");
                 break;
         case 0x2827:
+        case 0x2828:
                 strcpy(elf_platform, "zEC12");
                 break;
         }
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index ba694d2ba51e..34c1c9a90be2 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -702,14 +702,25 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
                 return rc;
 
         vcpu->arch.sie_block->icptcode = 0;
-        preempt_disable();
-        kvm_guest_enter();
-        preempt_enable();
         VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                    atomic_read(&vcpu->arch.sie_block->cpuflags));
         trace_kvm_s390_sie_enter(vcpu,
                                  atomic_read(&vcpu->arch.sie_block->cpuflags));
+
+        /*
+         * As PF_VCPU will be used in fault handler, between guest_enter
+         * and guest_exit should be no uaccess.
+         */
+        preempt_disable();
+        kvm_guest_enter();
+        preempt_enable();
         rc = sie64a(vcpu->arch.sie_block, vcpu->run->s.regs.gprs);
+        kvm_guest_exit();
+
+        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
+                   vcpu->arch.sie_block->icptcode);
+        trace_kvm_s390_sie_exit(vcpu, vcpu->arch.sie_block->icptcode);
+
         if (rc > 0)
                 rc = 0;
         if (rc < 0) {
@@ -721,10 +732,6 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
                         rc = kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
                 }
         }
-        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
-                   vcpu->arch.sie_block->icptcode);
-        trace_kvm_s390_sie_exit(vcpu, vcpu->arch.sie_block->icptcode);
-        kvm_guest_exit();
 
         memcpy(&vcpu->run->s.regs.gprs[14], &vcpu->arch.sie_block->gg14, 16);
         return rc;
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 0da3e6eb6be6..4cdc54e63ebc 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -16,6 +16,7 @@
 #include <linux/errno.h>
 #include <linux/compat.h>
 #include <asm/asm-offsets.h>
+#include <asm/facility.h>
 #include <asm/current.h>
 #include <asm/debug.h>
 #include <asm/ebcdic.h>
@@ -532,8 +533,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
         /* Only provide non-quiescing support if the host supports it */
-        if (vcpu->run->s.regs.gprs[reg1] & PFMF_NQ &&
-            S390_lowcore.stfl_fac_list & 0x00020000)
+        if (vcpu->run->s.regs.gprs[reg1] & PFMF_NQ && !test_facility(14))
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
         /* No support for conditional-SSKE */
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index ce36ea80e4f9..ad446b0c55b6 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -69,6 +69,7 @@ static void __init setup_zero_pages(void)
                 order = 2;
                 break;
         case 0x2827:    /* zEC12 */
+        case 0x2828:    /* zEC12 */
         default:
                 order = 5;
                 break;
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index ffeb17ce7f31..930783d2c99b 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -440,7 +440,7 @@ static int oprofile_hwsampler_init(struct oprofile_operations *ops)
                 switch (id.machine) {
                 case 0x2097: case 0x2098: ops->cpu_type = "s390/z10"; break;
                 case 0x2817: case 0x2818: ops->cpu_type = "s390/z196"; break;
-                case 0x2827:              ops->cpu_type = "s390/zEC12"; break;
+                case 0x2827: case 0x2828: ops->cpu_type = "s390/zEC12"; break;
                 default: return -ENODEV;
                 }
         }
diff --git a/arch/sh/configs/sh03_defconfig b/arch/sh/configs/sh03_defconfig
index 2051821724c6..0cf4097b71e8 100644
--- a/arch/sh/configs/sh03_defconfig
+++ b/arch/sh/configs/sh03_defconfig
@@ -22,7 +22,7 @@ CONFIG_PREEMPT=y
 CONFIG_CMDLINE_OVERWRITE=y
 CONFIG_CMDLINE="console=ttySC1,115200 mem=64M root=/dev/nfs"
 CONFIG_PCI=y
-CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI=y
 CONFIG_BINFMT_MISC=y
 CONFIG_NET=y
 CONFIG_PACKET=y
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index d606463aa6d6..b7388a425f09 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -225,7 +225,7 @@ static void low_free(unsigned long size, unsigned long addr)
         unsigned long nr_pages;
 
         nr_pages = round_up(size, EFI_PAGE_SIZE) / EFI_PAGE_SIZE;
-        efi_call_phys2(sys_table->boottime->free_pages, addr, size);
+        efi_call_phys2(sys_table->boottime->free_pages, addr, nr_pages);
 }
 
 static void find_bits(unsigned long mask, u8 *pos, u8 *size)
diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
index e2703520d120..c370e1c4468b 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
@@ -111,8 +111,8 @@ static struct severity {
 #ifdef  CONFIG_MEMORY_FAILURE
         MCESEV(
                 KEEP, "Action required but unaffected thread is continuable",
-                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR),
-                MCGMASK(MCG_STATUS_RIPV, MCG_STATUS_RIPV)
+                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR, MCI_UC_SAR|MCI_ADDR),
+                MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, MCG_STATUS_RIPV)
                 ),
         MCESEV(
                 AR, "Action required: data load error in a user process",
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 94ab6b90dd3f..63bdb29b2549 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -196,15 +196,23 @@ static void __init ati_bugs_contd(int num, int slot, int func)
 static void __init intel_remapping_check(int num, int slot, int func)
 {
         u8 revision;
+        u16 device;
 
+        device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
         revision = read_pci_config_byte(num, slot, func, PCI_REVISION_ID);
 
         /*
-         * Revision 0x13 of this chipset supports irq remapping
-         * but has an erratum that breaks its behavior, flag it as such
+         * Revision 13 of all triggering devices id in this quirk have
+         * a problem draining interrupts when irq remapping is enabled,
+         * and should be flagged as broken.  Additionally revisions 0x12
+         * and 0x22 of device id 0x3405 has this problem.
          */
         if (revision == 0x13)
                 set_irq_remapping_broken();
+        else if ((device == 0x3405) &&
+            ((revision == 0x12) ||
+             (revision == 0x22)))
+                set_irq_remapping_broken();
 
 }
 
@@ -239,6 +247,8 @@ static struct chipset early_qrk[] __initdata = {
           PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
         { PCI_VENDOR_ID_INTEL, 0x3403, PCI_CLASS_BRIDGE_HOST,
           PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
+        { PCI_VENDOR_ID_INTEL, 0x3405, PCI_CLASS_BRIDGE_HOST,
+          PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
         { PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
           PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
         {}
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 202d24f0f7e7..5d576ab34403 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -116,7 +116,7 @@ static void mxcsr_feature_mask_init(void)
 
         if (cpu_has_fxsr) {
                 memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
-                asm volatile("fxsave %0" : : "m" (fx_scratch));
+                asm volatile("fxsave %0" : "+m" (fx_scratch));
                 mask = fx_scratch.mxcsr_mask;
                 if (mask == 0)
                         mask = 0x0000ffbf;
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 47ebb1dbfbcb..7a0adb7ee433 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -220,12 +220,13 @@ int apply_microcode_amd(int cpu)
                 return 0;
         }
 
-        if (__apply_microcode_amd(mc_amd))
+        if (__apply_microcode_amd(mc_amd)) {
                 pr_err("CPU%d: update failed for patch_level=0x%08x\n",
                         cpu, mc_amd->hdr.patch_id);
-        else
-                pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
-                        mc_amd->hdr.patch_id);
+                return -1;
+        }
+        pr_info("CPU%d: new patch_level=0x%08x\n", cpu,
+                mc_amd->hdr.patch_id);
 
         uci->cpu_sig.rev = mc_amd->hdr.patch_id;
         c->microcode = mc_amd->hdr.patch_id;
diff --git a/arch/x86/platform/ce4100/ce4100.c b/arch/x86/platform/ce4100/ce4100.c
index 643b8b5eee86..8244f5ec2f4c 100644
--- a/arch/x86/platform/ce4100/ce4100.c
+++ b/arch/x86/platform/ce4100/ce4100.c
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/reboot.h>
 #include <linux/serial_reg.h>
 #include <linux/serial_8250.h>
 #include <linux/reboot.h>
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index d21167bfc865..dc34a5b8bcee 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -359,6 +359,9 @@ int braille_register_console(struct console *console, int index,
                 char *console_options, char *braille_options)
 {
         int ret;
+
+        if (!(console->flags & CON_BRL))
+                return 0;
         if (!console_options)
                 /* Only support VisioBraille for now */
                 console_options = "57600o8";
@@ -374,15 +377,17 @@ int braille_register_console(struct console *console, int index,
         braille_co = console;
         register_keyboard_notifier(&keyboard_notifier_block);
         register_vt_notifier(&vt_notifier_block);
-        return 0;
+        return 1;
 }
 
 int braille_unregister_console(struct console *console)
 {
         if (braille_co != console)
                 return -EINVAL;
+        if (!(console->flags & CON_BRL))
+                return 0;
         unregister_keyboard_notifier(&keyboard_notifier_block);
         unregister_vt_notifier(&vt_notifier_block);
         braille_co = NULL;
-        return 0;
+        return 1;
 }
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index fd6c51cc3acb..5a74a9c1e42c 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -451,7 +451,6 @@ static void acpi_processor_remove(struct acpi_device *device)
         /* Clean up. */
         per_cpu(processor_device_array, pr->id) = NULL;
         per_cpu(processors, pr->id) = NULL;
-        try_offline_node(cpu_to_node(pr->id));
 
         /* Remove the CPU. */
         get_online_cpus();
@@ -459,6 +458,8 @@ static void acpi_processor_remove(struct acpi_device *device)
         acpi_unmap_lsapic(pr->id);
         put_online_cpus();
 
+        try_offline_node(cpu_to_node(pr->id));
+
  out:
         free_cpumask_var(pr->throttling.shared_cpu_map);
         kfree(pr);
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 082b4dd252a8..d405fbad406a 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -117,6 +117,7 @@ struct acpi_battery {
         struct acpi_device *device;
         struct notifier_block pm_nb;
         unsigned long update_time;
+        int revision;
         int rate_now;
         int capacity_now;
         int voltage_now;
@@ -359,6 +360,7 @@ static struct acpi_offsets info_offsets[] = {
 };
 
 static struct acpi_offsets extended_info_offsets[] = {
+        {offsetof(struct acpi_battery, revision), 0},
         {offsetof(struct acpi_battery, power_unit), 0},
         {offsetof(struct acpi_battery, design_capacity), 0},
         {offsetof(struct acpi_battery, full_charge_capacity), 0},
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index f68095756fb7..408f6b2a5fa8 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -31,6 +31,7 @@ static LIST_HEAD(bus_type_list);
 static DECLARE_RWSEM(bus_type_sem);
 
 #define PHYSICAL_NODE_STRING "physical_node"
+#define PHYSICAL_NODE_NAME_SIZE (sizeof(PHYSICAL_NODE_STRING) + 10)
 
 int register_acpi_bus_type(struct acpi_bus_type *type)
 {
@@ -78,41 +79,108 @@ static struct acpi_bus_type *acpi_get_bus_type(struct device *dev)
         return ret;
 }
 
-static acpi_status do_acpi_find_child(acpi_handle handle, u32 lvl_not_used,
-                                      void *addr_p, void **ret_p)
+static acpi_status acpi_dev_present(acpi_handle handle, u32 lvl_not_used,
+                                  void *not_used, void **ret_p)
 {
-        unsigned long long addr, sta;
-        acpi_status status;
+        struct acpi_device *adev = NULL;
 
-        status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
-        if (ACPI_SUCCESS(status) && addr == *((u64 *)addr_p)) {
+        acpi_bus_get_device(handle, &adev);
+        if (adev) {
                 *ret_p = handle;
-                status = acpi_bus_get_status_handle(handle, &sta);
-                if (ACPI_SUCCESS(status) && (sta & ACPI_STA_DEVICE_ENABLED))
-                        return AE_CTRL_TERMINATE;
+                return AE_CTRL_TERMINATE;
         }
         return AE_OK;
 }
 
-acpi_handle acpi_get_child(acpi_handle parent, u64 address)
+static bool acpi_extra_checks_passed(acpi_handle handle, bool is_bridge)
 {
-        void *ret = NULL;
+        unsigned long long sta;
+        acpi_status status;
+
+        status = acpi_bus_get_status_handle(handle, &sta);
+        if (ACPI_FAILURE(status) || !(sta & ACPI_STA_DEVICE_ENABLED))
+                return false;
+
+        if (is_bridge) {
+                void *test = NULL;
+
+                /* Check if this object has at least one child device. */
+                acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1,
+                                    acpi_dev_present, NULL, NULL, &test);
+                return !!test;
+        }
+        return true;
+}
+
+struct find_child_context {
+        u64 addr;
+        bool is_bridge;
+        acpi_handle ret;
+        bool ret_checked;
+};
+
+static acpi_status do_find_child(acpi_handle handle, u32 lvl_not_used,
+                                 void *data, void **not_used)
+{
+        struct find_child_context *context = data;
+        unsigned long long addr;
+        acpi_status status;
 
-        if (!parent)
-                return NULL;
+        status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
+        if (ACPI_FAILURE(status) || addr != context->addr)
+                return AE_OK;
 
-        acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, NULL,
-                            do_acpi_find_child, &address, &ret);
-        return (acpi_handle)ret;
+        if (!context->ret) {
+                /* This is the first matching object.  Save its handle. */
+                context->ret = handle;
+                return AE_OK;
+        }
+        /*
+         * There is more than one matching object with the same _ADR value.
+         * That really is unexpected, so we are kind of beyond the scope of the
+         * spec here.  We have to choose which one to return, though.
+         *
+         * First, check if the previously found object is good enough and return
+         * its handle if so.  Second, check the same for the object that we've
+         * just found.
+         */
+        if (!context->ret_checked) {
+                if (acpi_extra_checks_passed(context->ret, context->is_bridge))
+                        return AE_CTRL_TERMINATE;
+                else
+                        context->ret_checked = true;
+        }
+        if (acpi_extra_checks_passed(handle, context->is_bridge)) {
+                context->ret = handle;
+                return AE_CTRL_TERMINATE;
+        }
+        return AE_OK;
 }
-EXPORT_SYMBOL(acpi_get_child);
+
+acpi_handle acpi_find_child(acpi_handle parent, u64 addr, bool is_bridge)
+{
+        if (parent) {
+                struct find_child_context context = {
+                        .addr = addr,
+                        .is_bridge = is_bridge,
+                };
+
+                acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, do_find_child,
+                                    NULL, &context, NULL);
+                return context.ret;
+        }
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(acpi_find_child);
 
 int acpi_bind_one(struct device *dev, acpi_handle handle)
 {
         struct acpi_device *acpi_dev;
         acpi_status status;
         struct acpi_device_physical_node *physical_node, *pn;
-        char physical_node_name[sizeof(PHYSICAL_NODE_STRING) + 2];
+        char physical_node_name[PHYSICAL_NODE_NAME_SIZE];
+        struct list_head *physnode_list;
+        unsigned int node_id;
         int retval = -EINVAL;
 
         if (ACPI_HANDLE(dev)) {
@@ -139,25 +207,27 @@ int acpi_bind_one(struct device *dev, acpi_handle handle)
 
         mutex_lock(&acpi_dev->physical_node_lock);
 
-        /* Sanity check. */
-        list_for_each_entry(pn, &acpi_dev->physical_node_list, node)
+        /*
+         * Keep the list sorted by node_id so that the IDs of removed nodes can
+         * be recycled easily.
+         */
+        physnode_list = &acpi_dev->physical_node_list;
+        node_id = 0;
+        list_for_each_entry(pn, &acpi_dev->physical_node_list, node) {
+                /* Sanity check. */
                 if (pn->dev == dev) {
                         dev_warn(dev, "Already associated with ACPI node\n");
                         goto err_free;
                 }
-
-        /* allocate physical node id according to physical_node_id_bitmap */
-        physical_node->node_id =
-                find_first_zero_bit(acpi_dev->physical_node_id_bitmap,
-                ACPI_MAX_PHYSICAL_NODE);
-        if (physical_node->node_id >= ACPI_MAX_PHYSICAL_NODE) {
-                retval = -ENOSPC;
-                goto err_free;
+                if (pn->node_id == node_id) {
+                        physnode_list = &pn->node;
+                        node_id++;
+                }
         }
 
-        set_bit(physical_node->node_id, acpi_dev->physical_node_id_bitmap);
+        physical_node->node_id = node_id;
         physical_node->dev = dev;
-        list_add_tail(&physical_node->node, &acpi_dev->physical_node_list);
+        list_add(&physical_node->node, physnode_list);
         acpi_dev->physical_node_count++;
 
         mutex_unlock(&acpi_dev->physical_node_lock);
@@ -208,7 +278,7 @@ int acpi_unbind_one(struct device *dev)
 
         mutex_lock(&acpi_dev->physical_node_lock);
         list_for_each_safe(node, next, &acpi_dev->physical_node_list) {
-                char physical_node_name[sizeof(PHYSICAL_NODE_STRING) + 2];
+                char physical_node_name[PHYSICAL_NODE_NAME_SIZE];
 
                 entry = list_entry(node, struct acpi_device_physical_node,
                         node);
@@ -216,7 +286,6 @@ int acpi_unbind_one(struct device *dev)
                         continue;
 
                 list_del(node);
-                clear_bit(entry->node_id, acpi_dev->physical_node_id_bitmap);
 
                 acpi_dev->physical_node_count--;
 
diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
index aa1227a7e3f2..04a13784dd20 100644
--- a/drivers/acpi/proc.c
+++ b/drivers/acpi/proc.c
@@ -311,6 +311,8 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
                            dev->pnp.bus_id,
                            (u32) dev->wakeup.sleep_state);
 
+                mutex_lock(&dev->physical_node_lock);
+
                 if (!dev->physical_node_count) {
                         seq_printf(seq, "%c%-8s\n",
                                 dev->wakeup.flags.run_wake ? '*' : ' ',
@@ -338,6 +340,8 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
                                 put_device(ldev);
                         }
                 }
+
+                mutex_unlock(&dev->physical_node_lock);
         }
         mutex_unlock(&acpi_device_lock);
         return 0;
@@ -347,12 +351,16 @@ static void physical_device_enable_wakeup(struct acpi_device *adev)
 {
         struct acpi_device_physical_node *entry;
 
+        mutex_lock(&adev->physical_node_lock);
+
         list_for_each_entry(entry,
                 &adev->physical_node_list, node)
                 if (entry->dev && device_can_wakeup(entry->dev)) {
                         bool enable = !device_may_wakeup(entry->dev);
                         device_set_wakeup_enable(entry->dev, enable);
                 }
+
+        mutex_unlock(&adev->physical_node_lock);
 }
 
 static ssize_t
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 0ec434d2586d..e1284b8dc6ee 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -689,7 +689,7 @@ static int acpi_video_bqc_quirk(struct acpi_video_device *device,
          * Some systems always report current brightness level as maximum
          * through _BQC, we need to test another value for them.
          */
-        test_level = current_level == max_level ? br->levels[2] : max_level;
+        test_level = current_level == max_level ? br->levels[3] : max_level;
 
         result = acpi_video_device_lcd_set_level(device, test_level);
         if (result)
diff --git a/drivers/ata/pata_imx.c b/drivers/ata/pata_imx.c
index 4ec7c04b3f82..26386f0b89a8 100644
--- a/drivers/ata/pata_imx.c
+++ b/drivers/ata/pata_imx.c
@@ -237,6 +237,7 @@ static const struct of_device_id imx_pata_dt_ids[] = {
                 /* sentinel */
         }
 };
+MODULE_DEVICE_TABLE(of, imx_pata_dt_ids);
 
 static struct platform_driver pata_imx_driver = {
         .probe          = pata_imx_probe,
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index e69102696533..3455f833e473 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -719,7 +719,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
                 }
         }
 
-        return regcache_sync_block_raw_flush(map, &data, base, regtmp);
+        return regcache_sync_block_raw_flush(map, &data, base, regtmp +
+                        map->reg_stride);
 }
 
 int regcache_sync_block(struct regmap *map, void *block,
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 11f467c00d0a..a12b923bbaca 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -91,6 +91,10 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0489, 0xe04e) },
         { USB_DEVICE(0x0489, 0xe056) },
         { USB_DEVICE(0x0489, 0xe04d) },
+        { USB_DEVICE(0x04c5, 0x1330) },
+        { USB_DEVICE(0x13d3, 0x3402) },
+        { USB_DEVICE(0x0cf3, 0x3121) },
+        { USB_DEVICE(0x0cf3, 0xe003) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -128,6 +132,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
@@ -193,24 +201,44 @@ error:
 
 static int ath3k_get_state(struct usb_device *udev, unsigned char *state)
 {
-        int pipe = 0;
+        int ret, pipe = 0;
+        char *buf;
+
+        buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
         pipe = usb_rcvctrlpipe(udev, 0);
-        return usb_control_msg(udev, pipe, ATH3K_GETSTATE,
-                        USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
-                        state, 0x01, USB_CTRL_SET_TIMEOUT);
+        ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE,
+                              USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+                              buf, sizeof(*buf), USB_CTRL_SET_TIMEOUT);
+
+        *state = *buf;
+        kfree(buf);
+
+        return ret;
 }
 
 static int ath3k_get_version(struct usb_device *udev,
                         struct ath3k_version *version)
 {
-        int pipe = 0;
+        int ret, pipe = 0;
+        struct ath3k_version *buf;
+        const int size = sizeof(*buf);
+
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
         pipe = usb_rcvctrlpipe(udev, 0);
-        return usb_control_msg(udev, pipe, ATH3K_GETVERSION,
-                        USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version,
-                        sizeof(struct ath3k_version),
-                        USB_CTRL_SET_TIMEOUT);
+        ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION,
+                              USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+                              buf, size, USB_CTRL_SET_TIMEOUT);
+
+        memcpy(version, buf, size);
+        kfree(buf);
+
+        return ret;
 }
 
 static int ath3k_load_fwfile(struct usb_device *udev,
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index de4cf4daa2f4..8e16f0af6358 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -154,6 +154,10 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
@@ -1095,7 +1099,7 @@ static int btusb_setup_intel_patching(struct hci_dev *hdev,
         if (IS_ERR(skb)) {
                 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
                        hdev->name, cmd->opcode, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
 
         /* It ensures that the returned event matches the event data read from
@@ -1147,7 +1151,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
         if (IS_ERR(skb)) {
                 BT_ERR("%s sending initial HCI reset command failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
@@ -1161,7 +1165,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
         if (IS_ERR(skb)) {
                 BT_ERR("%s reading Intel fw version command failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
 
         if (skb->len != sizeof(*ver)) {
@@ -1219,7 +1223,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
                 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
                 release_firmware(fw);
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
 
         if (skb->data[0]) {
@@ -1276,7 +1280,7 @@ static int btusb_setup_intel(struct hci_dev *hdev)
         if (IS_ERR(skb)) {
                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
@@ -1292,7 +1296,7 @@ exit_mfg_disable:
         if (IS_ERR(skb)) {
                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
@@ -1310,7 +1314,7 @@ exit_mfg_deactivate:
         if (IS_ERR(skb)) {
                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
                        hdev->name, PTR_ERR(skb));
-                return -PTR_ERR(skb);
+                return PTR_ERR(skb);
         }
         kfree_skb(skb);
 
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index bf5d2477cb77..15f2e7025b78 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -129,7 +129,8 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
         off_t j, io_pg_start;
         int io_pg_count;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type ||
+                agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
                 return -EINVAL;
         }
 
@@ -175,7 +176,8 @@ parisc_agp_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         struct _parisc_agp_info *info = &parisc_agp_info;
         int i, io_pg_start, io_pg_count;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type ||
+                agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type)) {
                 return -EINVAL;
         }
 
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 1b456fe9b87a..fc45567ad3ac 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -272,9 +272,12 @@ static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev,
         unsigned long flags;
 
         spin_lock_irqsave(&portdev->ports_lock, flags);
-        list_for_each_entry(port, &portdev->ports, list)
-                if (port->cdev->dev == dev)
+        list_for_each_entry(port, &portdev->ports, list) {
+                if (port->cdev->dev == dev) {
+                        kref_get(&port->kref);
                         goto out;
+                }
+        }
         port = NULL;
 out:
         spin_unlock_irqrestore(&portdev->ports_lock, flags);
@@ -746,6 +749,10 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
 
         port = filp->private_data;
 
+        /* Port is hot-unplugged. */
+        if (!port->guest_connected)
+                return -ENODEV;
+
         if (!port_has_data(port)) {
                 /*
                  * If nothing's connected on the host just return 0 in
@@ -762,7 +769,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
                 if (ret < 0)
                         return ret;
         }
-        /* Port got hot-unplugged. */
+        /* Port got hot-unplugged while we were waiting above. */
         if (!port->guest_connected)
                 return -ENODEV;
         /*
@@ -932,13 +939,25 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
         if (is_rproc_serial(port->out_vq->vdev))
                 return -EINVAL;
 
+        /*
+         * pipe->nrbufs == 0 means there are no data to transfer,
+         * so this returns just 0 for no data.
+         */
+        pipe_lock(pipe);
+        if (!pipe->nrbufs) {
+                ret = 0;
+                goto error_out;
+        }
+
         ret = wait_port_writable(port, filp->f_flags & O_NONBLOCK);
         if (ret < 0)
-                return ret;
+                goto error_out;
 
         buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
-        if (!buf)
-                return -ENOMEM;
+        if (!buf) {
+                ret = -ENOMEM;
+                goto error_out;
+        }
 
         sgl.n = 0;
         sgl.len = 0;
@@ -946,12 +965,17 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
         sgl.sg = buf->sg;
         sg_init_table(sgl.sg, sgl.size);
         ret = __splice_from_pipe(pipe, &sd, pipe_to_sg);
+        pipe_unlock(pipe);
         if (likely(ret > 0))
                 ret = __send_to_port(port, buf->sg, sgl.n, sgl.len, buf, true);
 
         if (unlikely(ret <= 0))
                 free_buf(buf, true);
         return ret;
+
+error_out:
+        pipe_unlock(pipe);
+        return ret;
 }
 
 static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
@@ -1019,14 +1043,14 @@ static int port_fops_open(struct inode *inode, struct file *filp)
         struct port *port;
         int ret;
 
+        /* We get the port with a kref here */
         port = find_port_by_devt(cdev->dev);
+        if (!port) {
+                /* Port was unplugged before we could proceed */
+                return -ENXIO;
+        }
         filp->private_data = port;
 
-        /* Prevent against a port getting hot-unplugged at the same time */
-        spin_lock_irq(&port->portdev->ports_lock);
-        kref_get(&port->kref);
-        spin_unlock_irq(&port->portdev->ports_lock);
-
         /*
          * Don't allow opening of console port devices -- that's done
          * via /dev/hvc
@@ -1498,14 +1522,6 @@ static void remove_port(struct kref *kref)
 
         port = container_of(kref, struct port, kref);
 
-        sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
-        device_destroy(pdrvdata.class, port->dev->devt);
-        cdev_del(port->cdev);
-
-        kfree(port->name);
-
-        debugfs_remove(port->debugfs_file);
-
         kfree(port);
 }
 
@@ -1539,12 +1555,14 @@ static void unplug_port(struct port *port)
         spin_unlock_irq(&port->portdev->ports_lock);
 
         if (port->guest_connected) {
+                /* Let the app know the port is going down. */
+                send_sigio_to_port(port);
+
+                /* Do this after sigio is actually sent */
                 port->guest_connected = false;
                 port->host_connected = false;
-                wake_up_interruptible(&port->waitqueue);
 
-                /* Let the app know the port is going down. */
-                send_sigio_to_port(port);
+                wake_up_interruptible(&port->waitqueue);
         }
 
         if (is_console_port(port)) {
@@ -1563,6 +1581,14 @@ static void unplug_port(struct port *port)
          */
         port->portdev = NULL;
 
+        sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
+        device_destroy(pdrvdata.class, port->dev->devt);
+        cdev_del(port->cdev);
+
+        kfree(port->name);
+
+        debugfs_remove(port->debugfs_file);
+
         /*
          * Locks around here are not necessary - a port can't be
          * opened after we removed the port struct from ports_list
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a4ad7339588d..f0a5e2b0eb8a 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1177,14 +1177,11 @@ static int __cpufreq_remove_dev(struct device *dev,
                                 __func__, cpu_dev->id, cpu);
         }
 
-        if ((cpus == 1) && (cpufreq_driver->target))
-                __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
-
-        pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
-        cpufreq_cpu_put(data);
-
         /* If cpu is last user of policy, free policy */
         if (cpus == 1) {
+                if (cpufreq_driver->target)
+                        __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+
                 lock_policy_rwsem_read(cpu);
                 kobj = &data->kobj;
                 cmp = &data->kobj_unregister;
@@ -1205,9 +1202,13 @@ static int __cpufreq_remove_dev(struct device *dev,
                 free_cpumask_var(data->related_cpus);
                 free_cpumask_var(data->cpus);
                 kfree(data);
-        } else if (cpufreq_driver->target) {
-                __cpufreq_governor(data, CPUFREQ_GOV_START);
-                __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+        } else {
+                pr_debug("%s: removing link, cpu: %d\n", __func__, cpu);
+                cpufreq_cpu_put(data);
+                if (cpufreq_driver->target) {
+                        __cpufreq_governor(data, CPUFREQ_GOV_START);
+                        __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
+                }
         }
 
         per_cpu(cpufreq_policy_cpu, cpu) = -1;
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 0ceb2eff5a7e..f97cb3d8c5a2 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -221,8 +221,8 @@ static ssize_t store_down_threshold(struct dbs_data *dbs_data, const char *buf,
         return count;
 }
 
-static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
-                size_t count)
+static ssize_t store_ignore_nice_load(struct dbs_data *dbs_data,
+                const char *buf, size_t count)
 {
         struct cs_dbs_tuners *cs_tuners = dbs_data->tuners;
         unsigned int input, j;
@@ -235,10 +235,10 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
         if (input > 1)
                 input = 1;
 
-        if (input == cs_tuners->ignore_nice) /* nothing to do */
+        if (input == cs_tuners->ignore_nice_load) /* nothing to do */
                 return count;
 
-        cs_tuners->ignore_nice = input;
+        cs_tuners->ignore_nice_load = input;
 
         /* we need to re-evaluate prev_cpu_idle */
         for_each_online_cpu(j) {
@@ -246,7 +246,7 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
                 dbs_info = &per_cpu(cs_cpu_dbs_info, j);
                 dbs_info->cdbs.prev_cpu_idle = get_cpu_idle_time(j,
                                         &dbs_info->cdbs.prev_cpu_wall, 0);
-                if (cs_tuners->ignore_nice)
+                if (cs_tuners->ignore_nice_load)
                         dbs_info->cdbs.prev_cpu_nice =
                                 kcpustat_cpu(j).cpustat[CPUTIME_NICE];
         }
@@ -279,7 +279,7 @@ show_store_one(cs, sampling_rate);
 show_store_one(cs, sampling_down_factor);
 show_store_one(cs, up_threshold);
 show_store_one(cs, down_threshold);
-show_store_one(cs, ignore_nice);
+show_store_one(cs, ignore_nice_load);
 show_store_one(cs, freq_step);
 declare_show_sampling_rate_min(cs);
 
@@ -287,7 +287,7 @@ gov_sys_pol_attr_rw(sampling_rate);
 gov_sys_pol_attr_rw(sampling_down_factor);
 gov_sys_pol_attr_rw(up_threshold);
 gov_sys_pol_attr_rw(down_threshold);
-gov_sys_pol_attr_rw(ignore_nice);
+gov_sys_pol_attr_rw(ignore_nice_load);
 gov_sys_pol_attr_rw(freq_step);
 gov_sys_pol_attr_ro(sampling_rate_min);
 
@@ -297,7 +297,7 @@ static struct attribute *dbs_attributes_gov_sys[] = {
         &sampling_down_factor_gov_sys.attr,
         &up_threshold_gov_sys.attr,
         &down_threshold_gov_sys.attr,
-        &ignore_nice_gov_sys.attr,
+        &ignore_nice_load_gov_sys.attr,
         &freq_step_gov_sys.attr,
         NULL
 };
@@ -313,7 +313,7 @@ static struct attribute *dbs_attributes_gov_pol[] = {
         &sampling_down_factor_gov_pol.attr,
         &up_threshold_gov_pol.attr,
         &down_threshold_gov_pol.attr,
-        &ignore_nice_gov_pol.attr,
+        &ignore_nice_load_gov_pol.attr,
         &freq_step_gov_pol.attr,
         NULL
 };
@@ -338,7 +338,7 @@ static int cs_init(struct dbs_data *dbs_data)
         tuners->up_threshold = DEF_FREQUENCY_UP_THRESHOLD;
         tuners->down_threshold = DEF_FREQUENCY_DOWN_THRESHOLD;
         tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
-        tuners->ignore_nice = 0;
+        tuners->ignore_nice_load = 0;
         tuners->freq_step = DEF_FREQUENCY_STEP;
 
         dbs_data->tuners = tuners;
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 7b839a8db2a7..e59afaa9da23 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -47,9 +47,9 @@ void dbs_check_cpu(struct dbs_data *dbs_data, int cpu)
         unsigned int j;
 
         if (dbs_data->cdata->governor == GOV_ONDEMAND)
-                ignore_nice = od_tuners->ignore_nice;
+                ignore_nice = od_tuners->ignore_nice_load;
         else
-                ignore_nice = cs_tuners->ignore_nice;
+                ignore_nice = cs_tuners->ignore_nice_load;
 
         policy = cdbs->cur_policy;
 
@@ -298,12 +298,12 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 cs_tuners = dbs_data->tuners;
                 cs_dbs_info = dbs_data->cdata->get_cpu_dbs_info_s(cpu);
                 sampling_rate = cs_tuners->sampling_rate;
-                ignore_nice = cs_tuners->ignore_nice;
+                ignore_nice = cs_tuners->ignore_nice_load;
         } else {
                 od_tuners = dbs_data->tuners;
                 od_dbs_info = dbs_data->cdata->get_cpu_dbs_info_s(cpu);
                 sampling_rate = od_tuners->sampling_rate;
-                ignore_nice = od_tuners->ignore_nice;
+                ignore_nice = od_tuners->ignore_nice_load;
                 od_ops = dbs_data->cdata->gov_ops;
                 io_busy = od_tuners->io_is_busy;
         }
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 6663ec3b3056..d5f12b4b11b8 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -165,7 +165,7 @@ struct cs_cpu_dbs_info_s {
 
 /* Per policy Governers sysfs tunables */
 struct od_dbs_tuners {
-        unsigned int ignore_nice;
+        unsigned int ignore_nice_load;
         unsigned int sampling_rate;
         unsigned int sampling_down_factor;
         unsigned int up_threshold;
@@ -175,7 +175,7 @@ struct od_dbs_tuners {
 };
 
 struct cs_dbs_tuners {
-        unsigned int ignore_nice;
+        unsigned int ignore_nice_load;
         unsigned int sampling_rate;
         unsigned int sampling_down_factor;
         unsigned int up_threshold;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 93eb5cbcc1f6..c087347d6688 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -403,8 +403,8 @@ static ssize_t store_sampling_down_factor(struct dbs_data *dbs_data,
         return count;
 }
 
-static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
-                size_t count)
+static ssize_t store_ignore_nice_load(struct dbs_data *dbs_data,
+                const char *buf, size_t count)
 {
         struct od_dbs_tuners *od_tuners = dbs_data->tuners;
         unsigned int input;
@@ -419,10 +419,10 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
         if (input > 1)
                 input = 1;
 
-        if (input == od_tuners->ignore_nice) { /* nothing to do */
+        if (input == od_tuners->ignore_nice_load) { /* nothing to do */
                 return count;
         }
-        od_tuners->ignore_nice = input;
+        od_tuners->ignore_nice_load = input;
 
         /* we need to re-evaluate prev_cpu_idle */
         for_each_online_cpu(j) {
@@ -430,7 +430,7 @@ static ssize_t store_ignore_nice(struct dbs_data *dbs_data, const char *buf,
                 dbs_info = &per_cpu(od_cpu_dbs_info, j);
                 dbs_info->cdbs.prev_cpu_idle = get_cpu_idle_time(j,
                         &dbs_info->cdbs.prev_cpu_wall, od_tuners->io_is_busy);
-                if (od_tuners->ignore_nice)
+                if (od_tuners->ignore_nice_load)
                         dbs_info->cdbs.prev_cpu_nice =
                                 kcpustat_cpu(j).cpustat[CPUTIME_NICE];
 
@@ -461,7 +461,7 @@ show_store_one(od, sampling_rate);
 show_store_one(od, io_is_busy);
 show_store_one(od, up_threshold);
 show_store_one(od, sampling_down_factor);
-show_store_one(od, ignore_nice);
+show_store_one(od, ignore_nice_load);
 show_store_one(od, powersave_bias);
 declare_show_sampling_rate_min(od);
 
@@ -469,7 +469,7 @@ gov_sys_pol_attr_rw(sampling_rate);
 gov_sys_pol_attr_rw(io_is_busy);
 gov_sys_pol_attr_rw(up_threshold);
 gov_sys_pol_attr_rw(sampling_down_factor);
-gov_sys_pol_attr_rw(ignore_nice);
+gov_sys_pol_attr_rw(ignore_nice_load);
 gov_sys_pol_attr_rw(powersave_bias);
 gov_sys_pol_attr_ro(sampling_rate_min);
 
@@ -478,7 +478,7 @@ static struct attribute *dbs_attributes_gov_sys[] = {
         &sampling_rate_gov_sys.attr,
         &up_threshold_gov_sys.attr,
         &sampling_down_factor_gov_sys.attr,
-        &ignore_nice_gov_sys.attr,
+        &ignore_nice_load_gov_sys.attr,
         &powersave_bias_gov_sys.attr,
         &io_is_busy_gov_sys.attr,
         NULL
@@ -494,7 +494,7 @@ static struct attribute *dbs_attributes_gov_pol[] = {
         &sampling_rate_gov_pol.attr,
         &up_threshold_gov_pol.attr,
         &sampling_down_factor_gov_pol.attr,
-        &ignore_nice_gov_pol.attr,
+        &ignore_nice_load_gov_pol.attr,
         &powersave_bias_gov_pol.attr,
         &io_is_busy_gov_pol.attr,
         NULL
@@ -544,7 +544,7 @@ static int od_init(struct dbs_data *dbs_data)
         }
 
         tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
-        tuners->ignore_nice = 0;
+        tuners->ignore_nice_load = 0;
         tuners->powersave_bias = default_powersave_bias;
         tuners->io_is_busy = should_io_be_busy();
 
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index bb838b985077..9536852c504a 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -118,11 +118,6 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 clk_put(cpuclk);
                 return -EINVAL;
         }
-        ret = clk_set_rate(cpuclk, rate);
-        if (ret) {
-                clk_put(cpuclk);
-                return ret;
-        }
 
         /* clock table init */
         for (i = 2;
@@ -130,6 +125,12 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
              i++)
                 loongson2_clockmod_table[i].frequency = (rate * i) / 8;
 
+        ret = clk_set_rate(cpuclk, rate);
+        if (ret) {
+                clk_put(cpuclk);
+                return ret;
+        }
+
         policy->cur = loongson2_cpufreq_get(policy->cpu);
 
         cpufreq_frequency_table_get_attr(&loongson2_clockmod_table[0],
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index fe343a06b7da..bc580b67a652 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -28,13 +28,6 @@
 #define MAX_INTERESTING 50000
 #define STDDEV_THRESH 400
 
-/* 60 * 60 > STDDEV_THRESH * INTERVALS = 400 * 8 */
-#define MAX_DEVIATION 60
-
-static DEFINE_PER_CPU(struct hrtimer, menu_hrtimer);
-static DEFINE_PER_CPU(int, hrtimer_status);
-/* menu hrtimer mode */
-enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
 
 /*
  * Concepts and ideas behind the menu governor
@@ -116,13 +109,6 @@ enum {MENU_HRTIMER_STOP, MENU_HRTIMER_REPEAT, MENU_HRTIMER_GENERAL};
  *
  */
 
-/*
- * The C-state residency is so long that is is worthwhile to exit
- * from the shallow C-state and re-enter into a deeper C-state.
- */
-static unsigned int perfect_cstate_ms __read_mostly = 30;
-module_param(perfect_cstate_ms, uint, 0000);
-
 struct menu_device {
         int             last_state_idx;
         int             needs_update;
@@ -205,52 +191,17 @@ static u64 div_round64(u64 dividend, u32 divisor)
         return div_u64(dividend + (divisor / 2), divisor);
 }
 
-/* Cancel the hrtimer if it is not triggered yet */
-void menu_hrtimer_cancel(void)
-{
-        int cpu = smp_processor_id();
-        struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
-
-        /* The timer is still not time out*/
-        if (per_cpu(hrtimer_status, cpu)) {
-                hrtimer_cancel(hrtmr);
-                per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
-        }
-}
-EXPORT_SYMBOL_GPL(menu_hrtimer_cancel);
-
-/* Call back for hrtimer is triggered */
-static enum hrtimer_restart menu_hrtimer_notify(struct hrtimer *hrtimer)
-{
-        int cpu = smp_processor_id();
-        struct menu_device *data = &per_cpu(menu_devices, cpu);
-
-        /* In general case, the expected residency is much larger than
-         *  deepest C-state target residency, but prediction logic still
-         *  predicts a small predicted residency, so the prediction
-         *  history is totally broken if the timer is triggered.
-         *  So reset the correction factor.
-         */
-        if (per_cpu(hrtimer_status, cpu) == MENU_HRTIMER_GENERAL)
-                data->correction_factor[data->bucket] = RESOLUTION * DECAY;
-
-        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_STOP;
-
-        return HRTIMER_NORESTART;
-}
-
 /*
  * Try detecting repeating patterns by keeping track of the last 8
  * intervals, and checking if the standard deviation of that set
  * of points is below a threshold. If it is... then use the
  * average of these 8 points as the estimated value.
  */
-static u32 get_typical_interval(struct menu_device *data)
+static void get_typical_interval(struct menu_device *data)
 {
         int i = 0, divisor = 0;
         uint64_t max = 0, avg = 0, stddev = 0;
         int64_t thresh = LLONG_MAX; /* Discard outliers above this value. */
-        unsigned int ret = 0;
 
 again:
 
@@ -291,16 +242,13 @@ again:
         if (((avg > stddev * 6) && (divisor * 4 >= INTERVALS * 3))
                                                         || stddev <= 20) {
                 data->predicted_us = avg;
-                ret = 1;
-                return ret;
+                return;
 
         } else if ((divisor * 4) > INTERVALS * 3) {
                 /* Exclude the max interval */
                 thresh = max - 1;
                 goto again;
         }
-
-        return ret;
 }
 
 /**
@@ -315,9 +263,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
         int i;
         int multiplier;
         struct timespec t;
-        int repeat = 0, low_predicted = 0;
-        int cpu = smp_processor_id();
-        struct hrtimer *hrtmr = &per_cpu(menu_hrtimer, cpu);
 
         if (data->needs_update) {
                 menu_update(drv, dev);
@@ -352,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
         data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
                                          RESOLUTION * DECAY);
 
-        repeat = get_typical_interval(data);
+        get_typical_interval(data);
 
         /*
          * We want to default to C1 (hlt), not to busy polling
@@ -373,10 +318,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 
                 if (s->disabled || su->disable)
                         continue;
-                if (s->target_residency > data->predicted_us) {
-                        low_predicted = 1;
+                if (s->target_residency > data->predicted_us)
                         continue;
-                }
                 if (s->exit_latency > latency_req)
                         continue;
                 if (s->exit_latency * multiplier > data->predicted_us)
@@ -386,44 +329,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
                 data->exit_us = s->exit_latency;
         }
 
-        /* not deepest C-state chosen for low predicted residency */
-        if (low_predicted) {
-                unsigned int timer_us = 0;
-                unsigned int perfect_us = 0;
-
-                /*
-                 * Set a timer to detect whether this sleep is much
-                 * longer than repeat mode predicted.  If the timer
-                 * triggers, the code will evaluate whether to put
-                 * the CPU into a deeper C-state.
-                 * The timer is cancelled on CPU wakeup.
-                 */
-                timer_us = 2 * (data->predicted_us + MAX_DEVIATION);
-
-                perfect_us = perfect_cstate_ms * 1000;
-
-                if (repeat && (4 * timer_us < data->expected_us)) {
-                        RCU_NONIDLE(hrtimer_start(hrtmr,
-                                ns_to_ktime(1000 * timer_us),
-                                HRTIMER_MODE_REL_PINNED));
-                        /* In repeat case, menu hrtimer is started */
-                        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_REPEAT;
-                } else if (perfect_us < data->expected_us) {
-                        /*
-                         * The next timer is long. This could be because
-                         * we did not make a useful prediction.
-                         * In that case, it makes sense to re-enter
-                         * into a deeper C-state after some time.
-                         */
-                        RCU_NONIDLE(hrtimer_start(hrtmr,
-                                ns_to_ktime(1000 * timer_us),
-                                HRTIMER_MODE_REL_PINNED));
-                        /* In general case, menu hrtimer is started */
-                        per_cpu(hrtimer_status, cpu) = MENU_HRTIMER_GENERAL;
-                }
-
-        }
-
         return data->last_state_idx;
 }
 
@@ -514,9 +419,6 @@ static int menu_enable_device(struct cpuidle_driver *drv,
                                 struct cpuidle_device *dev)
 {
         struct menu_device *data = &per_cpu(menu_devices, dev->cpu);
-        struct hrtimer *t = &per_cpu(menu_hrtimer, dev->cpu);
-        hrtimer_init(t, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
-        t->function = menu_hrtimer_notify;
 
         memset(data, 0, sizeof(struct menu_device));
 
diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
index ce3dc3e9688c..0bbdea5059f3 100644
--- a/drivers/dma/pch_dma.c
+++ b/drivers/dma/pch_dma.c
@@ -867,6 +867,7 @@ static int pch_dma_probe(struct pci_dev *pdev,
 
         if (!(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
                 dev_err(&pdev->dev, "Cannot find proper base address\n");
+                err = -ENODEV;
                 goto err_disable_pdev;
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 593827b3fdd4..fa645d825009 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2505,6 +2505,10 @@ static dma_cookie_t pl330_tx_submit(struct dma_async_tx_descriptor *tx)
         /* Assign cookies to all nodes */
         while (!list_empty(&last->node)) {
                 desc = list_entry(last->node.next, struct dma_pl330_desc, node);
+                if (pch->cyclic) {
+                        desc->txd.callback = last->txd.callback;
+                        desc->txd.callback_param = last->txd.callback_param;
+                }
 
                 dma_cookie_assign(&desc->txd);
 
@@ -2688,45 +2692,82 @@ static struct dma_async_tx_descriptor *pl330_prep_dma_cyclic(
                 size_t period_len, enum dma_transfer_direction direction,
                 unsigned long flags, void *context)
 {
-        struct dma_pl330_desc *desc;
+        struct dma_pl330_desc *desc = NULL, *first = NULL;
         struct dma_pl330_chan *pch = to_pchan(chan);
+        struct dma_pl330_dmac *pdmac = pch->dmac;
+        unsigned int i;
         dma_addr_t dst;
         dma_addr_t src;
 
-        desc = pl330_get_desc(pch);
-        if (!desc) {
-                dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
-                        __func__, __LINE__);
+        if (len % period_len != 0)
                 return NULL;
-        }
 
-        switch (direction) {
-        case DMA_MEM_TO_DEV:
-                desc->rqcfg.src_inc = 1;
-                desc->rqcfg.dst_inc = 0;
-                desc->req.rqtype = MEMTODEV;
-                src = dma_addr;
-                dst = pch->fifo_addr;
-                break;
-        case DMA_DEV_TO_MEM:
-                desc->rqcfg.src_inc = 0;
-                desc->rqcfg.dst_inc = 1;
-                desc->req.rqtype = DEVTOMEM;
-                src = pch->fifo_addr;
-                dst = dma_addr;
-                break;
-        default:
+        if (!is_slave_direction(direction)) {
                 dev_err(pch->dmac->pif.dev, "%s:%d Invalid dma direction\n",
                 __func__, __LINE__);
                 return NULL;
         }
 
-        desc->rqcfg.brst_size = pch->burst_sz;
-        desc->rqcfg.brst_len = 1;
+        for (i = 0; i < len / period_len; i++) {
+                desc = pl330_get_desc(pch);
+                if (!desc) {
+                        dev_err(pch->dmac->pif.dev, "%s:%d Unable to fetch desc\n",
+                                __func__, __LINE__);
 
-        pch->cyclic = true;
+                        if (!first)
+                                return NULL;
+
+                        spin_lock_irqsave(&pdmac->pool_lock, flags);
+
+                        while (!list_empty(&first->node)) {
+                                desc = list_entry(first->node.next,
+                                                struct dma_pl330_desc, node);
+                                list_move_tail(&desc->node, &pdmac->desc_pool);
+                        }
+
+                        list_move_tail(&first->node, &pdmac->desc_pool);
 
-        fill_px(&desc->px, dst, src, period_len);
+                        spin_unlock_irqrestore(&pdmac->pool_lock, flags);
+
+                        return NULL;
+                }
+
+                switch (direction) {
+                case DMA_MEM_TO_DEV:
+                        desc->rqcfg.src_inc = 1;
+                        desc->rqcfg.dst_inc = 0;
+                        desc->req.rqtype = MEMTODEV;
+                        src = dma_addr;
+                        dst = pch->fifo_addr;
+                        break;
+                case DMA_DEV_TO_MEM:
+                        desc->rqcfg.src_inc = 0;
+                        desc->rqcfg.dst_inc = 1;
+                        desc->req.rqtype = DEVTOMEM;
+                        src = pch->fifo_addr;
+                        dst = dma_addr;
+                        break;
+                default:
+                        break;
+                }
+
+                desc->rqcfg.brst_size = pch->burst_sz;
+                desc->rqcfg.brst_len = 1;
+                fill_px(&desc->px, dst, src, period_len);
+
+                if (!first)
+                        first = desc;
+                else
+                        list_add_tail(&desc->node, &first->node);
+
+                dma_addr += period_len;
+        }
+
+        if (!desc)
+                return NULL;
+
+        pch->cyclic = true;
+        desc->txd.flags = flags;
 
         return &desc->txd;
 }
diff --git a/drivers/dma/sh/shdma.c b/drivers/dma/sh/shdma.c
index b67f45f5c271..5039fbc88254 100644
--- a/drivers/dma/sh/shdma.c
+++ b/drivers/dma/sh/shdma.c
@@ -400,8 +400,8 @@ static size_t sh_dmae_get_partial(struct shdma_chan *schan,
                                                     shdma_chan);
         struct sh_dmae_desc *sh_desc = container_of(sdesc,
                                         struct sh_dmae_desc, shdma_desc);
-        return (sh_desc->hw.tcr - sh_dmae_readl(sh_chan, TCR)) <<
-                sh_chan->xmit_shift;
+        return sh_desc->hw.tcr -
+                (sh_dmae_readl(sh_chan, TCR) << sh_chan->xmit_shift);
 }
 
 /* Called from error IRQ or NMI */
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index eb760a218da4..232fa8fce26a 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -419,6 +419,13 @@ static void __init dmi_format_ids(char *buf, size_t len)
                             dmi_get_system_info(DMI_BIOS_DATE));
 }
 
+/*
+ * Check for DMI/SMBIOS headers in the system firmware image.  Any
+ * SMBIOS header must start 16 bytes before the DMI header, so take a
+ * 32 byte buffer and check for DMI at offset 16 and SMBIOS at offset
+ * 0.  If the DMI header is present, set dmi_ver accordingly (SMBIOS
+ * takes precedence) and return 0.  Otherwise return 1.
+ */
 static int __init dmi_present(const u8 *buf)
 {
         int smbios_ver;
@@ -506,6 +513,13 @@ void __init dmi_scan_machine(void)
                 if (p == NULL)
                         goto error;
 
+                /*
+                 * Iterate over all possible DMI header addresses q.
+                 * Maintain the 32 bytes around q in buf.  On the
+                 * first iteration, substitute zero for the
+                 * out-of-range bytes so there is no chance of falsely
+                 * detecting an SMBIOS header.
+                 */
                 memset(buf, 0, 16);
                 for (q = p; q < p + 0x10000; q += 16) {
                         memcpy_fromio(buf + 16, q, 16);
diff --git a/drivers/gpio/gpio-msm-v1.c b/drivers/gpio/gpio-msm-v1.c
index e3ceaacde45c..73b73969d361 100644
--- a/drivers/gpio/gpio-msm-v1.c
+++ b/drivers/gpio/gpio-msm-v1.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/platform_device.h>
+#include <linux/err.h>
 
 #include <mach/msm_gpiomux.h>
 
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index c57244ef428b..dfeb3a3a8f20 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -1037,18 +1037,6 @@ omap_mpuio_alloc_gc(struct gpio_bank *bank, unsigned int irq_start,
                                IRQ_NOREQUEST | IRQ_NOPROBE, 0);
 }
 
-#if defined(CONFIG_OF_GPIO)
-static inline bool omap_gpio_chip_boot_dt(struct gpio_chip *chip)
-{
-        return chip->of_node != NULL;
-}
-#else
-static inline bool omap_gpio_chip_boot_dt(struct gpio_chip *chip)
-{
-        return false;
-}
-#endif
-
 static void omap_gpio_chip_init(struct gpio_bank *bank)
 {
         int j;
@@ -1080,68 +1068,24 @@ static void omap_gpio_chip_init(struct gpio_bank *bank)
 
         gpiochip_add(&bank->chip);
 
-        /*
-         * REVISIT these explicit calls to irq_create_mapping()
-         * to do the GPIO to IRQ domain mapping for each GPIO in
-         * the bank can be removed once all OMAP platforms have
-         * been migrated to Device Tree boot only.
-         * Since in DT boot irq_create_mapping() is called from
-         * irq_create_of_mapping() only for the GPIO lines that
-         * are used as interrupts.
-         */
-        if (!omap_gpio_chip_boot_dt(&bank->chip))
-                for (j = 0; j < bank->width; j++)
-                        irq_create_mapping(bank->domain, j);
+        for (j = 0; j < bank->width; j++) {
+                int irq = irq_create_mapping(bank->domain, j);
+                irq_set_lockdep_class(irq, &gpio_lock_class);
+                irq_set_chip_data(irq, bank);
+                if (bank->is_mpuio) {
+                        omap_mpuio_alloc_gc(bank, irq, bank->width);
+                } else {
+                        irq_set_chip_and_handler(irq, &gpio_irq_chip,
+                                                 handle_simple_irq);
+                        set_irq_flags(irq, IRQF_VALID);
+                }
+        }
         irq_set_chained_handler(bank->irq, gpio_irq_handler);
         irq_set_handler_data(bank->irq, bank);
 }
 
 static const struct of_device_id omap_gpio_match[];
 
-static int omap_gpio_irq_map(struct irq_domain *d, unsigned int virq,
-                             irq_hw_number_t hwirq)
-{
-        struct gpio_bank *bank = d->host_data;
-        int gpio;
-        int ret;
-
-        if (!bank)
-                return -EINVAL;
-
-        irq_set_lockdep_class(virq, &gpio_lock_class);
-        irq_set_chip_data(virq, bank);
-        if (bank->is_mpuio) {
-                omap_mpuio_alloc_gc(bank, virq, bank->width);
-        } else {
-                irq_set_chip_and_handler(virq, &gpio_irq_chip,
-                                         handle_simple_irq);
-                set_irq_flags(virq, IRQF_VALID);
-        }
-
-        /*
-         * REVISIT most GPIO IRQ chip drivers need to call
-         * gpio_request() before a GPIO line can be used as an
-         * IRQ. Ideally this should be handled by the IRQ core
-         * but until then this has to be done on a per driver
-         * basis. Remove this once this is managed by the core.
-         */
-        if (omap_gpio_chip_boot_dt(&bank->chip)) {
-                gpio = irq_to_gpio(bank, hwirq);
-                ret = gpio_request_one(gpio, GPIOF_IN, NULL);
-                if (ret) {
-                        dev_err(bank->dev, "Could not request GPIO%d\n", gpio);
-                        return ret;
-                }
-        }
-
-        return 0;
-}
-
-static struct irq_domain_ops omap_gpio_irq_ops = {
-        .xlate  = irq_domain_xlate_onetwocell,
-        .map    = omap_gpio_irq_map,
-};
-
 static int omap_gpio_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -1207,10 +1151,10 @@ static int omap_gpio_probe(struct platform_device *pdev)
         }
 
         bank->domain = irq_domain_add_legacy(node, bank->width, irq_base,
-                                             0, &omap_gpio_irq_ops, bank);
+                                             0, &irq_domain_simple_ops, NULL);
 #else
         bank->domain = irq_domain_add_linear(node, bank->width,
-                                             &omap_gpio_irq_ops, bank);
+                                             &irq_domain_simple_ops, NULL);
 #endif
         if (!bank->domain) {
                 dev_err(dev, "Couldn't register an IRQ domain\n");
diff --git a/drivers/gpu/drm/ast/ast_ttm.c b/drivers/gpu/drm/ast/ast_ttm.c
index 98d670825a1a..6e8887fe6c1b 100644
--- a/drivers/gpu/drm/ast/ast_ttm.c
+++ b/drivers/gpu/drm/ast/ast_ttm.c
@@ -323,6 +323,7 @@ int ast_bo_create(struct drm_device *dev, int size, int align,
 
         astbo->gem.driver_private = NULL;
         astbo->bo.bdev = &ast->ttm.bdev;
+        astbo->bo.bdev->dev_mapping = dev->dev_mapping;
 
         ast_ttm_placement(astbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
diff --git a/drivers/gpu/drm/cirrus/cirrus_ttm.c b/drivers/gpu/drm/cirrus/cirrus_ttm.c
index 0047012045c2..69fd8f1ac8df 100644
--- a/drivers/gpu/drm/cirrus/cirrus_ttm.c
+++ b/drivers/gpu/drm/cirrus/cirrus_ttm.c
@@ -328,6 +328,7 @@ int cirrus_bo_create(struct drm_device *dev, int size, int align,
 
         cirrusbo->gem.driver_private = NULL;
         cirrusbo->bo.bdev = &cirrus->ttm.bdev;
+        cirrusbo->bo.bdev->dev_mapping = dev->dev_mapping;
 
         cirrus_ttm_placement(cirrusbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 8bcce7866d36..f92da0a32f0d 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -708,7 +708,10 @@ int drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev, int crtc,
         /* Subtract time delta from raw timestamp to get final
          * vblank_time timestamp for end of vblank.
          */
-        etime = ktime_sub_ns(etime, delta_ns);
+        if (delta_ns < 0)
+                etime = ktime_add_ns(etime, -delta_ns);
+        else
+                etime = ktime_sub_ns(etime, delta_ns);
         *vblank_time = ktime_to_timeval(etime);
 
         DRM_DEBUG("crtc %d : v %d p(%d,%d)@ %ld.%ld -> %ld.%ld [e %d us, %d rep]\n",
diff --git a/drivers/gpu/drm/exynos/exynos_ddc.c b/drivers/gpu/drm/exynos/exynos_ddc.c
index 95c75edef01a..30ef41bcd7b8 100644
--- a/drivers/gpu/drm/exynos/exynos_ddc.c
+++ b/drivers/gpu/drm/exynos/exynos_ddc.c
@@ -15,7 +15,6 @@
 
 #include <linux/kernel.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 
 
 #include "exynos_drm_drv.h"
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 61b094f689a7..6e047bd53e2f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -12,7 +12,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 3e106beca5b6..1c263dac3c1c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -14,7 +14,6 @@
 #include <drm/drmP.h>
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/of_device.h>
@@ -130,7 +129,6 @@ static const struct of_device_id fimd_driver_dt_match[] = {
           .data = &exynos5_fimd_driver_data },
         {},
 };
-MODULE_DEVICE_TABLE(of, fimd_driver_dt_match);
 #endif
 
 static inline struct fimd_driver_data *drm_fimd_get_driver_data(
@@ -1082,7 +1080,6 @@ static struct platform_device_id fimd_driver_ids[] = {
         },
         {},
 };
-MODULE_DEVICE_TABLE(platform, fimd_driver_ids);
 
 static const struct dev_pm_ops fimd_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(fimd_suspend, fimd_resume)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 42a5a5466075..eddea4941483 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
@@ -806,9 +805,20 @@ static void g2d_dma_start(struct g2d_data *g2d,
         struct g2d_cmdlist_node *node =
                                 list_first_entry(&runqueue_node->run_cmdlist,
                                                 struct g2d_cmdlist_node, list);
+        int ret;
+
+        ret = pm_runtime_get_sync(g2d->dev);
+        if (ret < 0) {
+                dev_warn(g2d->dev, "failed pm power on.\n");
+                return;
+        }
 
-        pm_runtime_get_sync(g2d->dev);
-        clk_enable(g2d->gate_clk);
+        ret = clk_prepare_enable(g2d->gate_clk);
+        if (ret < 0) {
+                dev_warn(g2d->dev, "failed to enable clock.\n");
+                pm_runtime_put_sync(g2d->dev);
+                return;
+        }
 
         writel_relaxed(node->dma_addr, g2d->regs + G2D_DMA_SFR_BASE_ADDR);
         writel_relaxed(G2D_DMA_START, g2d->regs + G2D_DMA_COMMAND);
@@ -861,7 +871,7 @@ static void g2d_runqueue_worker(struct work_struct *work)
                                             runqueue_work);
 
         mutex_lock(&g2d->runqueue_mutex);
-        clk_disable(g2d->gate_clk);
+        clk_disable_unprepare(g2d->gate_clk);
         pm_runtime_put_sync(g2d->dev);
 
         complete(&g2d->runqueue_node->complete);
@@ -1521,7 +1531,6 @@ static const struct of_device_id exynos_g2d_match[] = {
         { .compatible = "samsung,exynos5250-g2d" },
         {},
 };
-MODULE_DEVICE_TABLE(of, exynos_g2d_match);
 #endif
 
 struct platform_driver g2d_driver = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 472e3b25e7f2..90b8a1a5344c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -12,7 +12,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/pm_runtime.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index aaa550d622f0..8d3bc01d6834 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -15,7 +15,6 @@
 
 #include <linux/kernel.h>
 #include <linux/wait.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index b1ef8e7ff9c9..d2b6ab4def93 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -12,7 +12,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/types.h>
 #include <linux/clk.h>
@@ -342,10 +341,10 @@ int exynos_drm_ipp_get_property(struct drm_device *drm_dev, void *data,
                  */
                 ippdrv = ipp_find_obj(&ctx->ipp_idr, &ctx->ipp_lock,
                                                 prop_list->ipp_id);
-                if (!ippdrv) {
+                if (IS_ERR(ippdrv)) {
                         DRM_ERROR("not found ipp%d driver.\n",
                                         prop_list->ipp_id);
-                        return -EINVAL;
+                        return PTR_ERR(ippdrv);
                 }
 
                 prop_list = ippdrv->prop_list;
@@ -970,9 +969,9 @@ int exynos_drm_ipp_queue_buf(struct drm_device *drm_dev, void *data,
         /* find command node */
         c_node = ipp_find_obj(&ctx->prop_idr, &ctx->prop_lock,
                 qbuf->prop_id);
-        if (!c_node) {
+        if (IS_ERR(c_node)) {
                 DRM_ERROR("failed to get command node.\n");
-                return -EFAULT;
+                return PTR_ERR(c_node);
         }
 
         /* buffer control */
@@ -1106,9 +1105,9 @@ int exynos_drm_ipp_cmd_ctrl(struct drm_device *drm_dev, void *data,
 
         c_node = ipp_find_obj(&ctx->prop_idr, &ctx->prop_lock,
                 cmd_ctrl->prop_id);
-        if (!c_node) {
+        if (IS_ERR(c_node)) {
                 DRM_ERROR("invalid command node list.\n");
-                return -EINVAL;
+                return PTR_ERR(c_node);
         }
 
         if (!exynos_drm_ipp_check_valid(ippdrv->dev, cmd_ctrl->ctrl,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 427640aa5148..49669aa24c45 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 41cc74d83e4e..c57c56519add 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -13,7 +13,6 @@
 #include <drm/drmP.h>
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 
 #include <drm/exynos_drm.h>
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 62ef5971ac3c..2f5c6942c968 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -24,7 +24,6 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/gpu/drm/exynos/exynos_hdmiphy.c b/drivers/gpu/drm/exynos/exynos_hdmiphy.c
index ef04255076c7..6e320ae9afed 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmiphy.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmiphy.c
@@ -15,7 +15,6 @@
 
 #include <linux/kernel.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 
 #include "exynos_drm_drv.h"
 #include "exynos_hdmi.h"
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 42ffb71c63bc..c9a137caea41 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -23,7 +23,6 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/i2c.h>
-#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 66c63808fa35..f4669802a0fb 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1594,6 +1594,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         intel_detect_pch(dev);
 
         intel_irq_init(dev);
+        intel_pm_init(dev);
         intel_gt_sanitize(dev);
         intel_gt_init(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index d2ee3343c943..1929bffc1c77 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1582,6 +1582,7 @@ void i915_hangcheck_elapsed(unsigned long data);
 void i915_handle_error(struct drm_device *dev, bool wedged);
 
 extern void intel_irq_init(struct drm_device *dev);
+extern void intel_pm_init(struct drm_device *dev);
 extern void intel_hpd_init(struct drm_device *dev);
 extern void intel_gt_init(struct drm_device *dev);
 extern void intel_gt_sanitize(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index f2326fc60ac9..6f514297c483 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1856,10 +1856,16 @@
 #define CRT_HOTPLUG_DETECT_VOLTAGE_475MV        (1 << 2)
 
 #define PORT_HOTPLUG_STAT       (dev_priv->info->display_mmio_offset + 0x61114)
-/* HDMI/DP bits are gen4+ */
-#define   PORTB_HOTPLUG_LIVE_STATUS               (1 << 29)
+/*
+ * HDMI/DP bits are gen4+
+ *
+ * WARNING: Bspec for hpd status bits on gen4 seems to be completely confused.
+ * Please check the detailed lore in the commit message for for experimental
+ * evidence.
+ */
+#define   PORTD_HOTPLUG_LIVE_STATUS               (1 << 29)
 #define   PORTC_HOTPLUG_LIVE_STATUS               (1 << 28)
-#define   PORTD_HOTPLUG_LIVE_STATUS               (1 << 27)
+#define   PORTB_HOTPLUG_LIVE_STATUS               (1 << 27)
 #define   PORTD_HOTPLUG_INT_STATUS              (3 << 21)
 #define   PORTC_HOTPLUG_INT_STATUS              (3 << 19)
 #define   PORTB_HOTPLUG_INT_STATUS              (3 << 17)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 5fb305840db8..e38b45786653 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8269,9 +8269,11 @@ check_crtc_state(struct drm_device *dev)
 
                 list_for_each_entry(encoder, &dev->mode_config.encoder_list,
                                     base.head) {
+                        enum pipe pipe;
                         if (encoder->base.crtc != &crtc->base)
                                 continue;
-                        if (encoder->get_config)
+                        if (encoder->get_config &&
+                            encoder->get_hw_state(encoder, &pipe))
                                 encoder->get_config(encoder, &pipe_config);
                 }
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 67e2c1f1c9a8..5950888ae1d0 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -497,8 +497,11 @@ void intel_panel_set_backlight(struct drm_device *dev, u32 level, u32 max)
                 goto out;
         }
 
-        /* scale to hardware */
-        level = level * freq / max;
+        /* scale to hardware, but be careful to not overflow */
+        if (freq < max)
+                level = level * freq / max;
+        else
+                level = freq / max * level;
 
         dev_priv->backlight.level = level;
         if (dev_priv->backlight.device)
@@ -515,6 +518,17 @@ void intel_panel_disable_backlight(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         unsigned long flags;
 
+        /*
+         * Do not disable backlight on the vgaswitcheroo path. When switching
+         * away from i915, the other client may depend on i915 to handle the
+         * backlight. This will leave the backlight on unnecessarily when
+         * another client is not activated.
+         */
+        if (dev->switch_power_state == DRM_SWITCH_POWER_CHANGING) {
+                DRM_DEBUG_DRIVER("Skipping backlight disable on vga switch\n");
+                return;
+        }
+
         spin_lock_irqsave(&dev_priv->backlight.lock, flags);
 
         dev_priv->backlight.enabled = false;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 51a2a60f5bfc..b0e4a0bd1313 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5063,8 +5063,26 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
                 }
         } else {
                 if (enable_requested) {
+                        unsigned long irqflags;
+                        enum pipe p;
+
                         I915_WRITE(HSW_PWR_WELL_DRIVER, 0);
+                        POSTING_READ(HSW_PWR_WELL_DRIVER);
                         DRM_DEBUG_KMS("Requesting to disable the power well\n");
+
+                        /*
+                         * After this, the registers on the pipes that are part
+                         * of the power well will become zero, so we have to
+                         * adjust our counters according to that.
+                         *
+                         * FIXME: Should we do this in general in
+                         * drm_vblank_post_modeset?
+                         */
+                        spin_lock_irqsave(&dev->vbl_lock, irqflags);
+                        for_each_pipe(p)
+                                if (p != PIPE_A)
+                                        dev->last_vblank[p] = 0;
+                        spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
                 }
         }
 }
@@ -5536,6 +5554,12 @@ void intel_gt_init(struct drm_device *dev)
                 dev_priv->gt.force_wake_get = __gen6_gt_force_wake_get;
                 dev_priv->gt.force_wake_put = __gen6_gt_force_wake_put;
         }
+}
+
+void intel_pm_init(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
         INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                           intel_gen6_powersave_work);
 }
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index 251784aa2225..503a414cbdad 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -29,6 +29,7 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
         struct mga_crtc *mga_crtc = to_mga_crtc(crtc);
         struct drm_device *dev = crtc->dev;
         struct mga_device *mdev = dev->dev_private;
+        struct drm_framebuffer *fb = crtc->fb;
         int i;
 
         if (!crtc->enabled)
@@ -36,6 +37,28 @@ static void mga_crtc_load_lut(struct drm_crtc *crtc)
 
         WREG8(DAC_INDEX + MGA1064_INDEX, 0);
 
+        if (fb && fb->bits_per_pixel == 16) {
+                int inc = (fb->depth == 15) ? 8 : 4;
+                u8 r, b;
+                for (i = 0; i < MGAG200_LUT_SIZE; i += inc) {
+                        if (fb->depth == 16) {
+                                if (i > (MGAG200_LUT_SIZE >> 1)) {
+                                        r = b = 0;
+                                } else {
+                                        r = mga_crtc->lut_r[i << 1];
+                                        b = mga_crtc->lut_b[i << 1];
+                                }
+                        } else {
+                                r = mga_crtc->lut_r[i];
+                                b = mga_crtc->lut_b[i];
+                        }
+                        /* VGA registers */
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, r);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_g[i]);
+                        WREG8(DAC_INDEX + MGA1064_COL_PAL, b);
+                }
+                return;
+        }
         for (i = 0; i < MGAG200_LUT_SIZE; i++) {
                 /* VGA registers */
                 WREG8(DAC_INDEX + MGA1064_COL_PAL, mga_crtc->lut_r[i]);
@@ -877,7 +900,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
 
         pitch = crtc->fb->pitches[0] / (crtc->fb->bits_per_pixel / 8);
         if (crtc->fb->bits_per_pixel == 24)
-                pitch = pitch >> (4 - bppshift);
+                pitch = (pitch * 3) >> (4 - bppshift);
         else
                 pitch = pitch >> (4 - bppshift);
 
@@ -1251,6 +1274,24 @@ static void mga_crtc_destroy(struct drm_crtc *crtc)
         kfree(mga_crtc);
 }
 
+static void mga_crtc_disable(struct drm_crtc *crtc)
+{
+        int ret;
+        DRM_DEBUG_KMS("\n");
+        mga_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+        if (crtc->fb) {
+                struct mga_framebuffer *mga_fb = to_mga_framebuffer(crtc->fb);
+                struct drm_gem_object *obj = mga_fb->obj;
+                struct mgag200_bo *bo = gem_to_mga_bo(obj);
+                ret = mgag200_bo_reserve(bo, false);
+                if (ret)
+                        return;
+                mgag200_bo_push_sysram(bo);
+                mgag200_bo_unreserve(bo);
+        }
+        crtc->fb = NULL;
+}
+
 /* These provide the minimum set of functions required to handle a CRTC */
 static const struct drm_crtc_funcs mga_crtc_funcs = {
         .cursor_set = mga_crtc_cursor_set,
@@ -1261,6 +1302,7 @@ static const struct drm_crtc_funcs mga_crtc_funcs = {
 };
 
 static const struct drm_crtc_helper_funcs mga_helper_funcs = {
+        .disable = mga_crtc_disable,
         .dpms = mga_crtc_dpms,
         .mode_fixup = mga_crtc_mode_fixup,
         .mode_set = mga_crtc_mode_set,
@@ -1581,6 +1623,8 @@ static struct drm_connector *mga_vga_init(struct drm_device *dev)
 
         drm_connector_helper_add(connector, &mga_vga_connector_helper_funcs);
 
+        drm_sysfs_connector_add(connector);
+
         mga_connector->i2c = mgag200_i2c_create(dev);
         if (!mga_connector->i2c)
                 DRM_ERROR("failed to add ddc bus\n");
diff --git a/drivers/gpu/drm/mgag200/mgag200_ttm.c b/drivers/gpu/drm/mgag200/mgag200_ttm.c
index 3acb2b044c7b..d70e4a92773b 100644
--- a/drivers/gpu/drm/mgag200/mgag200_ttm.c
+++ b/drivers/gpu/drm/mgag200/mgag200_ttm.c
@@ -323,6 +323,7 @@ int mgag200_bo_create(struct drm_device *dev, int size, int align,
 
         mgabo->gem.driver_private = NULL;
         mgabo->bo.bdev = &mdev->ttm.bdev;
+        mgabo->bo.bdev->dev_mapping = dev->dev_mapping;
 
         mgag200_ttm_placement(mgabo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
 
@@ -353,6 +354,7 @@ int mgag200_bo_pin(struct mgag200_bo *bo, u32 pl_flag, u64 *gpu_addr)
                 bo->pin_count++;
                 if (gpu_addr)
                         *gpu_addr = mgag200_bo_gpu_offset(bo);
+                return 0;
         }
 
         mgag200_ttm_placement(bo, pl_flag);
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
index 373dbcc523b2..a19e7d79b847 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanva3.c
@@ -36,6 +36,8 @@ nva3_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
         if (data && data[0]) {
                 for (i = 0; i < size; i++)
                         nv_wr32(priv, 0x61c440 + soff, (i << 8) | data[i]);
+                for (; i < 0x60; i++)
+                        nv_wr32(priv, 0x61c440 + soff, (i << 8));
                 nv_mask(priv, 0x61c448 + soff, 0x80000003, 0x80000003);
         } else
         if (data) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
index dc57e24fc1df..717639386ced 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/hdanvd0.c
@@ -41,6 +41,8 @@ nvd0_hda_eld(struct nv50_disp_priv *priv, int or, u8 *data, u32 size)
         if (data && data[0]) {
                 for (i = 0; i < size; i++)
                         nv_wr32(priv, 0x10ec00 + soff, (i << 8) | data[i]);
+                for (; i < 0x60; i++)
+                        nv_wr32(priv, 0x10ec00 + soff, (i << 8));
                 nv_mask(priv, 0x10ec10 + soff, 0x80000003, 0x80000003);
         } else
         if (data) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
index ab1e918469a8..526b75242899 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/sornv50.c
@@ -47,14 +47,8 @@ int
 nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
 {
         struct nv50_disp_priv *priv = (void *)object->engine;
-        struct nouveau_bios *bios = nouveau_bios(priv);
-        const u16 type = (mthd & NV50_DISP_SOR_MTHD_TYPE) >> 12;
         const u8  head = (mthd & NV50_DISP_SOR_MTHD_HEAD) >> 3;
-        const u8  link = (mthd & NV50_DISP_SOR_MTHD_LINK) >> 2;
         const u8    or = (mthd & NV50_DISP_SOR_MTHD_OR);
-        const u16 mask = (0x0100 << head) | (0x0040 << link) | (0x0001 << or);
-        struct dcb_output outp;
-        u8  ver, hdr;
         u32 data;
         int ret = -EINVAL;
 
@@ -62,8 +56,6 @@ nv50_sor_mthd(struct nouveau_object *object, u32 mthd, void *args, u32 size)
                 return -EINVAL;
         data = *(u32 *)args;
 
-        if (type && !dcb_outp_match(bios, type, mask, &ver, &hdr, &outp))
-                return -ENODEV;
 
         switch (mthd & ~0x3f) {
         case NV50_DISP_SOR_PWR:
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
index 49ecbb859b25..c19004301309 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv31.c
@@ -265,8 +265,8 @@ nv31_mpeg_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
 int
 nv31_mpeg_init(struct nouveau_object *object)
 {
-        struct nouveau_engine *engine = nv_engine(object->engine);
-        struct nv31_mpeg_priv *priv = (void *)engine;
+        struct nouveau_engine *engine = nv_engine(object);
+        struct nv31_mpeg_priv *priv = (void *)object;
         struct nouveau_fb *pfb = nouveau_fb(object);
         int ret, i;
 
@@ -284,7 +284,10 @@ nv31_mpeg_init(struct nouveau_object *object)
         /* PMPEG init */
         nv_wr32(priv, 0x00b32c, 0x00000000);
         nv_wr32(priv, 0x00b314, 0x00000100);
-        nv_wr32(priv, 0x00b220, nv44_graph_class(priv) ? 0x00000044 : 0x00000031);
+        if (nv_device(priv)->chipset >= 0x40 && nv44_graph_class(priv))
+                nv_wr32(priv, 0x00b220, 0x00000044);
+        else
+                nv_wr32(priv, 0x00b220, 0x00000031);
         nv_wr32(priv, 0x00b300, 0x02001ec1);
         nv_mask(priv, 0x00b32c, 0x00000001, 0x00000001);
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
index f7c581ad1991..dd6196072e9c 100644
--- a/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/mpeg/nv40.c
@@ -61,6 +61,7 @@ nv40_mpeg_context_ctor(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
+        nv_wo32(&chan->base.base, 0x78, 0x02001ec1);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/xtensa.c b/drivers/gpu/drm/nouveau/core/engine/xtensa.c
index 0639bc59d0a5..5f6ede7c4892 100644
--- a/drivers/gpu/drm/nouveau/core/engine/xtensa.c
+++ b/drivers/gpu/drm/nouveau/core/engine/xtensa.c
@@ -118,7 +118,13 @@ _nouveau_xtensa_init(struct nouveau_object *object)
                         return ret;
                 }
 
-                ret = nouveau_gpuobj_new(object, NULL, fw->size, 0x1000, 0,
+                if (fw->size > 0x40000) {
+                        nv_warn(xtensa, "firmware %s too large\n", name);
+                        release_firmware(fw);
+                        return -EINVAL;
+                }
+
+                ret = nouveau_gpuobj_new(object, NULL, 0x40000, 0x1000, 0,
                                          &xtensa->gpu_fw);
                 if (ret) {
                         release_firmware(fw);
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/vm.h b/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
index f2e87b105666..fcf57fa309bf 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/vm.h
@@ -55,7 +55,7 @@ struct nouveau_vma {
 struct nouveau_vm {
         struct nouveau_vmmgr *vmm;
         struct nouveau_mm mm;
-        int refcount;
+        struct kref refcount;
 
         struct list_head pgd_list;
         atomic_t engref[NVDEV_SUBDEV_NR];
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h b/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
index 6c974dd83e8b..db9d6ddde52c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/priv.h
@@ -81,7 +81,7 @@ void nv44_fb_tile_prog(struct nouveau_fb *, int, struct nouveau_fb_tile *);
 void nv46_fb_tile_init(struct nouveau_fb *, int i, u32 addr, u32 size,
                        u32 pitch, u32 flags, struct nouveau_fb_tile *);
 
-void nv50_ram_put(struct nouveau_fb *, struct nouveau_mem **);
+void __nv50_ram_put(struct nouveau_fb *, struct nouveau_mem *);
 extern int nv50_fb_memtype[0x80];
 
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
index af5aa7ee8ad9..903baff77fdd 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnv50.c
@@ -27,17 +27,10 @@
 #include "priv.h"
 
 void
-nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
+__nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem *mem)
 {
         struct nouveau_mm_node *this;
-        struct nouveau_mem *mem;
 
-        mem = *pmem;
-        *pmem = NULL;
-        if (unlikely(mem == NULL))
-                return;
-
-        mutex_lock(&pfb->base.mutex);
         while (!list_empty(&mem->regions)) {
                 this = list_first_entry(&mem->regions, typeof(*this), rl_entry);
 
@@ -46,6 +39,19 @@ nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
         }
 
         nouveau_mm_free(&pfb->tags, &mem->tag);
+}
+
+void
+nv50_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
+{
+        struct nouveau_mem *mem = *pmem;
+
+        *pmem = NULL;
+        if (unlikely(mem == NULL))
+                return;
+
+        mutex_lock(&pfb->base.mutex);
+        __nv50_ram_put(pfb, mem);
         mutex_unlock(&pfb->base.mutex);
 
         kfree(mem);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
index 9c3634acbb9d..cf97c4de4a6b 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/ramnvc0.c
@@ -33,11 +33,19 @@ void
 nvc0_ram_put(struct nouveau_fb *pfb, struct nouveau_mem **pmem)
 {
         struct nouveau_ltcg *ltcg = nouveau_ltcg(pfb);
+        struct nouveau_mem *mem = *pmem;
 
-        if ((*pmem)->tag)
-                ltcg->tags_free(ltcg, &(*pmem)->tag);
+        *pmem = NULL;
+        if (unlikely(mem == NULL))
+                return;
 
-        nv50_ram_put(pfb, pmem);
+        mutex_lock(&pfb->base.mutex);
+        if (mem->tag)
+                ltcg->tags_free(ltcg, &mem->tag);
+        __nv50_ram_put(pfb, mem);
+        mutex_unlock(&pfb->base.mutex);
+
+        kfree(mem);
 }
 
 int
diff --git a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
index bf489dcf46e2..c4c1d415e7fe 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/gpio/nv50.c
@@ -103,7 +103,7 @@ nv50_gpio_intr(struct nouveau_subdev *subdev)
         int i;
 
         intr0 = nv_rd32(priv, 0xe054) & nv_rd32(priv, 0xe050);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                 intr1 = nv_rd32(priv, 0xe074) & nv_rd32(priv, 0xe070);
 
         hi = (intr0 & 0x0000ffff) | (intr1 << 16);
@@ -115,7 +115,7 @@ nv50_gpio_intr(struct nouveau_subdev *subdev)
         }
 
         nv_wr32(priv, 0xe054, intr0);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                 nv_wr32(priv, 0xe074, intr1);
 }
 
@@ -146,7 +146,7 @@ nv50_gpio_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
         int ret;
 
         ret = nouveau_gpio_create(parent, engine, oclass,
-                                  nv_device(parent)->chipset >= 0x90 ? 32 : 16,
+                                  nv_device(parent)->chipset > 0x92 ? 32 : 16,
                                   &priv);
         *pobject = nv_object(priv);
         if (ret)
@@ -182,7 +182,7 @@ nv50_gpio_init(struct nouveau_object *object)
         /* disable, and ack any pending gpio interrupts */
         nv_wr32(priv, 0xe050, 0x00000000);
         nv_wr32(priv, 0xe054, 0xffffffff);
-        if (nv_device(priv)->chipset >= 0x90) {
+        if (nv_device(priv)->chipset > 0x92) {
                 nv_wr32(priv, 0xe070, 0x00000000);
                 nv_wr32(priv, 0xe074, 0xffffffff);
         }
@@ -195,7 +195,7 @@ nv50_gpio_fini(struct nouveau_object *object, bool suspend)
 {
         struct nv50_gpio_priv *priv = (void *)object;
         nv_wr32(priv, 0xe050, 0x00000000);
-        if (nv_device(priv)->chipset >= 0x90)
+        if (nv_device(priv)->chipset > 0x92)
                 nv_wr32(priv, 0xe070, 0x00000000);
         return nouveau_gpio_fini(&priv->base, suspend);
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
index 0cb322a5e72c..f25fc5fc7dd1 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv50.c
@@ -41,7 +41,7 @@ nv50_mc_intr[] = {
         { 0x04000000, NVDEV_ENGINE_DISP },
         { 0x10000000, NVDEV_SUBDEV_BUS },
         { 0x80000000, NVDEV_ENGINE_SW },
-        { 0x0000d101, NVDEV_SUBDEV_FB },
+        { 0x0002d101, NVDEV_SUBDEV_FB },
         {},
 };
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
index 67fcb6c852ac..ef3133e7575c 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -361,7 +361,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
 
         INIT_LIST_HEAD(&vm->pgd_list);
         vm->vmm = vmm;
-        vm->refcount = 1;
+        kref_init(&vm->refcount);
         vm->fpde = offset >> (vmm->pgt_bits + 12);
         vm->lpde = (offset + length - 1) >> (vmm->pgt_bits + 12);
 
@@ -441,8 +441,9 @@ nouveau_vm_unlink(struct nouveau_vm *vm, struct nouveau_gpuobj *mpgd)
 }
 
 static void
-nouveau_vm_del(struct nouveau_vm *vm)
+nouveau_vm_del(struct kref *kref)
 {
+        struct nouveau_vm *vm = container_of(kref, typeof(*vm), refcount);
         struct nouveau_vm_pgd *vpgd, *tmp;
 
         list_for_each_entry_safe(vpgd, tmp, &vm->pgd_list, head) {
@@ -458,27 +459,19 @@ int
 nouveau_vm_ref(struct nouveau_vm *ref, struct nouveau_vm **ptr,
                struct nouveau_gpuobj *pgd)
 {
-        struct nouveau_vm *vm;
-        int ret;
-
-        vm = ref;
-        if (vm) {
-                ret = nouveau_vm_link(vm, pgd);
+        if (ref) {
+                int ret = nouveau_vm_link(ref, pgd);
                 if (ret)
                         return ret;
 
-                vm->refcount++;
+                kref_get(&ref->refcount);
         }
 
-        vm = *ptr;
-        *ptr = ref;
-
-        if (vm) {
-                nouveau_vm_unlink(vm, pgd);
-
-                if (--vm->refcount == 0)
-                        nouveau_vm_del(vm);
+        if (*ptr) {
+                nouveau_vm_unlink(*ptr, pgd);
+                kref_put(&(*ptr)->refcount, nouveau_vm_del);
         }
 
+        *ptr = ref;
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 4e7ee5f4155c..af20fba3a1a4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -198,7 +198,12 @@ nouveau_bo_new(struct drm_device *dev, int size, int align,
         size_t acc_size;
         int ret;
         int type = ttm_bo_type_device;
-        int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
+        int lpg_shift = 12;
+        int max_size;
+
+        if (drm->client.base.vm)
+                lpg_shift = drm->client.base.vm->vmm->lpg_shift;
+        max_size = INT_MAX & ~((1 << lpg_shift) - 1);
 
         if (size <= 0 || size > max_size) {
                 nv_warn(drm, "skipped size %x\n", (u32)size);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 4c1bc061fae2..8f6d63d7edd3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -398,7 +398,8 @@ void
 nouveau_fbcon_output_poll_changed(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
-        drm_fb_helper_hotplug_event(&drm->fbcon->helper);
+        if (drm->fbcon)
+                drm_fb_helper_hotplug_event(&drm->fbcon->helper);
 }
 
 static int
diff --git a/drivers/gpu/drm/nouveau/nv17_fence.c b/drivers/gpu/drm/nouveau/nv17_fence.c
index 8e47a9bae8c3..22aa9963ea6f 100644
--- a/drivers/gpu/drm/nouveau/nv17_fence.c
+++ b/drivers/gpu/drm/nouveau/nv17_fence.c
@@ -76,7 +76,7 @@ nv17_fence_context_new(struct nouveau_channel *chan)
         struct ttm_mem_reg *mem = &priv->bo->bo.mem;
         struct nouveau_object *object;
         u32 start = mem->start * PAGE_SIZE;
-        u32 limit = mem->start + mem->size - 1;
+        u32 limit = start + mem->size - 1;
         int ret = 0;
 
         fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
diff --git a/drivers/gpu/drm/nouveau/nv50_fence.c b/drivers/gpu/drm/nouveau/nv50_fence.c
index f9701e567db8..0ee363840035 100644
--- a/drivers/gpu/drm/nouveau/nv50_fence.c
+++ b/drivers/gpu/drm/nouveau/nv50_fence.c
@@ -39,6 +39,8 @@ nv50_fence_context_new(struct nouveau_channel *chan)
         struct nv10_fence_chan *fctx;
         struct ttm_mem_reg *mem = &priv->bo->bo.mem;
         struct nouveau_object *object;
+        u32 start = mem->start * PAGE_SIZE;
+        u32 limit = start + mem->size - 1;
         int ret, i;
 
         fctx = chan->fence = kzalloc(sizeof(*fctx), GFP_KERNEL);
@@ -51,26 +53,28 @@ nv50_fence_context_new(struct nouveau_channel *chan)
         fctx->base.sync = nv17_fence_sync;
 
         ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
-                                 NvSema, 0x0002,
+                                 NvSema, 0x003d,
                                  &(struct nv_dma_class) {
                                         .flags = NV_DMA_TARGET_VRAM |
                                                  NV_DMA_ACCESS_RDWR,
-                                        .start = mem->start * PAGE_SIZE,
-                                        .limit = mem->size - 1,
+                                        .start = start,
+                                        .limit = limit,
                                  }, sizeof(struct nv_dma_class),
                                  &object);
 
         /* dma objects for display sync channel semaphore blocks */
         for (i = 0; !ret && i < dev->mode_config.num_crtc; i++) {
                 struct nouveau_bo *bo = nv50_display_crtc_sema(dev, i);
+                u32 start = bo->bo.mem.start * PAGE_SIZE;
+                u32 limit = start + bo->bo.mem.size - 1;
 
                 ret = nouveau_object_new(nv_object(chan->cli), chan->handle,
                                          NvEvoSema0 + i, 0x003d,
                                          &(struct nv_dma_class) {
                                                 .flags = NV_DMA_TARGET_VRAM |
                                                          NV_DMA_ACCESS_RDWR,
-                                                .start = bo->bo.offset,
-                                                .limit = bo->bo.offset + 0xfff,
+                                                .start = start,
+                                                .limit = limit,
                                          }, sizeof(struct nv_dma_class),
                                          &object);
         }
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index fb441a790f3d..15da7ef344a4 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1222,12 +1222,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
         int r;
 
         mutex_lock(&ctx->mutex);
+        /* reset data block */
+        ctx->data_block = 0;
         /* reset reg block */
         ctx->reg_block = 0;
         /* reset fb window */
         ctx->fb_base = 0;
         /* reset io mode */
         ctx->io_mode = ATOM_IO_MM;
+        /* reset divmul */
+        ctx->divmul[0] = 0;
+        ctx->divmul[1] = 0;
         r = atom_execute_table_locked(ctx, index, params);
         mutex_unlock(&ctx->mutex);
         return r;
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 0bfd55e08820..9953e1fbc46d 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -2548,9 +2548,6 @@ int btc_dpm_init(struct radeon_device *rdev)
 {
         struct rv7xx_power_info *pi;
         struct evergreen_power_info *eg_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        u16 data_offset, size;
-        u8 frev, crev;
         struct atom_clock_dividers dividers;
         int ret;
 
@@ -2633,16 +2630,7 @@ int btc_dpm_init(struct radeon_device *rdev)
         eg_pi->vddci_control =
                 radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDCI, 0);
 
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
+        rv770_get_engine_memory_ss(rdev);
 
         pi->asi = RV770_ASI_DFLT;
         pi->pasi = CYPRESS_HASI_DFLT;
@@ -2659,8 +2647,7 @@ int btc_dpm_init(struct radeon_device *rdev)
 
         pi->dynamic_pcie_gen2 = true;
 
-        if (pi->gfx_clock_gating &&
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
                 pi->thermal_protection = true;
         else
                 pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 6dacec4e2090..8928bd109c16 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -2587,9 +2587,11 @@ u32 cik_compute_ring_get_rptr(struct radeon_device *rdev,
         if (rdev->wb.enabled) {
                 rptr = le32_to_cpu(rdev->wb.wb[ring->rptr_offs/4]);
         } else {
+                mutex_lock(&rdev->srbm_mutex);
                 cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
                 rptr = RREG32(CP_HQD_PQ_RPTR);
                 cik_srbm_select(rdev, 0, 0, 0, 0);
+                mutex_unlock(&rdev->srbm_mutex);
         }
         rptr = (rptr & ring->ptr_reg_mask) >> ring->ptr_reg_shift;
 
@@ -2604,9 +2606,11 @@ u32 cik_compute_ring_get_wptr(struct radeon_device *rdev,
         if (rdev->wb.enabled) {
                 wptr = le32_to_cpu(rdev->wb.wb[ring->wptr_offs/4]);
         } else {
+                mutex_lock(&rdev->srbm_mutex);
                 cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
                 wptr = RREG32(CP_HQD_PQ_WPTR);
                 cik_srbm_select(rdev, 0, 0, 0, 0);
+                mutex_unlock(&rdev->srbm_mutex);
         }
         wptr = (wptr & ring->ptr_reg_mask) >> ring->ptr_reg_shift;
 
@@ -2897,6 +2901,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
         WREG32(CP_CPF_DEBUG, tmp);
 
         /* init the pipes */
+        mutex_lock(&rdev->srbm_mutex);
         for (i = 0; i < (rdev->mec.num_pipe * rdev->mec.num_mec); i++) {
                 int me = (i < 4) ? 1 : 2;
                 int pipe = (i < 4) ? i : (i - 4);
@@ -2919,6 +2924,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                 WREG32(CP_HPD_EOP_CONTROL, tmp);
         }
         cik_srbm_select(rdev, 0, 0, 0, 0);
+        mutex_unlock(&rdev->srbm_mutex);
 
         /* init the queues.  Just two for now. */
         for (i = 0; i < 2; i++) {
@@ -2972,6 +2978,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                 mqd->static_thread_mgmt23[0] = 0xffffffff;
                 mqd->static_thread_mgmt23[1] = 0xffffffff;
 
+                mutex_lock(&rdev->srbm_mutex);
                 cik_srbm_select(rdev, rdev->ring[idx].me,
                                 rdev->ring[idx].pipe,
                                 rdev->ring[idx].queue, 0);
@@ -3099,6 +3106,7 @@ static int cik_cp_compute_resume(struct radeon_device *rdev)
                 WREG32(CP_HQD_ACTIVE, mqd->queue_state.cp_hqd_active);
 
                 cik_srbm_select(rdev, 0, 0, 0, 0);
+                mutex_unlock(&rdev->srbm_mutex);
 
                 radeon_bo_kunmap(rdev->ring[idx].mqd_obj);
                 radeon_bo_unreserve(rdev->ring[idx].mqd_obj);
@@ -4320,6 +4328,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
 
         /* XXX SH_MEM regs */
         /* where to put LDS, scratch, GPUVM in FSA64 space */
+        mutex_lock(&rdev->srbm_mutex);
         for (i = 0; i < 16; i++) {
                 cik_srbm_select(rdev, 0, 0, 0, i);
                 /* CP and shaders */
@@ -4335,6 +4344,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev)
                 /* XXX SDMA RLC - todo */
         }
         cik_srbm_select(rdev, 0, 0, 0, 0);
+        mutex_unlock(&rdev->srbm_mutex);
 
         cik_pcie_gart_tlb_flush(rdev);
         DRM_INFO("PCIE GART of %uM enabled (table at 0x%016llX).\n",
@@ -5954,6 +5964,8 @@ static int cik_startup(struct radeon_device *rdev)
         struct radeon_ring *ring;
         int r;
 
+        cik_mc_program(rdev);
+
         if (rdev->flags & RADEON_IS_IGP) {
                 if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
                     !rdev->mec_fw || !rdev->sdma_fw || !rdev->rlc_fw) {
@@ -5985,7 +5997,6 @@ static int cik_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        cik_mc_program(rdev);
         r = cik_pcie_gart_enable(rdev);
         if (r)
                 return r;
@@ -6194,7 +6205,7 @@ int cik_suspend(struct radeon_device *rdev)
         radeon_vm_manager_fini(rdev);
         cik_cp_enable(rdev, false);
         cik_sdma_enable(rdev, false);
-        r600_uvd_rbc_stop(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_suspend(rdev);
         cik_irq_suspend(rdev);
         radeon_wb_disable(rdev);
@@ -6358,6 +6369,7 @@ void cik_fini(struct radeon_device *rdev)
         radeon_vm_manager_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_fini(rdev);
         cik_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
@@ -6978,7 +6990,7 @@ int cik_uvd_resume(struct radeon_device *rdev)
 
         /* programm the VCPU memory controller bits 0-27 */
         addr = rdev->uvd.gpu_addr >> 3;
-        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
+        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
         WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
         WREG32(UVD_VCPU_CACHE_SIZE0, size);
 
diff --git a/drivers/gpu/drm/radeon/cypress_dpm.c b/drivers/gpu/drm/radeon/cypress_dpm.c
index 9bcdd174780f..7e5d0b570a30 100644
--- a/drivers/gpu/drm/radeon/cypress_dpm.c
+++ b/drivers/gpu/drm/radeon/cypress_dpm.c
@@ -2038,9 +2038,6 @@ int cypress_dpm_init(struct radeon_device *rdev)
 {
         struct rv7xx_power_info *pi;
         struct evergreen_power_info *eg_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        uint16_t data_offset, size;
-        uint8_t frev, crev;
         struct atom_clock_dividers dividers;
         int ret;
 
@@ -2092,16 +2089,7 @@ int cypress_dpm_init(struct radeon_device *rdev)
         eg_pi->vddci_control =
                 radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDCI, 0);
 
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
+        rv770_get_engine_memory_ss(rdev);
 
         pi->asi = RV770_ASI_DFLT;
         pi->pasi = CYPRESS_HASI_DFLT;
@@ -2122,8 +2110,7 @@ int cypress_dpm_init(struct radeon_device *rdev)
 
         pi->dynamic_pcie_gen2 = true;
 
-        if (pi->gfx_clock_gating &&
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
                 pi->thermal_protection = true;
         else
                 pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 038dcac7670c..d5b49e33315e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -5106,6 +5106,8 @@ static int evergreen_startup(struct radeon_device *rdev)
         /* enable aspm */
         evergreen_program_aspm(rdev);
 
+        evergreen_mc_program(rdev);
+
         if (ASIC_IS_DCE5(rdev)) {
                 if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
                         r = ni_init_microcode(rdev);
@@ -5133,7 +5135,6 @@ static int evergreen_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        evergreen_mc_program(rdev);
         if (rdev->flags & RADEON_IS_AGP) {
                 evergreen_agp_enable(rdev);
         } else {
@@ -5291,10 +5292,10 @@ int evergreen_resume(struct radeon_device *rdev)
 int evergreen_suspend(struct radeon_device *rdev)
 {
         r600_audio_fini(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_suspend(rdev);
         r700_cp_stop(rdev);
         r600_dma_stop(rdev);
-        r600_uvd_rbc_stop(rdev);
         evergreen_irq_suspend(rdev);
         radeon_wb_disable(rdev);
         evergreen_pcie_gart_disable(rdev);
@@ -5429,6 +5430,7 @@ void evergreen_fini(struct radeon_device *rdev)
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
         evergreen_pcie_gart_fini(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index b0d3fb341417..b0e280058b9b 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -148,18 +148,40 @@ static void evergreen_audio_set_dto(struct drm_encoder *encoder, u32 clock)
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
         struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
         u32 base_rate = 24000;
+        u32 max_ratio = clock / base_rate;
+        u32 dto_phase;
+        u32 dto_modulo = clock;
+        u32 wallclock_ratio;
+        u32 dto_cntl;
 
         if (!dig || !dig->afmt)
                 return;
 
+        if (max_ratio >= 8) {
+                dto_phase = 192 * 1000;
+                wallclock_ratio = 3;
+        } else if (max_ratio >= 4) {
+                dto_phase = 96 * 1000;
+                wallclock_ratio = 2;
+        } else if (max_ratio >= 2) {
+                dto_phase = 48 * 1000;
+                wallclock_ratio = 1;
+        } else {
+                dto_phase = 24 * 1000;
+                wallclock_ratio = 0;
+        }
+        dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
+        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
+        WREG32(DCCG_AUDIO_DTO0_CNTL, dto_cntl);
+
         /* XXX two dtos; generally use dto0 for hdmi */
         /* Express [24MHz / target pixel clock] as an exact rational
          * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
          * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
          */
-        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
-        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
         WREG32(DCCG_AUDIO_DTO_SOURCE, DCCG_AUDIO_DTO0_SOURCE_SEL(radeon_crtc->crtc_id));
+        WREG32(DCCG_AUDIO_DTO0_PHASE, dto_phase);
+        WREG32(DCCG_AUDIO_DTO0_MODULE, dto_modulo);
 }
 
 
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index a7baf67aef6c..0d582ac1dc31 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -497,6 +497,9 @@
 #define DCCG_AUDIO_DTO0_MODULE            0x05b4
 #define DCCG_AUDIO_DTO0_LOAD              0x05b8
 #define DCCG_AUDIO_DTO0_CNTL              0x05bc
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO(x) (((x) & 7) << 0)
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK 7
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_SHIFT 0
 
 #define DCCG_AUDIO_DTO1_PHASE             0x05c0
 #define DCCG_AUDIO_DTO1_MODULE            0x05c4
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 56bd4f3be4fe..ccb4f8b54852 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -794,9 +794,13 @@ int ni_init_microcode(struct radeon_device *rdev)
         if ((rdev->family >= CHIP_BARTS) && (rdev->family <= CHIP_CAYMAN)) {
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
                 err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
-                if (err)
-                        goto out;
-                if (rdev->smc_fw->size != smc_req_size) {
+                if (err) {
+                        printk(KERN_ERR
+                               "smc: error loading firmware \"%s\"\n",
+                               fw_name);
+                        release_firmware(rdev->smc_fw);
+                        rdev->smc_fw = NULL;
+                } else if (rdev->smc_fw->size != smc_req_size) {
                         printk(KERN_ERR
                                "ni_mc: Bogus length %zu in firmware \"%s\"\n",
                                rdev->mc_fw->size, fw_name);
@@ -2079,6 +2083,8 @@ static int cayman_startup(struct radeon_device *rdev)
         /* enable aspm */
         evergreen_program_aspm(rdev);
 
+        evergreen_mc_program(rdev);
+
         if (rdev->flags & RADEON_IS_IGP) {
                 if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
                         r = ni_init_microcode(rdev);
@@ -2107,7 +2113,6 @@ static int cayman_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        evergreen_mc_program(rdev);
         r = cayman_pcie_gart_enable(rdev);
         if (r)
                 return r;
@@ -2286,7 +2291,7 @@ int cayman_suspend(struct radeon_device *rdev)
         radeon_vm_manager_fini(rdev);
         cayman_cp_enable(rdev, false);
         cayman_dma_stop(rdev);
-        r600_uvd_rbc_stop(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_suspend(rdev);
         evergreen_irq_suspend(rdev);
         radeon_wb_disable(rdev);
@@ -2418,6 +2423,7 @@ void cayman_fini(struct radeon_device *rdev)
         radeon_vm_manager_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_fini(rdev);
         cayman_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 559cf24d51af..f0f5f748938a 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -1054,10 +1054,6 @@ static int ni_restrict_performance_levels_before_switch(struct radeon_device *rd
 int ni_dpm_force_performance_level(struct radeon_device *rdev,
                                    enum radeon_dpm_forced_level level)
 {
-        struct radeon_ps *rps = rdev->pm.dpm.current_ps;
-        struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
-
         if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
                 if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
@@ -1068,8 +1064,7 @@ int ni_dpm_force_performance_level(struct radeon_device *rdev,
                 if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
 
-                levels = ps->performance_level_count - 1;
-                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
+                if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
                         return -EINVAL;
         } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                 if (ni_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
@@ -4072,9 +4067,6 @@ int ni_dpm_init(struct radeon_device *rdev)
         struct rv7xx_power_info *pi;
         struct evergreen_power_info *eg_pi;
         struct ni_power_info *ni_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        u16 data_offset, size;
-        u8 frev, crev;
         struct atom_clock_dividers dividers;
         int ret;
 
@@ -4167,16 +4159,7 @@ int ni_dpm_init(struct radeon_device *rdev)
         eg_pi->vddci_control =
                 radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDCI, 0);
 
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
+        rv770_get_engine_memory_ss(rdev);
 
         pi->asi = RV770_ASI_DFLT;
         pi->pasi = CYPRESS_HASI_DFLT;
@@ -4193,8 +4176,7 @@ int ni_dpm_init(struct radeon_device *rdev)
 
         pi->dynamic_pcie_gen2 = true;
 
-        if (pi->gfx_clock_gating &&
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
                 pi->thermal_protection = true;
         else
                 pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 10f712e37003..e66e72077350 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2299,9 +2299,13 @@ int r600_init_microcode(struct radeon_device *rdev)
         if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_HEMLOCK)) {
                 snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", smc_chip_name);
                 err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
-                if (err)
-                        goto out;
-                if (rdev->smc_fw->size != smc_req_size) {
+                if (err) {
+                        printk(KERN_ERR
+                               "smc: error loading firmware \"%s\"\n",
+                               fw_name);
+                        release_firmware(rdev->smc_fw);
+                        rdev->smc_fw = NULL;
+                } else if (rdev->smc_fw->size != smc_req_size) {
                         printk(KERN_ERR
                                "smc: Bogus length %zu in firmware \"%s\"\n",
                                rdev->smc_fw->size, fw_name);
@@ -2697,12 +2701,29 @@ int r600_uvd_rbc_start(struct radeon_device *rdev)
         return 0;
 }
 
-void r600_uvd_rbc_stop(struct radeon_device *rdev)
+void r600_uvd_stop(struct radeon_device *rdev)
 {
         struct radeon_ring *ring = &rdev->ring[R600_RING_TYPE_UVD_INDEX];
 
         /* force RBC into idle state */
         WREG32(UVD_RBC_RB_CNTL, 0x11010101);
+
+        /* Stall UMC and register bus before resetting VCPU */
+        WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
+        WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
+        mdelay(1);
+
+        /* put VCPU into reset */
+        WREG32(UVD_SOFT_RESET, VCPU_SOFT_RESET);
+        mdelay(5);
+
+        /* disable VCPU clock */
+        WREG32(UVD_VCPU_CNTL, 0x0);
+
+        /* Unstall UMC and register bus */
+        WREG32_P(UVD_LMI_CTRL2, 0, ~(1 << 8));
+        WREG32_P(UVD_RB_ARB_CTRL, 0, ~(1 << 3));
+
         ring->ready = false;
 }
 
@@ -2722,6 +2743,11 @@ int r600_uvd_init(struct radeon_device *rdev)
         /* disable interupt */
         WREG32_P(UVD_MASTINT_EN, 0, ~(1 << 1));
 
+        /* Stall UMC and register bus before resetting VCPU */
+        WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
+        WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
+        mdelay(1);
+
         /* put LMI, VCPU, RBC etc... into reset */
         WREG32(UVD_SOFT_RESET, LMI_SOFT_RESET | VCPU_SOFT_RESET |
                LBSI_SOFT_RESET | RBC_SOFT_RESET | CSM_SOFT_RESET |
@@ -2751,10 +2777,6 @@ int r600_uvd_init(struct radeon_device *rdev)
         WREG32(UVD_MPC_SET_ALU, 0);
         WREG32(UVD_MPC_SET_MUX, 0x88);
 
-        /* Stall UMC */
-        WREG32_P(UVD_LMI_CTRL2, 1 << 8, ~(1 << 8));
-        WREG32_P(UVD_RB_ARB_CTRL, 1 << 3, ~(1 << 3));
-
         /* take all subblocks out of reset, except VCPU */
         WREG32(UVD_SOFT_RESET, VCPU_SOFT_RESET);
         mdelay(5);
@@ -3312,6 +3334,8 @@ static int r600_startup(struct radeon_device *rdev)
         /* enable pcie gen2 link */
         r600_pcie_gen2_enable(rdev);
 
+        r600_mc_program(rdev);
+
         if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
                 r = r600_init_microcode(rdev);
                 if (r) {
@@ -3324,7 +3348,6 @@ static int r600_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        r600_mc_program(rdev);
         if (rdev->flags & RADEON_IS_AGP) {
                 r600_agp_enable(rdev);
         } else {
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index f48240bb8c56..f264df5470f7 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -226,10 +226,29 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
         u32 base_rate = 24000;
+        u32 max_ratio = clock / base_rate;
+        u32 dto_phase;
+        u32 dto_modulo = clock;
+        u32 wallclock_ratio;
+        u32 dto_cntl;
 
         if (!dig || !dig->afmt)
                 return;
 
+        if (max_ratio >= 8) {
+                dto_phase = 192 * 1000;
+                wallclock_ratio = 3;
+        } else if (max_ratio >= 4) {
+                dto_phase = 96 * 1000;
+                wallclock_ratio = 2;
+        } else if (max_ratio >= 2) {
+                dto_phase = 48 * 1000;
+                wallclock_ratio = 1;
+        } else {
+                dto_phase = 24 * 1000;
+                wallclock_ratio = 0;
+        }
+
         /* there are two DTOs selected by DCCG_AUDIO_DTO_SELECT.
          * doesn't matter which one you use.  Just use the first one.
          */
@@ -242,9 +261,21 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                 /* according to the reg specs, this should DCE3.2 only, but in
                  * practice it seems to cover DCE3.0 as well.
                  */
-                WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
-                WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
-                WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                if (dig->dig_encoder == 0) {
+                        dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
+                        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
+                        WREG32(DCCG_AUDIO_DTO0_CNTL, dto_cntl);
+                        WREG32(DCCG_AUDIO_DTO0_PHASE, dto_phase);
+                        WREG32(DCCG_AUDIO_DTO0_MODULE, dto_modulo);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                } else {
+                        dto_cntl = RREG32(DCCG_AUDIO_DTO1_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
+                        dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
+                        WREG32(DCCG_AUDIO_DTO1_CNTL, dto_cntl);
+                        WREG32(DCCG_AUDIO_DTO1_PHASE, dto_phase);
+                        WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
+                }
         } else {
                 /* according to the reg specs, this should be DCE2.0 and DCE3.0 */
                 WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 8e3fe815edab..7c780839a7f4 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -933,6 +933,9 @@
 #define DCCG_AUDIO_DTO0_LOAD              0x051c
 #       define DTO_LOAD                   (1 << 31)
 #define DCCG_AUDIO_DTO0_CNTL              0x0520
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO(x) (((x) & 7) << 0)
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK 7
+#       define DCCG_AUDIO_DTO_WALLCLOCK_RATIO_SHIFT 0
 
 #define DCCG_AUDIO_DTO1_PHASE             0x0524
 #define DCCG_AUDIO_DTO1_MODULE            0x0528
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 2f08219c39b6..274b8e1b889f 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1468,7 +1468,6 @@ struct radeon_uvd {
         void                    *cpu_addr;
         uint64_t                gpu_addr;
         void                    *saved_bo;
-        unsigned                fw_size;
         atomic_t                handles[RADEON_MAX_UVD_HANDLES];
         struct drm_file         *filp[RADEON_MAX_UVD_HANDLES];
         struct delayed_work     idle_work;
@@ -2066,6 +2065,7 @@ struct radeon_device {
         const struct firmware *mec_fw;  /* CIK MEC firmware */
         const struct firmware *sdma_fw; /* CIK SDMA firmware */
         const struct firmware *smc_fw;  /* SMC firmware */
+        const struct firmware *uvd_fw;  /* UVD firmware */
         struct r600_blit r600_blit;
         struct r600_vram_scratch vram_scratch;
         int msi_enabled; /* msi enabled */
@@ -2095,6 +2095,8 @@ struct radeon_device {
         /* ACPI interface */
         struct radeon_atif              atif;
         struct radeon_atcs              atcs;
+        /* srbm instance registers */
+        struct mutex                    srbm_mutex;
 };
 
 int radeon_device_init(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 902479fa737f..3d61d5aac18f 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -441,7 +441,7 @@ void rs780_dpm_debugfs_print_current_performance_level(struct radeon_device *rde
 /* uvd */
 int r600_uvd_init(struct radeon_device *rdev);
 int r600_uvd_rbc_start(struct radeon_device *rdev);
-void r600_uvd_rbc_stop(struct radeon_device *rdev);
+void r600_uvd_stop(struct radeon_device *rdev);
 int r600_uvd_ib_test(struct radeon_device *rdev, struct radeon_ring *ring);
 void r600_uvd_fence_emit(struct radeon_device *rdev,
                          struct radeon_fence *fence);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index e3f3e8841789..4ccd61f60eb6 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2782,7 +2782,7 @@ int radeon_atom_get_clock_dividers(struct radeon_device *rdev,
                                                              ATOM_PLL_CNTL_FLAG_PLL_POST_DIV_EN) ? true : false;
                                 dividers->enable_dithen = (args.v3.ucCntlFlag &
                                                            ATOM_PLL_CNTL_FLAG_FRACTION_DISABLE) ? false : true;
-                                dividers->fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
+                                dividers->whole_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDiv);
                                 dividers->frac_fb_div = le16_to_cpu(args.v3.ulFbDiv.usFbDivFrac);
                                 dividers->ref_div = args.v3.ucRefDiv;
                                 dividers->vco_mode = (args.v3.ucCntlFlag &
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 82335e38ec4f..63398ae1dbf5 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1163,6 +1163,7 @@ int radeon_device_init(struct radeon_device *rdev,
         mutex_init(&rdev->gem.mutex);
         mutex_init(&rdev->pm.mutex);
         mutex_init(&rdev->gpu_clock_mutex);
+        mutex_init(&rdev->srbm_mutex);
         init_rwsem(&rdev->pm.mclk_lock);
         init_rwsem(&rdev->exclusive_lock);
         init_waitqueue_head(&rdev->irq.vblank_queue);
@@ -1519,6 +1520,7 @@ int radeon_gpu_reset(struct radeon_device *rdev)
         radeon_save_bios_scratch_regs(rdev);
         /* block TTM */
         resched = ttm_bo_lock_delayed_workqueue(&rdev->mman.bdev);
+        radeon_pm_suspend(rdev);
         radeon_suspend(rdev);
 
         for (i = 0; i < RADEON_NUM_RINGS; ++i) {
@@ -1564,6 +1566,7 @@ retry:
                 }
         }
 
+        radeon_pm_resume(rdev);
         drm_helper_resume_force_mode(rdev->ddev);
 
         ttm_bo_unlock_delayed_workqueue(&rdev->mman.bdev, resched);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 7ddb0efe2408..ddb8f8e04eb5 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -782,7 +782,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring)
 
                 } else {
                         /* put fence directly behind firmware */
-                        index = ALIGN(rdev->uvd.fw_size, 8);
+                        index = ALIGN(rdev->uvd_fw->size, 8);
                         rdev->fence_drv[ring].cpu_addr = rdev->uvd.cpu_addr + index;
                         rdev->fence_drv[ring].gpu_addr = rdev->uvd.gpu_addr + index;
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 6a51d943ccf4..b990b1a2bd50 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -207,7 +207,6 @@ void radeon_gart_table_vram_free(struct radeon_device *rdev)
         if (rdev->gart.robj == NULL) {
                 return;
         }
-        radeon_gart_table_vram_unpin(rdev);
         radeon_bo_unref(&rdev->gart.robj);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index f374c467aaca..c557850cd345 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1176,7 +1176,14 @@ int radeon_pm_init(struct radeon_device *rdev)
         case CHIP_VERDE:
         case CHIP_OLAND:
         case CHIP_HAINAN:
-                if (radeon_dpm == 1)
+                /* DPM requires the RLC, RV770+ dGPU requires SMC */
+                if (!rdev->rlc_fw)
+                        rdev->pm.pm_method = PM_METHOD_PROFILE;
+                else if ((rdev->family >= CHIP_RV770) &&
+                         (!(rdev->flags & RADEON_IS_IGP)) &&
+                         (!rdev->smc_fw))
+                        rdev->pm.pm_method = PM_METHOD_PROFILE;
+                else if (radeon_dpm == 1)
                         rdev->pm.pm_method = PM_METHOD_DPM;
                 else
                         rdev->pm.pm_method = PM_METHOD_PROFILE;
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 414fd145d20e..f1c15754e73c 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -56,7 +56,6 @@ static void radeon_uvd_idle_work_handler(struct work_struct *work);
 
 int radeon_uvd_init(struct radeon_device *rdev)
 {
-        const struct firmware *fw;
         unsigned long bo_size;
         const char *fw_name;
         int i, r;
@@ -105,14 +104,14 @@ int radeon_uvd_init(struct radeon_device *rdev)
                 return -EINVAL;
         }
 
-        r = request_firmware(&fw, fw_name, rdev->dev);
+        r = request_firmware(&rdev->uvd_fw, fw_name, rdev->dev);
         if (r) {
                 dev_err(rdev->dev, "radeon_uvd: Can't load firmware \"%s\"\n",
                         fw_name);
                 return r;
         }
 
-        bo_size = RADEON_GPU_PAGE_ALIGN(fw->size + 8) +
+        bo_size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 8) +
                   RADEON_UVD_STACK_SIZE + RADEON_UVD_HEAP_SIZE;
         r = radeon_bo_create(rdev, bo_size, PAGE_SIZE, true,
                              RADEON_GEM_DOMAIN_VRAM, NULL, &rdev->uvd.vcpu_bo);
@@ -145,12 +144,6 @@ int radeon_uvd_init(struct radeon_device *rdev)
 
         radeon_bo_unreserve(rdev->uvd.vcpu_bo);
 
-        rdev->uvd.fw_size = fw->size;
-        memset(rdev->uvd.cpu_addr, 0, bo_size);
-        memcpy(rdev->uvd.cpu_addr, fw->data, fw->size);
-
-        release_firmware(fw);
-
         for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
                 atomic_set(&rdev->uvd.handles[i], 0);
                 rdev->uvd.filp[i] = NULL;
@@ -174,33 +167,60 @@ void radeon_uvd_fini(struct radeon_device *rdev)
         }
 
         radeon_bo_unref(&rdev->uvd.vcpu_bo);
+
+        release_firmware(rdev->uvd_fw);
 }
 
 int radeon_uvd_suspend(struct radeon_device *rdev)
 {
         unsigned size;
+        void *ptr;
+        int i;
 
         if (rdev->uvd.vcpu_bo == NULL)
                 return 0;
 
+        for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i)
+                if (atomic_read(&rdev->uvd.handles[i]))
+                        break;
+
+        if (i == RADEON_MAX_UVD_HANDLES)
+                return 0;
+
         size = radeon_bo_size(rdev->uvd.vcpu_bo);
+        size -= rdev->uvd_fw->size;
+
+        ptr = rdev->uvd.cpu_addr;
+        ptr += rdev->uvd_fw->size;
+
         rdev->uvd.saved_bo = kmalloc(size, GFP_KERNEL);
-        memcpy(rdev->uvd.saved_bo, rdev->uvd.cpu_addr, size);
+        memcpy(rdev->uvd.saved_bo, ptr, size);
 
         return 0;
 }
 
 int radeon_uvd_resume(struct radeon_device *rdev)
 {
+        unsigned size;
+        void *ptr;
+
         if (rdev->uvd.vcpu_bo == NULL)
                 return -EINVAL;
 
+        memcpy(rdev->uvd.cpu_addr, rdev->uvd_fw->data, rdev->uvd_fw->size);
+
+        size = radeon_bo_size(rdev->uvd.vcpu_bo);
+        size -= rdev->uvd_fw->size;
+
+        ptr = rdev->uvd.cpu_addr;
+        ptr += rdev->uvd_fw->size;
+
         if (rdev->uvd.saved_bo != NULL) {
-                unsigned size = radeon_bo_size(rdev->uvd.vcpu_bo);
-                memcpy(rdev->uvd.cpu_addr, rdev->uvd.saved_bo, size);
+                memcpy(ptr, rdev->uvd.saved_bo, size);
                 kfree(rdev->uvd.saved_bo);
                 rdev->uvd.saved_bo = NULL;
-        }
+        } else
+                memset(ptr, 0, size);
 
         return 0;
 }
@@ -215,8 +235,8 @@ void radeon_uvd_free_handles(struct radeon_device *rdev, struct drm_file *filp)
 {
         int i, r;
         for (i = 0; i < RADEON_MAX_UVD_HANDLES; ++i) {
-                if (rdev->uvd.filp[i] == filp) {
-                        uint32_t handle = atomic_read(&rdev->uvd.handles[i]);
+                uint32_t handle = atomic_read(&rdev->uvd.handles[i]);
+                if (handle != 0 && rdev->uvd.filp[i] == filp) {
                         struct radeon_fence *fence;
 
                         r = radeon_uvd_get_destroy_msg(rdev,
@@ -337,8 +357,10 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
         }
 
         r = radeon_bo_kmap(bo, &ptr);
-        if (r)
+        if (r) {
+                DRM_ERROR("Failed mapping the UVD message (%d)!\n", r);
                 return r;
+        }
 
         msg = ptr + offset;
 
@@ -364,8 +386,14 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
                 radeon_bo_kunmap(bo);
                 return 0;
         } else {
-                /* it's a create msg, no special handling needed */
                 radeon_bo_kunmap(bo);
+
+                if (msg_type != 0) {
+                        DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
+                        return -EINVAL;
+                }
+
+                /* it's a create msg, no special handling needed */
         }
 
         /* create or decode, validate the handle */
@@ -388,7 +416,7 @@ static int radeon_uvd_cs_msg(struct radeon_cs_parser *p, struct radeon_bo *bo,
 
 static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                                int data0, int data1,
-                               unsigned buf_sizes[])
+                               unsigned buf_sizes[], bool *has_msg_cmd)
 {
         struct radeon_cs_chunk *relocs_chunk;
         struct radeon_cs_reloc *reloc;
@@ -417,7 +445,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
 
         if (cmd < 0x4) {
                 if ((end - start) < buf_sizes[cmd]) {
-                        DRM_ERROR("buffer to small (%d / %d)!\n",
+                        DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
                                   (unsigned)(end - start), buf_sizes[cmd]);
                         return -EINVAL;
                 }
@@ -442,9 +470,17 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
         }
 
         if (cmd == 0) {
+                if (*has_msg_cmd) {
+                        DRM_ERROR("More than one message in a UVD-IB!\n");
+                        return -EINVAL;
+                }
+                *has_msg_cmd = true;
                 r = radeon_uvd_cs_msg(p, reloc->robj, offset, buf_sizes);
                 if (r)
                         return r;
+        } else if (!*has_msg_cmd) {
+                DRM_ERROR("Message needed before other commands are send!\n");
+                return -EINVAL;
         }
 
         return 0;
@@ -453,7 +489,8 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
 static int radeon_uvd_cs_reg(struct radeon_cs_parser *p,
                              struct radeon_cs_packet *pkt,
                              int *data0, int *data1,
-                             unsigned buf_sizes[])
+                             unsigned buf_sizes[],
+                             bool *has_msg_cmd)
 {
         int i, r;
 
@@ -467,7 +504,8 @@ static int radeon_uvd_cs_reg(struct radeon_cs_parser *p,
                         *data1 = p->idx;
                         break;
                 case UVD_GPCOM_VCPU_CMD:
-                        r = radeon_uvd_cs_reloc(p, *data0, *data1, buf_sizes);
+                        r = radeon_uvd_cs_reloc(p, *data0, *data1,
+                                                buf_sizes, has_msg_cmd);
                         if (r)
                                 return r;
                         break;
@@ -488,6 +526,9 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p)
         struct radeon_cs_packet pkt;
         int r, data0 = 0, data1 = 0;
 
+        /* does the IB has a msg command */
+        bool has_msg_cmd = false;
+
         /* minimum buffer sizes */
         unsigned buf_sizes[] = {
                 [0x00000000]    =       2048,
@@ -514,8 +555,8 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p)
                         return r;
                 switch (pkt.type) {
                 case RADEON_PACKET_TYPE0:
-                        r = radeon_uvd_cs_reg(p, &pkt, &data0,
-                                              &data1, buf_sizes);
+                        r = radeon_uvd_cs_reg(p, &pkt, &data0, &data1,
+                                              buf_sizes, &has_msg_cmd);
                         if (r)
                                 return r;
                         break;
@@ -527,6 +568,12 @@ int radeon_uvd_cs_parse(struct radeon_cs_parser *p)
                         return -EINVAL;
                 }
         } while (p->idx < p->chunks[p->chunk_ib_idx].length_dw);
+
+        if (!has_msg_cmd) {
+                DRM_ERROR("UVD-IBs need a msg command!\n");
+                return -EINVAL;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/rv6xx_dpm.c b/drivers/gpu/drm/radeon/rv6xx_dpm.c
index 363018c60412..bdd888b4db2b 100644
--- a/drivers/gpu/drm/radeon/rv6xx_dpm.c
+++ b/drivers/gpu/drm/radeon/rv6xx_dpm.c
@@ -1944,9 +1944,7 @@ static int rv6xx_parse_power_table(struct radeon_device *rdev)
 
 int rv6xx_dpm_init(struct radeon_device *rdev)
 {
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        uint16_t data_offset, size;
-        uint8_t frev, crev;
+        struct radeon_atom_ss ss;
         struct atom_clock_dividers dividers;
         struct rv6xx_power_info *pi;
         int ret;
@@ -1989,16 +1987,18 @@ int rv6xx_dpm_init(struct radeon_device *rdev)
 
         pi->gfx_clock_gating = true;
 
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
+        pi->sclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+                                                       ASIC_INTERNAL_ENGINE_SS, 0);
+        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+                                                       ASIC_INTERNAL_MEMORY_SS, 0);
+
+        /* Disable sclk ss, causes hangs on a lot of systems */
+        pi->sclk_ss = false;
+
+        if (pi->sclk_ss || pi->mclk_ss)
                 pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
+        else
                 pi->dynamic_ss = false;
-        }
 
         pi->dynamic_pcie_gen2 = true;
 
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 30ea14e8854c..bcc68ec204ad 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -813,7 +813,7 @@ int rv770_uvd_resume(struct radeon_device *rdev)
 
         /* programm the VCPU memory controller bits 0-27 */
         addr = rdev->uvd.gpu_addr >> 3;
-        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd.fw_size + 4) >> 3;
+        size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->size + 4) >> 3;
         WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
         WREG32(UVD_VCPU_CACHE_SIZE0, size);
 
@@ -1829,6 +1829,8 @@ static int rv770_startup(struct radeon_device *rdev)
         /* enable pcie gen2 link */
         rv770_pcie_gen2_enable(rdev);
 
+        rv770_mc_program(rdev);
+
         if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
                 r = r600_init_microcode(rdev);
                 if (r) {
@@ -1841,7 +1843,6 @@ static int rv770_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        rv770_mc_program(rdev);
         if (rdev->flags & RADEON_IS_AGP) {
                 rv770_agp_enable(rdev);
         } else {
@@ -1983,6 +1984,7 @@ int rv770_resume(struct radeon_device *rdev)
 int rv770_suspend(struct radeon_device *rdev)
 {
         r600_audio_fini(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_suspend(rdev);
         r700_cp_stop(rdev);
         r600_dma_stop(rdev);
@@ -2098,6 +2100,7 @@ void rv770_fini(struct radeon_device *rdev)
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
         rv770_pcie_gart_fini(rdev);
+        r600_uvd_stop(rdev);
         radeon_uvd_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 2d347925f77d..094c67a29d0d 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2319,12 +2319,25 @@ int rv7xx_parse_power_table(struct radeon_device *rdev)
         return 0;
 }
 
+void rv770_get_engine_memory_ss(struct radeon_device *rdev)
+{
+        struct rv7xx_power_info *pi = rv770_get_pi(rdev);
+        struct radeon_atom_ss ss;
+
+        pi->sclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+                                                       ASIC_INTERNAL_ENGINE_SS, 0);
+        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
+                                                       ASIC_INTERNAL_MEMORY_SS, 0);
+
+        if (pi->sclk_ss || pi->mclk_ss)
+                pi->dynamic_ss = true;
+        else
+                pi->dynamic_ss = false;
+}
+
 int rv770_dpm_init(struct radeon_device *rdev)
 {
         struct rv7xx_power_info *pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        uint16_t data_offset, size;
-        uint8_t frev, crev;
         struct atom_clock_dividers dividers;
         int ret;
 
@@ -2369,16 +2382,7 @@ int rv770_dpm_init(struct radeon_device *rdev)
         pi->mvdd_control =
                 radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_MVDDC, 0);
 
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = false;
-        }
+        rv770_get_engine_memory_ss(rdev);
 
         pi->asi = RV770_ASI_DFLT;
         pi->pasi = RV770_HASI_DFLT;
@@ -2393,8 +2397,7 @@ int rv770_dpm_init(struct radeon_device *rdev)
 
         pi->dynamic_pcie_gen2 = true;
 
-        if (pi->gfx_clock_gating &&
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
                 pi->thermal_protection = true;
         else
                 pi->thermal_protection = false;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.h b/drivers/gpu/drm/radeon/rv770_dpm.h
index 96b1b2a62a8a..9244effc6b59 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.h
+++ b/drivers/gpu/drm/radeon/rv770_dpm.h
@@ -275,6 +275,7 @@ void rv770_set_uvd_clock_before_set_eng_clock(struct radeon_device *rdev,
 void rv770_set_uvd_clock_after_set_eng_clock(struct radeon_device *rdev,
                                              struct radeon_ps *new_ps,
                                              struct radeon_ps *old_ps);
+void rv770_get_engine_memory_ss(struct radeon_device *rdev);
 
 /* smc */
 int rv770_read_smc_soft_register(struct radeon_device *rdev,
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index d325280e2f9f..daa8d2df8ec5 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -1663,9 +1663,13 @@ static int si_init_microcode(struct radeon_device *rdev)
 
         snprintf(fw_name, sizeof(fw_name), "radeon/%s_smc.bin", chip_name);
         err = request_firmware(&rdev->smc_fw, fw_name, rdev->dev);
-        if (err)
-                goto out;
-        if (rdev->smc_fw->size != smc_req_size) {
+        if (err) {
+                printk(KERN_ERR
+                       "smc: error loading firmware \"%s\"\n",
+                       fw_name);
+                release_firmware(rdev->smc_fw);
+                rdev->smc_fw = NULL;
+        } else if (rdev->smc_fw->size != smc_req_size) {
                 printk(KERN_ERR
                        "si_smc: Bogus length %zu in firmware \"%s\"\n",
                        rdev->smc_fw->size, fw_name);
@@ -5215,14 +5219,12 @@ static void si_enable_mc_ls(struct radeon_device *rdev,
 
 static void si_init_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
-
         si_enable_mgcg(rdev, true);
-        si_enable_cgcg(rdev, true);
+        si_enable_cgcg(rdev, false);
         /* disable MC LS on Tahiti */
         if (rdev->family == CHIP_TAHITI)
                 si_enable_mc_ls(rdev, false);
-        if (has_uvd) {
+        if (rdev->has_uvd) {
                 si_enable_uvd_mgcg(rdev, true);
                 si_init_uvd_internal_cg(rdev);
         }
@@ -5230,9 +5232,7 @@ static void si_init_cg(struct radeon_device *rdev)
 
 static void si_fini_cg(struct radeon_device *rdev)
 {
-        bool has_uvd = true;
-
-        if (has_uvd)
+        if (rdev->has_uvd)
                 si_enable_uvd_mgcg(rdev, false);
         si_enable_cgcg(rdev, false);
         si_enable_mgcg(rdev, false);
@@ -5241,11 +5241,11 @@ static void si_fini_cg(struct radeon_device *rdev)
 static void si_init_pg(struct radeon_device *rdev)
 {
         bool has_pg = false;
-
+#if 0
         /* only cape verde supports PG */
         if (rdev->family == CHIP_VERDE)
                 has_pg = true;
-
+#endif
         if (has_pg) {
                 si_init_ao_cu_mask(rdev);
                 si_init_dma_pg(rdev);
@@ -6422,6 +6422,8 @@ static int si_startup(struct radeon_device *rdev)
         /* enable aspm */
         si_program_aspm(rdev);
 
+        si_mc_program(rdev);
+
         if (!rdev->me_fw || !rdev->pfp_fw || !rdev->ce_fw ||
             !rdev->rlc_fw || !rdev->mc_fw) {
                 r = si_init_microcode(rdev);
@@ -6441,7 +6443,6 @@ static int si_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        si_mc_program(rdev);
         r = si_pcie_gart_enable(rdev);
         if (r)
                 return r;
@@ -6625,7 +6626,7 @@ int si_suspend(struct radeon_device *rdev)
         si_cp_enable(rdev, false);
         cayman_dma_stop(rdev);
         if (rdev->has_uvd) {
-                r600_uvd_rbc_stop(rdev);
+                r600_uvd_stop(rdev);
                 radeon_uvd_suspend(rdev);
         }
         si_irq_suspend(rdev);
@@ -6767,8 +6768,10 @@ void si_fini(struct radeon_device *rdev)
         radeon_vm_manager_fini(rdev);
         radeon_ib_pool_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        if (rdev->has_uvd)
+        if (rdev->has_uvd) {
+                r600_uvd_stop(rdev);
                 radeon_uvd_fini(rdev);
+        }
         si_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 73aaa2e4c312..88699e3cd868 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -37,8 +37,6 @@
 
 #define SMC_RAM_END                 0x20000
 
-#define DDR3_DRAM_ROWS              0x2000
-
 #define SCLK_MIN_DEEPSLEEP_FREQ     1350
 
 static const struct si_cac_config_reg cac_weights_tahiti[] =
@@ -1767,8 +1765,9 @@ static void si_calculate_leakage_for_v_and_t_formula(const struct ni_leakage_coe
 {
         s64 kt, kv, leakage_w, i_leakage, vddc;
         s64 temperature, t_slope, t_intercept, av, bv, t_ref;
+        s64 tmp;
 
-        i_leakage = drm_int2fixp(ileakage / 100);
+        i_leakage = div64_s64(drm_int2fixp(ileakage), 100);
         vddc = div64_s64(drm_int2fixp(v), 1000);
         temperature = div64_s64(drm_int2fixp(t), 1000);
 
@@ -1778,8 +1777,9 @@ static void si_calculate_leakage_for_v_and_t_formula(const struct ni_leakage_coe
         bv = div64_s64(drm_int2fixp(coeff->bv), 100000000);
         t_ref = drm_int2fixp(coeff->t_ref);
 
-        kt = drm_fixp_div(drm_fixp_exp(drm_fixp_mul(drm_fixp_mul(t_slope, vddc) + t_intercept, temperature)),
-                          drm_fixp_exp(drm_fixp_mul(drm_fixp_mul(t_slope, vddc) + t_intercept, t_ref)));
+        tmp = drm_fixp_mul(t_slope, vddc) + t_intercept;
+        kt = drm_fixp_exp(drm_fixp_mul(tmp, temperature));
+        kt = drm_fixp_div(kt, drm_fixp_exp(drm_fixp_mul(tmp, t_ref)));
         kv = drm_fixp_mul(av, drm_fixp_exp(drm_fixp_mul(bv, vddc)));
 
         leakage_w = drm_fixp_mul(drm_fixp_mul(drm_fixp_mul(i_leakage, kt), kv), vddc);
@@ -1931,6 +1931,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                         si_pi->cac_override = cac_override_pitcairn;
                         si_pi->powertune_data = &powertune_data_pitcairn;
                         si_pi->dte_data = dte_data_pitcairn;
+                        break;
                 }
         } else if (rdev->family == CHIP_VERDE) {
                 si_pi->lcac_config = lcac_cape_verde;
@@ -1941,6 +1942,7 @@ static void si_initialize_powertune_defaults(struct radeon_device *rdev)
                 case 0x683B:
                 case 0x683F:
                 case 0x6829:
+                case 0x6835:
                         si_pi->cac_weights = cac_weights_cape_verde_pro;
                         si_pi->dte_data = dte_data_cape_verde;
                         break;
@@ -2901,7 +2903,8 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
 {
         struct ni_ps *ps = ni_get_ps(rps);
         struct radeon_clock_and_voltage_limits *max_limits;
-        bool disable_mclk_switching;
+        bool disable_mclk_switching = false;
+        bool disable_sclk_switching = false;
         u32 mclk, sclk;
         u16 vddc, vddci;
         int i;
@@ -2909,8 +2912,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
             ni_dpm_vblank_too_short(rdev))
                 disable_mclk_switching = true;
-        else
-                disable_mclk_switching = false;
+
+        if (rps->vclk || rps->dclk) {
+                disable_mclk_switching = true;
+                disable_sclk_switching = true;
+        }
 
         if (rdev->pm.dpm.ac_power)
                 max_limits = &rdev->pm.dpm.dyn_state.max_clock_voltage_on_ac;
@@ -2938,27 +2944,43 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
 
         if (disable_mclk_switching) {
                 mclk  = ps->performance_levels[ps->performance_level_count - 1].mclk;
-                sclk = ps->performance_levels[0].sclk;
-                vddc = ps->performance_levels[0].vddc;
                 vddci = ps->performance_levels[ps->performance_level_count - 1].vddci;
         } else {
-                sclk = ps->performance_levels[0].sclk;
                 mclk = ps->performance_levels[0].mclk;
-                vddc = ps->performance_levels[0].vddc;
                 vddci = ps->performance_levels[0].vddci;
         }
 
+        if (disable_sclk_switching) {
+                sclk = ps->performance_levels[ps->performance_level_count - 1].sclk;
+                vddc = ps->performance_levels[ps->performance_level_count - 1].vddc;
+        } else {
+                sclk = ps->performance_levels[0].sclk;
+                vddc = ps->performance_levels[0].vddc;
+        }
+
         /* adjusted low state */
         ps->performance_levels[0].sclk = sclk;
         ps->performance_levels[0].mclk = mclk;
         ps->performance_levels[0].vddc = vddc;
         ps->performance_levels[0].vddci = vddci;
 
-        for (i = 1; i < ps->performance_level_count; i++) {
-                if (ps->performance_levels[i].sclk < ps->performance_levels[i - 1].sclk)
-                        ps->performance_levels[i].sclk = ps->performance_levels[i - 1].sclk;
-                if (ps->performance_levels[i].vddc < ps->performance_levels[i - 1].vddc)
-                        ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
+        if (disable_sclk_switching) {
+                sclk = ps->performance_levels[0].sclk;
+                for (i = 1; i < ps->performance_level_count; i++) {
+                        if (sclk < ps->performance_levels[i].sclk)
+                                sclk = ps->performance_levels[i].sclk;
+                }
+                for (i = 0; i < ps->performance_level_count; i++) {
+                        ps->performance_levels[i].sclk = sclk;
+                        ps->performance_levels[i].vddc = vddc;
+                }
+        } else {
+                for (i = 1; i < ps->performance_level_count; i++) {
+                        if (ps->performance_levels[i].sclk < ps->performance_levels[i - 1].sclk)
+                                ps->performance_levels[i].sclk = ps->performance_levels[i - 1].sclk;
+                        if (ps->performance_levels[i].vddc < ps->performance_levels[i - 1].vddc)
+                                ps->performance_levels[i].vddc = ps->performance_levels[i - 1].vddc;
+                }
         }
 
         if (disable_mclk_switching) {
@@ -3237,10 +3259,10 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
 {
         struct radeon_ps *rps = rdev->pm.dpm.current_ps;
         struct ni_ps *ps = ni_get_ps(rps);
-        u32 levels;
+        u32 levels = ps->performance_level_count;
 
         if (level == RADEON_DPM_FORCED_LEVEL_HIGH) {
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                         return -EINVAL;
 
                 if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 1) != PPSMC_Result_OK)
@@ -3249,14 +3271,13 @@ int si_dpm_force_performance_level(struct radeon_device *rdev,
                 if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
 
-                levels = ps->performance_level_count - 1;
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 1) != PPSMC_Result_OK)
                         return -EINVAL;
         } else if (level == RADEON_DPM_FORCED_LEVEL_AUTO) {
                 if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetForcedLevels, 0) != PPSMC_Result_OK)
                         return -EINVAL;
 
-                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, 0) != PPSMC_Result_OK)
+                if (si_send_msg_to_smc_with_parameter(rdev, PPSMC_MSG_SetEnabledLevels, levels) != PPSMC_Result_OK)
                         return -EINVAL;
         }
 
@@ -3620,8 +3641,12 @@ static void si_enable_display_gap(struct radeon_device *rdev)
 {
         u32 tmp = RREG32(CG_DISPLAY_GAP_CNTL);
 
+        tmp &= ~(DISP1_GAP_MASK | DISP2_GAP_MASK);
+        tmp |= (DISP1_GAP(R600_PM_DISPLAY_GAP_IGNORE) |
+                DISP2_GAP(R600_PM_DISPLAY_GAP_IGNORE));
+
         tmp &= ~(DISP1_GAP_MCHG_MASK | DISP2_GAP_MCHG_MASK);
-        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE) |
+        tmp |= (DISP1_GAP_MCHG(R600_PM_DISPLAY_GAP_VBLANK) |
                 DISP2_GAP_MCHG(R600_PM_DISPLAY_GAP_IGNORE));
         WREG32(CG_DISPLAY_GAP_CNTL, tmp);
 }
@@ -4036,16 +4061,15 @@ static int si_force_switch_to_arb_f0(struct radeon_device *rdev)
 static u32 si_calculate_memory_refresh_rate(struct radeon_device *rdev,
                                             u32 engine_clock)
 {
-        struct rv7xx_power_info *pi = rv770_get_pi(rdev);
         u32 dram_rows;
         u32 dram_refresh_rate;
         u32 mc_arb_rfsh_rate;
         u32 tmp = (RREG32(MC_ARB_RAMCFG) & NOOFROWS_MASK) >> NOOFROWS_SHIFT;
 
-        if (pi->mem_gddr5)
-                dram_rows = 1 << (tmp + 10);
+        if (tmp >= 4)
+                dram_rows = 16384;
         else
-                dram_rows = DDR3_DRAM_ROWS;
+                dram_rows = 1 << (tmp + 10);
 
         dram_refresh_rate = 1 << ((RREG32(MC_SEQ_MISC0) & 0x3) + 3);
         mc_arb_rfsh_rate = ((engine_clock * 10) * dram_refresh_rate / dram_rows - 32) / 64;
@@ -6013,16 +6037,11 @@ int si_dpm_set_power_state(struct radeon_device *rdev)
                 return ret;
         }
 
-#if 0
-        /* XXX */
         ret = si_dpm_force_performance_level(rdev, RADEON_DPM_FORCED_LEVEL_AUTO);
         if (ret) {
                 DRM_ERROR("si_dpm_force_performance_level failed\n");
                 return ret;
         }
-#else
-        rdev->pm.dpm.forced_level = RADEON_DPM_FORCED_LEVEL_AUTO;
-#endif
 
         return 0;
 }
@@ -6254,9 +6273,6 @@ int si_dpm_init(struct radeon_device *rdev)
         struct evergreen_power_info *eg_pi;
         struct ni_power_info *ni_pi;
         struct si_power_info *si_pi;
-        int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
-        u16 data_offset, size;
-        u8 frev, crev;
         struct atom_clock_dividers dividers;
         int ret;
         u32 mask;
@@ -6347,16 +6363,7 @@ int si_dpm_init(struct radeon_device *rdev)
         si_pi->vddc_phase_shed_control =
                 radeon_atom_is_voltage_gpio(rdev, SET_VOLTAGE_TYPE_ASIC_VDDC, VOLTAGE_OBJ_PHASE_LUT);
 
-        if (atom_parse_data_header(rdev->mode_info.atom_context, index, &size,
-                                   &frev, &crev, &data_offset)) {
-                pi->sclk_ss = true;
-                pi->mclk_ss = true;
-                pi->dynamic_ss = true;
-        } else {
-                pi->sclk_ss = false;
-                pi->mclk_ss = false;
-                pi->dynamic_ss = true;
-        }
+        rv770_get_engine_memory_ss(rdev);
 
         pi->asi = RV770_ASI_DFLT;
         pi->pasi = CYPRESS_HASI_DFLT;
@@ -6367,8 +6374,7 @@ int si_dpm_init(struct radeon_device *rdev)
         eg_pi->sclk_deep_sleep = true;
         si_pi->sclk_deep_sleep_above_low = false;
 
-        if (pi->gfx_clock_gating &&
-            (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE))
+        if (rdev->pm.int_thermal_type != THERMAL_TYPE_NONE)
                 pi->thermal_protection = true;
         else
                 pi->thermal_protection = false;
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 5207591a598c..cd33084c7860 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -192,6 +192,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
                                         size_t count,
                                         unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                                 struct dj_report *dj_report)
@@ -232,6 +233,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
         if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
             SPFUNCTION_DEVICE_LIST_EMPTY) {
                 dbg_hid("%s: device list is empty\n", __func__);
+                djrcv_dev->querying_devices = false;
                 return;
         }
 
@@ -242,6 +244,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                 return;
         }
 
+        if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+                /* The device is already known. No need to reallocate it. */
+                dbg_hid("%s: device is already known\n", __func__);
+                return;
+        }
+
         dj_hiddev = hid_allocate_device();
         if (IS_ERR(dj_hiddev)) {
                 dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -305,6 +313,7 @@ static void delayedwork_callback(struct work_struct *work)
         struct dj_report dj_report;
         unsigned long flags;
         int count;
+        int retval;
 
         dbg_hid("%s\n", __func__);
 
@@ -337,6 +346,25 @@ static void delayedwork_callback(struct work_struct *work)
                 logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
                 break;
         default:
+        /* A normal report (i. e. not belonging to a pair/unpair notification)
+         * arriving here, means that the report arrived but we did not have a
+         * paired dj_device associated to the report's device_index, this
+         * means that the original "device paired" notification corresponding
+         * to this dj_device never arrived to this driver. The reason is that
+         * hid-core discards all packets coming from a device while probe() is
+         * executing. */
+        if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+                /* ok, we don't know the device, just re-ask the
+                 * receiver for the list of connected devices. */
+                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+                if (!retval) {
+                        /* everything went fine, so just leave */
+                        break;
+                }
+                dev_err(&djrcv_dev->hdev->dev,
+                        "%s:logi_dj_recv_query_paired_devices "
+                        "error:%d\n", __func__, retval);
+                }
                 dbg_hid("%s: unexpected report type\n", __func__);
         }
 }
@@ -367,6 +395,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
         if (!djdev) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -397,6 +431,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
         if (dj_device == NULL) {
                 dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                         " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                 return;
         }
 
@@ -444,6 +484,10 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         struct dj_report *dj_report;
         int retval;
 
+        /* no need to protect djrcv_dev->querying_devices */
+        if (djrcv_dev->querying_devices)
+                return 0;
+
         dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
         if (!dj_report)
                 return -ENOMEM;
@@ -455,6 +499,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
         return retval;
 }
 
+
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                           unsigned timeout)
 {
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index fd28a5e0ca3b..4a4000340ce1 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
         struct work_struct work;
         struct kfifo notif_fifo;
         spinlock_t lock;
+        bool querying_devices;
 };
 
 struct dj_device {
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index ecbc74923d06..87fbe2924cfa 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -369,7 +369,8 @@ static int sony_mapping(struct hid_device *hdev, struct hid_input *hi,
         if (sc->quirks & PS3REMOTE)
                 return ps3remote_mapping(hdev, hi, field, usage, bit, max);
 
-        return -1;
+        /* Let hid-core decide for the others */
+        return 0;
 }
 
 /*
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index a7451632ceb4..6f1feb2c2e97 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -518,7 +518,6 @@ int hidraw_connect(struct hid_device *hid)
                 goto out;
         }
 
-        mutex_unlock(&minors_lock);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->list);
 
@@ -528,6 +527,7 @@ int hidraw_connect(struct hid_device *hid)
         dev->exist = 1;
         hid->hidraw = dev;
 
+        mutex_unlock(&minors_lock);
 out:
         return result;
 
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 0f34bca9f5e5..6099f50b28aa 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -215,7 +215,7 @@ static inline int adt7470_write_word_data(struct i2c_client *client, u8 reg,
                                           u16 value)
 {
         return i2c_smbus_write_byte_data(client, reg, value & 0xFF)
-               && i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
+               || i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
 }
 
 static void adt7470_init_client(struct i2c_client *client)
diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c
index 328fb0353c17..a41b5f3fc506 100644
--- a/drivers/hwmon/max6697.c
+++ b/drivers/hwmon/max6697.c
@@ -605,12 +605,12 @@ static int max6697_init_chip(struct i2c_client *client)
                 if (ret < 0)
                         return ret;
                 ret = i2c_smbus_write_byte_data(client, MAX6581_REG_IDEALITY,
-                                                pdata->ideality_mask >> 1);
+                                                pdata->ideality_value);
                 if (ret < 0)
                         return ret;
                 ret = i2c_smbus_write_byte_data(client,
                                                 MAX6581_REG_IDEALITY_SELECT,
-                                                pdata->ideality_value);
+                                                pdata->ideality_mask >> 1);
                 if (ret < 0)
                         return ret;
         }
diff --git a/drivers/i2c/busses/i2c-kempld.c b/drivers/i2c/busses/i2c-kempld.c
index ccec916bc3eb..af8f65fb1c05 100644
--- a/drivers/i2c/busses/i2c-kempld.c
+++ b/drivers/i2c/busses/i2c-kempld.c
@@ -246,9 +246,9 @@ static void kempld_i2c_device_init(struct kempld_i2c_data *i2c)
                 bus_frequency = KEMPLD_I2C_FREQ_MAX;
 
         if (pld->info.spec_major == 1)
-                prescale = pld->pld_clock / bus_frequency * 5 - 1000;
+                prescale = pld->pld_clock / (bus_frequency * 5) - 1000;
         else
-                prescale = pld->pld_clock / bus_frequency * 4 - 3000;
+                prescale = pld->pld_clock / (bus_frequency * 4) - 3000;
 
         if (prescale < 0)
                 prescale = 0;
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index df8ff5aea5b5..e2e9a0dade96 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -493,7 +493,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
          * based on this empirical measurement and a lot of previous frobbing.
          */
         i2c->cmd_err = 0;
-        if (msg->len < 8) {
+        if (0) {        /* disable PIO mode until a proper fix is made */
                 ret = mxs_i2c_pio_setup_xfer(adap, msg, flags);
                 if (ret)
                         mxs_i2c_reset(i2c);
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 0ad208a69c29..3ceac3e91dde 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -60,7 +60,6 @@ static void tiadc_step_config(struct tiadc_device *adc_dev)
 {
         unsigned int stepconfig;
         int i, steps;
-        u32 step_en;
 
         /*
          * There are 16 configurable steps and 8 analog input
@@ -86,8 +85,7 @@ static void tiadc_step_config(struct tiadc_device *adc_dev)
                 adc_dev->channel_step[i] = steps;
                 steps++;
         }
-        step_en = get_adc_step_mask(adc_dev);
-        am335x_tsc_se_set(adc_dev->mfd_tscadc, step_en);
+
 }
 
 static const char * const chan_name_ain[] = {
@@ -142,10 +140,22 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                 int *val, int *val2, long mask)
 {
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        int i;
-        unsigned int fifo1count, read;
+        int i, map_val;
+        unsigned int fifo1count, read, stepid;
         u32 step = UINT_MAX;
         bool found = false;
+        u32 step_en;
+        unsigned long timeout = jiffies + usecs_to_jiffies
+                                (IDLE_TIMEOUT * adc_dev->channels);
+        step_en = get_adc_step_mask(adc_dev);
+        am335x_tsc_se_set(adc_dev->mfd_tscadc, step_en);
+
+        /* Wait for ADC sequencer to complete sampling */
+        while (tiadc_readl(adc_dev, REG_ADCFSM) & SEQ_STATUS) {
+                if (time_after(jiffies, timeout))
+                        return -EAGAIN;
+                }
+        map_val = chan->channel + TOTAL_CHANNELS;
 
         /*
          * When the sub-system is first enabled,
@@ -170,12 +180,16 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
         for (i = 0; i < fifo1count; i++) {
                 read = tiadc_readl(adc_dev, REG_FIFO1);
-                if (read >> 16 == step) {
-                        *val = read & 0xfff;
+                stepid = read & FIFOREAD_CHNLID_MASK;
+                stepid = stepid >> 0x10;
+
+                if (stepid == map_val) {
+                        read = read & FIFOREAD_DATA_MASK;
                         found = true;
+                        *val = read;
                 }
         }
-        am335x_tsc_se_update(adc_dev->mfd_tscadc);
+
         if (found == false)
                 return -EBUSY;
         return IIO_VAL_INT;
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index ea8a4146620d..0dd9bb873130 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -127,12 +127,17 @@ static struct iio_trigger *iio_trigger_find_by_name(const char *name,
 void iio_trigger_poll(struct iio_trigger *trig, s64 time)
 {
         int i;
-        if (!trig->use_count)
-                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++)
-                        if (trig->subirqs[i].enabled) {
-                                trig->use_count++;
+
+        if (!atomic_read(&trig->use_count)) {
+                atomic_set(&trig->use_count, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
+
+                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++) {
+                        if (trig->subirqs[i].enabled)
                                 generic_handle_irq(trig->subirq_base + i);
-                        }
+                        else
+                                iio_trigger_notify_done(trig);
+                }
+        }
 }
 EXPORT_SYMBOL(iio_trigger_poll);
 
@@ -146,19 +151,24 @@ EXPORT_SYMBOL(iio_trigger_generic_data_rdy_poll);
 void iio_trigger_poll_chained(struct iio_trigger *trig, s64 time)
 {
         int i;
-        if (!trig->use_count)
-                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++)
-                        if (trig->subirqs[i].enabled) {
-                                trig->use_count++;
+
+        if (!atomic_read(&trig->use_count)) {
+                atomic_set(&trig->use_count, CONFIG_IIO_CONSUMERS_PER_TRIGGER);
+
+                for (i = 0; i < CONFIG_IIO_CONSUMERS_PER_TRIGGER; i++) {
+                        if (trig->subirqs[i].enabled)
                                 handle_nested_irq(trig->subirq_base + i);
-                        }
+                        else
+                                iio_trigger_notify_done(trig);
+                }
+        }
 }
 EXPORT_SYMBOL(iio_trigger_poll_chained);
 
 void iio_trigger_notify_done(struct iio_trigger *trig)
 {
-        trig->use_count--;
-        if (trig->use_count == 0 && trig->ops && trig->ops->try_reenable)
+        if (atomic_dec_and_test(&trig->use_count) && trig->ops &&
+                trig->ops->try_reenable)
                 if (trig->ops->try_reenable(trig))
                         /* Missed an interrupt so launch new poll now */
                         iio_trigger_poll(trig, 0);
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f1c279fabe64..7c0f9535fb7d 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -423,7 +423,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
         struct sockaddr_ib *addr;
         union ib_gid gid, sgid, *dgid;
         u16 pkey, index;
-        u8 port, p;
+        u8 p;
         int i;
 
         cma_dev = NULL;
@@ -443,7 +443,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                 if (!memcmp(&gid, dgid, sizeof(gid))) {
                                         cma_dev = cur_dev;
                                         sgid = gid;
-                                        port = p;
+                                        id_priv->id.port_num = p;
                                         goto found;
                                 }
 
@@ -451,7 +451,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                                  dgid->global.subnet_prefix)) {
                                         cma_dev = cur_dev;
                                         sgid = gid;
-                                        port = p;
+                                        id_priv->id.port_num = p;
                                 }
                         }
                 }
@@ -462,7 +462,6 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
 
 found:
         cma_attach_to_dev(id_priv, cma_dev);
-        id_priv->id.port_num = port;
         addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
         memcpy(&addr->sib_addr, &sgid, sizeof sgid);
         cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
@@ -880,7 +879,8 @@ static int cma_save_net_info(struct rdma_cm_id *id, struct rdma_cm_id *listen_id
 {
         struct cma_hdr *hdr;
 
-        if (listen_id->route.addr.src_addr.ss_family == AF_IB) {
+        if ((listen_id->route.addr.src_addr.ss_family == AF_IB) &&
+            (ib_event->event == IB_CM_REQ_RECEIVED)) {
                 cma_save_ib_info(id, listen_id, ib_event->param.req_rcvd.primary_path);
                 return 0;
         }
@@ -2677,29 +2677,32 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
 {
         struct ib_cm_sidr_req_param req;
         struct ib_cm_id *id;
+        void *private_data;
         int offset, ret;
 
+        memset(&req, 0, sizeof req);
         offset = cma_user_data_offset(id_priv);
         req.private_data_len = offset + conn_param->private_data_len;
         if (req.private_data_len < conn_param->private_data_len)
                 return -EINVAL;
 
         if (req.private_data_len) {
-                req.private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
-                if (!req.private_data)
+                private_data = kzalloc(req.private_data_len, GFP_ATOMIC);
+                if (!private_data)
                         return -ENOMEM;
         } else {
-                req.private_data = NULL;
+                private_data = NULL;
         }
 
         if (conn_param->private_data && conn_param->private_data_len)
-                memcpy((void *) req.private_data + offset,
-                       conn_param->private_data, conn_param->private_data_len);
+                memcpy(private_data + offset, conn_param->private_data,
+                       conn_param->private_data_len);
 
-        if (req.private_data) {
-                ret = cma_format_hdr((void *) req.private_data, id_priv);
+        if (private_data) {
+                ret = cma_format_hdr(private_data, id_priv);
                 if (ret)
                         goto out;
+                req.private_data = private_data;
         }
 
         id = ib_create_cm_id(id_priv->id.device, cma_sidr_rep_handler,
@@ -2721,7 +2724,7 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv,
                 id_priv->cm_id.ib = NULL;
         }
 out:
-        kfree(req.private_data);
+        kfree(private_data);
         return ret;
 }
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index dc3fd1e8af07..4c837e66516b 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -2663,6 +2663,7 @@ static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
         int ret, i;
         struct ib_qp_attr *attr;
         struct ib_qp *qp;
+        u16 pkey_index;
 
         attr = kmalloc(sizeof *attr, GFP_KERNEL);
         if (!attr) {
@@ -2670,6 +2671,11 @@ static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
                 return -ENOMEM;
         }
 
+        ret = ib_find_pkey(port_priv->device, port_priv->port_num,
+                           IB_DEFAULT_PKEY_FULL, &pkey_index);
+        if (ret)
+                pkey_index = 0;
+
         for (i = 0; i < IB_MAD_QPS_CORE; i++) {
                 qp = port_priv->qp_info[i].qp;
                 if (!qp)
@@ -2680,7 +2686,7 @@ static int ib_mad_port_start(struct ib_mad_port_private *port_priv)
                  * one is needed for the Reset to Init transition
                  */
                 attr->qp_state = IB_QPS_INIT;
-                attr->pkey_index = 0;
+                attr->pkey_index = pkey_index;
                 attr->qkey = (qp->qp_num == 0) ? 0 : IB_QP1_QKEY;
                 ret = ib_modify_qp(qp, attr, IB_QP_STATE |
                                              IB_QP_PKEY_INDEX | IB_QP_QKEY);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index e87f2201b220..d2283837d451 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -226,6 +226,7 @@ static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries, int ve
                         mm->len = PAGE_ALIGN(((1UL << uresp.size_log2) + 1) *
                                              sizeof(struct t3_cqe));
                         uresp.memsize = mm->len;
+                        uresp.reserved = 0;
                         resplen = sizeof uresp;
                 }
                 if (ib_copy_to_udata(udata, &uresp, resplen)) {
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 232040447e8a..a4975e1654a6 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1657,6 +1657,8 @@ struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
                 if (mm5) {
                         uresp.ma_sync_key = ucontext->key;
                         ucontext->key += PAGE_SIZE;
+                } else {
+                        uresp.ma_sync_key =  0;
                 }
                 uresp.sq_key = ucontext->key;
                 ucontext->key += PAGE_SIZE;
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 4d599cedbb0b..f2a3f48107e7 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1511,8 +1511,14 @@ static int create_pv_sqp(struct mlx4_ib_demux_pv_ctx *ctx,
 
         memset(&attr, 0, sizeof attr);
         attr.qp_state = IB_QPS_INIT;
-        attr.pkey_index =
-                to_mdev(ctx->ib_dev)->pkeys.virt2phys_pkey[ctx->slave][ctx->port - 1][0];
+        ret = 0;
+        if (create_tun)
+                ret = find_slave_port_pkey_ix(to_mdev(ctx->ib_dev), ctx->slave,
+                                              ctx->port, IB_DEFAULT_PKEY_FULL,
+                                              &attr.pkey_index);
+        if (ret || !create_tun)
+                attr.pkey_index =
+                        to_mdev(ctx->ib_dev)->pkeys.virt2phys_pkey[ctx->slave][ctx->port - 1][0];
         attr.qkey = IB_QP1_QKEY;
         attr.port_num = ctx->port;
         ret = ib_modify_qp(tun_qp->qp, &attr, qp_attr_mask_INIT);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 8000fff4d444..3f831de9a4d8 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -619,7 +619,8 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
 
         resp.tot_uuars = req.total_num_uuars;
         resp.num_ports = dev->mdev.caps.num_ports;
-        err = ib_copy_to_udata(udata, &resp, sizeof(resp));
+        err = ib_copy_to_udata(udata, &resp,
+                               sizeof(resp) - sizeof(resp.reserved));
         if (err)
                 goto out_uars;
 
@@ -1426,7 +1427,8 @@ static int init_one(struct pci_dev *pdev,
         if (err)
                 goto err_eqs;
 
-        if (ib_register_device(&dev->ib_dev, NULL))
+        err = ib_register_device(&dev->ib_dev, NULL);
+        if (err)
                 goto err_rsrc;
 
         err = create_umr_res(dev);
@@ -1434,8 +1436,9 @@ static int init_one(struct pci_dev *pdev,
                 goto err_dev;
 
         for (i = 0; i < ARRAY_SIZE(mlx5_class_attributes); i++) {
-                if (device_create_file(&dev->ib_dev.dev,
-                                       mlx5_class_attributes[i]))
+                err = device_create_file(&dev->ib_dev.dev,
+                                         mlx5_class_attributes[i]);
+                if (err)
                         goto err_umrc;
         }
 
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 16ac54c9819f..045f8cdbd303 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -199,7 +199,7 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
 
 static int sq_overhead(enum ib_qp_type qp_type)
 {
-        int size;
+        int size = 0;
 
         switch (qp_type) {
         case IB_QPT_XRC_INI:
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 418004c93feb..90200245c5eb 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -3570,10 +3570,10 @@ static void nes_process_iwarp_aeqe(struct nes_device *nesdev,
         tcp_state = (aeq_info & NES_AEQE_TCP_STATE_MASK) >> NES_AEQE_TCP_STATE_SHIFT;
         iwarp_state = (aeq_info & NES_AEQE_IWARP_STATE_MASK) >> NES_AEQE_IWARP_STATE_SHIFT;
         nes_debug(NES_DBG_AEQ, "aeid = 0x%04X, qp-cq id = %d, aeqe = %p,"
-                        " Tcp state = %d, iWARP state = %d\n",
+                        " Tcp state = %s, iWARP state = %s\n",
                         async_event_id,
                         le32_to_cpu(aeqe->aeqe_words[NES_AEQE_COMP_QP_CQ_ID_IDX]), aeqe,
-                        tcp_state, iwarp_state);
+                        nes_tcp_state_str[tcp_state], nes_iwarp_state_str[iwarp_state]);
 
         aeqe_cq_id = le32_to_cpu(aeqe->aeqe_words[NES_AEQE_COMP_QP_CQ_ID_IDX]);
         if (aeq_info & NES_AEQE_QP) {
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 8f67fe2e91e6..5b53ca5a2284 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1384,6 +1384,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
 
                         if (ibpd->uobject) {
                                 uresp.mmap_sq_db_index = nesqp->mmap_sq_db_index;
+                                uresp.mmap_rq_db_index = 0;
                                 uresp.actual_sq_size = sq_size;
                                 uresp.actual_rq_size = rq_size;
                                 uresp.qp_id = nesqp->hwqp.qp_id;
@@ -1767,7 +1768,7 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
                 resp.cq_id = nescq->hw_cq.cq_number;
                 resp.cq_size = nescq->hw_cq.cq_size;
                 resp.mmap_db_index = 0;
-                if (ib_copy_to_udata(udata, &resp, sizeof resp)) {
+                if (ib_copy_to_udata(udata, &resp, sizeof resp - sizeof resp.reserved)) {
                         nes_free_resource(nesadapter, nesadapter->allocated_cqs, cq_num);
                         kfree(nescq);
                         return ERR_PTR(-EFAULT);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
index a877a8ed7907..f4c587c68f64 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
@@ -29,7 +29,6 @@
 #include <net/netevent.h>
 
 #include <rdma/ib_addr.h>
-#include <rdma/ib_cache.h>
 
 #include "ocrdma.h"
 #include "ocrdma_verbs.h"
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index dcfbab177faa..f36630e4b6be 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -242,6 +242,7 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
         memset(ctx->ah_tbl.va, 0, map_len);
         ctx->ah_tbl.len = map_len;
 
+        memset(&resp, 0, sizeof(resp));
         resp.ah_tbl_len = ctx->ah_tbl.len;
         resp.ah_tbl_page = ctx->ah_tbl.pa;
 
@@ -253,7 +254,6 @@ struct ib_ucontext *ocrdma_alloc_ucontext(struct ib_device *ibdev,
         resp.wqe_size = dev->attr.wqe_size;
         resp.rqe_size = dev->attr.rqe_size;
         resp.dpp_wqe_size = dev->attr.wqe_size;
-        resp.rsvd = 0;
 
         memcpy(resp.fw_ver, dev->attr.fw_ver, sizeof(resp.fw_ver));
         status = ib_copy_to_udata(udata, &resp, sizeof(resp));
@@ -338,6 +338,7 @@ static int ocrdma_copy_pd_uresp(struct ocrdma_pd *pd,
         struct ocrdma_alloc_pd_uresp rsp;
         struct ocrdma_ucontext *uctx = get_ocrdma_ucontext(ib_ctx);
 
+        memset(&rsp, 0, sizeof(rsp));
         rsp.id = pd->id;
         rsp.dpp_enabled = pd->dpp_enabled;
         db_page_addr = pd->dev->nic_info.unmapped_db +
@@ -692,6 +693,7 @@ static int ocrdma_copy_cq_uresp(struct ocrdma_cq *cq, struct ib_udata *udata,
         struct ocrdma_ucontext *uctx;
         struct ocrdma_create_cq_uresp uresp;
 
+        memset(&uresp, 0, sizeof(uresp));
         uresp.cq_id = cq->id;
         uresp.page_size = cq->len;
         uresp.num_pages = 1;
@@ -1460,6 +1462,7 @@ static int ocrdma_copy_srq_uresp(struct ocrdma_srq *srq, struct ib_udata *udata)
         int status;
         struct ocrdma_create_srq_uresp uresp;
 
+        memset(&uresp, 0, sizeof(uresp));
         uresp.rq_dbid = srq->rq.dbid;
         uresp.num_rq_pages = 1;
         uresp.rq_page_addr[0] = srq->rq.pa;
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 21e8b09d4bf8..016e7429adf6 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -1596,6 +1596,8 @@ static void sdma_7322_p_errors(struct qib_pportdata *ppd, u64 errs)
         struct qib_devdata *dd = ppd->dd;
 
         errs &= QIB_E_P_SDMAERRS;
+        err_decode(ppd->cpspec->sdmamsgbuf, sizeof(ppd->cpspec->sdmamsgbuf),
+                   errs, qib_7322p_error_msgs);
 
         if (errs & QIB_E_P_SDMAUNEXPDATA)
                 qib_dev_err(dd, "IB%u:%u SDmaUnexpData\n", dd->unit,
diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
index 32162d355370..9b5322d8cd5a 100644
--- a/drivers/infiniband/hw/qib/qib_sdma.c
+++ b/drivers/infiniband/hw/qib/qib_sdma.c
@@ -717,7 +717,7 @@ void dump_sdma_state(struct qib_pportdata *ppd)
         struct qib_sdma_txreq *txp, *txpnext;
         __le64 *descqp;
         u64 desc[2];
-        dma_addr_t addr;
+        u64 addr;
         u16 gen, dwlen, dwoffset;
         u16 head, tail, cnt;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 2cfa76f5d99e..196b1d13cbcb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -932,12 +932,47 @@ int ipoib_ib_dev_init(struct net_device *dev, struct ib_device *ca, int port)
         return 0;
 }
 
+/*
+ * Takes whatever value which is in pkey index 0 and updates priv->pkey
+ * returns 0 if the pkey value was changed.
+ */
+static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
+{
+        int result;
+        u16 prev_pkey;
+
+        prev_pkey = priv->pkey;
+        result = ib_query_pkey(priv->ca, priv->port, 0, &priv->pkey);
+        if (result) {
+                ipoib_warn(priv, "ib_query_pkey port %d failed (ret = %d)\n",
+                           priv->port, result);
+                return result;
+        }
+
+        priv->pkey |= 0x8000;
+
+        if (prev_pkey != priv->pkey) {
+                ipoib_dbg(priv, "pkey changed from 0x%x to 0x%x\n",
+                          prev_pkey, priv->pkey);
+                /*
+                 * Update the pkey in the broadcast address, while making sure to set
+                 * the full membership bit, so that we join the right broadcast group.
+                 */
+                priv->dev->broadcast[8] = priv->pkey >> 8;
+                priv->dev->broadcast[9] = priv->pkey & 0xff;
+                return 0;
+        }
+
+        return 1;
+}
+
 static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
                                 enum ipoib_flush_level level)
 {
         struct ipoib_dev_priv *cpriv;
         struct net_device *dev = priv->dev;
         u16 new_index;
+        int result;
 
         mutex_lock(&priv->vlan_mutex);
 
@@ -951,6 +986,10 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         mutex_unlock(&priv->vlan_mutex);
 
         if (!test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) {
+                /* for non-child devices must check/update the pkey value here */
+                if (level == IPOIB_FLUSH_HEAVY &&
+                    !test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags))
+                        update_parent_pkey(priv);
                 ipoib_dbg(priv, "Not flushing - IPOIB_FLAG_INITIALIZED not set.\n");
                 return;
         }
@@ -961,21 +1000,32 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         }
 
         if (level == IPOIB_FLUSH_HEAVY) {
-                if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &new_index)) {
-                        clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
-                        ipoib_ib_dev_down(dev, 0);
-                        ipoib_ib_dev_stop(dev, 0);
-                        if (ipoib_pkey_dev_delay_open(dev))
+                /* child devices chase their origin pkey value, while non-child
+                 * (parent) devices should always takes what present in pkey index 0
+                 */
+                if (test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
+                        if (ib_find_pkey(priv->ca, priv->port, priv->pkey, &new_index)) {
+                                clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+                                ipoib_ib_dev_down(dev, 0);
+                                ipoib_ib_dev_stop(dev, 0);
+                                if (ipoib_pkey_dev_delay_open(dev))
+                                        return;
+                        }
+                        /* restart QP only if P_Key index is changed */
+                        if (test_and_set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags) &&
+                            new_index == priv->pkey_index) {
+                                ipoib_dbg(priv, "Not flushing - P_Key index not changed.\n");
                                 return;
+                        }
+                        priv->pkey_index = new_index;
+                } else {
+                        result = update_parent_pkey(priv);
+                        /* restart QP only if P_Key value changed */
+                        if (result) {
+                                ipoib_dbg(priv, "Not flushing - P_Key value not changed.\n");
+                                return;
+                        }
                 }
-
-                /* restart QP only if P_Key index is changed */
-                if (test_and_set_bit(IPOIB_PKEY_ASSIGNED, &priv->flags) &&
-                    new_index == priv->pkey_index) {
-                        ipoib_dbg(priv, "Not flushing - P_Key index not changed.\n");
-                        return;
-                }
-                priv->pkey_index = new_index;
         }
 
         if (level == IPOIB_FLUSH_LIGHT) {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index b6e049a3c7a8..c6f71a88c55c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1461,7 +1461,7 @@ static ssize_t create_child(struct device *dev,
         if (sscanf(buf, "%i", &pkey) != 1)
                 return -EINVAL;
 
-        if (pkey < 0 || pkey > 0xffff)
+        if (pkey <= 0 || pkey > 0xffff || pkey == 0x8000)
                 return -EINVAL;
 
         /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
index 74685936c948..f81abe16cf09 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
@@ -119,6 +119,15 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev,
         } else
                 child_pkey  = nla_get_u16(data[IFLA_IPOIB_PKEY]);
 
+        if (child_pkey == 0 || child_pkey == 0x8000)
+                return -EINVAL;
+
+        /*
+         * Set the full membership bit, so that we join the right
+         * broadcast group, etc.
+         */
+        child_pkey |= 0x8000;
+
         err = __ipoib_vlan_add(ppriv, netdev_priv(dev), child_pkey, IPOIB_RTNL_CHILD);
 
         if (!err && data)
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 0b9a79b2f48a..82fc86a90c1a 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -439,15 +439,15 @@ static void backside_setup_pid(void)
 
 /* Slots fan */
 static const struct wf_pid_param slots_param = {
-        .interval       = 5,
-        .history_len    = 2,
-        .gd             = 30 << 20,
-        .gp             = 5 << 20,
-        .gr             = 0,
-        .itarget        = 40 << 16,
-        .additive       = 1,
-        .min            = 300,
-        .max            = 4000,
+        .interval       = 1,
+        .history_len    = 20,
+        .gd             = 0,
+        .gp             = 0,
+        .gr             = 0x00100000,
+        .itarget        = 3200000,
+        .additive       = 0,
+        .min            = 20,
+        .max            = 100,
 };
 
 static void slots_fan_tick(void)
diff --git a/drivers/media/i2c/ml86v7667.c b/drivers/media/i2c/ml86v7667.c
index efdc873e58d1..a9857022f71d 100644
--- a/drivers/media/i2c/ml86v7667.c
+++ b/drivers/media/i2c/ml86v7667.c
@@ -117,7 +117,7 @@ static int ml86v7667_s_ctrl(struct v4l2_ctrl *ctrl)
 {
         struct v4l2_subdev *sd = to_sd(ctrl);
         struct i2c_client *client = v4l2_get_subdevdata(sd);
-        int ret;
+        int ret = -EINVAL;
 
         switch (ctrl->id) {
         case V4L2_CID_BRIGHTNESS:
@@ -157,7 +157,7 @@ static int ml86v7667_s_ctrl(struct v4l2_ctrl *ctrl)
                 break;
         }
 
-        return 0;
+        return ret;
 }
 
 static int ml86v7667_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index df4ada880e42..bd9405df1bd6 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -1987,7 +1987,7 @@ MODULE_DEVICE_TABLE(platform, coda_platform_ids);
 
 #ifdef CONFIG_OF
 static const struct of_device_id coda_dt_ids[] = {
-        { .compatible = "fsl,imx27-vpu", .data = &coda_platform_ids[CODA_IMX27] },
+        { .compatible = "fsl,imx27-vpu", .data = &coda_devdata[CODA_IMX27] },
         { .compatible = "fsl,imx53-vpu", .data = &coda_devdata[CODA_IMX53] },
         { /* sentinel */ }
 };
diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c
index 553d87e5ceab..fd6289d60cde 100644
--- a/drivers/media/platform/s5p-g2d/g2d.c
+++ b/drivers/media/platform/s5p-g2d/g2d.c
@@ -784,6 +784,7 @@ static int g2d_probe(struct platform_device *pdev)
         }
         *vfd = g2d_videodev;
         vfd->lock = &dev->mutex;
+        vfd->v4l2_dev = &dev->v4l2_dev;
         ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
         if (ret) {
                 v4l2_err(&dev->v4l2_dev, "Failed to register video device\n");
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
index 5296385153d5..4f6dd42c9adb 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
@@ -344,7 +344,7 @@ static int vidioc_g_fmt(struct file *file, void *priv, struct v4l2_format *f)
                 pix_mp->num_planes = 2;
                 /* Set pixelformat to the format in which MFC
                    outputs the decoded frame */
-                pix_mp->pixelformat = V4L2_PIX_FMT_NV12MT;
+                pix_mp->pixelformat = ctx->dst_fmt->fourcc;
                 pix_mp->plane_fmt[0].bytesperline = ctx->buf_width;
                 pix_mp->plane_fmt[0].sizeimage = ctx->luma_size;
                 pix_mp->plane_fmt[1].bytesperline = ctx->buf_width;
@@ -382,10 +382,16 @@ static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
                         mfc_err("Unsupported format for source.\n");
                         return -EINVAL;
                 }
-                if (!IS_MFCV6(dev) && (fmt->fourcc == V4L2_PIX_FMT_VP8)) {
-                        mfc_err("Not supported format.\n");
+                if (fmt->codec_mode == S5P_FIMV_CODEC_NONE) {
+                        mfc_err("Unknown codec\n");
                         return -EINVAL;
                 }
+                if (!IS_MFCV6(dev)) {
+                        if (fmt->fourcc == V4L2_PIX_FMT_VP8) {
+                                mfc_err("Not supported format.\n");
+                                return -EINVAL;
+                        }
+                }
         } else if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
                 fmt = find_format(f, MFC_FMT_RAW);
                 if (!fmt) {
@@ -411,7 +417,6 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
         struct s5p_mfc_dev *dev = video_drvdata(file);
         struct s5p_mfc_ctx *ctx = fh_to_ctx(priv);
         int ret = 0;
-        struct s5p_mfc_fmt *fmt;
         struct v4l2_pix_format_mplane *pix_mp;
 
         mfc_debug_enter();
@@ -425,54 +430,32 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
                 goto out;
         }
         if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
-                fmt = find_format(f, MFC_FMT_RAW);
-                if (!fmt) {
-                        mfc_err("Unsupported format for source.\n");
-                        return -EINVAL;
-                }
-                if (!IS_MFCV6(dev) && (fmt->fourcc != V4L2_PIX_FMT_NV12MT)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                } else if (IS_MFCV6(dev) &&
-                                (fmt->fourcc == V4L2_PIX_FMT_NV12MT)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                }
-                ctx->dst_fmt = fmt;
-                mfc_debug_leave();
-                return ret;
-        } else if (f->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
-                mfc_err("Wrong type error for S_FMT : %d", f->type);
-                return -EINVAL;
-        }
-        fmt = find_format(f, MFC_FMT_DEC);
-        if (!fmt || fmt->codec_mode == S5P_MFC_CODEC_NONE) {
-                mfc_err("Unknown codec\n");
-                ret = -EINVAL;
+                /* dst_fmt is validated by call to vidioc_try_fmt */
+                ctx->dst_fmt = find_format(f, MFC_FMT_RAW);
+                ret = 0;
                 goto out;
-        }
-        if (fmt->type != MFC_FMT_DEC) {
-                mfc_err("Wrong format selected, you should choose "
-                                        "format for decoding\n");
+        } else if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+                /* src_fmt is validated by call to vidioc_try_fmt */
+                ctx->src_fmt = find_format(f, MFC_FMT_DEC);
+                ctx->codec_mode = ctx->src_fmt->codec_mode;
+                mfc_debug(2, "The codec number is: %d\n", ctx->codec_mode);
+                pix_mp->height = 0;
+                pix_mp->width = 0;
+                if (pix_mp->plane_fmt[0].sizeimage)
+                        ctx->dec_src_buf_size = pix_mp->plane_fmt[0].sizeimage;
+                else
+                        pix_mp->plane_fmt[0].sizeimage = ctx->dec_src_buf_size =
+                                                                DEF_CPB_SIZE;
+                pix_mp->plane_fmt[0].bytesperline = 0;
+                ctx->state = MFCINST_INIT;
+                ret = 0;
+                goto out;
+        } else {
+                mfc_err("Wrong type error for S_FMT : %d", f->type);
                 ret = -EINVAL;
                 goto out;
         }
-        if (!IS_MFCV6(dev) && (fmt->fourcc == V4L2_PIX_FMT_VP8)) {
-                mfc_err("Not supported format.\n");
-                return -EINVAL;
-        }
-        ctx->src_fmt = fmt;
-        ctx->codec_mode = fmt->codec_mode;
-        mfc_debug(2, "The codec number is: %d\n", ctx->codec_mode);
-        pix_mp->height = 0;
-        pix_mp->width = 0;
-        if (pix_mp->plane_fmt[0].sizeimage)
-                ctx->dec_src_buf_size = pix_mp->plane_fmt[0].sizeimage;
-        else
-                pix_mp->plane_fmt[0].sizeimage = ctx->dec_src_buf_size =
-                                                                DEF_CPB_SIZE;
-        pix_mp->plane_fmt[0].bytesperline = 0;
-        ctx->state = MFCINST_INIT;
+
 out:
         mfc_debug_leave();
         return ret;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
index 2549967b2f85..59e56f4c8ce3 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
@@ -906,6 +906,7 @@ static int vidioc_g_fmt(struct file *file, void *priv, struct v4l2_format *f)
 
 static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
 {
+        struct s5p_mfc_dev *dev = video_drvdata(file);
         struct s5p_mfc_fmt *fmt;
         struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
 
@@ -930,6 +931,18 @@ static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
                         return -EINVAL;
                 }
 
+                if (!IS_MFCV6(dev)) {
+                        if (fmt->fourcc == V4L2_PIX_FMT_NV12MT_16X16) {
+                                mfc_err("Not supported format.\n");
+                                return -EINVAL;
+                        }
+                } else if (IS_MFCV6(dev)) {
+                        if (fmt->fourcc == V4L2_PIX_FMT_NV12MT) {
+                                mfc_err("Not supported format.\n");
+                                return -EINVAL;
+                        }
+                }
+
                 if (fmt->num_planes != pix_fmt_mp->num_planes) {
                         mfc_err("failed to try output format\n");
                         return -EINVAL;
@@ -947,7 +960,6 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
 {
         struct s5p_mfc_dev *dev = video_drvdata(file);
         struct s5p_mfc_ctx *ctx = fh_to_ctx(priv);
-        struct s5p_mfc_fmt *fmt;
         struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
         int ret = 0;
 
@@ -960,13 +972,9 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
                 goto out;
         }
         if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
-                fmt = find_format(f, MFC_FMT_ENC);
-                if (!fmt) {
-                        mfc_err("failed to set capture format\n");
-                        return -EINVAL;
-                }
+                /* dst_fmt is validated by call to vidioc_try_fmt */
+                ctx->dst_fmt = find_format(f, MFC_FMT_ENC);
                 ctx->state = MFCINST_INIT;
-                ctx->dst_fmt = fmt;
                 ctx->codec_mode = ctx->dst_fmt->codec_mode;
                 ctx->enc_dst_buf_size = pix_fmt_mp->plane_fmt[0].sizeimage;
                 pix_fmt_mp->plane_fmt[0].bytesperline = 0;
@@ -987,28 +995,8 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
                 }
                 mfc_debug(2, "Got instance number: %d\n", ctx->inst_no);
         } else if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
-                fmt = find_format(f, MFC_FMT_RAW);
-                if (!fmt) {
-                        mfc_err("failed to set output format\n");
-                        return -EINVAL;
-                }
-
-                if (!IS_MFCV6(dev) &&
-                                (fmt->fourcc == V4L2_PIX_FMT_NV12MT_16X16)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                } else if (IS_MFCV6(dev) &&
-                                (fmt->fourcc == V4L2_PIX_FMT_NV12MT)) {
-                        mfc_err("Not supported format.\n");
-                        return -EINVAL;
-                }
-
-                if (fmt->num_planes != pix_fmt_mp->num_planes) {
-                        mfc_err("failed to set output format\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-                ctx->src_fmt = fmt;
+                /* src_fmt is validated by call to vidioc_try_fmt */
+                ctx->src_fmt = find_format(f, MFC_FMT_RAW);
                 ctx->img_width = pix_fmt_mp->width;
                 ctx->img_height = pix_fmt_mp->height;
                 mfc_debug(2, "codec number: %d\n", ctx->src_fmt->codec_mode);
diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
index 4851cc2e4a4d..c4ff9739a7ae 100644
--- a/drivers/media/usb/em28xx/em28xx-i2c.c
+++ b/drivers/media/usb/em28xx/em28xx-i2c.c
@@ -726,7 +726,7 @@ static int em28xx_i2c_eeprom(struct em28xx *dev, unsigned bus,
 
         *eedata = data;
         *eedata_len = len;
-        dev_config = (void *)eedata;
+        dev_config = (void *)*eedata;
 
         switch (le16_to_cpu(dev_config->chip_conf) >> 4 & 0x3) {
         case 0:
diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
index cb694055ba7d..6e5070774dc2 100644
--- a/drivers/media/usb/hdpvr/hdpvr-core.c
+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
@@ -303,6 +303,11 @@ static int hdpvr_probe(struct usb_interface *interface,
 
         dev->workqueue = 0;
 
+        /* init video transfer queues first of all */
+        /* to prevent oops in hdpvr_delete() on error paths */
+        INIT_LIST_HEAD(&dev->free_buff_list);
+        INIT_LIST_HEAD(&dev->rec_buff_list);
+
         /* register v4l2_device early so it can be used for printks */
         if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
                 dev_err(&interface->dev, "v4l2_device_register failed\n");
@@ -325,10 +330,6 @@ static int hdpvr_probe(struct usb_interface *interface,
         if (!dev->workqueue)
                 goto error;
 
-        /* init video transfer queues */
-        INIT_LIST_HEAD(&dev->free_buff_list);
-        INIT_LIST_HEAD(&dev->rec_buff_list);
-
         dev->options = hdpvr_default_options;
 
         if (default_video_input < HDPVR_VIDEO_INPUTS)
@@ -405,7 +406,7 @@ static int hdpvr_probe(struct usb_interface *interface,
                                     video_nr[atomic_inc_return(&dev_nr)]);
         if (retval < 0) {
                 v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
-                goto error;
+                goto reg_fail;
         }
 
         /* let the user know what node this device is now attached to */
diff --git a/drivers/media/usb/usbtv/Kconfig b/drivers/media/usb/usbtv/Kconfig
index 8864436464bf..7c5b86006ee6 100644
--- a/drivers/media/usb/usbtv/Kconfig
+++ b/drivers/media/usb/usbtv/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_USBTV
         tristate "USBTV007 video capture support"
-        depends on VIDEO_DEV
+        depends on VIDEO_V4L2
         select VIDEOBUF2_VMALLOC
 
         ---help---
diff --git a/drivers/media/usb/usbtv/usbtv.c b/drivers/media/usb/usbtv/usbtv.c
index bf43f874685e..91650173941a 100644
--- a/drivers/media/usb/usbtv/usbtv.c
+++ b/drivers/media/usb/usbtv/usbtv.c
@@ -57,7 +57,7 @@
 #define USBTV_CHUNK_SIZE        256
 #define USBTV_CHUNK             240
 #define USBTV_CHUNKS            (USBTV_WIDTH * USBTV_HEIGHT \
-                                        / 2 / USBTV_CHUNK)
+                                        / 4 / USBTV_CHUNK)
 
 /* Chunk header. */
 #define USBTV_MAGIC_OK(chunk)   ((be32_to_cpu(chunk[0]) & 0xff000000) \
@@ -89,6 +89,7 @@ struct usbtv {
         /* Number of currently processed frame, useful find
          * out when a new one begins. */
         u32 frame_id;
+        int chunks_done;
 
         int iso_size;
         unsigned int sequence;
@@ -202,6 +203,26 @@ static int usbtv_setup_capture(struct usbtv *usbtv)
         return 0;
 }
 
+/* Copy data from chunk into a frame buffer, deinterlacing the data
+ * into every second line. Unfortunately, they don't align nicely into
+ * 720 pixel lines, as the chunk is 240 words long, which is 480 pixels.
+ * Therefore, we break down the chunk into two halves before copyting,
+ * so that we can interleave a line if needed. */
+static void usbtv_chunk_to_vbuf(u32 *frame, u32 *src, int chunk_no, int odd)
+{
+        int half;
+
+        for (half = 0; half < 2; half++) {
+                int part_no = chunk_no * 2 + half;
+                int line = part_no / 3;
+                int part_index = (line * 2 + !odd) * 3 + (part_no % 3);
+
+                u32 *dst = &frame[part_index * USBTV_CHUNK/2];
+                memcpy(dst, src, USBTV_CHUNK/2 * sizeof(*src));
+                src += USBTV_CHUNK/2;
+        }
+}
+
 /* Called for each 256-byte image chunk.
  * First word identifies the chunk, followed by 240 words of image
  * data and padding. */
@@ -218,17 +239,17 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
         frame_id = USBTV_FRAME_ID(chunk);
         odd = USBTV_ODD(chunk);
         chunk_no = USBTV_CHUNK_NO(chunk);
-
-        /* Deinterlace. TODO: Use interlaced frame format. */
-        chunk_no = (chunk_no - chunk_no % 3) * 2 + chunk_no % 3;
-        chunk_no += !odd * 3;
-
         if (chunk_no >= USBTV_CHUNKS)
                 return;
 
         /* Beginning of a frame. */
-        if (chunk_no == 0)
+        if (chunk_no == 0) {
                 usbtv->frame_id = frame_id;
+                usbtv->chunks_done = 0;
+        }
+
+        if (usbtv->frame_id != frame_id)
+                return;
 
         spin_lock_irqsave(&usbtv->buflock, flags);
         if (list_empty(&usbtv->bufs)) {
@@ -241,19 +262,23 @@ static void usbtv_image_chunk(struct usbtv *usbtv, u32 *chunk)
         buf = list_first_entry(&usbtv->bufs, struct usbtv_buf, list);
         frame = vb2_plane_vaddr(&buf->vb, 0);
 
-        /* Copy the chunk. */
-        memcpy(&frame[chunk_no * USBTV_CHUNK], &chunk[1],
-                        USBTV_CHUNK * sizeof(chunk[1]));
+        /* Copy the chunk data. */
+        usbtv_chunk_to_vbuf(frame, &chunk[1], chunk_no, odd);
+        usbtv->chunks_done++;
 
         /* Last chunk in a frame, signalling an end */
-        if (usbtv->frame_id && chunk_no == USBTV_CHUNKS-1) {
+        if (odd && chunk_no == USBTV_CHUNKS-1) {
                 int size = vb2_plane_size(&buf->vb, 0);
+                enum vb2_buffer_state state = usbtv->chunks_done ==
+                                                USBTV_CHUNKS ?
+                                                VB2_BUF_STATE_DONE :
+                                                VB2_BUF_STATE_ERROR;
 
                 buf->vb.v4l2_buf.field = V4L2_FIELD_INTERLACED;
                 buf->vb.v4l2_buf.sequence = usbtv->sequence++;
                 v4l2_get_timestamp(&buf->vb.v4l2_buf.timestamp);
                 vb2_set_plane_payload(&buf->vb, 0, size);
-                vb2_buffer_done(&buf->vb, VB2_BUF_STATE_DONE);
+                vb2_buffer_done(&buf->vb, state);
                 list_del(&buf->list);
         }
 
@@ -518,7 +543,7 @@ static int usbtv_queue_setup(struct vb2_queue *vq,
         if (*nbuffers < 2)
                 *nbuffers = 2;
         *nplanes = 1;
-        sizes[0] = USBTV_CHUNK * USBTV_CHUNKS * sizeof(u32);
+        sizes[0] = USBTV_WIDTH * USBTV_HEIGHT / 2 * sizeof(u32);
 
         return 0;
 }
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index a746ba272f04..a956053608f9 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
 
         soft = &pkt.soft.rfc1201;
 
-        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
+        lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
         if (pkt.hard.offset[0]) {
                 ofs = pkt.hard.offset[0];
                 length = 256 - ofs;
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b3266c80..ac6177d3befc 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
 
                 switch (msg->msg.hdr.cmd) {
                 case CMD_CAN_RX:
+                        if (msg->msg.rx.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
+
                         esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
                         break;
 
                 case CMD_CAN_TX:
+                        if (msg->msg.txdone.net >= dev->net_count) {
+                                dev_err(dev->udev->dev.parent, "format error\n");
+                                break;
+                        }
+
                         esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
                                              msg);
                         break;
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388eea682..8becd3d838b5 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
                         usb_unanchor_urb(urb);
                         usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
                                           urb->transfer_dma);
+                        usb_free_urb(urb);
                         break;
                 }
 
diff --git a/drivers/net/ethernet/allwinner/Kconfig b/drivers/net/ethernet/allwinner/Kconfig
index 53ad213e865b..d8d95d4cd45a 100644
--- a/drivers/net/ethernet/allwinner/Kconfig
+++ b/drivers/net/ethernet/allwinner/Kconfig
@@ -3,19 +3,20 @@
 #
 
 config NET_VENDOR_ALLWINNER
-       bool "Allwinner devices"
-       default y
-       depends on ARCH_SUNXI
-       ---help---
-         If you have a network (Ethernet) card belonging to this
-         class, say Y and read the Ethernet-HOWTO, available from
-         <http://www.tldp.org/docs.html#howto>.
+        bool "Allwinner devices"
+        default y
 
-         Note that the answer to this question doesn't directly
-         affect the kernel: saying N will just cause the configurator
-         to skip all the questions about Allwinner cards. If you say Y,
-         you will be asked for your specific card in the following
-         questions.
+        depends on ARCH_SUNXI
+        ---help---
+          If you have a network (Ethernet) card belonging to this
+          class, say Y and read the Ethernet-HOWTO, available from
+          <http://www.tldp.org/docs.html#howto>.
+
+          Note that the answer to this question doesn't directly
+          affect the kernel: saying N will just cause the configurator
+          to skip all the questions about Allwinner cards. If you say Y,
+          you will be asked for your specific card in the following
+          questions.
 
 if NET_VENDOR_ALLWINNER
 
@@ -26,6 +27,7 @@ config SUN4I_EMAC
         select CRC32
         select MII
         select PHYLIB
+        select MDIO_SUN4I
         ---help---
           Support for Allwinner A10 EMAC ethernet driver.
 
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c.h b/drivers/net/ethernet/atheros/atl1c/atl1c.h
index b2bf324631dc..0f0556526ba9 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
@@ -520,6 +520,9 @@ struct atl1c_adapter {
         struct net_device   *netdev;
         struct pci_dev      *pdev;
         struct napi_struct  napi;
+        struct page         *rx_page;
+        unsigned int        rx_page_offset;
+        unsigned int        rx_frag_size;
         struct atl1c_hw        hw;
         struct atl1c_hw_stats  hw_stats;
         struct mii_if_info  mii;    /* MII interface info */
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 786a87483298..a36a760ada28 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net_device *netdev, void *p)
 static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
                                 struct net_device *dev)
 {
+        unsigned int head_size;
         int mtu = dev->mtu;
 
         adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
                 roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
+
+        head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
+                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        adapter->rx_frag_size = roundup_pow_of_two(head_size);
 }
 
 static netdev_features_t atl1c_fix_features(struct net_device *netdev,
@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(struct atl1c_adapter *adapter)
                 kfree(adapter->tpd_ring[0].buffer_info);
                 adapter->tpd_ring[0].buffer_info = NULL;
         }
+        if (adapter->rx_page) {
+                put_page(adapter->rx_page);
+                adapter->rx_page = NULL;
+        }
 }
 
 /**
@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(struct atl1c_adapter *adapter,
         skb_checksum_none_assert(skb);
 }
 
+static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
+{
+        struct sk_buff *skb;
+        struct page *page;
+
+        if (adapter->rx_frag_size > PAGE_SIZE)
+                return netdev_alloc_skb(adapter->netdev,
+                                        adapter->rx_buffer_len);
+
+        page = adapter->rx_page;
+        if (!page) {
+                adapter->rx_page = page = alloc_page(GFP_ATOMIC);
+                if (unlikely(!page))
+                        return NULL;
+                adapter->rx_page_offset = 0;
+        }
+
+        skb = build_skb(page_address(page) + adapter->rx_page_offset,
+                        adapter->rx_frag_size);
+        if (likely(skb)) {
+                adapter->rx_page_offset += adapter->rx_frag_size;
+                if (adapter->rx_page_offset >= PAGE_SIZE)
+                        adapter->rx_page = NULL;
+                else
+                        get_page(page);
+        }
+        return skb;
+}
+
 static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
 {
         struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
         while (next_info->flags & ATL1C_BUFFER_FREE) {
                 rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
 
-                skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
+                skb = atl1c_alloc_skb(adapter);
                 if (unlikely(!skb)) {
                         if (netif_msg_rx_err(adapter))
                                 dev_warn(&pdev->dev, "alloc rx buffer failed\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index dedbd76c033e..d80e34b8285f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -486,7 +486,7 @@ struct bnx2x_fastpath {
 
         struct napi_struct      napi;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int state;
 #define BNX2X_FP_STATE_IDLE                   0
 #define BNX2X_FP_STATE_NAPI             (1 << 0)    /* NAPI owns this FP */
@@ -498,7 +498,7 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
         /* protect state */
         spinlock_t lock;
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
         union host_hc_status_block      status_blk;
         /* chip independent shortcuts into sb structure */
@@ -572,7 +572,7 @@ struct bnx2x_fastpath {
 #define bnx2x_fp_stats(bp, fp)  (&((bp)->fp_stats[(fp)->index]))
 #define bnx2x_fp_qstats(bp, fp) (&((bp)->fp_stats[(fp)->index].eth_q_stats))
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
 {
         spin_lock_init(&fp->lock);
@@ -680,7 +680,7 @@ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
         return false;
 }
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
 /* Use 2500 as a mini-jumbo MTU for FCoE */
 #define BNX2X_FCOE_MINI_JUMBO_MTU       2500
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ee350bde1818..f2d1ff10054b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3117,7 +3117,7 @@ int bnx2x_poll(struct napi_struct *napi, int budget)
         return work_done;
 }
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 /* must be called with local_bh_disable()d */
 int bnx2x_low_latency_recv(struct napi_struct *napi)
 {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e5da07858a2f..e06186c305d8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12026,7 +12026,7 @@ static const struct net_device_ops bnx2x_netdev_ops = {
         .ndo_fcoe_get_wwn       = bnx2x_fcoe_get_wwn,
 #endif
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = bnx2x_low_latency_recv,
 #endif
 };
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index d964f302ac94..ddebc7a5dda0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17625,7 +17625,8 @@ err_out_free_res:
         pci_release_regions(pdev);
 
 err_out_disable_pdev:
-        pci_disable_device(pdev);
+        if (pci_is_enabled(pdev))
+                pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
         return err;
 }
@@ -17773,7 +17774,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
 
         rtnl_lock();
 
-        if (!netif_running(netdev))
+        /* We probably don't have netdev yet */
+        if (!netdev || !netif_running(netdev))
                 goto done;
 
         tg3_phy_stop(tp);
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 2b0a0ea4f8e7..ae236009f1a8 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -259,6 +259,7 @@ struct bufdesc_ex {
 struct fec_enet_delayed_work {
         struct delayed_work delay_work;
         bool timeout;
+        bool trig_tx;
 };
 
 /* The FEC buffer descriptors track the ring buffers.  The rx_bd_base and
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d3ad5ea711d3..77ea0db0bbfc 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -93,6 +93,20 @@ static void set_multicast_list(struct net_device *ndev);
 #define FEC_QUIRK_HAS_CSUM              (1 << 5)
 /* Controller has hardware vlan support */
 #define FEC_QUIRK_HAS_VLAN              (1 << 6)
+/* ENET IP errata ERR006358
+ *
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
+ * detected as not set during a prior frame transmission, then the
+ * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
+ * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
+ * frames not being transmitted until there is a 0-to-1 transition on
+ * ENET_TDAR[TDAR].
+ */
+#define FEC_QUIRK_ERR006358            (1 << 7)
 
 static struct platform_device_id fec_devtype[] = {
         {
@@ -112,7 +126,7 @@ static struct platform_device_id fec_devtype[] = {
                 .name = "imx6q-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
                                 FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
-                                FEC_QUIRK_HAS_VLAN,
+                                FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358,
         }, {
                 .name = "mvf600-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC,
@@ -275,16 +289,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         const struct platform_device_id *id_entry =
                                 platform_get_device_id(fep->pdev);
-        struct bufdesc *bdp;
+        struct bufdesc *bdp, *bdp_pre;
         void *bufaddr;
         unsigned short  status;
         unsigned int index;
 
-        if (!fep->link) {
-                /* Link is down or auto-negotiation is in progress. */
-                return NETDEV_TX_BUSY;
-        }
-
         /* Fill in a Tx ring entry */
         bdp = fep->cur_tx;
 
@@ -370,6 +379,15 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                 ebdp->cbd_esc |= BD_ENET_TX_PINS;
                 }
         }
+
+        bdp_pre = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
+        if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
+            !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
+                fep->delay_work.trig_tx = true;
+                schedule_delayed_work(&(fep->delay_work.delay_work),
+                                        msecs_to_jiffies(1));
+        }
+
         /* If this was the last BD in the ring, start at the beginning again. */
         if (status & BD_ENET_TX_WRAP)
                 bdp = fep->tx_bd_base;
@@ -689,6 +707,11 @@ static void fec_enet_work(struct work_struct *work)
                 fec_restart(fep->netdev, fep->full_duplex);
                 netif_wake_queue(fep->netdev);
         }
+
+        if (fep->delay_work.trig_tx) {
+                fep->delay_work.trig_tx = false;
+                writel(0, fep->hwp + FEC_X_DES_ACTIVE);
+        }
 }
 
 static void
@@ -2279,4 +2302,5 @@ static struct platform_driver fec_driver = {
 
 module_platform_driver(fec_driver);
 
+MODULE_ALIAS("platform:"DRIVER_NAME);
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 6a0c1b66ce54..c1d72c03cb59 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3739,9 +3739,8 @@ static void igb_set_rx_mode(struct net_device *netdev)
         rctl &= ~(E1000_RCTL_UPE | E1000_RCTL_MPE | E1000_RCTL_VFE);
 
         if (netdev->flags & IFF_PROMISC) {
-                u32 mrqc = rd32(E1000_MRQC);
                 /* retain VLAN HW filtering if in VT mode */
-                if (mrqc & E1000_MRQC_ENABLE_VMDQ)
+                if (adapter->vfs_allocated_count)
                         rctl |= E1000_RCTL_VFE;
                 rctl |= (E1000_RCTL_UPE | E1000_RCTL_MPE);
                 vmolr |= (E1000_VMOLR_ROPE | E1000_VMOLR_MPME);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 7be725cdfea8..a6494e5daffe 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -54,7 +54,7 @@
 
 #include <net/busy_poll.h>
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 #define LL_EXTENDED_STATS
 #endif
 /* common prefix used by pr_<> macros */
@@ -366,7 +366,7 @@ struct ixgbe_q_vector {
         struct rcu_head rcu;    /* to avoid race with update stats on free */
         char name[IFNAMSIZ + 9];
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int state;
 #define IXGBE_QV_STATE_IDLE        0
 #define IXGBE_QV_STATE_NAPI        1    /* NAPI owns this QV */
@@ -377,12 +377,12 @@ struct ixgbe_q_vector {
 #define IXGBE_QV_YIELD (IXGBE_QV_STATE_NAPI_YIELD | IXGBE_QV_STATE_POLL_YIELD)
 #define IXGBE_QV_USER_PEND (IXGBE_QV_STATE_POLL | IXGBE_QV_STATE_POLL_YIELD)
         spinlock_t lock;
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 
         /* for dynamic allocation of rings associated with this q_vector */
         struct ixgbe_ring ring[0] ____cacheline_internodealigned_in_smp;
 };
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 static inline void ixgbe_qv_init_lock(struct ixgbe_q_vector *q_vector)
 {
 
@@ -462,7 +462,7 @@ static inline bool ixgbe_qv_ll_polling(struct ixgbe_q_vector *q_vector)
         WARN_ON(!(q_vector->state & IXGBE_QV_LOCKED));
         return q_vector->state & IXGBE_QV_USER_PEND;
 }
-#else /* CONFIG_NET_LL_RX_POLL */
+#else /* CONFIG_NET_RX_BUSY_POLL */
 static inline void ixgbe_qv_init_lock(struct ixgbe_q_vector *q_vector)
 {
 }
@@ -491,7 +491,7 @@ static inline bool ixgbe_qv_ll_polling(struct ixgbe_q_vector *q_vector)
 {
         return false;
 }
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
 #ifdef CONFIG_IXGBE_HWMON
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
index ac780770863d..7a77f37a7cbc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
 
         /* Enable arbiter */
         reg &= ~IXGBE_DPMCS_ARBDIS;
-        /* Enable DFP and Recycle mode */
-        reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
         reg |= IXGBE_DPMCS_TSOEF;
+
         /* Configure Max TSO packet size 34KB including payload and headers */
         reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index bad8f14b1941..be4b1fb3d0d2 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1998,7 +1998,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
         return total_rx_packets;
 }
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 /* must be called with local_bh_disable()d */
 static int ixgbe_low_latency_recv(struct napi_struct *napi)
 {
@@ -2030,7 +2030,7 @@ static int ixgbe_low_latency_recv(struct napi_struct *napi)
 
         return found;
 }
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 
 /**
  * ixgbe_configure_msix - Configure MSI-X hardware
@@ -7227,7 +7227,7 @@ static const struct net_device_ops ixgbe_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ixgbe_netpoll,
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = ixgbe_low_latency_recv,
 #endif
 #ifdef IXGBE_FCOE
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 712779fb12b7..b017818bccae 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -88,6 +88,8 @@
 #define      MVNETA_TX_IN_PRGRS                  BIT(1)
 #define      MVNETA_TX_FIFO_EMPTY                BIT(8)
 #define MVNETA_RX_MIN_FRAME_SIZE                 0x247c
+#define MVNETA_SGMII_SERDES_CFG                  0x24A0
+#define      MVNETA_SGMII_SERDES_PROTO           0x0cc7
 #define MVNETA_TYPE_PRIO                         0x24bc
 #define      MVNETA_FORCE_UNI                    BIT(21)
 #define MVNETA_TXQ_CMD_1                         0x24e4
@@ -655,6 +657,8 @@ static void mvneta_port_sgmii_config(struct mvneta_port *pp)
         val = mvreg_read(pp, MVNETA_GMAC_CTRL_2);
         val |= MVNETA_GMAC2_PSC_ENABLE;
         mvreg_write(pp, MVNETA_GMAC_CTRL_2, val);
+
+        mvreg_write(pp, MVNETA_SGMII_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
 }
 
 /* Start the Ethernet port RX and TX activity */
@@ -2728,28 +2732,24 @@ static int mvneta_probe(struct platform_device *pdev)
 
         pp = netdev_priv(dev);
 
-        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
-        init_timer(&pp->tx_done_timer);
-        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
-
         pp->weight = MVNETA_RX_POLL_WEIGHT;
         pp->phy_node = phy_node;
         pp->phy_interface = phy_mode;
 
-        pp->base = of_iomap(dn, 0);
-        if (pp->base == NULL) {
-                err = -ENOMEM;
-                goto err_free_irq;
-        }
-
         pp->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(pp->clk)) {
                 err = PTR_ERR(pp->clk);
-                goto err_unmap;
+                goto err_free_irq;
         }
 
         clk_prepare_enable(pp->clk);
 
+        pp->base = of_iomap(dn, 0);
+        if (pp->base == NULL) {
+                err = -ENOMEM;
+                goto err_clk;
+        }
+
         dt_mac_addr = of_get_mac_address(dn);
         if (dt_mac_addr && is_valid_ether_addr(dt_mac_addr)) {
                 mac_from = "device tree";
@@ -2766,6 +2766,9 @@ static int mvneta_probe(struct platform_device *pdev)
         }
 
         pp->tx_done_timer.data = (unsigned long)dev;
+        pp->tx_done_timer.function = mvneta_tx_done_timer_callback;
+        init_timer(&pp->tx_done_timer);
+        clear_bit(MVNETA_F_TX_DONE_TIMER_BIT, &pp->flags);
 
         pp->tx_ring_size = MVNETA_MAX_TXD;
         pp->rx_ring_size = MVNETA_MAX_RXD;
@@ -2776,7 +2779,7 @@ static int mvneta_probe(struct platform_device *pdev)
         err = mvneta_init(pp, phy_addr);
         if (err < 0) {
                 dev_err(&pdev->dev, "can't init eth hal\n");
-                goto err_clk;
+                goto err_unmap;
         }
         mvneta_port_power_up(pp, phy_mode);
 
@@ -2806,10 +2809,10 @@ static int mvneta_probe(struct platform_device *pdev)
 
 err_deinit:
         mvneta_deinit(pp);
-err_clk:
-        clk_disable_unprepare(pp->clk);
 err_unmap:
         iounmap(pp->base);
+err_clk:
+        clk_disable_unprepare(pp->clk);
 err_free_irq:
         irq_dispose_mapping(dev->irq);
 err_free_netdev:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index 727874f575ce..a28cd801a236 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -223,7 +223,7 @@ static int mlx4_en_get_sset_count(struct net_device *dev, int sset)
         case ETH_SS_STATS:
                 return (priv->stats_bitmap ? bit_count : NUM_ALL_STATS) +
                         (priv->tx_ring_num * 2) +
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
                         (priv->rx_ring_num * 5);
 #else
                         (priv->rx_ring_num * 2);
@@ -276,7 +276,7 @@ static void mlx4_en_get_ethtool_stats(struct net_device *dev,
         for (i = 0; i < priv->rx_ring_num; i++) {
                 data[index++] = priv->rx_ring[i].packets;
                 data[index++] = priv->rx_ring[i].bytes;
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
                 data[index++] = priv->rx_ring[i].yields;
                 data[index++] = priv->rx_ring[i].misses;
                 data[index++] = priv->rx_ring[i].cleaned;
@@ -344,7 +344,7 @@ static void mlx4_en_get_strings(struct net_device *dev,
                                 "rx%d_packets", i);
                         sprintf(data + (index++) * ETH_GSTRING_LEN,
                                 "rx%d_bytes", i);
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
                         sprintf(data + (index++) * ETH_GSTRING_LEN,
                                 "rx%d_napi_yield", i);
                         sprintf(data + (index++) * ETH_GSTRING_LEN,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 5eac871399d8..fa37b7a61213 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -68,7 +68,7 @@ int mlx4_en_setup_tc(struct net_device *dev, u8 up)
         return 0;
 }
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 /* must be called with local_bh_disable()d */
 static int mlx4_en_low_latency_recv(struct napi_struct *napi)
 {
@@ -94,7 +94,7 @@ static int mlx4_en_low_latency_recv(struct napi_struct *napi)
 
         return done;
 }
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 
 #ifdef CONFIG_RFS_ACCEL
 
@@ -2140,7 +2140,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_RFS_ACCEL
         .ndo_rx_flow_steer      = mlx4_en_filter_rfs,
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         .ndo_busy_poll          = mlx4_en_low_latency_recv,
 #endif
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 8873d6802c80..6fc6dabc78d5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -845,16 +845,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
                            MLX4_CMD_NATIVE);
 
         if (!err && dev->caps.function != slave) {
-                /* if config MAC in DB use it */
-                if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac)
-                        def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
-                else {
-                        /* set slave default_mac address */
-                        MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
-                        def_mac += slave << 8;
-                        priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac;
-                }
-
+                def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
                 MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET);
 
                 /* get port type - currently only eth is enabled */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index e85af922dcdc..36be3208786a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -371,7 +371,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 
         dev->caps.sqp_demux = (mlx4_is_master(dev)) ? MLX4_MAX_NUM_SLAVES : 0;
 
-        if (!enable_64b_cqe_eqe) {
+        if (!enable_64b_cqe_eqe && !mlx4_is_slave(dev)) {
                 if (dev_cap->flags &
                     (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) {
                         mlx4_warn(dev, "64B EQEs/CQEs supported by the device but not enabled\n");
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 35fb60e2320c..5e0aa569306a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -292,7 +292,7 @@ struct mlx4_en_rx_ring {
         void *rx_info;
         unsigned long bytes;
         unsigned long packets;
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned long yields;
         unsigned long misses;
         unsigned long cleaned;
@@ -318,7 +318,7 @@ struct mlx4_en_cq {
         struct mlx4_cqe *buf;
 #define MLX4_EN_OPCODE_ERROR    0x1e
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int state;
 #define MLX4_EN_CQ_STATE_IDLE        0
 #define MLX4_EN_CQ_STATE_NAPI     1    /* NAPI owns this CQ */
@@ -329,7 +329,7 @@ struct mlx4_en_cq {
 #define CQ_YIELD (MLX4_EN_CQ_STATE_NAPI_YIELD | MLX4_EN_CQ_STATE_POLL_YIELD)
 #define CQ_USER_PEND (MLX4_EN_CQ_STATE_POLL | MLX4_EN_CQ_STATE_POLL_YIELD)
         spinlock_t poll_lock; /* protects from LLS/napi conflicts */
-#endif  /* CONFIG_NET_LL_RX_POLL */
+#endif  /* CONFIG_NET_RX_BUSY_POLL */
 };
 
 struct mlx4_en_port_profile {
@@ -580,7 +580,7 @@ struct mlx4_mac_entry {
         struct rcu_head rcu;
 };
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 static inline void mlx4_en_cq_init_lock(struct mlx4_en_cq *cq)
 {
         spin_lock_init(&cq->poll_lock);
@@ -687,7 +687,7 @@ static inline bool mlx4_en_cq_ll_polling(struct mlx4_en_cq *cq)
 {
         return false;
 }
-#endif /* CONFIG_NET_LL_RX_POLL */
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 
 #define MLX4_EN_WOL_DO_MODIFY (1ULL << 63)
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 205753a04cfc..c571de85d0f9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -46,7 +46,7 @@
 #include "mlx5_core.h"
 
 enum {
-        CMD_IF_REV = 3,
+        CMD_IF_REV = 4,
 };
 
 enum {
@@ -282,6 +282,12 @@ const char *mlx5_command_str(int command)
         case MLX5_CMD_OP_TEARDOWN_HCA:
                 return "TEARDOWN_HCA";
 
+        case MLX5_CMD_OP_ENABLE_HCA:
+                return "MLX5_CMD_OP_ENABLE_HCA";
+
+        case MLX5_CMD_OP_DISABLE_HCA:
+                return "MLX5_CMD_OP_DISABLE_HCA";
+
         case MLX5_CMD_OP_QUERY_PAGES:
                 return "QUERY_PAGES";
 
@@ -1113,7 +1119,13 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
 
         for (i = 0; i < (1 << cmd->log_sz); i++) {
                 if (test_bit(i, &vector)) {
+                        struct semaphore *sem;
+
                         ent = cmd->ent_arr[i];
+                        if (ent->page_queue)
+                                sem = &cmd->pages_sem;
+                        else
+                                sem = &cmd->sem;
                         ktime_get_ts(&ent->ts2);
                         memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out));
                         dump_command(dev, ent, 0);
@@ -1136,10 +1148,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
                         } else {
                                 complete(&ent->done);
                         }
-                        if (ent->page_queue)
-                                up(&cmd->pages_sem);
-                        else
-                                up(&cmd->sem);
+                        up(sem);
                 }
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 12242de2b0e3..b47739b0b5f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -249,6 +249,44 @@ static int set_hca_ctrl(struct mlx5_core_dev *dev)
         return err;
 }
 
+static int mlx5_core_enable_hca(struct mlx5_core_dev *dev)
+{
+        int err;
+        struct mlx5_enable_hca_mbox_in in;
+        struct mlx5_enable_hca_mbox_out out;
+
+        memset(&in, 0, sizeof(in));
+        memset(&out, 0, sizeof(out));
+        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_ENABLE_HCA);
+        err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
+        if (err)
+                return err;
+
+        if (out.hdr.status)
+                return mlx5_cmd_status_to_err(&out.hdr);
+
+        return 0;
+}
+
+static int mlx5_core_disable_hca(struct mlx5_core_dev *dev)
+{
+        int err;
+        struct mlx5_disable_hca_mbox_in in;
+        struct mlx5_disable_hca_mbox_out out;
+
+        memset(&in, 0, sizeof(in));
+        memset(&out, 0, sizeof(out));
+        in.hdr.opcode = cpu_to_be16(MLX5_CMD_OP_DISABLE_HCA);
+        err = mlx5_cmd_exec(dev, &in, sizeof(in), &out, sizeof(out));
+        if (err)
+                return err;
+
+        if (out.hdr.status)
+                return mlx5_cmd_status_to_err(&out.hdr);
+
+        return 0;
+}
+
 int mlx5_dev_init(struct mlx5_core_dev *dev, struct pci_dev *pdev)
 {
         struct mlx5_priv *priv = &dev->priv;
@@ -304,28 +342,41 @@ int mlx5_dev_init(struct mlx5_core_dev *dev, struct pci_dev *pdev)
         }
 
         mlx5_pagealloc_init(dev);
+
+        err = mlx5_core_enable_hca(dev);
+        if (err) {
+                dev_err(&pdev->dev, "enable hca failed\n");
+                goto err_pagealloc_cleanup;
+        }
+
+        err = mlx5_satisfy_startup_pages(dev, 1);
+        if (err) {
+                dev_err(&pdev->dev, "failed to allocate boot pages\n");
+                goto err_disable_hca;
+        }
+
         err = set_hca_ctrl(dev);
         if (err) {
                 dev_err(&pdev->dev, "set_hca_ctrl failed\n");
-                goto err_pagealloc_cleanup;
+                goto reclaim_boot_pages;
         }
 
         err = handle_hca_cap(dev);
         if (err) {
                 dev_err(&pdev->dev, "handle_hca_cap failed\n");
-                goto err_pagealloc_cleanup;
+                goto reclaim_boot_pages;
         }
 
-        err = mlx5_satisfy_startup_pages(dev);
+        err = mlx5_satisfy_startup_pages(dev, 0);
         if (err) {
-                dev_err(&pdev->dev, "failed to allocate startup pages\n");
-                goto err_pagealloc_cleanup;
+                dev_err(&pdev->dev, "failed to allocate init pages\n");
+                goto reclaim_boot_pages;
         }
 
         err = mlx5_pagealloc_start(dev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_pagealloc_start failed\n");
-                goto err_reclaim_pages;
+                goto reclaim_boot_pages;
         }
 
         err = mlx5_cmd_init_hca(dev);
@@ -396,9 +447,12 @@ err_stop_poll:
 err_pagealloc_stop:
         mlx5_pagealloc_stop(dev);
 
-err_reclaim_pages:
+reclaim_boot_pages:
         mlx5_reclaim_startup_pages(dev);
 
+err_disable_hca:
+        mlx5_core_disable_hca(dev);
+
 err_pagealloc_cleanup:
         mlx5_pagealloc_cleanup(dev);
         mlx5_cmd_cleanup(dev);
@@ -434,6 +488,7 @@ void mlx5_dev_cleanup(struct mlx5_core_dev *dev)
         mlx5_cmd_teardown_hca(dev);
         mlx5_pagealloc_stop(dev);
         mlx5_reclaim_startup_pages(dev);
+        mlx5_core_disable_hca(dev);
         mlx5_pagealloc_cleanup(dev);
         mlx5_cmd_cleanup(dev);
         iounmap(dev->iseg);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index f0bf46339b28..4a3e137931a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -64,7 +64,7 @@ struct mlx5_query_pages_inbox {
 
 struct mlx5_query_pages_outbox {
         struct mlx5_outbox_hdr  hdr;
-        u8                      reserved[2];
+        __be16                  num_boot_pages;
         __be16                  func_id;
         __be16                  init_pages;
         __be16                  num_pages;
@@ -146,7 +146,7 @@ static struct page *remove_page(struct mlx5_core_dev *dev, u64 addr)
 }
 
 static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
-                                s16 *pages, s16 *init_pages)
+                                s16 *pages, s16 *init_pages, u16 *boot_pages)
 {
         struct mlx5_query_pages_inbox   in;
         struct mlx5_query_pages_outbox  out;
@@ -164,8 +164,13 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
 
         if (pages)
                 *pages = be16_to_cpu(out.num_pages);
+
         if (init_pages)
                 *init_pages = be16_to_cpu(out.init_pages);
+
+        if (boot_pages)
+                *boot_pages = be16_to_cpu(out.num_boot_pages);
+
         *func_id = be16_to_cpu(out.func_id);
 
         return err;
@@ -357,19 +362,22 @@ void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
         queue_work(dev->priv.pg_wq, &req->work);
 }
 
-int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev)
+int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot)
 {
+        u16 uninitialized_var(boot_pages);
         s16 uninitialized_var(init_pages);
         u16 uninitialized_var(func_id);
         int err;
 
-        err = mlx5_cmd_query_pages(dev, &func_id, NULL, &init_pages);
+        err = mlx5_cmd_query_pages(dev, &func_id, NULL, &init_pages,
+                                   &boot_pages);
         if (err)
                 return err;
 
-        mlx5_core_dbg(dev, "requested %d init pages for func_id 0x%x\n", init_pages, func_id);
 
-        return give_pages(dev, func_id, init_pages, 0);
+        mlx5_core_dbg(dev, "requested %d init pages and %d boot pages for func_id 0x%x\n",
+                      init_pages, boot_pages, func_id);
+        return give_pages(dev, func_id, boot ? boot_pages : init_pages, 0);
 }
 
 static int optimal_reclaimed_pages(void)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/uar.c b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
index 71d4a3937200..68f5d9c77c7b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/uar.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
@@ -164,6 +164,7 @@ int mlx5_alloc_uuars(struct mlx5_core_dev *dev, struct mlx5_uuar_info *uuari)
                 uuari->uars[i].map = ioremap(addr, PAGE_SIZE);
                 if (!uuari->uars[i].map) {
                         mlx5_cmd_free_uar(dev, uuari->uars[i].index);
+                        err = -ENOMEM;
                         goto out_count;
                 }
                 mlx5_core_dbg(dev, "allocated uar index 0x%x, mmaped at %p\n",
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
index cb22341a14a8..a588ffde9700 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/Kconfig
@@ -4,7 +4,7 @@
 
 config PCH_GBE
         tristate "OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
-        depends on PCI
+        depends on PCI && (X86 || COMPILE_TEST)
         select MII
         select PTP_1588_CLOCK_PCH
         ---help---
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index b00cf5665eab..221645e9f182 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1400,8 +1400,8 @@ void qlcnic_pci_camqm_write_2M(struct qlcnic_adapter *, u64, u64);
 #define ADDR_IN_RANGE(addr, low, high)  \
         (((addr) < (high)) && ((addr) >= (low)))
 
-#define QLCRD32(adapter, off) \
-        (adapter->ahw->hw_ops->read_reg)(adapter, off)
+#define QLCRD32(adapter, off, err) \
+        (adapter->ahw->hw_ops->read_reg)(adapter, off, err)
 
 #define QLCWR32(adapter, off, val) \
         adapter->ahw->hw_ops->write_reg(adapter, off, val)
@@ -1604,7 +1604,7 @@ struct qlcnic_nic_template {
 struct qlcnic_hardware_ops {
         void (*read_crb) (struct qlcnic_adapter *, char *, loff_t, size_t);
         void (*write_crb) (struct qlcnic_adapter *, char *, loff_t, size_t);
-        int (*read_reg) (struct qlcnic_adapter *, ulong);
+        int (*read_reg) (struct qlcnic_adapter *, ulong, int *);
         int (*write_reg) (struct qlcnic_adapter *, ulong, u32);
         void (*get_ocm_win) (struct qlcnic_hardware_context *);
         int (*get_mac_address) (struct qlcnic_adapter *, u8 *);
@@ -1662,12 +1662,6 @@ static inline void qlcnic_write_crb(struct qlcnic_adapter *adapter, char *buf,
         adapter->ahw->hw_ops->write_crb(adapter, buf, offset, size);
 }
 
-static inline int qlcnic_hw_read_wx_2M(struct qlcnic_adapter *adapter,
-                                       ulong off)
-{
-        return adapter->ahw->hw_ops->read_reg(adapter, off);
-}
-
 static inline int qlcnic_hw_write_wx_2M(struct qlcnic_adapter *adapter,
                                         ulong off, u32 data)
 {
@@ -1869,7 +1863,8 @@ static inline void qlcnic_free_mac_list(struct qlcnic_adapter *adapter)
 
 static inline void qlcnic_set_mac_filter_count(struct qlcnic_adapter *adapter)
 {
-        adapter->ahw->hw_ops->set_mac_filter_count(adapter);
+        if (adapter->ahw->hw_ops->set_mac_filter_count)
+                adapter->ahw->hw_ops->set_mac_filter_count(adapter);
 }
 
 static inline void qlcnic_dev_request_reset(struct qlcnic_adapter *adapter,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 0913c623a67e..92da9980a0a0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -228,17 +228,17 @@ static int __qlcnic_set_win_base(struct qlcnic_adapter *adapter, u32 addr)
         return 0;
 }
 
-int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *adapter, ulong addr)
+int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *adapter, ulong addr,
+                                int *err)
 {
-        int ret;
         struct qlcnic_hardware_context *ahw = adapter->ahw;
 
-        ret = __qlcnic_set_win_base(adapter, (u32) addr);
-        if (!ret) {
+        *err = __qlcnic_set_win_base(adapter, (u32) addr);
+        if (!*err) {
                 return QLCRDX(ahw, QLCNIC_WILDCARD);
         } else {
                 dev_err(&adapter->pdev->dev,
-                        "%s failed, addr = 0x%x\n", __func__, (int)addr);
+                        "%s failed, addr = 0x%lx\n", __func__, addr);
                 return -EIO;
         }
 }
@@ -561,7 +561,7 @@ void qlcnic_83xx_cam_unlock(struct qlcnic_adapter *adapter)
 void qlcnic_83xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                           loff_t offset, size_t size)
 {
-        int ret;
+        int ret = 0;
         u32 data;
 
         if (qlcnic_api_lock(adapter)) {
@@ -571,7 +571,7 @@ void qlcnic_83xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                 return;
         }
 
-        ret = qlcnic_83xx_rd_reg_indirect(adapter, (u32) offset);
+        data = QLCRD32(adapter, (u32) offset, &ret);
         qlcnic_api_unlock(adapter);
 
         if (ret == -EIO) {
@@ -580,7 +580,6 @@ void qlcnic_83xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                         __func__, (u32)offset);
                 return;
         }
-        data = ret;
         memcpy(buf, &data, size);
 }
 
@@ -2075,18 +2074,25 @@ void qlcnic_83xx_config_intr_coal(struct qlcnic_adapter *adapter)
 static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
                                         u32 data[])
 {
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
         u8 link_status, duplex;
         /* link speed */
         link_status = LSB(data[3]) & 1;
-        adapter->ahw->link_speed = MSW(data[2]);
-        adapter->ahw->link_autoneg = MSB(MSW(data[3]));
-        adapter->ahw->module_type = MSB(LSW(data[3]));
-        duplex = LSB(MSW(data[3]));
-        if (duplex)
-                adapter->ahw->link_duplex = DUPLEX_FULL;
-        else
-                adapter->ahw->link_duplex = DUPLEX_HALF;
-        adapter->ahw->has_link_events = 1;
+        if (link_status) {
+                ahw->link_speed = MSW(data[2]);
+                duplex = LSB(MSW(data[3]));
+                if (duplex)
+                        ahw->link_duplex = DUPLEX_FULL;
+                else
+                        ahw->link_duplex = DUPLEX_HALF;
+        } else {
+                ahw->link_speed = SPEED_UNKNOWN;
+                ahw->link_duplex = DUPLEX_UNKNOWN;
+        }
+
+        ahw->link_autoneg = MSB(MSW(data[3]));
+        ahw->module_type = MSB(LSW(data[3]));
+        ahw->has_link_events = 1;
         qlcnic_advert_link_change(adapter, link_status);
 }
 
@@ -2384,9 +2390,9 @@ int qlcnic_83xx_lockless_flash_read32(struct qlcnic_adapter *adapter,
                                       u32 flash_addr, u8 *p_data,
                                       int count)
 {
-        int i, ret;
-        u32 word, range, flash_offset, addr = flash_addr;
+        u32 word, range, flash_offset, addr = flash_addr, ret;
         ulong indirect_add, direct_window;
+        int i, err = 0;
 
         flash_offset = addr & (QLCNIC_FLASH_SECTOR_SIZE - 1);
         if (addr & 0x3) {
@@ -2404,10 +2410,9 @@ int qlcnic_83xx_lockless_flash_read32(struct qlcnic_adapter *adapter,
                 /* Multi sector read */
                 for (i = 0; i < count; i++) {
                         indirect_add = QLC_83XX_FLASH_DIRECT_DATA(addr);
-                        ret = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                          indirect_add);
-                        if (ret == -EIO)
-                                return -EIO;
+                        ret = QLCRD32(adapter, indirect_add, &err);
+                        if (err == -EIO)
+                                return err;
 
                         word = ret;
                         *(u32 *)p_data  = word;
@@ -2428,10 +2433,9 @@ int qlcnic_83xx_lockless_flash_read32(struct qlcnic_adapter *adapter,
                 /* Single sector read */
                 for (i = 0; i < count; i++) {
                         indirect_add = QLC_83XX_FLASH_DIRECT_DATA(addr);
-                        ret = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                          indirect_add);
-                        if (ret == -EIO)
-                                return -EIO;
+                        ret = QLCRD32(adapter, indirect_add, &err);
+                        if (err == -EIO)
+                                return err;
 
                         word = ret;
                         *(u32 *)p_data  = word;
@@ -2447,10 +2451,13 @@ static int qlcnic_83xx_poll_flash_status_reg(struct qlcnic_adapter *adapter)
 {
         u32 status;
         int retries = QLC_83XX_FLASH_READ_RETRY_COUNT;
+        int err = 0;
 
         do {
-                status = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                     QLC_83XX_FLASH_STATUS);
+                status = QLCRD32(adapter, QLC_83XX_FLASH_STATUS, &err);
+                if (err == -EIO)
+                        return err;
+
                 if ((status & QLC_83XX_FLASH_STATUS_READY) ==
                     QLC_83XX_FLASH_STATUS_READY)
                         break;
@@ -2502,7 +2509,8 @@ int qlcnic_83xx_disable_flash_write(struct qlcnic_adapter *adapter)
 
 int qlcnic_83xx_read_flash_mfg_id(struct qlcnic_adapter *adapter)
 {
-        int ret, mfg_id;
+        int ret, err = 0;
+        u32 mfg_id;
 
         if (qlcnic_83xx_lock_flash(adapter))
                 return -EIO;
@@ -2517,9 +2525,11 @@ int qlcnic_83xx_read_flash_mfg_id(struct qlcnic_adapter *adapter)
                 return -EIO;
         }
 
-        mfg_id = qlcnic_83xx_rd_reg_indirect(adapter, QLC_83XX_FLASH_RDDATA);
-        if (mfg_id == -EIO)
-                return -EIO;
+        mfg_id = QLCRD32(adapter, QLC_83XX_FLASH_RDDATA, &err);
+        if (err == -EIO) {
+                qlcnic_83xx_unlock_flash(adapter);
+                return err;
+        }
 
         adapter->flash_mfg_id = (mfg_id & 0xFF);
         qlcnic_83xx_unlock_flash(adapter);
@@ -2636,7 +2646,7 @@ int qlcnic_83xx_flash_bulk_write(struct qlcnic_adapter *adapter, u32 addr,
                                  u32 *p_data, int count)
 {
         u32 temp;
-        int ret = -EIO;
+        int ret = -EIO, err = 0;
 
         if ((count < QLC_83XX_FLASH_WRITE_MIN) ||
             (count > QLC_83XX_FLASH_WRITE_MAX)) {
@@ -2645,8 +2655,10 @@ int qlcnic_83xx_flash_bulk_write(struct qlcnic_adapter *adapter, u32 addr,
                 return -EIO;
         }
 
-        temp = qlcnic_83xx_rd_reg_indirect(adapter,
-                                           QLC_83XX_FLASH_SPI_CONTROL);
+        temp = QLCRD32(adapter, QLC_83XX_FLASH_SPI_CONTROL, &err);
+        if (err == -EIO)
+                return err;
+
         qlcnic_83xx_wrt_reg_indirect(adapter, QLC_83XX_FLASH_SPI_CONTROL,
                                      (temp | QLC_83XX_FLASH_SPI_CTRL));
         qlcnic_83xx_wrt_reg_indirect(adapter, QLC_83XX_FLASH_ADDR,
@@ -2695,13 +2707,18 @@ int qlcnic_83xx_flash_bulk_write(struct qlcnic_adapter *adapter, u32 addr,
                 return -EIO;
         }
 
-        ret = qlcnic_83xx_rd_reg_indirect(adapter, QLC_83XX_FLASH_SPI_STATUS);
+        ret = QLCRD32(adapter, QLC_83XX_FLASH_SPI_STATUS, &err);
+        if (err == -EIO)
+                return err;
+
         if ((ret & QLC_83XX_FLASH_SPI_CTRL) == QLC_83XX_FLASH_SPI_CTRL) {
                 dev_err(&adapter->pdev->dev, "%s: failed at %d\n",
                         __func__, __LINE__);
                 /* Operation failed, clear error bit */
-                temp = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                   QLC_83XX_FLASH_SPI_CONTROL);
+                temp = QLCRD32(adapter, QLC_83XX_FLASH_SPI_CONTROL, &err);
+                if (err == -EIO)
+                        return err;
+
                 qlcnic_83xx_wrt_reg_indirect(adapter,
                                              QLC_83XX_FLASH_SPI_CONTROL,
                                              (temp | QLC_83XX_FLASH_SPI_CTRL));
@@ -2823,6 +2840,7 @@ int qlcnic_83xx_ms_mem_write128(struct qlcnic_adapter *adapter, u64 addr,
 {
         int i, j, ret = 0;
         u32 temp;
+        int err = 0;
 
         /* Check alignment */
         if (addr & 0xF)
@@ -2855,8 +2873,12 @@ int qlcnic_83xx_ms_mem_write128(struct qlcnic_adapter *adapter, u64 addr,
                                              QLCNIC_TA_WRITE_START);
 
                 for (j = 0; j < MAX_CTL_CHECK; j++) {
-                        temp = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                           QLCNIC_MS_CTRL);
+                        temp = QLCRD32(adapter, QLCNIC_MS_CTRL, &err);
+                        if (err == -EIO) {
+                                mutex_unlock(&adapter->ahw->mem_lock);
+                                return err;
+                        }
+
                         if ((temp & TA_CTL_BUSY) == 0)
                                 break;
                 }
@@ -2878,9 +2900,9 @@ int qlcnic_83xx_ms_mem_write128(struct qlcnic_adapter *adapter, u64 addr,
 int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
                              u8 *p_data, int count)
 {
-        int i, ret;
-        u32 word, addr = flash_addr;
+        u32 word, addr = flash_addr, ret;
         ulong  indirect_addr;
+        int i, err = 0;
 
         if (qlcnic_83xx_lock_flash(adapter) != 0)
                 return -EIO;
@@ -2900,10 +2922,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
                 }
 
                 indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr);
-                ret = qlcnic_83xx_rd_reg_indirect(adapter,
-                                                  indirect_addr);
-                if (ret == -EIO)
-                        return -EIO;
+                ret = QLCRD32(adapter, indirect_addr, &err);
+                if (err == -EIO)
+                        return err;
+
                 word = ret;
                 *(u32 *)p_data  = word;
                 p_data = p_data + 4;
@@ -3014,8 +3036,8 @@ int qlcnic_83xx_get_settings(struct qlcnic_adapter *adapter,
         }
 
         if (ahw->port_type == QLCNIC_XGBE) {
-                ecmd->supported = SUPPORTED_1000baseT_Full;
-                ecmd->advertising = ADVERTISED_1000baseT_Full;
+                ecmd->supported = SUPPORTED_10000baseT_Full;
+                ecmd->advertising = ADVERTISED_10000baseT_Full;
         } else {
                 ecmd->supported = (SUPPORTED_10baseT_Half |
                                    SUPPORTED_10baseT_Full |
@@ -3369,7 +3391,8 @@ int qlcnic_83xx_set_pauseparam(struct qlcnic_adapter *adapter,
 
 static int qlcnic_83xx_read_flash_status_reg(struct qlcnic_adapter *adapter)
 {
-        int ret;
+        int ret, err = 0;
+        u32 temp;
 
         qlcnic_83xx_wrt_reg_indirect(adapter, QLC_83XX_FLASH_ADDR,
                                      QLC_83XX_FLASH_OEM_READ_SIG);
@@ -3379,8 +3402,11 @@ static int qlcnic_83xx_read_flash_status_reg(struct qlcnic_adapter *adapter)
         if (ret)
                 return -EIO;
 
-        ret = qlcnic_83xx_rd_reg_indirect(adapter, QLC_83XX_FLASH_RDDATA);
-        return ret & 0xFF;
+        temp = QLCRD32(adapter, QLC_83XX_FLASH_RDDATA, &err);
+        if (err == -EIO)
+                return err;
+
+        return temp & 0xFF;
 }
 
 int qlcnic_83xx_flash_test(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 2548d1403d75..272f56a2e14b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -508,7 +508,7 @@ void qlcnic_83xx_add_sysfs(struct qlcnic_adapter *);
 void qlcnic_83xx_remove_sysfs(struct qlcnic_adapter *);
 void qlcnic_83xx_write_crb(struct qlcnic_adapter *, char *, loff_t, size_t);
 void qlcnic_83xx_read_crb(struct qlcnic_adapter *, char *, loff_t, size_t);
-int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *, ulong);
+int qlcnic_83xx_rd_reg_indirect(struct qlcnic_adapter *, ulong, int *);
 int qlcnic_83xx_wrt_reg_indirect(struct qlcnic_adapter *, ulong, u32);
 void qlcnic_83xx_process_rcv_diag(struct qlcnic_adapter *, int, u64 []);
 int qlcnic_83xx_nic_set_promisc(struct qlcnic_adapter *, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index f41dfab1e9a3..9f4b8d5f0865 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -1303,8 +1303,11 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
 {
         int i, j;
         u32 val = 0, val1 = 0, reg = 0;
+        int err = 0;
 
-        val = QLCRD32(adapter, QLC_83XX_SRE_SHIM_REG);
+        val = QLCRD32(adapter, QLC_83XX_SRE_SHIM_REG, &err);
+        if (err == -EIO)
+                return;
         dev_info(&adapter->pdev->dev, "SRE-Shim Ctrl:0x%x\n", val);
 
         for (j = 0; j < 2; j++) {
@@ -1318,7 +1321,9 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
                         reg = QLC_83XX_PORT1_THRESHOLD;
                 }
                 for (i = 0; i < 8; i++) {
-                        val = QLCRD32(adapter, reg + (i * 0x4));
+                        val = QLCRD32(adapter, reg + (i * 0x4), &err);
+                        if (err == -EIO)
+                                return;
                         dev_info(&adapter->pdev->dev, "0x%x  ", val);
                 }
                 dev_info(&adapter->pdev->dev, "\n");
@@ -1335,8 +1340,10 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
                         reg = QLC_83XX_PORT1_TC_MC_REG;
                 }
                 for (i = 0; i < 4; i++) {
-                        val = QLCRD32(adapter, reg + (i * 0x4));
-                         dev_info(&adapter->pdev->dev, "0x%x  ", val);
+                        val = QLCRD32(adapter, reg + (i * 0x4), &err);
+                        if (err == -EIO)
+                                return;
+                        dev_info(&adapter->pdev->dev, "0x%x  ", val);
                 }
                 dev_info(&adapter->pdev->dev, "\n");
         }
@@ -1352,17 +1359,25 @@ static void qlcnic_83xx_dump_pause_control_regs(struct qlcnic_adapter *adapter)
                         reg = QLC_83XX_PORT1_TC_STATS;
                 }
                 for (i = 7; i >= 0; i--) {
-                        val = QLCRD32(adapter, reg);
+                        val = QLCRD32(adapter, reg, &err);
+                        if (err == -EIO)
+                                return;
                         val &= ~(0x7 << 29);    /* Reset bits 29 to 31 */
                         QLCWR32(adapter, reg, (val | (i << 29)));
-                        val = QLCRD32(adapter, reg);
+                        val = QLCRD32(adapter, reg, &err);
+                        if (err == -EIO)
+                                return;
                         dev_info(&adapter->pdev->dev, "0x%x  ", val);
                 }
                 dev_info(&adapter->pdev->dev, "\n");
         }
 
-        val = QLCRD32(adapter, QLC_83XX_PORT2_IFB_THRESHOLD);
-        val1 = QLCRD32(adapter, QLC_83XX_PORT3_IFB_THRESHOLD);
+        val = QLCRD32(adapter, QLC_83XX_PORT2_IFB_THRESHOLD, &err);
+        if (err == -EIO)
+                return;
+        val1 = QLCRD32(adapter, QLC_83XX_PORT3_IFB_THRESHOLD, &err);
+        if (err == -EIO)
+                return;
         dev_info(&adapter->pdev->dev,
                  "IFB-Pause Thresholds: Port 2:0x%x, Port 3:0x%x\n",
                  val, val1);
@@ -1425,7 +1440,7 @@ static void qlcnic_83xx_take_eport_out_of_reset(struct qlcnic_adapter *adapter)
 static int qlcnic_83xx_check_heartbeat(struct qlcnic_adapter *p_dev)
 {
         u32 heartbeat, peg_status;
-        int retries, ret = -EIO;
+        int retries, ret = -EIO, err = 0;
 
         retries = QLCNIC_HEARTBEAT_CHECK_RETRY_COUNT;
         p_dev->heartbeat = QLC_SHARED_REG_RD32(p_dev,
@@ -1453,11 +1468,11 @@ static int qlcnic_83xx_check_heartbeat(struct qlcnic_adapter *p_dev)
                          "PEG_NET_2_PC: 0x%x, PEG_NET_3_PC: 0x%x,\n"
                          "PEG_NET_4_PC: 0x%x\n", peg_status,
                          QLC_SHARED_REG_RD32(p_dev, QLCNIC_PEG_HALT_STATUS2),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_0),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_1),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_2),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_3),
-                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_4));
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_0, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_1, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_2, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_3, &err),
+                         QLCRD32(p_dev, QLC_83XX_CRB_PEG_NET_4, &err));
 
                 if (QLCNIC_FWERROR_CODE(peg_status) == 0x67)
                         dev_err(&p_dev->pdev->dev,
@@ -1501,18 +1516,22 @@ int qlcnic_83xx_check_hw_status(struct qlcnic_adapter *p_dev)
 static int qlcnic_83xx_poll_reg(struct qlcnic_adapter *p_dev, u32 addr,
                                 int duration, u32 mask, u32 status)
 {
+        int timeout_error, err = 0;
         u32 value;
-        int timeout_error;
         u8 retries;
 
-        value = qlcnic_83xx_rd_reg_indirect(p_dev, addr);
+        value = QLCRD32(p_dev, addr, &err);
+        if (err == -EIO)
+                return err;
         retries = duration / 10;
 
         do {
                 if ((value & mask) != status) {
                         timeout_error = 1;
                         msleep(duration / 10);
-                        value = qlcnic_83xx_rd_reg_indirect(p_dev, addr);
+                        value = QLCRD32(p_dev, addr, &err);
+                        if (err == -EIO)
+                                return err;
                 } else {
                         timeout_error = 0;
                         break;
@@ -1606,9 +1625,12 @@ int qlcnic_83xx_get_reset_instruction_template(struct qlcnic_adapter *p_dev)
 static void qlcnic_83xx_read_write_crb_reg(struct qlcnic_adapter *p_dev,
                                            u32 raddr, u32 waddr)
 {
-        int value;
+        int err = 0;
+        u32 value;
 
-        value = qlcnic_83xx_rd_reg_indirect(p_dev, raddr);
+        value = QLCRD32(p_dev, raddr, &err);
+        if (err == -EIO)
+                return;
         qlcnic_83xx_wrt_reg_indirect(p_dev, waddr, value);
 }
 
@@ -1617,12 +1639,16 @@ static void qlcnic_83xx_rmw_crb_reg(struct qlcnic_adapter *p_dev,
                                     u32 raddr, u32 waddr,
                                     struct qlc_83xx_rmw *p_rmw_hdr)
 {
-        int value;
+        int err = 0;
+        u32 value;
 
-        if (p_rmw_hdr->index_a)
+        if (p_rmw_hdr->index_a) {
                 value = p_dev->ahw->reset.array[p_rmw_hdr->index_a];
-        else
-                value = qlcnic_83xx_rd_reg_indirect(p_dev, raddr);
+        } else {
+                value = QLCRD32(p_dev, raddr, &err);
+                if (err == -EIO)
+                        return;
+        }
 
         value &= p_rmw_hdr->mask;
         value <<= p_rmw_hdr->shl;
@@ -1675,7 +1701,7 @@ static void qlcnic_83xx_poll_list(struct qlcnic_adapter *p_dev,
         long delay;
         struct qlc_83xx_entry *entry;
         struct qlc_83xx_poll *poll;
-        int i;
+        int i, err = 0;
         unsigned long arg1, arg2;
 
         poll = (struct qlc_83xx_poll *)((char *)p_hdr +
@@ -1699,10 +1725,12 @@ static void qlcnic_83xx_poll_list(struct qlcnic_adapter *p_dev,
                                                          arg1, delay,
                                                          poll->mask,
                                                          poll->status)){
-                                        qlcnic_83xx_rd_reg_indirect(p_dev,
-                                                                    arg1);
-                                        qlcnic_83xx_rd_reg_indirect(p_dev,
-                                                                    arg2);
+                                        QLCRD32(p_dev, arg1, &err);
+                                        if (err == -EIO)
+                                                return;
+                                        QLCRD32(p_dev, arg2, &err);
+                                        if (err == -EIO)
+                                                return;
                                 }
                         }
                 }
@@ -1768,7 +1796,7 @@ static void qlcnic_83xx_poll_read_list(struct qlcnic_adapter *p_dev,
                                        struct qlc_83xx_entry_hdr *p_hdr)
 {
         long delay;
-        int index, i, j;
+        int index, i, j, err;
         struct qlc_83xx_quad_entry *entry;
         struct qlc_83xx_poll *poll;
         unsigned long addr;
@@ -1788,7 +1816,10 @@ static void qlcnic_83xx_poll_read_list(struct qlcnic_adapter *p_dev,
                                                   poll->mask, poll->status)){
                                 index = p_dev->ahw->reset.array_index;
                                 addr = entry->dr_addr;
-                                j = qlcnic_83xx_rd_reg_indirect(p_dev, addr);
+                                j = QLCRD32(p_dev, addr, &err);
+                                if (err == -EIO)
+                                        return;
+
                                 p_dev->ahw->reset.array[index++] = j;
 
                                 if (index == QLC_83XX_MAX_RESET_SEQ_ENTRIES)
@@ -2123,6 +2154,8 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         set_bit(QLC_83XX_MBX_READY, &adapter->ahw->idc.status);
         qlcnic_83xx_clear_function_resources(adapter);
 
+        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
+
         /* register for NIC IDC AEN Events */
         qlcnic_83xx_register_nic_idc_func(adapter, 1);
 
@@ -2140,8 +2173,6 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter, int pci_using_dac)
         if (adapter->nic_ops->init_driver(adapter))
                 return -EIO;
 
-        INIT_DELAYED_WORK(&adapter->idc_aen_work, qlcnic_83xx_idc_aen_work);
-
         /* Periodically monitor device status */
         qlcnic_83xx_idc_poll_dev_state(&adapter->fw_work.work);
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index 0581a484ceb5..d09389b33474 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -104,7 +104,7 @@ static u32
 qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 {
         u32 rsp;
-        int timeout = 0;
+        int timeout = 0, err = 0;
 
         do {
                 /* give atleast 1ms for firmware to respond */
@@ -113,7 +113,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
                 if (++timeout > QLCNIC_OS_CRB_RETRY_COUNT)
                         return QLCNIC_CDRP_RSP_TIMEOUT;
 
-                rsp = QLCRD32(adapter, QLCNIC_CDRP_CRB_OFFSET);
+                rsp = QLCRD32(adapter, QLCNIC_CDRP_CRB_OFFSET, &err);
         } while (!QLCNIC_CDRP_IS_RSP(rsp));
 
         return rsp;
@@ -122,7 +122,7 @@ qlcnic_poll_rsp(struct qlcnic_adapter *adapter)
 int qlcnic_82xx_issue_cmd(struct qlcnic_adapter *adapter,
                           struct qlcnic_cmd_args *cmd)
 {
-        int i;
+        int i, err = 0;
         u32 rsp;
         u32 signature;
         struct pci_dev *pdev = adapter->pdev;
@@ -148,7 +148,7 @@ int qlcnic_82xx_issue_cmd(struct qlcnic_adapter *adapter,
                 dev_err(&pdev->dev, "card response timeout.\n");
                 cmd->rsp.arg[0] = QLCNIC_RCODE_TIMEOUT;
         } else if (rsp == QLCNIC_CDRP_RSP_FAIL) {
-                cmd->rsp.arg[0] = QLCRD32(adapter, QLCNIC_CDRP_ARG(1));
+                cmd->rsp.arg[0] = QLCRD32(adapter, QLCNIC_CDRP_ARG(1), &err);
                 switch (cmd->rsp.arg[0]) {
                 case QLCNIC_RCODE_INVALID_ARGS:
                         fmt = "CDRP invalid args: [%d]\n";
@@ -175,7 +175,7 @@ int qlcnic_82xx_issue_cmd(struct qlcnic_adapter *adapter,
                 cmd->rsp.arg[0] = QLCNIC_RCODE_SUCCESS;
 
         for (i = 1; i < cmd->rsp.num; i++)
-                cmd->rsp.arg[i] = QLCRD32(adapter, QLCNIC_CDRP_ARG(i));
+                cmd->rsp.arg[i] = QLCRD32(adapter, QLCNIC_CDRP_ARG(i), &err);
 
         /* Release semaphore */
         qlcnic_api_unlock(adapter);
@@ -210,10 +210,10 @@ int qlcnic_fw_cmd_set_drv_version(struct qlcnic_adapter *adapter, u32 fw_cmd)
         if (err) {
                 dev_info(&adapter->pdev->dev,
                          "Failed to set driver version in firmware\n");
-                return -EIO;
+                err = -EIO;
         }
-
-        return 0;
+        qlcnic_free_mbx_args(&cmd);
+        return err;
 }
 
 int
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 700a46324d09..7aac23ab31d1 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -150,6 +150,7 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
         "Link_Test_on_offline",
         "Interrupt_Test_offline",
         "Internal_Loopback_offline",
+        "External_Loopback_offline",
         "EEPROM_Test_offline"
 };
 
@@ -266,7 +267,7 @@ int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
 {
         struct qlcnic_hardware_context *ahw = adapter->ahw;
         u32 speed, reg;
-        int check_sfp_module = 0;
+        int check_sfp_module = 0, err = 0;
         u16 pcifn = ahw->pci_func;
 
         /* read which mode */
@@ -289,7 +290,7 @@ int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
 
         } else if (adapter->ahw->port_type == QLCNIC_XGBE) {
                 u32 val = 0;
-                val = QLCRD32(adapter, QLCNIC_PORT_MODE_ADDR);
+                val = QLCRD32(adapter, QLCNIC_PORT_MODE_ADDR, &err);
 
                 if (val == QLCNIC_PORT_MODE_802_3_AP) {
                         ecmd->supported = SUPPORTED_1000baseT_Full;
@@ -300,9 +301,13 @@ int qlcnic_82xx_get_settings(struct qlcnic_adapter *adapter,
                 }
 
                 if (netif_running(adapter->netdev) && ahw->has_link_events) {
-                        reg = QLCRD32(adapter, P3P_LINK_SPEED_REG(pcifn));
-                        speed = P3P_LINK_SPEED_VAL(pcifn, reg);
-                        ahw->link_speed = speed * P3P_LINK_SPEED_MHZ;
+                        if (ahw->linkup) {
+                                reg = QLCRD32(adapter,
+                                              P3P_LINK_SPEED_REG(pcifn), &err);
+                                speed = P3P_LINK_SPEED_VAL(pcifn, reg);
+                                ahw->link_speed = speed * P3P_LINK_SPEED_MHZ;
+                        }
+
                         ethtool_cmd_speed_set(ecmd, ahw->link_speed);
                         ecmd->autoneg = ahw->link_autoneg;
                         ecmd->duplex = ahw->link_duplex;
@@ -463,13 +468,14 @@ static int qlcnic_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 static int qlcnic_82xx_get_registers(struct qlcnic_adapter *adapter,
                                      u32 *regs_buff)
 {
-        int i, j = 0;
+        int i, j = 0, err = 0;
 
         for (i = QLCNIC_DEV_INFO_SIZE + 1; diag_registers[j] != -1; j++, i++)
                 regs_buff[i] = QLC_SHARED_REG_RD32(adapter, diag_registers[j]);
         j = 0;
         while (ext_diag_registers[j] != -1)
-                regs_buff[i++] = QLCRD32(adapter, ext_diag_registers[j++]);
+                regs_buff[i++] = QLCRD32(adapter, ext_diag_registers[j++],
+                                         &err);
         return i;
 }
 
@@ -519,13 +525,16 @@ qlcnic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
 static u32 qlcnic_test_link(struct net_device *dev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
+        int err = 0;
         u32 val;
 
         if (qlcnic_83xx_check(adapter)) {
                 val = qlcnic_83xx_test_link(adapter);
                 return (val & 1) ? 0 : 1;
         }
-        val = QLCRD32(adapter, CRB_XG_STATE_P3P);
+        val = QLCRD32(adapter, CRB_XG_STATE_P3P, &err);
+        if (err == -EIO)
+                return err;
         val = XG_LINK_STATE_P3P(adapter->ahw->pci_func, val);
         return (val == XG_LINK_UP_P3P) ? 0 : 1;
 }
@@ -658,6 +667,7 @@ qlcnic_get_pauseparam(struct net_device *netdev,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         int port = adapter->ahw->physical_port;
+        int err = 0;
         __u32 val;
 
         if (qlcnic_83xx_check(adapter)) {
@@ -668,9 +678,13 @@ qlcnic_get_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_GBE_PORTS))
                         return;
                 /* get flow control settings */
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port));
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port), &err);
+                if (err == -EIO)
+                        return;
                 pause->rx_pause = qlcnic_gb_get_rx_flowctl(val);
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return;
                 switch (port) {
                 case 0:
                         pause->tx_pause = !(qlcnic_gb_get_gb0_mask(val));
@@ -690,7 +704,9 @@ qlcnic_get_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_XG_PORTS))
                         return;
                 pause->rx_pause = 1;
-                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return;
                 if (port == 0)
                         pause->tx_pause = !(qlcnic_xg_get_xg0_mask(val));
                 else
@@ -707,6 +723,7 @@ qlcnic_set_pauseparam(struct net_device *netdev,
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         int port = adapter->ahw->physical_port;
+        int err = 0;
         __u32 val;
 
         if (qlcnic_83xx_check(adapter))
@@ -717,7 +734,9 @@ qlcnic_set_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_GBE_PORTS))
                         return -EIO;
                 /* set flow control */
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port));
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port), &err);
+                if (err == -EIO)
+                        return err;
 
                 if (pause->rx_pause)
                         qlcnic_gb_rx_flowctl(val);
@@ -728,7 +747,9 @@ qlcnic_set_pauseparam(struct net_device *netdev,
                                 val);
                 QLCWR32(adapter, QLCNIC_NIU_GB_MAC_CONFIG_0(port), val);
                 /* set autoneg */
-                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_GB_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return err;
                 switch (port) {
                 case 0:
                         if (pause->tx_pause)
@@ -764,7 +785,9 @@ qlcnic_set_pauseparam(struct net_device *netdev,
                 if ((port < 0) || (port > QLCNIC_NIU_MAX_XG_PORTS))
                         return -EIO;
 
-                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL);
+                val = QLCRD32(adapter, QLCNIC_NIU_XG_PAUSE_CTL, &err);
+                if (err == -EIO)
+                        return err;
                 if (port == 0) {
                         if (pause->tx_pause)
                                 qlcnic_xg_unset_xg0_mask(val);
@@ -788,11 +811,14 @@ static int qlcnic_reg_test(struct net_device *dev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 data_read;
+        int err = 0;
 
         if (qlcnic_83xx_check(adapter))
                 return qlcnic_83xx_reg_test(adapter);
 
-        data_read = QLCRD32(adapter, QLCNIC_PCIX_PH_REG(0));
+        data_read = QLCRD32(adapter, QLCNIC_PCIX_PH_REG(0), &err);
+        if (err == -EIO)
+                return err;
         if ((data_read & 0xffff) != adapter->pdev->vendor)
                 return 1;
 
@@ -1026,8 +1052,15 @@ qlcnic_diag_test(struct net_device *dev, struct ethtool_test *eth_test,
                 if (data[3])
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
-                data[4] = qlcnic_eeprom_test(dev);
-                if (data[4])
+                if (eth_test->flags & ETH_TEST_FL_EXTERNAL_LB) {
+                        data[4] = qlcnic_loopback_test(dev, QLCNIC_ELB_MODE);
+                        if (data[4])
+                                eth_test->flags |= ETH_TEST_FL_FAILED;
+                        eth_test->flags |= ETH_TEST_FL_EXTERNAL_LB_DONE;
+                }
+
+                data[5] = qlcnic_eeprom_test(dev);
+                if (data[5])
                         eth_test->flags |= ETH_TEST_FL_FAILED;
         }
 }
@@ -1257,17 +1290,20 @@ qlcnic_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 wol_cfg;
+        int err = 0;
 
         if (qlcnic_83xx_check(adapter))
                 return;
         wol->supported = 0;
         wol->wolopts = 0;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV, &err);
+        if (err == -EIO)
+                return;
         if (wol_cfg & (1UL << adapter->portnum))
                 wol->supported |= WAKE_MAGIC;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG, &err);
         if (wol_cfg & (1UL << adapter->portnum))
                 wol->wolopts |= WAKE_MAGIC;
 }
@@ -1277,17 +1313,22 @@ qlcnic_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct qlcnic_adapter *adapter = netdev_priv(dev);
         u32 wol_cfg;
+        int err = 0;
 
         if (qlcnic_83xx_check(adapter))
                 return -EOPNOTSUPP;
         if (wol->wolopts & ~WAKE_MAGIC)
                 return -EINVAL;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV, &err);
+        if (err == -EIO)
+                return err;
         if (!(wol_cfg & (1 << adapter->portnum)))
                 return -EOPNOTSUPP;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG, &err);
+        if (err == -EIO)
+                return err;
         if (wol->wolopts & WAKE_MAGIC)
                 wol_cfg |= 1UL << adapter->portnum;
         else
@@ -1540,7 +1581,7 @@ qlcnic_set_dump(struct net_device *netdev, struct ethtool_dump *val)
                 return 0;
         case QLCNIC_SET_QUIESCENT:
         case QLCNIC_RESET_QUIESCENT:
-                state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+                state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
                 if (state == QLCNIC_DEV_FAILED || (state == QLCNIC_DEV_BADBAD))
                         netdev_info(netdev, "Device in FAILED state\n");
                 return 0;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 5b5d2edf125d..4d5f59b2d153 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -317,16 +317,20 @@ static void qlcnic_write_window_reg(u32 addr, void __iomem *bar0, u32 data)
 int
 qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
 {
-        int done = 0, timeout = 0;
+        int timeout = 0;
+        int err = 0;
+        u32 done = 0;
 
         while (!done) {
-                done = QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_LOCK(sem)));
+                done = QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_LOCK(sem)),
+                               &err);
                 if (done == 1)
                         break;
                 if (++timeout >= QLCNIC_PCIE_SEM_TIMEOUT) {
                         dev_err(&adapter->pdev->dev,
                                 "Failed to acquire sem=%d lock; holdby=%d\n",
-                                sem, id_reg ? QLCRD32(adapter, id_reg) : -1);
+                                sem,
+                                id_reg ? QLCRD32(adapter, id_reg, &err) : -1);
                         return -EIO;
                 }
                 msleep(1);
@@ -341,19 +345,22 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
 void
 qlcnic_pcie_sem_unlock(struct qlcnic_adapter *adapter, int sem)
 {
-        QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
+        int err = 0;
+
+        QLCRD32(adapter, QLCNIC_PCIE_REG(PCIE_SEM_UNLOCK(sem)), &err);
 }
 
 int qlcnic_ind_rd(struct qlcnic_adapter *adapter, u32 addr)
 {
+        int err = 0;
         u32 data;
 
         if (qlcnic_82xx_check(adapter))
                 qlcnic_read_window_reg(addr, adapter->ahw->pci_base0, &data);
         else {
-                data = qlcnic_83xx_rd_reg_indirect(adapter, addr);
-                if (data == -EIO)
-                        return -EIO;
+                data = QLCRD32(adapter, addr, &err);
+                if (err == -EIO)
+                        return err;
         }
         return data;
 }
@@ -516,20 +523,18 @@ void __qlcnic_set_multi(struct net_device *netdev, u16 vlan)
         if (netdev->flags & IFF_PROMISC) {
                 if (!(adapter->flags & QLCNIC_PROMISC_DISABLED))
                         mode = VPORT_MISS_MODE_ACCEPT_ALL;
-        } else if (netdev->flags & IFF_ALLMULTI) {
-                if (netdev_mc_count(netdev) > ahw->max_mc_count) {
-                        mode = VPORT_MISS_MODE_ACCEPT_MULTI;
-                } else if (!netdev_mc_empty(netdev) &&
-                           !qlcnic_sriov_vf_check(adapter)) {
-                                netdev_for_each_mc_addr(ha, netdev)
-                                        qlcnic_nic_add_mac(adapter, ha->addr,
-                                                           vlan);
-                }
-                if (mode != VPORT_MISS_MODE_ACCEPT_MULTI &&
-                    qlcnic_sriov_vf_check(adapter))
-                        qlcnic_vf_add_mc_list(netdev, vlan);
+        } else if ((netdev->flags & IFF_ALLMULTI) ||
+                   (netdev_mc_count(netdev) > ahw->max_mc_count)) {
+                mode = VPORT_MISS_MODE_ACCEPT_MULTI;
+        } else if (!netdev_mc_empty(netdev) &&
+                   !qlcnic_sriov_vf_check(adapter)) {
+                netdev_for_each_mc_addr(ha, netdev)
+                        qlcnic_nic_add_mac(adapter, ha->addr, vlan);
         }
 
+        if (qlcnic_sriov_vf_check(adapter))
+                qlcnic_vf_add_mc_list(netdev, vlan);
+
         /* configure unicast MAC address, if there is not sufficient space
          * to store all the unicast addresses then enable promiscuous mode
          */
@@ -1161,7 +1166,8 @@ int qlcnic_82xx_hw_write_wx_2M(struct qlcnic_adapter *adapter, ulong off,
         return -EIO;
 }
 
-int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong off)
+int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong off,
+                              int *err)
 {
         unsigned long flags;
         int rv;
@@ -1417,7 +1423,7 @@ int qlcnic_pci_mem_read_2M(struct qlcnic_adapter *adapter, u64 off, u64 *data)
 
 int qlcnic_82xx_get_board_info(struct qlcnic_adapter *adapter)
 {
-        int offset, board_type, magic;
+        int offset, board_type, magic, err = 0;
         struct pci_dev *pdev = adapter->pdev;
 
         offset = QLCNIC_FW_MAGIC_OFFSET;
@@ -1437,7 +1443,9 @@ int qlcnic_82xx_get_board_info(struct qlcnic_adapter *adapter)
         adapter->ahw->board_type = board_type;
 
         if (board_type == QLCNIC_BRDTYPE_P3P_4_GB_MM) {
-                u32 gpio = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_PAD_GPIO_I);
+                u32 gpio = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_PAD_GPIO_I, &err);
+                if (err == -EIO)
+                        return err;
                 if ((gpio & 0x8000) == 0)
                         board_type = QLCNIC_BRDTYPE_P3P_10G_TP;
         }
@@ -1477,10 +1485,13 @@ int
 qlcnic_wol_supported(struct qlcnic_adapter *adapter)
 {
         u32 wol_cfg;
+        int err = 0;
 
-        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV);
+        wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG_NV, &err);
         if (wol_cfg & (1UL << adapter->portnum)) {
-                wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG);
+                wol_cfg = QLCRD32(adapter, QLCNIC_WOL_CONFIG, &err);
+                if (err == -EIO)
+                        return err;
                 if (wol_cfg & (1 << adapter->portnum))
                         return 1;
         }
@@ -1541,6 +1552,7 @@ void qlcnic_82xx_get_func_no(struct qlcnic_adapter *adapter)
 void qlcnic_82xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                           loff_t offset, size_t size)
 {
+        int err = 0;
         u32 data;
         u64 qmdata;
 
@@ -1548,7 +1560,7 @@ void qlcnic_82xx_read_crb(struct qlcnic_adapter *adapter, char *buf,
                 qlcnic_pci_camqm_read_2M(adapter, offset, &qmdata);
                 memcpy(buf, &qmdata, size);
         } else {
-                data = QLCRD32(adapter, offset);
+                data = QLCRD32(adapter, offset, &err);
                 memcpy(buf, &data, size);
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
index 2c22504f57aa..4a71b28effcb 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.h
@@ -154,7 +154,7 @@ struct qlcnic_hardware_context;
 struct qlcnic_adapter;
 
 int qlcnic_82xx_start_firmware(struct qlcnic_adapter *);
-int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong);
+int qlcnic_82xx_hw_read_wx_2M(struct qlcnic_adapter *adapter, ulong, int *);
 int qlcnic_82xx_hw_write_wx_2M(struct qlcnic_adapter *, ulong, u32);
 int qlcnic_82xx_config_hw_lro(struct qlcnic_adapter *adapter, int);
 int qlcnic_82xx_nic_set_promisc(struct qlcnic_adapter *adapter, u32);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index d28336fc65ab..974d62607e13 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -142,7 +142,7 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter)
                                          buffrag->length, PCI_DMA_TODEVICE);
                         buffrag->dma = 0ULL;
                 }
-                for (j = 0; j < cmd_buf->frag_count; j++) {
+                for (j = 1; j < cmd_buf->frag_count; j++) {
                         buffrag++;
                         if (buffrag->dma) {
                                 pci_unmap_page(adapter->pdev, buffrag->dma,
@@ -286,10 +286,11 @@ static int qlcnic_wait_rom_done(struct qlcnic_adapter *adapter)
 {
         long timeout = 0;
         long done = 0;
+        int err = 0;
 
         cond_resched();
         while (done == 0) {
-                done = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_STATUS);
+                done = QLCRD32(adapter, QLCNIC_ROMUSB_GLB_STATUS, &err);
                 done &= 2;
                 if (++timeout >= QLCNIC_MAX_ROM_WAIT_USEC) {
                         dev_err(&adapter->pdev->dev,
@@ -304,6 +305,8 @@ static int qlcnic_wait_rom_done(struct qlcnic_adapter *adapter)
 static int do_rom_fast_read(struct qlcnic_adapter *adapter,
                             u32 addr, u32 *valp)
 {
+        int err = 0;
+
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_ADDRESS, addr);
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_ABYTE_CNT, 3);
@@ -317,7 +320,9 @@ static int do_rom_fast_read(struct qlcnic_adapter *adapter,
         udelay(10);
         QLCWR32(adapter, QLCNIC_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
 
-        *valp = QLCRD32(adapter, QLCNIC_ROMUSB_ROM_RDATA);
+        *valp = QLCRD32(adapter, QLCNIC_ROMUSB_ROM_RDATA, &err);
+        if (err == -EIO)
+                return err;
         return 0;
 }
 
@@ -369,11 +374,11 @@ int qlcnic_rom_fast_read(struct qlcnic_adapter *adapter, u32 addr, u32 *valp)
 
 int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
 {
-        int addr, val;
+        int addr, err = 0;
         int i, n, init_delay;
         struct crb_addr_pair *buf;
         unsigned offset;
-        u32 off;
+        u32 off, val;
         struct pci_dev *pdev = adapter->pdev;
 
         QLC_SHARED_REG_WR32(adapter, QLCNIC_CMDPEG_STATE, 0);
@@ -402,7 +407,9 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
         QLCWR32(adapter, QLCNIC_CRB_NIU + 0xb0000, 0x00);
 
         /* halt sre */
-        val = QLCRD32(adapter, QLCNIC_CRB_SRE + 0x1000);
+        val = QLCRD32(adapter, QLCNIC_CRB_SRE + 0x1000, &err);
+        if (err == -EIO)
+                return err;
         QLCWR32(adapter, QLCNIC_CRB_SRE + 0x1000, val & (~(0x1)));
 
         /* halt epg */
@@ -719,10 +726,12 @@ qlcnic_check_flash_fw_ver(struct qlcnic_adapter *adapter)
 static int
 qlcnic_has_mn(struct qlcnic_adapter *adapter)
 {
-        u32 capability;
-        capability = 0;
+        u32 capability = 0;
+        int err = 0;
 
-        capability = QLCRD32(adapter, QLCNIC_PEG_TUNE_CAPABILITY);
+        capability = QLCRD32(adapter, QLCNIC_PEG_TUNE_CAPABILITY, &err);
+        if (err == -EIO)
+                return err;
         if (capability & QLCNIC_PEG_TUNE_MN_PRESENT)
                 return 1;
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index d3f8797efcc3..6946d354f44f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -161,36 +161,68 @@ static inline int qlcnic_82xx_is_lb_pkt(u64 sts_data)
         return (qlcnic_get_sts_status(sts_data) == STATUS_CKSUM_LOOP) ? 1 : 0;
 }
 
+static void qlcnic_delete_rx_list_mac(struct qlcnic_adapter *adapter,
+                                      struct qlcnic_filter *fil,
+                                      void *addr, u16 vlan_id)
+{
+        int ret;
+        u8 op;
+
+        op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
+        ret = qlcnic_sre_macaddr_change(adapter, addr, vlan_id, op);
+        if (ret)
+                return;
+
+        op = vlan_id ? QLCNIC_MAC_VLAN_DEL : QLCNIC_MAC_DEL;
+        ret = qlcnic_sre_macaddr_change(adapter, addr, vlan_id, op);
+        if (!ret) {
+                hlist_del(&fil->fnode);
+                adapter->rx_fhash.fnum--;
+        }
+}
+
+static struct qlcnic_filter *qlcnic_find_mac_filter(struct hlist_head *head,
+                                                    void *addr, u16 vlan_id)
+{
+        struct qlcnic_filter *tmp_fil = NULL;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
+                if (!memcmp(tmp_fil->faddr, addr, ETH_ALEN) &&
+                    tmp_fil->vlan_id == vlan_id)
+                        return tmp_fil;
+        }
+
+        return NULL;
+}
+
 void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
                           int loopback_pkt, u16 vlan_id)
 {
         struct ethhdr *phdr = (struct ethhdr *)(skb->data);
         struct qlcnic_filter *fil, *tmp_fil;
-        struct hlist_node *n;
         struct hlist_head *head;
         unsigned long time;
         u64 src_addr = 0;
-        u8 hindex, found = 0, op;
+        u8 hindex, op;
         int ret;
 
         memcpy(&src_addr, phdr->h_source, ETH_ALEN);
+        hindex = qlcnic_mac_hash(src_addr) &
+                 (adapter->fhash.fbucket_size - 1);
 
         if (loopback_pkt) {
                 if (adapter->rx_fhash.fnum >= adapter->rx_fhash.fmax)
                         return;
 
-                hindex = qlcnic_mac_hash(src_addr) &
-                         (adapter->fhash.fbucket_size - 1);
                 head = &(adapter->rx_fhash.fhead[hindex]);
 
-                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
-                        if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
-                            tmp_fil->vlan_id == vlan_id) {
-                                time = tmp_fil->ftime;
-                                if (jiffies > (QLCNIC_READD_AGE * HZ + time))
-                                        tmp_fil->ftime = jiffies;
-                                return;
-                        }
+                tmp_fil = qlcnic_find_mac_filter(head, &src_addr, vlan_id);
+                if (tmp_fil) {
+                        time = tmp_fil->ftime;
+                        if (time_after(jiffies, QLCNIC_READD_AGE * HZ + time))
+                                tmp_fil->ftime = jiffies;
+                        return;
                 }
 
                 fil = kzalloc(sizeof(struct qlcnic_filter), GFP_ATOMIC);
@@ -205,36 +237,37 @@ void qlcnic_add_lb_filter(struct qlcnic_adapter *adapter, struct sk_buff *skb,
                 adapter->rx_fhash.fnum++;
                 spin_unlock(&adapter->rx_mac_learn_lock);
         } else {
-                hindex = qlcnic_mac_hash(src_addr) &
-                         (adapter->fhash.fbucket_size - 1);
-                head = &(adapter->rx_fhash.fhead[hindex]);
-                spin_lock(&adapter->rx_mac_learn_lock);
-                hlist_for_each_entry_safe(tmp_fil, n, head, fnode) {
-                        if (!memcmp(tmp_fil->faddr, &src_addr, ETH_ALEN) &&
-                            tmp_fil->vlan_id == vlan_id) {
-                                found = 1;
-                                break;
-                        }
-                }
+                head = &adapter->fhash.fhead[hindex];
 
-                if (!found) {
-                        spin_unlock(&adapter->rx_mac_learn_lock);
-                        return;
-                }
+                spin_lock(&adapter->mac_learn_lock);
 
-                op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
-                ret = qlcnic_sre_macaddr_change(adapter, (u8 *)&src_addr,
-                                                vlan_id, op);
-                if (!ret) {
+                tmp_fil = qlcnic_find_mac_filter(head, &src_addr, vlan_id);
+                if (tmp_fil) {
                         op = vlan_id ? QLCNIC_MAC_VLAN_DEL : QLCNIC_MAC_DEL;
                         ret = qlcnic_sre_macaddr_change(adapter,
                                                         (u8 *)&src_addr,
                                                         vlan_id, op);
                         if (!ret) {
-                                hlist_del(&(tmp_fil->fnode));
-                                adapter->rx_fhash.fnum--;
+                                hlist_del(&tmp_fil->fnode);
+                                adapter->fhash.fnum--;
                         }
+
+                        spin_unlock(&adapter->mac_learn_lock);
+
+                        return;
                 }
+
+                spin_unlock(&adapter->mac_learn_lock);
+
+                head = &adapter->rx_fhash.fhead[hindex];
+
+                spin_lock(&adapter->rx_mac_learn_lock);
+
+                tmp_fil = qlcnic_find_mac_filter(head, &src_addr, vlan_id);
+                if (tmp_fil)
+                        qlcnic_delete_rx_list_mac(adapter, tmp_fil, &src_addr,
+                                                  vlan_id);
+
                 spin_unlock(&adapter->rx_mac_learn_lock);
         }
 }
@@ -262,7 +295,7 @@ void qlcnic_82xx_change_filter(struct qlcnic_adapter *adapter, u64 *uaddr,
 
         mac_req = (struct qlcnic_mac_req *)&(req->words[0]);
         mac_req->op = vlan_id ? QLCNIC_MAC_VLAN_ADD : QLCNIC_MAC_ADD;
-        memcpy(mac_req->mac_addr, &uaddr, ETH_ALEN);
+        memcpy(mac_req->mac_addr, uaddr, ETH_ALEN);
 
         vlan_req = (struct qlcnic_vlan_req *)&req->words[1];
         vlan_req->vlan_id = cpu_to_le16(vlan_id);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 4528f8ec333b..ee013fcc3322 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -977,8 +977,8 @@ qlcnic_check_options(struct qlcnic_adapter *adapter)
 static int
 qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
 {
-        int err;
         struct qlcnic_info nic_info;
+        int err = 0;
 
         memset(&nic_info, 0, sizeof(struct qlcnic_info));
         err = qlcnic_get_nic_info(adapter, &nic_info, adapter->ahw->pci_func);
@@ -993,7 +993,9 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
 
         if (adapter->ahw->capabilities & QLCNIC_FW_CAPABILITY_MORE_CAPS) {
                 u32 temp;
-                temp = QLCRD32(adapter, CRB_FW_CAPABILITIES_2);
+                temp = QLCRD32(adapter, CRB_FW_CAPABILITIES_2, &err);
+                if (err == -EIO)
+                        return err;
                 adapter->ahw->extra_capability[0] = temp;
         }
         adapter->ahw->max_mac_filters = nic_info.max_mac_filters;
@@ -1383,6 +1385,8 @@ qlcnic_request_irq(struct qlcnic_adapter *adapter)
         if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                 if (qlcnic_82xx_check(adapter))
                         handler = qlcnic_tmp_intr;
+                else
+                        handler = qlcnic_83xx_tmp_intr;
                 if (!QLCNIC_IS_MSI_FAMILY(adapter))
                         flags |= IRQF_SHARED;
 
@@ -1531,12 +1535,12 @@ int __qlcnic_up(struct qlcnic_adapter *adapter, struct net_device *netdev)
         if (netdev->features & NETIF_F_LRO)
                 qlcnic_config_hw_lro(adapter, QLCNIC_LRO_ENABLED);
 
+        set_bit(__QLCNIC_DEV_UP, &adapter->state);
         qlcnic_napi_enable(adapter);
 
         qlcnic_linkevent_request(adapter, 1);
 
         adapter->ahw->reset_context = 0;
-        set_bit(__QLCNIC_DEV_UP, &adapter->state);
         return 0;
 }
 
@@ -2139,7 +2143,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (qlcnic_83xx_check(adapter) && !qlcnic_use_msi_x &&
             !!qlcnic_use_msi)
                 dev_warn(&pdev->dev,
-                         "83xx adapter do not support MSI interrupts\n");
+                         "Device does not support MSI interrupts\n");
 
         err = qlcnic_setup_intr(adapter, 0);
         if (err) {
@@ -3093,6 +3097,7 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
 {
         u32 state = 0, heartbeat;
         u32 peg_status;
+        int err = 0;
 
         if (qlcnic_check_temp(adapter))
                 goto detach;
@@ -3139,11 +3144,11 @@ qlcnic_check_health(struct qlcnic_adapter *adapter)
                         "PEG_NET_4_PC: 0x%x\n",
                         peg_status,
                         QLC_SHARED_REG_RD32(adapter, QLCNIC_PEG_HALT_STATUS2),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_0 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_1 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_2 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_3 + 0x3c),
-                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c));
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_0 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_1 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_2 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_3 + 0x3c, &err),
+                        QLCRD32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, &err));
         if (QLCNIC_FWERROR_CODE(peg_status) == 0x67)
                 dev_err(&adapter->pdev->dev,
                         "Firmware aborted with error code 0x00006700. "
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
index ab8a6744d402..79e54efe07b9 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1084,7 +1084,7 @@ flash_temp:
         tmpl_hdr = ahw->fw_dump.tmpl_hdr;
         tmpl_hdr->drv_cap_mask = QLCNIC_DUMP_MASK_DEF;
 
-        if ((tmpl_hdr->version & 0xffffff) >= 0x20001)
+        if ((tmpl_hdr->version & 0xfffff) >= 0x20001)
                 ahw->fw_dump.use_pex_dma = true;
         else
                 ahw->fw_dump.use_pex_dma = false;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 62380ce89905..5d40045b3cea 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -562,7 +562,7 @@ static int qlcnic_sriov_setup_vf(struct qlcnic_adapter *adapter,
         INIT_LIST_HEAD(&adapter->vf_mc_list);
         if (!qlcnic_use_msi_x && !!qlcnic_use_msi)
                 dev_warn(&adapter->pdev->dev,
-                         "83xx adapter do not support MSI interrupts\n");
+                         "Device does not support MSI interrupts\n");
 
         err = qlcnic_setup_intr(adapter, 1);
         if (err) {
@@ -762,6 +762,7 @@ static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *mbx, u32 type)
                         memset(mbx->rsp.arg, 0, sizeof(u32) * mbx->rsp.num);
                         mbx->req.arg[0] = (type | (mbx->req.num << 16) |
                                            (3 << 29));
+                        mbx->rsp.arg[0] = (type & 0xffff) | mbx->rsp.num << 16;
                         return 0;
                 }
         }
@@ -813,6 +814,7 @@ static int qlcnic_sriov_prepare_bc_hdr(struct qlcnic_bc_trans *trans,
                 cmd->req.num = trans->req_pay_size / 4;
                 cmd->rsp.num = trans->rsp_pay_size / 4;
                 hdr = trans->rsp_hdr;
+                cmd->op_type = trans->req_hdr->op_type;
         }
 
         trans->trans_id = seq;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index ee0c1d307966..eb49cd65378c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -635,12 +635,12 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                            struct qlcnic_cmd_args *cmd)
 {
         struct qlcnic_vf_info *vf = trans->vf;
-        struct qlcnic_adapter *adapter = vf->adapter;
-        int err;
+        struct qlcnic_vport *vp = vf->vp;
+        struct qlcnic_adapter *adapter;
         u16 func = vf->pci_func;
+        int err;
 
-        cmd->rsp.arg[0] = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] |= (1 << 16);
+        adapter = vf->adapter;
 
         if (trans->req_hdr->cmd_op == QLCNIC_BC_CMD_CHANNEL_INIT) {
                 err = qlcnic_sriov_pf_config_vport(adapter, 1, func);
@@ -650,6 +650,8 @@ static int qlcnic_sriov_pf_channel_cfg_cmd(struct qlcnic_bc_trans *trans,
                                 qlcnic_sriov_pf_config_vport(adapter, 0, func);
                 }
         } else {
+                if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                        vp->vlan = 0;
                 err = qlcnic_sriov_pf_config_vport(adapter, 0, func);
         }
 
@@ -1183,7 +1185,7 @@ static int qlcnic_sriov_pf_get_acl_cmd(struct qlcnic_bc_trans *trans,
         u8 cmd_op, mode = vp->vlan_mode;
 
         cmd_op = trans->req_hdr->cmd_op;
-        cmd->rsp.arg[0] = (cmd_op & 0xffff) | 14 << 16 | 1 << 25;
+        cmd->rsp.arg[0] |= 1 << 25;
 
         switch (mode) {
         case QLC_GUEST_VLAN_MODE:
@@ -1561,6 +1563,7 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                                 struct qlcnic_vf_info *vf)
 {
         struct net_device *dev = vf->adapter->netdev;
+        struct qlcnic_vport *vp = vf->vp;
 
         if (!test_and_clear_bit(QLC_BC_VF_STATE, &vf->state)) {
                 clear_bit(QLC_BC_VF_FLR, &vf->state);
@@ -1573,6 +1576,9 @@ void qlcnic_sriov_pf_handle_flr(struct qlcnic_sriov *sriov,
                 return;
         }
 
+        if (vp->vlan_mode == QLC_GUEST_VLAN_MODE)
+                vp->vlan = 0;
+
         qlcnic_sriov_schedule_flr(sriov, vf, qlcnic_sriov_pf_process_flr);
         netdev_info(dev, "FLR received for PCI func %d\n", vf->pci_func);
 }
@@ -1621,13 +1627,15 @@ int qlcnic_sriov_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_sriov *sriov = adapter->ahw->sriov;
-        int i, num_vfs = sriov->num_vfs;
+        int i, num_vfs;
         struct qlcnic_vf_info *vf_info;
         u8 *curr_mac;
 
         if (!qlcnic_sriov_pf_check(adapter))
                 return -EOPNOTSUPP;
 
+        num_vfs = sriov->num_vfs;
+
         if (!is_valid_ether_addr(mac) || vf >= num_vfs)
                 return -EINVAL;
 
@@ -1741,6 +1749,7 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
 
         switch (vlan) {
         case 4095:
+                vp->vlan = 0;
                 vp->vlan_mode = QLC_GUEST_VLAN_MODE;
                 break;
         case 0:
@@ -1759,6 +1768,29 @@ int qlcnic_sriov_set_vf_vlan(struct net_device *netdev, int vf,
         return 0;
 }
 
+static inline __u32 qlcnic_sriov_get_vf_vlan(struct qlcnic_adapter *adapter,
+                                             struct qlcnic_vport *vp, int vf)
+{
+        __u32 vlan = 0;
+
+        switch (vp->vlan_mode) {
+        case QLC_PVID_MODE:
+                vlan = vp->vlan;
+                break;
+        case QLC_GUEST_VLAN_MODE:
+                vlan = MAX_VLAN_ID;
+                break;
+        case QLC_NO_VLAN_MODE:
+                vlan = 0;
+                break;
+        default:
+                netdev_info(adapter->netdev, "Invalid VLAN mode = %d for VF %d\n",
+                            vp->vlan_mode, vf);
+        }
+
+        return vlan;
+}
+
 int qlcnic_sriov_get_vf_config(struct net_device *netdev,
                                int vf, struct ifla_vf_info *ivi)
 {
@@ -1774,7 +1806,7 @@ int qlcnic_sriov_get_vf_config(struct net_device *netdev,
 
         vp = sriov->vf_info[vf].vp;
         memcpy(&ivi->mac, vp->mac, ETH_ALEN);
-        ivi->vlan = vp->vlan;
+        ivi->vlan = qlcnic_sriov_get_vf_vlan(adapter, vp, vf);
         ivi->qos = vp->qos;
         ivi->spoofchk = vp->spoofchk;
         if (vp->max_tx_bw == MAX_BW)
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index e6acb9fa5767..6f35f8404d68 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -478,7 +478,7 @@ rx_status_loop:
 
         while (1) {
                 u32 status, len;
-                dma_addr_t mapping;
+                dma_addr_t mapping, new_mapping;
                 struct sk_buff *skb, *new_skb;
                 struct cp_desc *desc;
                 const unsigned buflen = cp->rx_buf_sz;
@@ -520,6 +520,13 @@ rx_status_loop:
                         goto rx_next;
                 }
 
+                new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+                                         PCI_DMA_FROMDEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
+                        dev->stats.rx_dropped++;
+                        goto rx_next;
+                }
+
                 dma_unmap_single(&cp->pdev->dev, mapping,
                                  buflen, PCI_DMA_FROMDEVICE);
 
@@ -531,12 +538,11 @@ rx_status_loop:
 
                 skb_put(skb, len);
 
-                mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
-                                         PCI_DMA_FROMDEVICE);
                 cp->rx_skb[rx_tail] = new_skb;
 
                 cp_rx_skb(cp, skb, desc);
                 rx++;
+                mapping = new_mapping;
 
 rx_next:
                 cp->rx_ring[rx_tail].opts2 = 0;
@@ -716,6 +722,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
                 TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
 }
 
+static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
+                                   int first, int entry_last)
+{
+        int frag, index;
+        struct cp_desc *txd;
+        skb_frag_t *this_frag;
+        for (frag = 0; frag+first < entry_last; frag++) {
+                index = first+frag;
+                cp->tx_skb[index] = NULL;
+                txd = &cp->tx_ring[index];
+                this_frag = &skb_shinfo(skb)->frags[frag];
+                dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
+                                 skb_frag_size(this_frag), PCI_DMA_TODEVICE);
+        }
+}
+
 static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                                         struct net_device *dev)
 {
@@ -749,6 +771,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
 
                 len = skb->len;
                 mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, mapping))
+                        goto out_dma_error;
+
                 txd->opts2 = opts2;
                 txd->addr = cpu_to_le64(mapping);
                 wmb();
@@ -786,6 +811,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                 first_len = skb_headlen(skb);
                 first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
                                                first_len, PCI_DMA_TODEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, first_mapping))
+                        goto out_dma_error;
+
                 cp->tx_skb[entry] = skb;
                 entry = NEXT_TX(entry);
 
@@ -799,6 +827,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                         mapping = dma_map_single(&cp->pdev->dev,
                                                  skb_frag_address(this_frag),
                                                  len, PCI_DMA_TODEVICE);
+                        if (dma_mapping_error(&cp->pdev->dev, mapping)) {
+                                unwind_tx_frag_mapping(cp, skb, first_entry, entry);
+                                goto out_dma_error;
+                        }
+
                         eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
 
                         ctrl = eor | len | DescOwn;
@@ -859,11 +892,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
         if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
                 netif_stop_queue(dev);
 
+out_unlock:
         spin_unlock_irqrestore(&cp->lock, intr_flags);
 
         cpw8(TxPoll, NormalTxPoll);
 
         return NETDEV_TX_OK;
+out_dma_error:
+        kfree_skb(skb);
+        cp->dev->stats.tx_dropped++;
+        goto out_unlock;
 }
 
 /* Set or clear the multicast filter for this adaptor.
@@ -1054,6 +1092,10 @@ static int cp_refill_rx(struct cp_private *cp)
 
                 mapping = dma_map_single(&cp->pdev->dev, skb->data,
                                          cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                if (dma_mapping_error(&cp->pdev->dev, mapping)) {
+                        kfree_skb(skb);
+                        goto err_out;
+                }
                 cp->rx_skb[i] = skb;
 
                 cp->rx_ring[i].opts2 = 0;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 4106a743ca74..b5eb4195fc99 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3689,7 +3689,7 @@ static void rtl_phy_work(struct rtl8169_private *tp)
         if (tp->link_ok(ioaddr))
                 return;
 
-        netif_warn(tp, link, tp->dev, "PHY reset until link up\n");
+        netif_dbg(tp, link, tp->dev, "PHY reset until link up\n");
 
         tp->phy_reset_enable(tp);
 
@@ -6468,6 +6468,8 @@ static int rtl8169_close(struct net_device *dev)
         rtl8169_down(dev);
         rtl_unlock_work(tp);
 
+        cancel_work_sync(&tp->wk.work);
+
         free_irq(pdev->irq, dev);
 
         dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
@@ -6793,8 +6795,6 @@ static void rtl_remove_one(struct pci_dev *pdev)
                 rtl8168_driver_stop(tp);
         }
 
-        cancel_work_sync(&tp->wk.work);
-
         netif_napi_del(&tp->napi);
 
         unregister_netdev(dev);
diff --git a/drivers/net/ethernet/sfc/filter.c b/drivers/net/ethernet/sfc/filter.c
index b74a60ab9ac7..2a469b27a506 100644
--- a/drivers/net/ethernet/sfc/filter.c
+++ b/drivers/net/ethernet/sfc/filter.c
@@ -1209,7 +1209,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
         ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
 
-        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
+        efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
+                           efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
+                           rxq_index);
         rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
                                       ip->daddr, ports[1], ip->saddr, ports[0]);
         if (rc)
diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
index eb4aea3fe793..f5d7ad75e479 100644
--- a/drivers/net/ethernet/sis/sis900.c
+++ b/drivers/net/ethernet/sis/sis900.c
@@ -1318,7 +1318,7 @@ static void sis900_timer(unsigned long data)
                 if (duplex){
                         sis900_set_mode(sis_priv, speed, duplex);
                         sis630_set_eq(net_dev, sis_priv->chipset_rev);
-                        netif_start_queue(net_dev);
+                        netif_carrier_on(net_dev);
                 }
 
                 sis_priv->timer.expires = jiffies + HZ;
@@ -1336,10 +1336,8 @@ static void sis900_timer(unsigned long data)
                 status = sis900_default_phy(net_dev);
                 mii_phy = sis_priv->mii;
 
-                if (status & MII_STAT_LINK){
+                if (status & MII_STAT_LINK)
                         sis900_check_mode(net_dev, mii_phy);
-                        netif_carrier_on(net_dev);
-                }
         } else {
         /* Link ON -> OFF */
                 if (!(status & MII_STAT_LINK)){
@@ -1612,12 +1610,6 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
         unsigned int  index_cur_tx, index_dirty_tx;
         unsigned int  count_dirty_tx;
 
-        /* Don't transmit data before the complete of auto-negotiation */
-        if(!sis_priv->autong_complete){
-                netif_stop_queue(net_dev);
-                return NETDEV_TX_BUSY;
-        }
-
         spin_lock_irqsave(&sis_priv->lock, flags);
 
         /* Calculate the next Tx descriptor entry. */
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 05a1674e204f..22a7a4336211 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1867,7 +1867,7 @@ static int cpsw_probe(struct platform_device *pdev)
 
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                 for (i = res->start; i <= res->end; i++) {
-                        if (request_irq(i, cpsw_interrupt, IRQF_DISABLED,
+                        if (request_irq(i, cpsw_interrupt, 0,
                                         dev_name(&pdev->dev), priv)) {
                                 dev_err(priv->dev, "error attaching irq\n");
                                 goto clean_ale_ret;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 07b176bcf929..1a222bce4bd7 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1568,8 +1568,7 @@ static int emac_dev_open(struct net_device *ndev)
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                 for (i = res->start; i <= res->end; i++) {
                         if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
-                                             IRQF_DISABLED,
-                                             ndev->name, ndev))
+                                             0, ndev->name, ndev))
                                 goto rollback;
                 }
                 k++;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 18373b6ae37d..d0f9c2fd1d4f 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -337,8 +337,11 @@ static int macvlan_open(struct net_device *dev)
         int err;
 
         if (vlan->port->passthru) {
-                if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC))
-                        dev_set_promiscuity(lowerdev, 1);
+                if (!(vlan->flags & MACVLAN_FLAG_NOPROMISC)) {
+                        err = dev_set_promiscuity(lowerdev, 1);
+                        if (err < 0)
+                                goto out;
+                }
                 goto hash_add;
         }
 
@@ -863,6 +866,18 @@ static int macvlan_changelink(struct net_device *dev,
                 struct nlattr *tb[], struct nlattr *data[])
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
+        enum macvlan_mode mode;
+        bool set_mode = false;
+
+        /* Validate mode, but don't set yet: setting flags may fail. */
+        if (data && data[IFLA_MACVLAN_MODE]) {
+                set_mode = true;
+                mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);
+                /* Passthrough mode can't be set or cleared dynamically */
+                if ((mode == MACVLAN_MODE_PASSTHRU) !=
+                    (vlan->mode == MACVLAN_MODE_PASSTHRU))
+                        return -EINVAL;
+        }
 
         if (data && data[IFLA_MACVLAN_FLAGS]) {
                 __u16 flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
@@ -879,8 +894,8 @@ static int macvlan_changelink(struct net_device *dev,
                 }
                 vlan->flags = flags;
         }
-        if (data && data[IFLA_MACVLAN_MODE])
-                vlan->mode = nla_get_u32(data[IFLA_MACVLAN_MODE]);
+        if (set_mode)
+                vlan->mode = mode;
         return 0;
 }
 
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index 61d3f4ebf52e..7f25e49ae37f 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -40,7 +40,7 @@ struct sun4i_mdio_data {
 static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
         struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
         int value;
 
         /* issue the phy address and reg */
@@ -49,10 +49,9 @@ static int sun4i_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
         writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
 
         /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
         while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
-                               start_jiffies + MDIO_TIMEOUT))
+                if (time_is_before_jiffies(timeout_jiffies))
                         return -ETIMEDOUT;
                 msleep(1);
         }
@@ -69,7 +68,7 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                             u16 value)
 {
         struct sun4i_mdio_data *data = bus->priv;
-        unsigned long start_jiffies;
+        unsigned long timeout_jiffies;
 
         /* issue the phy address and reg */
         writel((mii_id << 8) | regnum, data->membase + EMAC_MAC_MADR_REG);
@@ -77,10 +76,9 @@ static int sun4i_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
         writel(0x1, data->membase + EMAC_MAC_MCMD_REG);
 
         /* Wait read complete */
-        start_jiffies = jiffies;
+        timeout_jiffies = jiffies + MDIO_TIMEOUT;
         while (readl(data->membase + EMAC_MAC_MIND_REG) & 0x1) {
-                if (time_after(start_jiffies,
-                               start_jiffies + MDIO_TIMEOUT))
+                if (time_is_before_jiffies(timeout_jiffies))
                         return -ETIMEDOUT;
                 msleep(1);
         }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 1e3c302d94fe..2bc87e3a8141 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.supports_gmii = 1;
 
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
 
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
         if (((skb->len + 8) % frame_size) == 0)
                 tx_hdr2 |= 0x80008000;  /* Enable padding */
 
-        skb_linearize(skb);
         headroom = skb_headroom(skb);
         tailroom = skb_tailroom(skb);
 
@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *dev)
                           1, 1, tmp);
 
         dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                              NETIF_F_RXCSUM;
 
         dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+                                 NETIF_F_RXCSUM;
 
         /* Enable checksum offload */
         *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ee13f9eb740c..11c51f275366 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -344,17 +344,41 @@ static const int multicast_filter_limit = 32;
 static
 int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
 {
-        return usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
+        int ret;
+        void *tmp;
+
+        tmp = kmalloc(size, GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
+        ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
                                RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
-                               value, index, data, size, 500);
+                               value, index, tmp, size, 500);
+
+        memcpy(data, tmp, size);
+        kfree(tmp);
+
+        return ret;
 }
 
 static
 int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
 {
-        return usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0),
+        int ret;
+        void *tmp;
+
+        tmp = kmalloc(size, GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
+        memcpy(tmp, data, size);
+
+        ret = usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0),
                                RTL8152_REQ_SET_REGS, RTL8152_REQT_WRITE,
-                               value, index, data, size, 500);
+                               value, index, tmp, size, 500);
+
+        kfree(tmp);
+        return ret;
 }
 
 static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
@@ -490,37 +514,31 @@ int usb_ocp_write(struct r8152 *tp, u16 index, u16 byteen, u16 size, void *data)
 
 static u32 ocp_read_dword(struct r8152 *tp, u16 type, u16 index)
 {
-        u32 data;
+        __le32 data;
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(data), &data);
-        else
-                usb_ocp_read(tp, index, sizeof(data), &data);
+        generic_ocp_read(tp, index, sizeof(data), &data, type);
 
         return __le32_to_cpu(data);
 }
 
 static void ocp_write_dword(struct r8152 *tp, u16 type, u16 index, u32 data)
 {
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_write(tp, index, BYTE_EN_DWORD, sizeof(data), &data);
-        else
-                usb_ocp_write(tp, index, BYTE_EN_DWORD, sizeof(data), &data);
+        __le32 tmp = __cpu_to_le32(data);
+
+        generic_ocp_write(tp, index, BYTE_EN_DWORD, sizeof(tmp), &tmp, type);
 }
 
 static u16 ocp_read_word(struct r8152 *tp, u16 type, u16 index)
 {
         u32 data;
+        __le32 tmp;
         u8 shift = index & 2;
 
         index &= ~3;
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(data), &data);
-        else
-                usb_ocp_read(tp, index, sizeof(data), &data);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        data = __le32_to_cpu(data);
+        data = __le32_to_cpu(tmp);
         data >>= (shift * 8);
         data &= 0xffff;
 
@@ -529,7 +547,8 @@ static u16 ocp_read_word(struct r8152 *tp, u16 type, u16 index)
 
 static void ocp_write_word(struct r8152 *tp, u16 type, u16 index, u32 data)
 {
-        u32 tmp, mask = 0xffff;
+        u32 mask = 0xffff;
+        __le32 tmp;
         u16 byen = BYTE_EN_WORD;
         u8 shift = index & 2;
 
@@ -542,34 +561,25 @@ static void ocp_write_word(struct r8152 *tp, u16 type, u16 index, u32 data)
                 index &= ~3;
         }
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(tmp), &tmp);
-        else
-                usb_ocp_read(tp, index, sizeof(tmp), &tmp);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        tmp = __le32_to_cpu(tmp) & ~mask;
-        tmp |= data;
-        tmp = __cpu_to_le32(tmp);
+        data |= __le32_to_cpu(tmp) & ~mask;
+        tmp = __cpu_to_le32(data);
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
-        else
-                usb_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
+        generic_ocp_write(tp, index, byen, sizeof(tmp), &tmp, type);
 }
 
 static u8 ocp_read_byte(struct r8152 *tp, u16 type, u16 index)
 {
         u32 data;
+        __le32 tmp;
         u8 shift = index & 3;
 
         index &= ~3;
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(data), &data);
-        else
-                usb_ocp_read(tp, index, sizeof(data), &data);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        data = __le32_to_cpu(data);
+        data = __le32_to_cpu(tmp);
         data >>= (shift * 8);
         data &= 0xff;
 
@@ -578,7 +588,8 @@ static u8 ocp_read_byte(struct r8152 *tp, u16 type, u16 index)
 
 static void ocp_write_byte(struct r8152 *tp, u16 type, u16 index, u32 data)
 {
-        u32 tmp, mask = 0xff;
+        u32 mask = 0xff;
+        __le32 tmp;
         u16 byen = BYTE_EN_BYTE;
         u8 shift = index & 3;
 
@@ -591,19 +602,12 @@ static void ocp_write_byte(struct r8152 *tp, u16 type, u16 index, u32 data)
                 index &= ~3;
         }
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_read(tp, index, sizeof(tmp), &tmp);
-        else
-                usb_ocp_read(tp, index, sizeof(tmp), &tmp);
+        generic_ocp_read(tp, index, sizeof(tmp), &tmp, type);
 
-        tmp = __le32_to_cpu(tmp) & ~mask;
-        tmp |= data;
-        tmp = __cpu_to_le32(tmp);
+        data |= __le32_to_cpu(tmp) & ~mask;
+        tmp = __cpu_to_le32(data);
 
-        if (type == MCU_TYPE_PLA)
-                pla_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
-        else
-                usb_ocp_write(tp, index, byen, sizeof(tmp), &tmp);
+        generic_ocp_write(tp, index, byen, sizeof(tmp), &tmp, type);
 }
 
 static void r8152_mdio_write(struct r8152 *tp, u32 reg_addr, u32 value)
@@ -685,21 +689,14 @@ static void ocp_reg_write(struct r8152 *tp, u16 addr, u16 data)
 static inline void set_ethernet_addr(struct r8152 *tp)
 {
         struct net_device *dev = tp->netdev;
-        u8 *node_id;
-
-        node_id = kmalloc(sizeof(u8) * 8, GFP_KERNEL);
-        if (!node_id) {
-                netif_err(tp, probe, dev, "out of memory");
-                return;
-        }
+        u8 node_id[8] = {0};
 
-        if (pla_ocp_read(tp, PLA_IDR, sizeof(u8) * 8, node_id) < 0)
+        if (pla_ocp_read(tp, PLA_IDR, sizeof(node_id), node_id) < 0)
                 netif_notice(tp, probe, dev, "inet addr fail\n");
         else {
                 memcpy(dev->dev_addr, node_id, dev->addr_len);
                 memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
         }
-        kfree(node_id);
 }
 
 static int rtl8152_set_mac_address(struct net_device *netdev, void *p)
@@ -882,15 +879,10 @@ static void rtl8152_set_rx_mode(struct net_device *netdev)
 static void _rtl8152_set_rx_mode(struct net_device *netdev)
 {
         struct r8152 *tp = netdev_priv(netdev);
-        u32 tmp, *mc_filter;    /* Multicast hash filter */
+        u32 mc_filter[2];       /* Multicast hash filter */
+        __le32 tmp[2];
         u32 ocp_data;
 
-        mc_filter = kmalloc(sizeof(u32) * 2, GFP_KERNEL);
-        if (!mc_filter) {
-                netif_err(tp, link, netdev, "out of memory");
-                return;
-        }
-
         clear_bit(RTL8152_SET_RX_MODE, &tp->flags);
         netif_stop_queue(netdev);
         ocp_data = ocp_read_dword(tp, MCU_TYPE_PLA, PLA_RCR);
@@ -918,14 +910,12 @@ static void _rtl8152_set_rx_mode(struct net_device *netdev)
                 }
         }
 
-        tmp = mc_filter[0];
-        mc_filter[0] = __cpu_to_le32(swab32(mc_filter[1]));
-        mc_filter[1] = __cpu_to_le32(swab32(tmp));
+        tmp[0] = __cpu_to_le32(swab32(mc_filter[1]));
+        tmp[1] = __cpu_to_le32(swab32(mc_filter[0]));
 
-        pla_ocp_write(tp, PLA_MAR, BYTE_EN_DWORD, sizeof(u32) * 2, mc_filter);
+        pla_ocp_write(tp, PLA_MAR, BYTE_EN_DWORD, sizeof(tmp), tmp);
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
         netif_wake_queue(netdev);
-        kfree(mc_filter);
 }
 
 static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
index 852392269718..2df2f4fb42a7 100644
--- a/drivers/net/usb/r815x.c
+++ b/drivers/net/usb/r815x.c
@@ -24,34 +24,43 @@
 
 static int pla_read_word(struct usb_device *udev, u16 index)
 {
-        int data, ret;
+        int ret;
         u8 shift = index & 2;
-        __le32 ocp_data;
+        __le32 *tmp;
+
+        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
 
         index &= ~3;
 
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                               RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
-                              500);
+                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
         if (ret < 0)
-                return ret;
+                goto out2;
 
-        data = __le32_to_cpu(ocp_data);
-        data >>= (shift * 8);
-        data &= 0xffff;
+        ret = __le32_to_cpu(*tmp);
+        ret >>= (shift * 8);
+        ret &= 0xffff;
 
-        return data;
+out2:
+        kfree(tmp);
+        return ret;
 }
 
 static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
 {
-        __le32 ocp_data;
+        __le32 *tmp;
         u32 mask = 0xffff;
         u16 byen = BYTE_EN_WORD;
         u8 shift = index & 2;
         int ret;
 
+        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
         data &= mask;
 
         if (shift) {
@@ -63,19 +72,20 @@ static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
 
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                               RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, &ocp_data, sizeof(ocp_data),
-                              500);
+                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
         if (ret < 0)
-                return ret;
+                goto out3;
 
-        data |= __le32_to_cpu(ocp_data) & ~mask;
-        ocp_data = __cpu_to_le32(data);
+        data |= __le32_to_cpu(*tmp) & ~mask;
+        *tmp = __cpu_to_le32(data);
 
         ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
                               RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-                              index, MCU_TYPE_PLA | byen, &ocp_data,
-                              sizeof(ocp_data), 500);
+                              index, MCU_TYPE_PLA | byen, tmp, sizeof(*tmp),
+                              500);
 
+out3:
+        kfree(tmp);
         return ret;
 }
 
@@ -116,11 +126,18 @@ out1:
 static int r815x_mdio_read(struct net_device *netdev, int phy_id, int reg)
 {
         struct usbnet *dev = netdev_priv(netdev);
+        int ret;
 
         if (phy_id != R815x_PHY_ID)
                 return -EINVAL;
 
-        return ocp_reg_read(dev, BASE_MII + reg * 2);
+        if (usb_autopm_get_interface(dev->intf) < 0)
+                return -ENODEV;
+
+        ret = ocp_reg_read(dev, BASE_MII + reg * 2);
+
+        usb_autopm_put_interface(dev->intf);
+        return ret;
 }
 
 static
@@ -131,7 +148,12 @@ void r815x_mdio_write(struct net_device *netdev, int phy_id, int reg, int val)
         if (phy_id != R815x_PHY_ID)
                 return;
 
+        if (usb_autopm_get_interface(dev->intf) < 0)
+                return;
+
         ocp_reg_write(dev, BASE_MII + reg * 2, val);
+
+        usb_autopm_put_interface(dev->intf);
 }
 
 static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
@@ -150,7 +172,7 @@ static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.phy_id = R815x_PHY_ID;
         dev->mii.supports_gmii = 1;
 
-        return 0;
+        return status;
 }
 
 static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
@@ -169,7 +191,7 @@ static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->mii.phy_id = R815x_PHY_ID;
         dev->mii.supports_gmii = 0;
 
-        return 0;
+        return status;
 }
 
 static const struct driver_info r8152_info = {
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 75409748c774..66ebbacf066f 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -45,7 +45,6 @@
 #define EEPROM_MAC_OFFSET               (0x01)
 #define DEFAULT_TX_CSUM_ENABLE          (true)
 #define DEFAULT_RX_CSUM_ENABLE          (true)
-#define DEFAULT_TSO_ENABLE              (true)
 #define SMSC75XX_INTERNAL_PHY_ID        (1)
 #define SMSC75XX_TX_OVERHEAD            (8)
 #define MAX_RX_FIFO_SIZE                (20 * 1024)
@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
 
-        if (DEFAULT_TX_CSUM_ENABLE) {
+        if (DEFAULT_TX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                if (DEFAULT_TSO_ENABLE)
-                        dev->net->features |= NETIF_F_SG |
-                                NETIF_F_TSO | NETIF_F_TSO6;
-        }
+
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
         dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
+                                NETIF_F_RXCSUM;
 
         ret = smsc75xx_wait_ready(dev, 0);
         if (ret < 0) {
@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        skb_linearize(skb);
-
         if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
                 struct sk_buff *skb2 =
                         skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index da866523cf20..eee1f19ef1e9 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -269,6 +269,7 @@ static void veth_setup(struct net_device *dev)
         dev->ethtool_ops = &veth_ethtool_ops;
         dev->features |= NETIF_F_LLTX;
         dev->features |= VETH_FEATURES;
+        dev->vlan_features = dev->features;
         dev->destructor = veth_dev_free;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index a5ba8dd7e6be..f4c6db419ddb 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -136,7 +136,8 @@ struct vxlan_dev {
         u32               flags;        /* VXLAN_F_* below */
 
         struct work_struct sock_work;
-        struct work_struct igmp_work;
+        struct work_struct igmp_join;
+        struct work_struct igmp_leave;
 
         unsigned long     age_interval;
         struct timer_list age_timer;
@@ -736,7 +737,6 @@ static bool vxlan_snoop(struct net_device *dev,
         return false;
 }
 
-
 /* See if multicast group is already in use by other ID */
 static bool vxlan_group_used(struct vxlan_net *vn, __be32 remote_ip)
 {
@@ -770,12 +770,13 @@ static void vxlan_sock_release(struct vxlan_net *vn, struct vxlan_sock *vs)
         queue_work(vxlan_wq, &vs->del_work);
 }
 
-/* Callback to update multicast group membership.
- * Scheduled when vxlan goes up/down.
+/* Callback to update multicast group membership when first VNI on
+ * multicast asddress is brought up
+ * Done as workqueue because ip_mc_join_group acquires RTNL.
  */
-static void vxlan_igmp_work(struct work_struct *work)
+static void vxlan_igmp_join(struct work_struct *work)
 {
-        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_work);
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_join);
         struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
         struct vxlan_sock *vs = vxlan->vn_sock;
         struct sock *sk = vs->sock->sk;
@@ -785,10 +786,27 @@ static void vxlan_igmp_work(struct work_struct *work)
         };
 
         lock_sock(sk);
-        if (vxlan_group_used(vn, vxlan->default_dst.remote_ip))
-                ip_mc_join_group(sk, &mreq);
-        else
-                ip_mc_leave_group(sk, &mreq);
+        ip_mc_join_group(sk, &mreq);
+        release_sock(sk);
+
+        vxlan_sock_release(vn, vs);
+        dev_put(vxlan->dev);
+}
+
+/* Inverse of vxlan_igmp_join when last VNI is brought down */
+static void vxlan_igmp_leave(struct work_struct *work)
+{
+        struct vxlan_dev *vxlan = container_of(work, struct vxlan_dev, igmp_leave);
+        struct vxlan_net *vn = net_generic(dev_net(vxlan->dev), vxlan_net_id);
+        struct vxlan_sock *vs = vxlan->vn_sock;
+        struct sock *sk = vs->sock->sk;
+        struct ip_mreqn mreq = {
+                .imr_multiaddr.s_addr   = vxlan->default_dst.remote_ip,
+                .imr_ifindex            = vxlan->default_dst.remote_ifindex,
+        };
+
+        lock_sock(sk);
+        ip_mc_leave_group(sk, &mreq);
         release_sock(sk);
 
         vxlan_sock_release(vn, vs);
@@ -1359,6 +1377,7 @@ static void vxlan_uninit(struct net_device *dev)
 /* Start ageing timer and join group when device is brought up */
 static int vxlan_open(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_sock *vs = vxlan->vn_sock;
 
@@ -1366,10 +1385,11 @@ static int vxlan_open(struct net_device *dev)
         if (!vs)
                 return -ENOTCONN;
 
-        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_join);
         }
 
         if (vxlan->age_interval)
@@ -1400,13 +1420,15 @@ static void vxlan_flush(struct vxlan_dev *vxlan)
 /* Cleanup timer and forwarding table on shutdown */
 static int vxlan_stop(struct net_device *dev)
 {
+        struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_sock *vs = vxlan->vn_sock;
 
-        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip))) {
+        if (vs && IN_MULTICAST(ntohl(vxlan->default_dst.remote_ip)) &&
+            ! vxlan_group_used(vn, vxlan->default_dst.remote_ip)) {
                 vxlan_sock_hold(vs);
                 dev_hold(dev);
-                queue_work(vxlan_wq, &vxlan->igmp_work);
+                queue_work(vxlan_wq, &vxlan->igmp_leave);
         }
 
         del_timer_sync(&vxlan->age_timer);
@@ -1471,7 +1493,8 @@ static void vxlan_setup(struct net_device *dev)
 
         INIT_LIST_HEAD(&vxlan->next);
         spin_lock_init(&vxlan->hash_lock);
-        INIT_WORK(&vxlan->igmp_work, vxlan_igmp_work);
+        INIT_WORK(&vxlan->igmp_join, vxlan_igmp_join);
+        INIT_WORK(&vxlan->igmp_leave, vxlan_igmp_leave);
         INIT_WORK(&vxlan->sock_work, vxlan_sock_work);
 
         init_timer_deferrable(&vxlan->age_timer);
@@ -1878,10 +1901,12 @@ static __net_exit void vxlan_exit_net(struct net *net)
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_dev *vxlan;
+        LIST_HEAD(list);
 
         rtnl_lock();
         list_for_each_entry(vxlan, &vn->vxlan_list, next)
-                dev_close(vxlan->dev);
+                unregister_netdevice_queue(vxlan->dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig
index cde58fe96254..82e8088ca9b4 100644
--- a/drivers/net/wireless/ath/ath10k/Kconfig
+++ b/drivers/net/wireless/ath/ath10k/Kconfig
@@ -1,6 +1,6 @@
 config ATH10K
         tristate "Atheros 802.11ac wireless cards support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
         select ATH_COMMON
         ---help---
           This module adds support for wireless adapters based on
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 81b686c6a376..40825d43322e 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -325,7 +325,7 @@ ath5k_prepare_multicast(struct ieee80211_hw *hw,
         struct netdev_hw_addr *ha;
 
         mfilt[0] = 0;
-        mfilt[1] = 1;
+        mfilt[1] = 0;
 
         netdev_hw_addr_list_for_each(ha, mc_list) {
                 /* calculate XOR of eight 6-bit values */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index d1acfe98918a..1576d58291d4 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -610,7 +610,15 @@ static void ar5008_hw_override_ini(struct ath_hw *ah,
         REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 
         if (AR_SREV_9280_20_OR_LATER(ah)) {
-                val = REG_READ(ah, AR_PCU_MISC_MODE2);
+                /*
+                 * For AR9280 and above, there is a new feature that allows
+                 * Multicast search based on both MAC Address and Key ID.
+                 * By default, this feature is enabled. But since the driver
+                 * is not using this feature, we switch it off; otherwise
+                 * multicast search based on MAC addr only will fail.
+                 */
+                val = REG_READ(ah, AR_PCU_MISC_MODE2) &
+                        (~AR_ADHOC_MCAST_KEYID_ENABLE);
 
                 if (!AR_SREV_9271(ah))
                         val &= ~AR_PCU_MISC_MODE2_HWWAR1;
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 9e582e14da74..5205a3625e84 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1082,7 +1082,7 @@ static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
         struct device *dev = &hif_dev->udev->dev;
         struct device *parent = dev->parent;
 
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
 
         if (parent)
                 device_lock(parent);
@@ -1131,7 +1131,7 @@ static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context)
 
         release_firmware(fw);
         hif_dev->flags |= HIF_USB_READY;
-        complete(&hif_dev->fw_done);
+        complete_all(&hif_dev->fw_done);
 
         return;
 
@@ -1295,7 +1295,9 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
 
         usb_set_intfdata(interface, NULL);
 
-        if (!unplugged && (hif_dev->flags & HIF_USB_START))
+        /* If firmware was loaded we should drop it
+         * go back to first stage bootloader. */
+        if (!unplugged && (hif_dev->flags & HIF_USB_READY))
                 ath9k_hif_usb_reboot(udev);
 
         kfree(hif_dev);
@@ -1316,7 +1318,10 @@ static int ath9k_hif_usb_suspend(struct usb_interface *interface,
         if (!(hif_dev->flags & HIF_USB_START))
                 ath9k_htc_suspend(hif_dev->htc_handle);
 
-        ath9k_hif_usb_dealloc_urbs(hif_dev);
+        wait_for_completion(&hif_dev->fw_done);
+
+        if (hif_dev->flags & HIF_USB_READY)
+                ath9k_hif_usb_dealloc_urbs(hif_dev);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 71a183ffc77f..c3676bf1d6c4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -861,6 +861,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
         if (error != 0)
                 goto err_rx;
 
+        ath9k_hw_disable(priv->ah);
 #ifdef CONFIG_MAC80211_LEDS
         /* must be initialized before ieee80211_register_hw */
         priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index c59ae43b9b35..927992732620 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -146,6 +146,28 @@ static void ath_set_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                                ARRAY_SIZE(bf->rates));
 }
 
+static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
+                             struct sk_buff *skb)
+{
+        int q;
+
+        q = skb_get_queue_mapping(skb);
+        if (txq == sc->tx.uapsdq)
+                txq = sc->tx.txq_map[q];
+
+        if (txq != sc->tx.txq_map[q])
+                return;
+
+        if (WARN_ON(--txq->pending_frames < 0))
+                txq->pending_frames = 0;
+
+        if (txq->stopped &&
+            txq->pending_frames < sc->tx.txq_max_pending[q]) {
+                ieee80211_wake_queue(sc->hw, q);
+                txq->stopped = false;
+        }
+}
+
 static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
         struct ath_txq *txq = tid->ac->txq;
@@ -167,6 +189,7 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
                 if (!bf) {
                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
                         if (!bf) {
+                                ath_txq_skb_done(sc, txq, skb);
                                 ieee80211_free_txskb(sc->hw, skb);
                                 continue;
                         }
@@ -811,6 +834,7 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 if (!bf) {
                         __skb_unlink(skb, &tid->buf_q);
+                        ath_txq_skb_done(sc, txq, skb);
                         ieee80211_free_txskb(sc->hw, skb);
                         continue;
                 }
@@ -1824,6 +1848,7 @@ static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
         if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                 ieee80211_free_txskb(sc->hw, skb);
                 return;
         }
@@ -2090,6 +2115,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
         if (!bf) {
+                ath_txq_skb_done(sc, txq, skb);
                 if (txctl->paprd)
                         dev_kfree_skb_any(skb);
                 else
@@ -2189,7 +2215,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
-        int q, padpos, padsize;
+        int padpos, padsize;
         unsigned long flags;
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
@@ -2225,21 +2251,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
         __skb_queue_tail(&txq->complete_q, skb);
-
-        q = skb_get_queue_mapping(skb);
-        if (txq == sc->tx.uapsdq)
-                txq = sc->tx.txq_map[q];
-
-        if (txq == sc->tx.txq_map[q]) {
-                if (WARN_ON(--txq->pending_frames < 0))
-                        txq->pending_frames = 0;
-
-                if (txq->stopped &&
-                    txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                        ieee80211_wake_queue(sc->hw, q);
-                        txq->stopped = false;
-                }
-        }
+        ath_txq_skb_done(sc, txq, skb);
 }
 
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index e8308ec30970..ab636767fbde 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -145,7 +145,7 @@ static void wil_print_ring(struct seq_file *s, const char *prefix,
                                    le16_to_cpu(hdr.type), hdr.flags);
                         if (len <= MAX_MBOXITEM_SIZE) {
                                 int n = 0;
-                                unsigned char printbuf[16 * 3 + 2];
+                                char printbuf[16 * 3 + 2];
                                 unsigned char databuf[MAX_MBOXITEM_SIZE];
                                 void __iomem *src = wmi_buffer(wil, d.addr) +
                                         sizeof(struct wil6210_mbox_hdr);
@@ -416,7 +416,7 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                 seq_printf(s, "  SKB = %p\n", skb);
 
                 if (skb) {
-                        unsigned char printbuf[16 * 3 + 2];
+                        char printbuf[16 * 3 + 2];
                         int i = 0;
                         int len = le16_to_cpu(d->dma.length);
                         void *p = skb->data;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 8e8975562ec3..80099016d21f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -242,7 +242,7 @@ void brcmf_txflowblock_if(struct brcmf_if *ifp,
 {
         unsigned long flags;
 
-        if (!ifp)
+        if (!ifp || !ifp->ndev)
                 return;
 
         brcmf_dbg(TRACE, "enter: idx=%d stop=0x%X reason=%d state=%d\n",
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index f0d9f7f6c83d..29b1f24c2d0f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -1744,13 +1744,14 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         ulong flags;
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
+        bool pae = eh->h_proto == htons(ETH_P_PAE);
 
         /* determine the priority */
         if (!skb->priority)
                 skb->priority = cfg80211_classify8021d(skb);
 
         drvr->tx_multicast += !!multicast;
-        if (ntohs(eh->h_proto) == ETH_P_PAE)
+        if (pae)
                 atomic_inc(&ifp->pend_8021x_cnt);
 
         if (!brcmf_fws_fc_active(fws)) {
@@ -1781,6 +1782,11 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 brcmf_fws_schedule_deq(fws);
         } else {
                 brcmf_err("drop skb: no hanger slot\n");
+                if (pae) {
+                        atomic_dec(&ifp->pend_8021x_cnt);
+                        if (waitqueue_active(&ifp->pend_8021x_wait))
+                                wake_up(&ifp->pend_8021x_wait);
+                }
                 brcmu_pkt_buf_free_skb(skb);
         }
         brcmf_fws_unlock(drvr, flags);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 277b37ae7126..7fa71f73cfe8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1093,8 +1093,11 @@ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
                 err = brcmf_fil_cmd_data_set(vif->ifp,
                                              BRCMF_C_DISASSOC, NULL, 0);
-                if (err)
+                if (err) {
                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
+                        cfg80211_disconnected(vif->wdev.netdev, 0,
+                                              NULL, 0, GFP_KERNEL);
+                }
                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
         }
         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index 5862c373d714..e824d4d4a18d 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -1165,7 +1165,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
                 if (cw1200_handle_action_rx(priv, skb))
                         return;
         } else if (ieee80211_is_beacon(frame->frame_control) &&
-                   !arg->status &&
+                   !arg->status && priv->vif &&
                    !memcmp(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid,
                            ETH_ALEN)) {
                 const u8 *tim_ie;
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 3952ddf2ddb2..1531a4fc0960 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -758,7 +758,7 @@ int iwl_alive_start(struct iwl_priv *priv)
                                          BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
                 if (ret)
                         return ret;
-        } else {
+        } else if (priv->lib->bt_params) {
                 /*
                  * default is 2-wire BT coexexistence support
                  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index ff8cc75c189d..a70c7b9d9bad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -97,6 +97,8 @@
 
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS          (0x00000800)
 
+#define APMG_RTC_INT_STT_RFKILL         (0x10000000)
+
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 7e5e5c2f9f87..83da884cf303 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -134,7 +134,7 @@ struct wowlan_key_data {
         struct iwl_wowlan_rsc_tsc_params_cmd *rsc_tsc;
         struct iwl_wowlan_tkip_params_cmd *tkip;
         bool error, use_rsc_tsc, use_tkip;
-        int gtk_key_idx;
+        int wep_key_idx;
 };
 
 static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
@@ -188,8 +188,8 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                         wkc.wep_key.key_offset = 0;
                 } else {
                         /* others start at 1 */
-                        data->gtk_key_idx++;
-                        wkc.wep_key.key_offset = data->gtk_key_idx;
+                        data->wep_key_idx++;
+                        wkc.wep_key.key_offset = data->wep_key_idx;
                 }
 
                 ret = iwl_mvm_send_cmd_pdu(mvm, WEP_KEY, CMD_SYNC,
@@ -316,8 +316,13 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw,
                 mvm->ptk_ivlen = key->iv_len;
                 mvm->ptk_icvlen = key->icv_len;
         } else {
-                data->gtk_key_idx++;
-                key->hw_key_idx = data->gtk_key_idx;
+                /*
+                 * firmware only supports TSC/RSC for a single key,
+                 * so if there are multiple keep overwriting them
+                 * with new ones -- this relies on mac80211 doing
+                 * list_add_tail().
+                 */
+                key->hw_key_idx = 1;
                 mvm->gtk_ivlen = key->iv_len;
                 mvm->gtk_icvlen = key->icv_len;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e56ed2a84888..c24a744910ac 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -988,7 +988,11 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         char buf[100];
 
-        if (!dbgfs_dir)
+        /*
+         * Check if debugfs directory already exist before creating it.
+         * This may happen when, for example, resetting hw or suspend-resume
+         */
+        if (!dbgfs_dir || mvmvif->dbgfs_dir)
                 return;
 
         mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index b60d14151721..365095a0c3b3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -69,7 +69,6 @@
 /* Scan Commands, Responses, Notifications */
 
 /* Masks for iwl_scan_channel.type flags */
-#define SCAN_CHANNEL_TYPE_PASSIVE       0
 #define SCAN_CHANNEL_TYPE_ACTIVE        BIT(0)
 #define SCAN_CHANNEL_NARROW_BAND        BIT(22)
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e08683b20531..f19baf0dea6b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -257,7 +257,11 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (ret)
                 return ret;
 
-        return ieee80211_register_hw(mvm->hw);
+        ret = ieee80211_register_hw(mvm->hw);
+        if (ret)
+                iwl_mvm_leds_exit(mvm);
+
+        return ret;
 }
 
 static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
@@ -385,6 +389,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         ieee80211_wake_queues(mvm->hw);
 
         mvm->vif_count = 0;
+        mvm->rx_ba_sessions = 0;
 }
 
 static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
@@ -507,6 +512,27 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 goto out_unlock;
 
         /*
+         * TODO: remove this temporary code.
+         * Currently MVM FW supports power management only on single MAC.
+         * If new interface added, disable PM on existing interface.
+         * P2P device is a special case, since it is handled by FW similary to
+         * scan. If P2P deviced is added, PM remains enabled on existing
+         * interface.
+         * Note: the method below does not count the new interface being added
+         * at this moment.
+         */
+        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
+                mvm->vif_count++;
+        if (mvm->vif_count > 1) {
+                IWL_DEBUG_MAC80211(mvm,
+                                   "Disable power on existing interfaces\n");
+                ieee80211_iterate_active_interfaces_atomic(
+                                            mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_pm_disable_iterator, mvm);
+        }
+
+        /*
          * The AP binding flow can be done only after the beacon
          * template is configured (which happens only in the mac80211
          * start_ap() flow), and adding the broadcast station can happen
@@ -529,27 +555,6 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        /*
-         * TODO: remove this temporary code.
-         * Currently MVM FW supports power management only on single MAC.
-         * If new interface added, disable PM on existing interface.
-         * P2P device is a special case, since it is handled by FW similary to
-         * scan. If P2P deviced is added, PM remains enabled on existing
-         * interface.
-         * Note: the method below does not count the new interface being added
-         * at this moment.
-         */
-        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
-                mvm->vif_count++;
-        if (mvm->vif_count > 1) {
-                IWL_DEBUG_MAC80211(mvm,
-                                   "Disable power on existing interfaces\n");
-                ieee80211_iterate_active_interfaces_atomic(
-                                            mvm->hw,
-                                            IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_pm_disable_iterator, mvm);
-        }
-
         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
         if (ret)
                 goto out_release;
@@ -1006,6 +1011,21 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         mutex_lock(&mvm->mutex);
         if (old_state == IEEE80211_STA_NOTEXIST &&
             new_state == IEEE80211_STA_NONE) {
+                /*
+                 * Firmware bug - it'll crash if the beacon interval is less
+                 * than 16. We can't avoid connecting at all, so refuse the
+                 * station state change, this will cause mac80211 to abandon
+                 * attempts to connect to this AP, and eventually wpa_s will
+                 * blacklist the AP...
+                 */
+                if (vif->type == NL80211_IFTYPE_STATION &&
+                    vif->bss_conf.beacon_int < 16) {
+                        IWL_ERR(mvm,
+                                "AP %pM beacon interval is %d, refusing due to firmware bug!\n",
+                                sta->addr, vif->bss_conf.beacon_int);
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
                 ret = iwl_mvm_add_sta(mvm, vif, sta);
         } else if (old_state == IEEE80211_STA_NONE &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -1038,6 +1058,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
         } else {
                 ret = -EIO;
         }
+ out_unlock:
         mutex_unlock(&mvm->mutex);
 
         return ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d40d7db185d6..420e82d379d9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -419,6 +419,7 @@ struct iwl_mvm {
         struct work_struct sta_drained_wk;
         unsigned long sta_drained[BITS_TO_LONGS(IWL_MVM_STATION_COUNT)];
         atomic_t pending_frames[IWL_MVM_STATION_COUNT];
+        u8 rx_ba_sessions;
 
         /* configured by mac80211 */
         u32 rts_threshold;
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 2157b0f8ced5..acdff6b67e04 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -137,8 +137,8 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
 {
         int fw_idx, req_idx;
 
-        fw_idx = 0;
-        for (req_idx = req->n_ssids - 1; req_idx > 0; req_idx--) {
+        for (req_idx = req->n_ssids - 1, fw_idx = 0; req_idx > 0;
+             req_idx--, fw_idx++) {
                 cmd->direct_scan[fw_idx].id = WLAN_EID_SSID;
                 cmd->direct_scan[fw_idx].len = req->ssids[req_idx].ssid_len;
                 memcpy(cmd->direct_scan[fw_idx].ssid,
@@ -153,7 +153,9 @@ static void iwl_mvm_scan_fill_ssids(struct iwl_scan_cmd *cmd,
  * just to notify that this scan is active and not passive.
  * In order to notify the FW of the number of SSIDs we wish to scan (including
  * the zero-length one), we need to set the corresponding bits in chan->type,
- * one for each SSID, and set the active bit (first).
+ * one for each SSID, and set the active bit (first). The first SSID is already
+ * included in the probe template, so we need to set only req->n_ssids - 1 bits
+ * in addition to the first bit.
  */
 static u16 iwl_mvm_get_active_dwell(enum ieee80211_band band, int n_ssids)
 {
@@ -176,19 +178,12 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
         struct iwl_scan_channel *chan = (struct iwl_scan_channel *)
                 (cmd->data + le16_to_cpu(cmd->tx_cmd.len));
         int i;
-        __le32 chan_type_value;
-
-        if (req->n_ssids > 0)
-                chan_type_value = cpu_to_le32(BIT(req->n_ssids + 1) - 1);
-        else
-                chan_type_value = SCAN_CHANNEL_TYPE_PASSIVE;
 
         for (i = 0; i < cmd->channel_count; i++) {
                 chan->channel = cpu_to_le16(req->channels[i]->hw_value);
+                chan->type = cpu_to_le32(BIT(req->n_ssids) - 1);
                 if (req->channels[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        chan->type = SCAN_CHANNEL_TYPE_PASSIVE;
-                else
-                        chan->type = chan_type_value;
+                        chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
                 chan->active_dwell = cpu_to_le16(active_dwell);
                 chan->passive_dwell = cpu_to_le16(passive_dwell);
                 chan->iteration_count = cpu_to_le16(1);
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 62fe5209093b..563f559b902d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -608,6 +608,8 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *bsta)
         return ret;
 }
 
+#define IWL_MAX_RX_BA_SESSIONS 16
+
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
@@ -618,11 +620,20 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         lockdep_assert_held(&mvm->mutex);
 
+        if (start && mvm->rx_ba_sessions >= IWL_MAX_RX_BA_SESSIONS) {
+                IWL_WARN(mvm, "Not enough RX BA SESSIONS\n");
+                return -ENOSPC;
+        }
+
         cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
         cmd.sta_id = mvm_sta->sta_id;
         cmd.add_modify = STA_MODE_MODIFY;
-        cmd.add_immediate_ba_tid = (u8) tid;
-        cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        if (start) {
+                cmd.add_immediate_ba_tid = (u8) tid;
+                cmd.add_immediate_ba_ssn = cpu_to_le16(ssn);
+        } else {
+                cmd.remove_immediate_ba_tid = (u8) tid;
+        }
         cmd.modify_mask = start ? STA_MODIFY_ADD_BA_TID :
                                   STA_MODIFY_REMOVE_BA_TID;
 
@@ -648,6 +659,14 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 break;
         }
 
+        if (!ret) {
+                if (start)
+                        mvm->rx_ba_sessions++;
+                else if (mvm->rx_ba_sessions > 0)
+                        /* check that restart flow didn't zero the counter */
+                        mvm->rx_ba_sessions--;
+        }
+
         return ret;
 }
 
@@ -896,6 +915,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         u16 txq_id;
+        enum iwl_mvm_agg_state old_state;
 
         /*
          * First set the agg state to OFF to avoid calling
@@ -905,13 +925,17 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         txq_id = tid_data->txq_id;
         IWL_DEBUG_TX_QUEUES(mvm, "Flush AGG: sta %d tid %d q %d state %d\n",
                             mvmsta->sta_id, tid, txq_id, tid_data->state);
+        old_state = tid_data->state;
         tid_data->state = IWL_AGG_OFF;
         spin_unlock_bh(&mvmsta->lock);
 
-        if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
-                IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+        if (old_state >= IWL_AGG_ON) {
+                if (iwl_mvm_flush_tx_path(mvm, BIT(txq_id), true))
+                        IWL_ERR(mvm, "Couldn't flush the AGG queue\n");
+
+                iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
+        }
 
-        iwl_trans_txq_disable(mvm->trans, tid_data->txq_id);
         mvm->queue_to_mac80211[tid_data->txq_id] =
                                 IWL_INVALID_MAC80211_QUEUE;
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 81f3ea5b09a4..ff13458efc27 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -130,6 +130,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
         {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
         {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
+        {IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */
 
         {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
         {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index fd848cd1583e..f600e68a410a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -888,6 +888,14 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
                 if (hw_rfkill) {
+                        /*
+                         * Clear the interrupt in APMG if the NIC is going down.
+                         * Note that when the NIC exits RFkill (else branch), we
+                         * can't access prph and the NIC will be reset in
+                         * start_hw anyway.
+                         */
+                        iwl_write_prph(trans, APMG_RTC_INT_STT_REG,
+                                       APMG_RTC_INT_STT_RFKILL);
                         set_bit(STATUS_RFKILL, &trans_pcie->status);
                         if (test_and_clear_bit(STATUS_HCMD_ACTIVE,
                                                &trans_pcie->status))
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 826c15602c46..96cfcdd39079 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -670,6 +670,11 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
                 return err;
         }
 
+        /* Reset the entire device */
+        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+
+        usleep_range(10, 15);
+
         iwl_pcie_apm_init(trans);
 
         /* From now on, the op_mode will be kept updated about RF kill state */
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ef5fa890a286..89459db4c53b 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1716,9 +1716,9 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         int ret;
 
-        if (priv->bss_mode != NL80211_IFTYPE_STATION) {
+        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
                 wiphy_err(wiphy,
-                          "%s: reject infra assoc request in non-STA mode\n",
+                          "%s: reject infra assoc request in non-STA role\n",
                           dev->name);
                 return -EINVAL;
         }
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index 988552dece75..5178c4630d89 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -415,7 +415,8 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
         u32 k = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
 
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                 switch (adapter->config_bands) {
                 case BAND_B:
                         dev_dbg(adapter->dev, "info: infra band=%d "
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index caaf4bd56b30..2cf8b964e966 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -693,7 +693,7 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
                 if (!ret) {
                         dev_notice(adapter->dev,
                                    "WLAN FW already running! Skip FW dnld\n");
-                        goto done;
+                        return 0;
                 }
 
                 poll_num = MAX_FIRMWARE_POLL_TRIES;
@@ -719,14 +719,8 @@ int mwifiex_dnld_fw(struct mwifiex_adapter *adapter,
 poll_fw:
         /* Check if the firmware is downloaded successfully or not */
         ret = adapter->if_ops.check_fw_status(adapter, poll_num);
-        if (ret) {
+        if (ret)
                 dev_err(adapter->dev, "FW failed to be active in time\n");
-                return -1;
-        }
-done:
-        /* re-enable host interrupt for mwifiex after fw dnld is successful */
-        if (adapter->if_ops.enable_int)
-                adapter->if_ops.enable_int(adapter);
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 1c8a771e8e81..12e778159ec5 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1291,8 +1291,10 @@ int mwifiex_associate(struct mwifiex_private *priv,
 {
         u8 current_bssid[ETH_ALEN];
 
-        /* Return error if the adapter or table entry is not marked as infra */
-        if ((priv->bss_mode != NL80211_IFTYPE_STATION) ||
+        /* Return error if the adapter is not STA role or table entry
+         * is not marked as infra.
+         */
+        if ((GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) ||
             (bss_desc->bss_mode != NL80211_IFTYPE_STATION))
                 return -1;
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index e15ab72fb03d..1753431de361 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -427,6 +427,10 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                                 "Cal data request_firmware() failed\n");
         }
 
+        /* enable host interrupt after fw dnld is successful */
+        if (adapter->if_ops.enable_int)
+                adapter->if_ops.enable_int(adapter);
+
         adapter->init_wait_q_woken = false;
         ret = mwifiex_init_fw(adapter);
         if (ret == -1) {
@@ -478,6 +482,8 @@ err_add_intf:
         mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
         rtnl_unlock();
 err_init_fw:
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
         pr_debug("info: %s: unregister device\n", __func__);
         adapter->if_ops.unregister_dev(adapter);
 done:
@@ -855,7 +861,7 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         INIT_WORK(&adapter->main_work, mwifiex_main_work_queue);
 
         /* Register the device. Fill up the private data structure with relevant
-           information from the card and request for the required IRQ. */
+           information from the card. */
         if (adapter->if_ops.register_dev(adapter)) {
                 pr_err("%s: failed to register mwifiex device\n", __func__);
                 goto err_registerdev;
@@ -919,6 +925,11 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         if (!adapter)
                 goto exit_remove;
 
+        /* We can no longer handle interrupts once we start doing the teardown
+         * below. */
+        if (adapter->if_ops.disable_int)
+                adapter->if_ops.disable_int(adapter);
+
         adapter->surprise_removed = true;
 
         /* Stop data */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 3da73d36acdf..253e0bd38e25 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -601,6 +601,7 @@ struct mwifiex_if_ops {
         int (*register_dev) (struct mwifiex_adapter *);
         void (*unregister_dev) (struct mwifiex_adapter *);
         int (*enable_int) (struct mwifiex_adapter *);
+        void (*disable_int) (struct mwifiex_adapter *);
         int (*process_int_status) (struct mwifiex_adapter *);
         int (*host_to_card) (struct mwifiex_adapter *, u8, struct sk_buff *,
                              struct mwifiex_tx_param *);
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 5ee5ed02eccd..09185c963248 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -51,6 +51,7 @@ static struct mwifiex_if_ops sdio_ops;
 static struct semaphore add_remove_card_sem;
 
 static int mwifiex_sdio_resume(struct device *dev);
+static void mwifiex_sdio_interrupt(struct sdio_func *func);
 
 /*
  * SDIO probe.
@@ -296,6 +297,15 @@ static struct sdio_driver mwifiex_sdio = {
         }
 };
 
+/* Write data into SDIO card register. Caller claims SDIO device. */
+static int
+mwifiex_write_reg_locked(struct sdio_func *func, u32 reg, u8 data)
+{
+        int ret = -1;
+        sdio_writeb(func, data, reg, &ret);
+        return ret;
+}
+
 /*
  * This function writes data into SDIO card register.
  */
@@ -303,10 +313,10 @@ static int
 mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u8 data)
 {
         struct sdio_mmc_card *card = adapter->card;
-        int ret = -1;
+        int ret;
 
         sdio_claim_host(card->func);
-        sdio_writeb(card->func, data, reg, &ret);
+        ret = mwifiex_write_reg_locked(card->func, reg, data);
         sdio_release_host(card->func);
 
         return ret;
@@ -685,23 +695,15 @@ mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat)
  * The host interrupt mask is read, the disable bit is reset and
  * written back to the card host interrupt mask register.
  */
-static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
+static void mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 {
-        u8 host_int_mask, host_int_disable = HOST_INT_DISABLE;
-
-        /* Read back the host_int_mask register */
-        if (mwifiex_read_reg(adapter, HOST_INT_MASK_REG, &host_int_mask))
-                return -1;
-
-        /* Update with the mask and write back to the register */
-        host_int_mask &= ~host_int_disable;
-
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG, host_int_mask)) {
-                dev_err(adapter->dev, "disable host interrupt failed\n");
-                return -1;
-        }
+        struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
 
-        return 0;
+        sdio_claim_host(func);
+        mwifiex_write_reg_locked(func, HOST_INT_MASK_REG, 0);
+        sdio_release_irq(func);
+        sdio_release_host(func);
 }
 
 /*
@@ -713,14 +715,29 @@ static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 static int mwifiex_sdio_enable_host_int(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
+        struct sdio_func *func = card->func;
+        int ret;
+
+        sdio_claim_host(func);
+
+        /* Request the SDIO IRQ */
+        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
+        if (ret) {
+                dev_err(adapter->dev, "claim irq failed: ret=%d\n", ret);
+                goto out;
+        }
 
         /* Simply write the mask to the register */
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG,
-                              card->reg->host_int_enable)) {
+        ret = mwifiex_write_reg_locked(func, HOST_INT_MASK_REG,
+                                       card->reg->host_int_enable);
+        if (ret) {
                 dev_err(adapter->dev, "enable host interrupt failed\n");
-                return -1;
+                sdio_release_irq(func);
         }
-        return 0;
+
+out:
+        sdio_release_host(func);
+        return ret;
 }
 
 /*
@@ -997,9 +1014,6 @@ mwifiex_sdio_interrupt(struct sdio_func *func)
         }
         adapter = card->adapter;
 
-        if (adapter->surprise_removed)
-                return;
-
         if (!adapter->pps_uapsd_mode && adapter->ps_state == PS_STATE_SLEEP)
                 adapter->ps_state = PS_STATE_AWAKE;
 
@@ -1625,8 +1639,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
         /* Allocate buffer and copy payload */
         blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
         buf_block_len = (pkt_len + blk_size - 1) / blk_size;
-        *(u16 *) &payload[0] = (u16) pkt_len;
-        *(u16 *) &payload[2] = type;
+        *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
+        *(__le16 *)&payload[2] = cpu_to_le16(type);
 
         /*
          * This is SDIO specific header
@@ -1728,9 +1742,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
         struct sdio_mmc_card *card = adapter->card;
 
         if (adapter->card) {
-                /* Release the SDIO IRQ */
                 sdio_claim_host(card->func);
-                sdio_release_irq(card->func);
                 sdio_disable_func(card->func);
                 sdio_release_host(card->func);
                 sdio_set_drvdata(card->func, NULL);
@@ -1744,7 +1756,7 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 {
-        int ret = 0;
+        int ret;
         struct sdio_mmc_card *card = adapter->card;
         struct sdio_func *func = card->func;
 
@@ -1753,22 +1765,14 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         sdio_claim_host(func);
 
-        /* Request the SDIO IRQ */
-        ret = sdio_claim_irq(func, mwifiex_sdio_interrupt);
-        if (ret) {
-                pr_err("claim irq failed: ret=%d\n", ret);
-                goto disable_func;
-        }
-
         /* Set block size */
         ret = sdio_set_block_size(card->func, MWIFIEX_SDIO_BLOCK_SIZE);
+        sdio_release_host(func);
         if (ret) {
                 pr_err("cannot set SDIO block size\n");
-                ret = -1;
-                goto release_irq;
+                return ret;
         }
 
-        sdio_release_host(func);
         sdio_set_drvdata(func, card);
 
         adapter->dev = &func->dev;
@@ -1776,15 +1780,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         strcpy(adapter->fw_name, card->firmware);
 
         return 0;
-
-release_irq:
-        sdio_release_irq(func);
-disable_func:
-        sdio_disable_func(func);
-        sdio_release_host(func);
-        adapter->card = NULL;
-
-        return -1;
 }
 
 /*
@@ -1813,9 +1808,6 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
          */
         mwifiex_read_reg(adapter, HOST_INTSTATUS_REG, &sdio_ireg);
 
-        /* Disable host interrupt mask register for SDIO */
-        mwifiex_sdio_disable_host_int(adapter);
-
         /* Get SDIO ioport */
         mwifiex_init_sdio_ioport(adapter);
 
@@ -1957,6 +1949,7 @@ static struct mwifiex_if_ops sdio_ops = {
         .register_dev = mwifiex_register_dev,
         .unregister_dev = mwifiex_unregister_dev,
         .enable_int = mwifiex_sdio_enable_host_int,
+        .disable_int = mwifiex_sdio_disable_host_int,
         .process_int_status = mwifiex_process_int_status,
         .host_to_card = mwifiex_sdio_host_to_card,
         .wakeup = mwifiex_pm_wakeup_card,
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 6d51dfdd8251..532ae0ac4dfb 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -92,9 +92,6 @@
 /* Host Control Registers : Download host interrupt mask */
 #define DN_LD_HOST_INT_MASK             (0x2U)
 
-/* Disable Host interrupt mask */
-#define HOST_INT_DISABLE                0xff
-
 /* Host Control Registers : Host interrupt status */
 #define HOST_INTSTATUS_REG              0x03
 /* Host Control Registers : Upload host interrupt status */
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 206c3e038072..8af97abf7108 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -257,10 +257,10 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                         goto done;
         }
 
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                 u8 config_bands;
 
-                /* Infra mode */
                 ret = mwifiex_deauthenticate(priv, NULL);
                 if (ret)
                         goto done;
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 9b915d3a44be..3e60a31582f8 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -1,6 +1,6 @@
 menuconfig RT2X00
         tristate "Ralink driver support"
-        depends on MAC80211
+        depends on MAC80211 && HAS_DMA
         ---help---
           This will enable the support for the Ralink drivers,
           developed in the rt2x00 project <http://rt2x00.serialmonkey.com>.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 6c0a91ff963c..aa95c6cf3545 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -936,13 +936,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
         spin_unlock_irqrestore(&queue->index_lock, irqflags);
 }
 
-void rt2x00queue_pause_queue(struct data_queue *queue)
+void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
 {
-        if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
-            !test_bit(QUEUE_STARTED, &queue->flags) ||
-            test_and_set_bit(QUEUE_PAUSED, &queue->flags))
-                return;
-
         switch (queue->qid) {
         case QID_AC_VO:
         case QID_AC_VI:
@@ -958,6 +953,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
                 break;
         }
 }
+void rt2x00queue_pause_queue(struct data_queue *queue)
+{
+        if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+            !test_bit(QUEUE_STARTED, &queue->flags) ||
+            test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+                return;
+
+        rt2x00queue_pause_queue_nocheck(queue);
+}
 EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
 
 void rt2x00queue_unpause_queue(struct data_queue *queue)
@@ -1019,7 +1023,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
                 return;
         }
 
-        rt2x00queue_pause_queue(queue);
+        rt2x00queue_pause_queue_nocheck(queue);
 
         queue->rt2x00dev->ops->lib->stop_queue(queue);
 
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 7253de3d8c66..c2ffce7a907c 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -1,27 +1,20 @@
-config RTLWIFI
-        tristate "Realtek wireless card support"
-        depends on MAC80211
-        select FW_LOADER
-        ---help---
-          This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
-          drivers.  This module does nothing by itself - the various front-end
-          drivers need to be enabled to support any desired devices.
-
-          If you choose to build as a module, it'll be called rtlwifi.
-
-config RTLWIFI_DEBUG
-        bool "Debugging output for rtlwifi driver family"
-        depends on RTLWIFI
+menuconfig RTL_CARDS
+        tristate "Realtek rtlwifi family of devices"
+        depends on MAC80211 && (PCI || USB)
         default y
         ---help---
-        To use the module option that sets the dynamic-debugging level for,
-        the front-end driver, this parameter must be "Y". For memory-limited
-        systems, choose "N". If in doubt, choose "Y".
+          This option will enable support for the Realtek mac80211-based
+          wireless drivers. Drivers rtl8192ce, rtl8192cu, rtl8192se, rtl8192de,
+          rtl8723eu, and rtl8188eu share some common code.
+
+if RTL_CARDS
 
 config RTL8192CE
         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
         select RTL8192C_COMMON
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
         wireless network adapters.
@@ -30,7 +23,9 @@ config RTL8192CE
 
 config RTL8192SE
         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
         wireless network adapters.
@@ -39,7 +34,9 @@ config RTL8192SE
 
 config RTL8192DE
         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
         wireless network adapters.
@@ -48,7 +45,9 @@ config RTL8192DE
 
 config RTL8723AE
         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8723AE 802.11n PCIe
         wireless network adapters.
@@ -57,7 +56,9 @@ config RTL8723AE
 
 config RTL8188EE
         tristate "Realtek RTL8188EE Wireless Network Adapter"
-        depends on RTLWIFI && PCI
+        depends on PCI
+        select RTLWIFI
+        select RTLWIFI_PCI
         ---help---
         This is the driver for Realtek RTL8188EE 802.11n PCIe
         wireless network adapters.
@@ -66,7 +67,9 @@ config RTL8188EE
 
 config RTL8192CU
         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-        depends on RTLWIFI && USB
+        depends on USB
+        select RTLWIFI
+        select RTLWIFI_USB
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
@@ -74,7 +77,28 @@ config RTL8192CU
 
         If you choose to build it as a module, it will be called rtl8192cu
 
+config RTLWIFI
+        tristate
+        select FW_LOADER
+
+config RTLWIFI_PCI
+        tristate
+
+config RTLWIFI_USB
+        tristate
+
+config RTLWIFI_DEBUG
+        bool "Debugging output for rtlwifi driver family"
+        depends on RTLWIFI
+        default y
+        ---help---
+        To use the module option that sets the dynamic-debugging level for,
+        the front-end driver, this parameter must be "Y". For memory-limited
+        systems, choose "N". If in doubt, choose "Y".
+
 config RTL8192C_COMMON
         tristate
         depends on RTL8192CE || RTL8192CU
-        default m
+        default y
+
+endif
diff --git a/drivers/net/wireless/rtlwifi/Makefile b/drivers/net/wireless/rtlwifi/Makefile
index ff02b874f8d8..d56f023a4b90 100644
--- a/drivers/net/wireless/rtlwifi/Makefile
+++ b/drivers/net/wireless/rtlwifi/Makefile
@@ -12,13 +12,11 @@ rtlwifi-objs	:=		\
 
 rtl8192c_common-objs +=         \
 
-ifneq ($(CONFIG_PCI),)
-rtlwifi-objs    += pci.o
-endif
+obj-$(CONFIG_RTLWIFI_PCI)       += rtl_pci.o
+rtl_pci-objs    :=              pci.o
 
-ifneq ($(CONFIG_USB),)
-rtlwifi-objs    += usb.o
-endif
+obj-$(CONFIG_RTLWIFI_USB)       += rtl_usb.o
+rtl_usb-objs    :=              usb.o
 
 obj-$(CONFIG_RTL8192C_COMMON)   += rtl8192c/
 obj-$(CONFIG_RTL8192CE)         += rtl8192ce/
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 9d558ac77b0c..7651f5acc14b 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -172,6 +172,7 @@ u8 rtl_tid_to_ac(u8 tid)
 {
         return tid_to_ac[tid];
 }
+EXPORT_SYMBOL_GPL(rtl_tid_to_ac);
 
 static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
                                   struct ieee80211_sta_ht_cap *ht_cap)
@@ -406,6 +407,7 @@ void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
         cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
         cancel_delayed_work(&rtlpriv->works.fwevt_wq);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
 
 void rtl_init_rfkill(struct ieee80211_hw *hw)
 {
@@ -439,6 +441,7 @@ void rtl_deinit_rfkill(struct ieee80211_hw *hw)
 {
         wiphy_rfkill_stop_polling(hw->wiphy);
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_rfkill);
 
 int rtl_init_core(struct ieee80211_hw *hw)
 {
@@ -489,10 +492,12 @@ int rtl_init_core(struct ieee80211_hw *hw)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(rtl_init_core);
 
 void rtl_deinit_core(struct ieee80211_hw *hw)
 {
 }
+EXPORT_SYMBOL_GPL(rtl_deinit_core);
 
 void rtl_init_rx_config(struct ieee80211_hw *hw)
 {
@@ -501,6 +506,7 @@ void rtl_init_rx_config(struct ieee80211_hw *hw)
 
         rtlpriv->cfg->ops->get_hw_reg(hw, HW_VAR_RCR, (u8 *) (&mac->rx_conf));
 }
+EXPORT_SYMBOL_GPL(rtl_init_rx_config);
 
 /*********************************************************
  *
@@ -879,6 +885,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(rtl_tx_mgmt_proc);
 
 void rtl_get_tcb_desc(struct ieee80211_hw *hw,
                       struct ieee80211_tx_info *info,
@@ -1052,6 +1059,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(rtl_action_proc);
 
 /*should call before software enc*/
 u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
@@ -1125,6 +1133,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 
         return false;
 }
+EXPORT_SYMBOL_GPL(rtl_is_special_data);
 
 /*********************************************************
  *
@@ -1300,6 +1309,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rtlpriv->link_info.bcn_rx_inperiod++;
 }
+EXPORT_SYMBOL_GPL(rtl_beacon_statistic);
 
 void rtl_watchdog_wq_callback(void *data)
 {
@@ -1793,6 +1803,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
 
         mac->vendor = vendor;
 }
+EXPORT_SYMBOL_GPL(rtl_recognize_peer);
 
 /*********************************************************
  *
@@ -1849,6 +1860,7 @@ struct attribute_group rtl_attribute_group = {
         .name = "rtlsysfs",
         .attrs = rtl_sysfs_entries,
 };
+EXPORT_SYMBOL_GPL(rtl_attribute_group);
 
 MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
 MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
@@ -1856,7 +1868,8 @@ MODULE_AUTHOR("Larry Finger	<Larry.FInger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
 
-struct rtl_global_var global_var = {};
+struct rtl_global_var rtl_global_var = {};
+EXPORT_SYMBOL_GPL(rtl_global_var);
 
 static int __init rtl_core_module_init(void)
 {
@@ -1864,8 +1877,8 @@ static int __init rtl_core_module_init(void)
                 pr_err("Unable to register rtl_rc, use default RC !!\n");
 
         /* init some global vars */
-        INIT_LIST_HEAD(&global_var.glb_priv_list);
-        spin_lock_init(&global_var.glb_list_lock);
+        INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
+        spin_lock_init(&rtl_global_var.glb_list_lock);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 8576bc34b032..0e5fe0902daf 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -147,7 +147,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
 u8 rtl_tid_to_ac(u8 tid);
 extern struct attribute_group rtl_attribute_group;
 void rtl_easy_concurrent_retrytimer_callback(unsigned long data);
-extern struct rtl_global_var global_var;
+extern struct rtl_global_var rtl_global_var;
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                          bool isht, u8 desc_rate, bool first_ampdu);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index ee84844be008..733b7ce7f0e2 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1330,3 +1330,4 @@ const struct ieee80211_ops rtl_ops = {
         .rfkill_poll = rtl_op_rfkill_poll,
         .flush = rtl_op_flush,
 };
+EXPORT_SYMBOL_GPL(rtl_ops);
diff --git a/drivers/net/wireless/rtlwifi/debug.c b/drivers/net/wireless/rtlwifi/debug.c
index 7d52d3d7769f..76e2086e137e 100644
--- a/drivers/net/wireless/rtlwifi/debug.c
+++ b/drivers/net/wireless/rtlwifi/debug.c
@@ -51,3 +51,4 @@ void rtl_dbgp_flag_init(struct ieee80211_hw *hw)
 
         /*Init Debug flag enable condition */
 }
+EXPORT_SYMBOL_GPL(rtl_dbgp_flag_init);
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index 9e3894178e77..838a1ed3f194 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -229,6 +229,7 @@ void read_efuse_byte(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf)
 
         *pbuf = (u8) (value32 & 0xff);
 }
+EXPORT_SYMBOL_GPL(read_efuse_byte);
 
 void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
 {
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index c97e9d327331..703f839af6ca 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -35,6 +35,13 @@
 #include "efuse.h"
 #include <linux/export.h>
 #include <linux/kmemleak.h>
+#include <linux/module.h>
+
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("PCI basic driver for rtlwifi");
 
 static const u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
         PCI_VENDOR_ID_INTEL,
@@ -1008,19 +1015,6 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
         return;
 }
 
-static void rtl_lps_change_work_callback(struct work_struct *work)
-{
-        struct rtl_works *rtlworks =
-            container_of(work, struct rtl_works, lps_change_work);
-        struct ieee80211_hw *hw = rtlworks->hw;
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-
-        if (rtlpriv->enter_ps)
-                rtl_lps_enter(hw);
-        else
-                rtl_lps_leave(hw);
-}
-
 static void _rtl_pci_init_trx_var(struct ieee80211_hw *hw)
 {
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
@@ -1899,7 +1893,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
         rtlpriv->rtlhal.interface = INTF_PCI;
         rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
         rtlpriv->intf_ops = &rtl_pci_ops;
-        rtlpriv->glb_var = &global_var;
+        rtlpriv->glb_var = &rtl_global_var;
 
         /*
          *init dbgp flags before all
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 884bceae38a9..298b615964e8 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -269,6 +269,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
 
         spin_unlock_irqrestore(&rtlpriv->locks.ips_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rtl_ips_nic_on);
 
 /*for FW LPS*/
 
@@ -518,6 +519,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
                          "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
         }
 }
+EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
 
 void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
 {
@@ -611,6 +613,19 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
                         MSECS(sleep_intv * mac->vif->bss_conf.beacon_int - 40));
 }
 
+void rtl_lps_change_work_callback(struct work_struct *work)
+{
+        struct rtl_works *rtlworks =
+            container_of(work, struct rtl_works, lps_change_work);
+        struct ieee80211_hw *hw = rtlworks->hw;
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+        if (rtlpriv->enter_ps)
+                rtl_lps_enter(hw);
+        else
+                rtl_lps_leave(hw);
+}
+EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
 
 void rtl_swlps_wq_callback(void *data)
 {
@@ -922,3 +937,4 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
         else
                 rtl_p2p_noa_ie(hw, data, len - FCS_LEN);
 }
+EXPORT_SYMBOL_GPL(rtl_p2p_info);
diff --git a/drivers/net/wireless/rtlwifi/ps.h b/drivers/net/wireless/rtlwifi/ps.h
index 4d682b753f50..88bd76ea88f7 100644
--- a/drivers/net/wireless/rtlwifi/ps.h
+++ b/drivers/net/wireless/rtlwifi/ps.h
@@ -49,5 +49,6 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw);
 void rtl_swlps_rf_sleep(struct ieee80211_hw *hw);
 void rtl_p2p_ps_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
 void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len);
+void rtl_lps_change_work_callback(struct work_struct *work);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a3532e077871..e56778cac9bf 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -32,6 +32,13 @@
 #include "ps.h"
 #include "rtl8192c/fw_common.h"
 #include <linux/export.h>
+#include <linux/module.h>
+
+MODULE_AUTHOR("lizhaoming       <chaoming_li@realsil.com.cn>");
+MODULE_AUTHOR("Realtek WlanFAE  <wlanfae@realtek.com>");
+MODULE_AUTHOR("Larry Finger     <Larry.FInger@lwfinger.net>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("USB basic driver for rtlwifi");
 
 #define REALTEK_USB_VENQT_READ                  0xC0
 #define REALTEK_USB_VENQT_WRITE                 0x40
@@ -1070,6 +1077,8 @@ int rtl_usb_probe(struct usb_interface *intf,
         spin_lock_init(&rtlpriv->locks.usb_lock);
         INIT_WORK(&rtlpriv->works.fill_h2c_cmd,
                   rtl_fill_h2c_cmd_work_callback);
+        INIT_WORK(&rtlpriv->works.lps_change_work,
+                  rtl_lps_change_work_callback);
 
         rtlpriv->usb_data_index = 0;
         init_completion(&rtlpriv->firmware_loading_complete);
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index e79e006eb9ab..9ee04b4b68bf 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -811,18 +811,28 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
         return pcidev->irq;
 }
 
-static struct iosapic_info *first_isi = NULL;
+static struct iosapic_info *iosapic_list;
 
 #ifdef CONFIG_64BIT
-int iosapic_serial_irq(int num)
+int iosapic_serial_irq(struct parisc_device *dev)
 {
-        struct iosapic_info *isi = first_isi;
-        struct irt_entry *irte = NULL;  /* only used if PAT PDC */
+        struct iosapic_info *isi;
+        struct irt_entry *irte;
         struct vector_info *vi;
-        int isi_line;   /* line used by device */
+        int cnt;
+        int intin;
+
+        intin = (dev->mod_info >> 24) & 15;
 
         /* lookup IRT entry for isi/slot/pin set */
-        irte = &irt_cell[num];
+        for (cnt = 0; cnt < irt_num_entry; cnt++) {
+                irte = &irt_cell[cnt];
+                if (COMPARE_IRTE_ADDR(irte, dev->mod0) &&
+                    irte->dest_iosapic_intin == intin)
+                        break;
+        }
+        if (cnt >= irt_num_entry)
+                return 0; /* no irq found, force polling */
 
         DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
                 irte,
@@ -834,11 +844,17 @@ int iosapic_serial_irq(int num)
                 irte->src_seg_id,
                 irte->dest_iosapic_intin,
                 (u32) irte->dest_iosapic_addr);
-        isi_line = irte->dest_iosapic_intin;
+
+        /* search for iosapic */
+        for (isi = iosapic_list; isi; isi = isi->isi_next)
+                if (isi->isi_hpa == dev->mod0)
+                        break;
+        if (!isi)
+                return 0; /* no iosapic found, force polling */
 
         /* get vector info for this input line */
-        vi = isi->isi_vector + isi_line;
-        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", isi_line, vi);
+        vi = isi->isi_vector + intin;
+        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", iosapic_intin, vi);
 
         /* If this IRQ line has already been setup, skip it */
         if (vi->irte)
@@ -941,8 +957,8 @@ void *iosapic_register(unsigned long hpa)
                 vip->irqline = (unsigned char) cnt;
                 vip->iosapic = isi;
         }
-        if (!first_isi)
-                first_isi = isi;
+        isi->isi_next = iosapic_list;
+        iosapic_list = isi;
         return isi;
 }
 
diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
index 13a633b1612e..7bf3926aecc0 100644
--- a/drivers/pci/host/pci-mvebu.c
+++ b/drivers/pci/host/pci-mvebu.c
@@ -86,10 +86,6 @@ struct mvebu_sw_pci_bridge {
         u16 secondary_status;
         u16 membase;
         u16 memlimit;
-        u16 prefmembase;
-        u16 prefmemlimit;
-        u32 prefbaseupper;
-        u32 preflimitupper;
         u16 iobaseupper;
         u16 iolimitupper;
         u8 cappointer;
@@ -419,15 +415,7 @@ static int mvebu_sw_pci_bridge_read(struct mvebu_pcie_port *port,
                 break;
 
         case PCI_PREF_MEMORY_BASE:
-                *value = (bridge->prefmemlimit << 16 | bridge->prefmembase);
-                break;
-
-        case PCI_PREF_BASE_UPPER32:
-                *value = bridge->prefbaseupper;
-                break;
-
-        case PCI_PREF_LIMIT_UPPER32:
-                *value = bridge->preflimitupper;
+                *value = 0;
                 break;
 
         case PCI_IO_BASE_UPPER16:
@@ -501,19 +489,6 @@ static int mvebu_sw_pci_bridge_write(struct mvebu_pcie_port *port,
                 mvebu_pcie_handle_membase_change(port);
                 break;
 
-        case PCI_PREF_MEMORY_BASE:
-                bridge->prefmembase = value & 0xffff;
-                bridge->prefmemlimit = value >> 16;
-                break;
-
-        case PCI_PREF_BASE_UPPER32:
-                bridge->prefbaseupper = value;
-                break;
-
-        case PCI_PREF_LIMIT_UPPER32:
-                bridge->preflimitupper = value;
-                break;
-
         case PCI_IO_BASE_UPPER16:
                 bridge->iobaseupper = value & 0xffff;
                 bridge->iolimitupper = value >> 16;
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index bb7ebb22db01..d85009de713d 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -3,16 +3,13 @@
 #
 
 menuconfig HOTPLUG_PCI
-        tristate "Support for PCI Hotplug"
+        bool "Support for PCI Hotplug"
         depends on PCI && SYSFS
         ---help---
           Say Y here if you have a motherboard with a PCI Hotplug controller.
           This allows you to add and remove PCI cards while the machine is
           powered up and running.
 
-          To compile this driver as a module, choose M here: the
-          module will be called pci_hotplug.
-
           When in doubt, say N.
 
 if HOTPLUG_PCI
diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index aac7a40e4a4a..0e0d0f7f63fd 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -92,7 +92,14 @@ int pciehp_unconfigure_device(struct slot *p_slot)
         if (ret)
                 presence = 0;
 
-        list_for_each_entry_safe(dev, temp, &parent->devices, bus_list) {
+        /*
+         * Stopping an SR-IOV PF device removes all the associated VFs,
+         * which will update the bus->devices list and confuse the
+         * iterator.  Therefore, iterate in reverse so we remove the VFs
+         * first, then the PF.  We do the same in pci_stop_bus_device().
+         */
+        list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
+                                         bus_list) {
                 pci_dev_get(dev);
                 if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE && presence) {
                         pci_read_config_byte(dev, PCI_BRIDGE_CONTROL, &bctl);
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index dbdc5f7e2b29..01e264fb50e0 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -317,13 +317,20 @@ void acpi_pci_remove_bus(struct pci_bus *bus)
 /* ACPI bus type */
 static int acpi_pci_find_device(struct device *dev, acpi_handle *handle)
 {
-        struct pci_dev * pci_dev;
-        u64     addr;
+        struct pci_dev *pci_dev = to_pci_dev(dev);
+        bool is_bridge;
+        u64 addr;
 
-        pci_dev = to_pci_dev(dev);
+        /*
+         * pci_is_bridge() is not suitable here, because pci_dev->subordinate
+         * is set only after acpi_pci_find_device() has been called for the
+         * given device.
+         */
+        is_bridge = pci_dev->hdr_type == PCI_HEADER_TYPE_BRIDGE
+                        || pci_dev->hdr_type == PCI_HEADER_TYPE_CARDBUS;
         /* Please ref to ACPI spec for the syntax of _ADR */
         addr = (PCI_SLOT(pci_dev->devfn) << 16) | PCI_FUNC(pci_dev->devfn);
-        *handle = acpi_get_child(DEVICE_ACPI_HANDLE(dev->parent), addr);
+        *handle = acpi_find_child(ACPI_HANDLE(dev->parent), addr, is_bridge);
         if (!*handle)
                 return -ENODEV;
         return 0;
diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
index 569f82fc9e22..3b94cfcfa03b 100644
--- a/drivers/pci/pcie/Kconfig
+++ b/drivers/pci/pcie/Kconfig
@@ -14,15 +14,12 @@ config PCIEPORTBUS
 # Include service Kconfig here
 #
 config HOTPLUG_PCI_PCIE
-        tristate "PCI Express Hotplug driver"
+        bool "PCI Express Hotplug driver"
         depends on HOTPLUG_PCI && PCIEPORTBUS
         help
           Say Y here if you have a motherboard that supports PCI Express Native
           Hotplug
 
-          To compile this driver as a module, choose M here: the
-          module will be called pciehp.
-
           When in doubt, say N.
 
 source "drivers/pci/pcie/aer/Kconfig"
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index d254e2379533..64a7de22d9af 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -300,6 +300,47 @@ static void assign_requested_resources_sorted(struct list_head *head,
         }
 }
 
+static unsigned long pci_fail_res_type_mask(struct list_head *fail_head)
+{
+        struct pci_dev_resource *fail_res;
+        unsigned long mask = 0;
+
+        /* check failed type */
+        list_for_each_entry(fail_res, fail_head, list)
+                mask |= fail_res->flags;
+
+        /*
+         * one pref failed resource will set IORESOURCE_MEM,
+         * as we can allocate pref in non-pref range.
+         * Will release all assigned non-pref sibling resources
+         * according to that bit.
+         */
+        return mask & (IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH);
+}
+
+static bool pci_need_to_release(unsigned long mask, struct resource *res)
+{
+        if (res->flags & IORESOURCE_IO)
+                return !!(mask & IORESOURCE_IO);
+
+        /* check pref at first */
+        if (res->flags & IORESOURCE_PREFETCH) {
+                if (mask & IORESOURCE_PREFETCH)
+                        return true;
+                /* count pref if its parent is non-pref */
+                else if ((mask & IORESOURCE_MEM) &&
+                         !(res->parent->flags & IORESOURCE_PREFETCH))
+                        return true;
+                else
+                        return false;
+        }
+
+        if (res->flags & IORESOURCE_MEM)
+                return !!(mask & IORESOURCE_MEM);
+
+        return false;   /* should not get here */
+}
+
 static void __assign_resources_sorted(struct list_head *head,
                                  struct list_head *realloc_head,
                                  struct list_head *fail_head)
@@ -312,11 +353,24 @@ static void __assign_resources_sorted(struct list_head *head,
          *  if could do that, could get out early.
          *  if could not do that, we still try to assign requested at first,
          *    then try to reassign add_size for some resources.
+         *
+         * Separate three resource type checking if we need to release
+         * assigned resource after requested + add_size try.
+         *      1. if there is io port assign fail, will release assigned
+         *         io port.
+         *      2. if there is pref mmio assign fail, release assigned
+         *         pref mmio.
+         *         if assigned pref mmio's parent is non-pref mmio and there
+         *         is non-pref mmio assign fail, will release that assigned
+         *         pref mmio.
+         *      3. if there is non-pref mmio assign fail or pref mmio
+         *         assigned fail, will release assigned non-pref mmio.
          */
         LIST_HEAD(save_head);
         LIST_HEAD(local_fail_head);
         struct pci_dev_resource *save_res;
-        struct pci_dev_resource *dev_res;
+        struct pci_dev_resource *dev_res, *tmp_res;
+        unsigned long fail_type;
 
         /* Check if optional add_size is there */
         if (!realloc_head || list_empty(realloc_head))
@@ -348,6 +402,19 @@ static void __assign_resources_sorted(struct list_head *head,
                 return;
         }
 
+        /* check failed type */
+        fail_type = pci_fail_res_type_mask(&local_fail_head);
+        /* remove not need to be released assigned res from head list etc */
+        list_for_each_entry_safe(dev_res, tmp_res, head, list)
+                if (dev_res->res->parent &&
+                    !pci_need_to_release(fail_type, dev_res->res)) {
+                        /* remove it from realloc_head list */
+                        remove_from_list(realloc_head, dev_res->res);
+                        remove_from_list(&save_head, dev_res->res);
+                        list_del(&dev_res->list);
+                        kfree(dev_res);
+                }
+
         free_list(&local_fail_head);
         /* Release assigned resource */
         list_for_each_entry(dev_res, head, list)
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index f4f30af2df68..2e8a20cac588 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -1715,11 +1715,13 @@ int rio_unregister_scan(int mport_id, struct rio_scan *scan_ops)
                     (mport_id == RIO_MPORT_ANY && port->nscan == scan_ops))
                         port->nscan = NULL;
 
-        list_for_each_entry(scan, &rio_scans, node)
+        list_for_each_entry(scan, &rio_scans, node) {
                 if (scan->mport_id == mport_id) {
                         list_del(&scan->node);
                         kfree(scan);
+                        break;
                 }
+        }
 
         mutex_unlock(&rio_mport_list_lock);
 
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 02faf3c4e0d5..c2e80d7ca5e2 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -524,6 +524,8 @@ static int twl_rtc_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out1;
 
+        device_init_wakeup(&pdev->dev, 1);
+
         rtc = rtc_device_register(pdev->name,
                                   &pdev->dev, &twl_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc)) {
@@ -542,7 +544,6 @@ static int twl_rtc_probe(struct platform_device *pdev)
         }
 
         platform_set_drvdata(pdev, rtc);
-        device_init_wakeup(&pdev->dev, 1);
         return 0;
 
 out2:
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 17150a778984..451bf99582ff 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2392,6 +2392,12 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
                 rc = cqr->intrc;
         else
                 rc = -EIO;
+
+        /* kick tasklets */
+        dasd_schedule_device_bh(device);
+        if (device->block)
+                dasd_schedule_block_bh(device->block);
+
         return rc;
 }
 
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 2168258fb2c3..74b88efde6ad 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -751,7 +751,7 @@ static void __virtscsi_set_affinity(struct virtio_scsi *vscsi, bool affinity)
 
                 vscsi->affinity_hint_set = true;
         } else {
-                for (i = 0; i < vscsi->num_queues - VIRTIO_SCSI_VQ_BASE; i++)
+                for (i = 0; i < vscsi->num_queues; i++)
                         virtqueue_set_affinity(vscsi->req_vqs[i].vq, -1);
 
                 vscsi->affinity_hint_set = false;
diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index 222d3e37fc28..707966bd5610 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -609,7 +609,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
                 else
                         buf = (void *)t->tx_buf;
                 t->tx_dma = dma_map_single(&spi->dev, buf,
-                                t->len, DMA_FROM_DEVICE);
+                                t->len, DMA_TO_DEVICE);
                 if (!t->tx_dma) {
                         ret = -EFAULT;
                         goto err_tx_map;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index dcceed29d31a..81972fa47beb 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1811,10 +1811,12 @@ static int zcache_comp_init(void)
 #else
         if (*zcache_comp_name != '\0') {
                 ret = crypto_has_comp(zcache_comp_name, 0, 0);
-                if (!ret)
+                if (!ret) {
                         pr_info("zcache: %s not supported\n",
                                         zcache_comp_name);
-                goto out;
+                        ret = 1;
+                        goto out;
+                }
         }
         if (!ret)
                 strcpy(zcache_comp_name, "lzo");
diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
index bb91b4713ebd..2e3ea1a70d7b 100644
--- a/drivers/tty/serial/8250/8250_gsc.c
+++ b/drivers/tty/serial/8250/8250_gsc.c
@@ -31,9 +31,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
         int err;
 
 #ifdef CONFIG_64BIT
-        extern int iosapic_serial_irq(int cellnum);
         if (!dev->irq && (dev->id.sversion == 0xad))
-                dev->irq = iosapic_serial_irq(dev->mod_index-1);
+                dev->irq = iosapic_serial_irq(dev);
 #endif
 
         if (!dev->irq) {
diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c
index cbf1d155b7b2..22f280aa4f2c 100644
--- a/drivers/tty/serial/arc_uart.c
+++ b/drivers/tty/serial/arc_uart.c
@@ -773,6 +773,6 @@ module_init(arc_serial_init);
 module_exit(arc_serial_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("plat-arcfpga/uart");
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_AUTHOR("Vineet Gupta");
 MODULE_DESCRIPTION("ARC(Synopsys) On-Chip(fpga) serial driver");
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 4f5f161896a1..f85b8e6d0346 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -678,11 +678,18 @@ static void mxs_auart_settermios(struct uart_port *u,
 
 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
 {
-        u32 istatus, istat;
+        u32 istat;
         struct mxs_auart_port *s = context;
         u32 stat = readl(s->port.membase + AUART_STAT);
 
-        istatus = istat = readl(s->port.membase + AUART_INTR);
+        istat = readl(s->port.membase + AUART_INTR);
+
+        /* ack irq */
+        writel(istat & (AUART_INTR_RTIS
+                | AUART_INTR_TXIS
+                | AUART_INTR_RXIS
+                | AUART_INTR_CTSMIS),
+                        s->port.membase + AUART_INTR_CLR);
 
         if (istat & AUART_INTR_CTSMIS) {
                 uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
@@ -702,12 +709,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
                 istat &= ~AUART_INTR_TXIS;
         }
 
-        writel(istatus & (AUART_INTR_RTIS
-                | AUART_INTR_TXIS
-                | AUART_INTR_RXIS
-                | AUART_INTR_CTSMIS),
-                        s->port.membase + AUART_INTR_CLR);
-
         return IRQ_HANDLED;
 }
 
@@ -850,7 +851,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
         struct mxs_auart_port *s;
         struct uart_port *port;
         unsigned int old_ctrl0, old_ctrl2;
-        unsigned int to = 1000;
+        unsigned int to = 20000;
 
         if (co->index >= MXS_AUART_PORTS || co->index < 0)
                 return;
@@ -871,18 +872,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
 
         uart_console_write(port, str, count, mxs_auart_console_putchar);
 
-        /*
-         * Finally, wait for transmitter to become empty
-         * and restore the TCR
-         */
+        /* Finally, wait for transmitter to become empty ... */
         while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
+                udelay(1);
                 if (!to--)
                         break;
-                udelay(1);
         }
 
-        writel(old_ctrl0, port->membase + AUART_CTRL0);
-        writel(old_ctrl2, port->membase + AUART_CTRL2);
+        /*
+         * ... and restore the TCR if we waited long enough for the transmitter
+         * to be idle. This might keep the transmitter enabled although it is
+         * unused, but that is better than to disable it while it is still
+         * transmitting.
+         */
+        if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
+                writel(old_ctrl0, port->membase + AUART_CTRL0);
+                writel(old_ctrl2, port->membase + AUART_CTRL2);
+        }
 
         clk_disable(s->clk);
 }
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 121aeb9393e1..f597e88a705d 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -256,10 +256,9 @@ void tty_port_tty_hangup(struct tty_port *port, bool check_clocal)
 {
         struct tty_struct *tty = tty_port_tty_get(port);
 
-        if (tty && (!check_clocal || !C_CLOCAL(tty))) {
+        if (tty && (!check_clocal || !C_CLOCAL(tty)))
                 tty_hangup(tty);
-                tty_kref_put(tty);
-        }
+        tty_kref_put(tty);
 }
 EXPORT_SYMBOL_GPL(tty_port_tty_hangup);
 
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index eb2aa2e5a842..d1bd8ef1f9c1 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -12,7 +12,7 @@ if USB_CHIPIDEA
 
 config USB_CHIPIDEA_UDC
         bool "ChipIdea device controller"
-        depends on USB_GADGET=y || USB_CHIPIDEA=m
+        depends on USB_GADGET=y || (USB_CHIPIDEA=m && USB_GADGET=m)
         help
           Say Y here to enable device controller functionality of the
           ChipIdea driver.
@@ -20,7 +20,7 @@ config USB_CHIPIDEA_UDC
 config USB_CHIPIDEA_HOST
         bool "ChipIdea host controller"
         depends on USB=y
-        depends on USB_EHCI_HCD=y || USB_CHIPIDEA=m
+        depends on USB_EHCI_HCD=y || (USB_CHIPIDEA=m && USB_EHCI_HCD=m)
         select USB_EHCI_ROOT_HUB_TT
         help
           Say Y here to enable host controller functionality of the
diff --git a/drivers/usb/chipidea/bits.h b/drivers/usb/chipidea/bits.h
index aefa0261220c..1b23e354f9fb 100644
--- a/drivers/usb/chipidea/bits.h
+++ b/drivers/usb/chipidea/bits.h
@@ -50,7 +50,7 @@
 #define PORTSC_PTC            (0x0FUL << 16)
 /* PTS and PTW for non lpm version only */
 #define PORTSC_PTS(d)                                           \
-        ((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
+        (u32)((((d) & 0x3) << 30) | (((d) & 0x4) ? BIT(25) : 0))
 #define PORTSC_PTW            BIT(28)
 #define PORTSC_STS            BIT(29)
 
@@ -59,7 +59,7 @@
 #define DEVLC_PSPD_HS         (0x02UL << 25)
 #define DEVLC_PTW             BIT(27)
 #define DEVLC_STS             BIT(28)
-#define DEVLC_PTS(d)          (((d) & 0x7) << 29)
+#define DEVLC_PTS(d)          (u32)(((d) & 0x7) << 29)
 
 /* Encoding for DEVLC_PTS and PORTSC_PTS */
 #define PTS_UTMI              0
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 4a8a1d68002c..558313de4911 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4798,7 +4798,8 @@ static void hub_events(void)
                                         hub->ports[i - 1]->child;
 
                                 dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                if (!udev) {
+                                if (!udev || !(portstatus &
+                                                USB_PORT_STAT_CONNECTION)) {
                                         status = hub_port_reset(hub, i,
                                                         NULL, HUB_BH_RESET_TIME,
                                                         true);
@@ -4808,8 +4809,8 @@ static void hub_events(void)
                                         usb_lock_device(udev);
                                         status = usb_reset_device(udev);
                                         usb_unlock_device(udev);
+                                        connect_change = 0;
                                 }
-                                connect_change = 0;
                         }
 
                         if (connect_change)
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index f48712ffe261..c1c113ef950c 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -449,14 +449,20 @@ fail:
 
 static int __exit eth_unbind(struct usb_composite_dev *cdev)
 {
-        if (has_rndis())
+        if (has_rndis()) {
+                usb_put_function(f_rndis);
                 usb_put_function_instance(fi_rndis);
-        if (use_eem)
+        }
+        if (use_eem) {
+                usb_put_function(f_eem);
                 usb_put_function_instance(fi_eem);
-        else if (can_support_ecm(cdev->gadget))
+        } else if (can_support_ecm(cdev->gadget)) {
+                usb_put_function(f_ecm);
                 usb_put_function_instance(fi_ecm);
-        else
+        } else {
+                usb_put_function(f_geth);
                 usb_put_function_instance(fi_geth);
+        }
         return 0;
 }
 
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 1bf26e9f38cd..eb3aa817a662 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -488,7 +488,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
         struct usb_ep *ep;
         int status, i;
 
-#ifndef USBF_PHONET_INCLUDED
         struct f_phonet_opts *phonet_opts;
 
         phonet_opts = container_of(f->fi, struct f_phonet_opts, func_inst);
@@ -507,7 +506,6 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
                         return status;
                 phonet_opts->bound = true;
         }
-#endif
 
         /* Reserve interface IDs */
         status = usb_interface_id(c, f);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 032b96a51ce4..2a1ebefd8f9e 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -160,10 +160,8 @@ static __init int rndis_do_config(struct usb_configuration *c)
                 return ret;
 
         f_acm_rndis = usb_get_function(fi_acm);
-        if (IS_ERR(f_acm_rndis)) {
-                ret = PTR_ERR(f_acm_rndis);
-                goto err_func_acm;
-        }
+        if (IS_ERR(f_acm_rndis))
+                return PTR_ERR(f_acm_rndis);
 
         ret = usb_add_function(c, f_acm_rndis);
         if (ret)
@@ -178,7 +176,6 @@ err_fsg:
         usb_remove_function(c, f_acm_rndis);
 err_conf:
         usb_put_function(f_acm_rndis);
-err_func_acm:
         return ret;
 }
 
@@ -226,7 +223,7 @@ static __init int cdc_do_config(struct usb_configuration *c)
         /* implicit port_num is zero */
         f_acm_multi = usb_get_function(fi_acm);
         if (IS_ERR(f_acm_multi))
-                goto err_func_acm;
+                return PTR_ERR(f_acm_multi);
 
         ret = usb_add_function(c, f_acm_multi);
         if (ret)
@@ -241,7 +238,6 @@ err_fsg:
         usb_remove_function(c, f_acm_multi);
 err_conf:
         usb_put_function(f_acm_multi);
-err_func_acm:
         return ret;
 }
 
diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
index c28ac9872030..13e25f80fc20 100644
--- a/drivers/usb/gadget/udc-core.c
+++ b/drivers/usb/gadget/udc-core.c
@@ -109,7 +109,7 @@ void usb_gadget_set_state(struct usb_gadget *gadget,
                 enum usb_device_state state)
 {
         gadget->state = state;
-        sysfs_notify(&gadget->dev.kobj, NULL, "status");
+        sysfs_notify(&gadget->dev.kobj, NULL, "state");
 }
 EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index df6978abd7e6..6f8c2fd47675 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -24,6 +24,7 @@
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/dmapool.h>
+#include <linux/dma-mapping.h>
 
 #include "xhci.h"
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 41eb4fc33453..9478caa2f71f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -27,6 +27,7 @@
 #include <linux/moduleparam.h>
 #include <linux/slab.h>
 #include <linux/dmi.h>
+#include <linux/dma-mapping.h>
 
 #include "xhci.h"
 
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 6708a3b78ad8..f44e8b5e00c9 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -481,7 +481,7 @@ static u64 omap2430_dmamask = DMA_BIT_MASK(32);
 
 static int omap2430_probe(struct platform_device *pdev)
 {
-        struct resource                 musb_resources[2];
+        struct resource                 musb_resources[3];
         struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
         struct omap_musb_board_data     *data;
         struct platform_device          *musb;
@@ -581,6 +581,11 @@ static int omap2430_probe(struct platform_device *pdev)
         musb_resources[1].end = pdev->resource[1].end;
         musb_resources[1].flags = pdev->resource[1].flags;
 
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
+
         ret = platform_device_add_resources(musb, musb_resources,
                         ARRAY_SIZE(musb_resources));
         if (ret) {
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 2c06a8969a9f..6f8a9ca96ae7 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1156,7 +1156,7 @@ static u64 tusb_dmamask = DMA_BIT_MASK(32);
 
 static int tusb_probe(struct platform_device *pdev)
 {
-        struct resource musb_resources[2];
+        struct resource musb_resources[3];
         struct musb_hdrc_platform_data  *pdata = pdev->dev.platform_data;
         struct platform_device          *musb;
         struct tusb6010_glue            *glue;
@@ -1199,6 +1199,11 @@ static int tusb_probe(struct platform_device *pdev)
         musb_resources[1].end = pdev->resource[1].end;
         musb_resources[1].flags = pdev->resource[1].flags;
 
+        musb_resources[2].name = pdev->resource[2].name;
+        musb_resources[2].start = pdev->resource[2].start;
+        musb_resources[2].end = pdev->resource[2].end;
+        musb_resources[2].flags = pdev->resource[2].flags;
+
         ret = platform_device_add_resources(musb, musb_resources,
                         ARRAY_SIZE(musb_resources));
         if (ret) {
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 8c3a42ea910c..7eef9b33fde6 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -719,6 +719,13 @@ config USB_SERIAL_FLASHLOADER
           To compile this driver as a module, choose M here: the
           module will be called flashloader.
 
+config USB_SERIAL_SUUNTO
+        tristate "USB Suunto ANT+ driver"
+        help
+          Say Y here if you want to use the Suunto ANT+ USB device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called suunto.
 
 config USB_SERIAL_DEBUG
         tristate "USB Debugging Device"
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index f7130114488f..a14a870d993f 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -54,6 +54,7 @@ obj-$(CONFIG_USB_SERIAL_SIEMENS_MPI)		+= siemens_mpi.o
 obj-$(CONFIG_USB_SERIAL_SIERRAWIRELESS)         += sierra.o
 obj-$(CONFIG_USB_SERIAL_SPCP8X5)                += spcp8x5.o
 obj-$(CONFIG_USB_SERIAL_SSU100)                 += ssu100.o
+obj-$(CONFIG_USB_SERIAL_SUUNTO)                 += suunto.o
 obj-$(CONFIG_USB_SERIAL_SYMBOL)                 += symbolserial.o
 obj-$(CONFIG_USB_SERIAL_WWAN)                   += usb_wwan.o
 obj-$(CONFIG_USB_SERIAL_TI)                     += ti_usb_3410_5052.o
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 7260ec660347..b65e657c641d 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -735,9 +735,34 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
-        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 6dd79253205d..1b8af461b522 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -815,11 +815,35 @@
 /*
  * RT Systems programming cables for various ham radios
  */
-#define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
-#define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
-#define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
-#define RTSYSTEMS_RTS01_PID             0x9e57  /* USB-RTS01 Radio Cable */
-
+#define RTSYSTEMS_VID           0x2100  /* Vendor ID */
+#define RTSYSTEMS_USB_S03_PID   0x9001  /* RTS-03 USB to Serial Adapter */
+#define RTSYSTEMS_USB_59_PID    0x9e50  /* USB-59 USB to 8 pin plug */
+#define RTSYSTEMS_USB_57A_PID   0x9e51  /* USB-57A USB to 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_57B_PID   0x9e52  /* USB-57B USB to extended 4pin 3.5mm plug */
+#define RTSYSTEMS_USB_29A_PID   0x9e53  /* USB-29A USB to 3.5mm stereo plug */
+#define RTSYSTEMS_USB_29B_PID   0x9e54  /* USB-29B USB to 6 pin mini din */
+#define RTSYSTEMS_USB_29F_PID   0x9e55  /* USB-29F USB to 6 pin modular plug */
+#define RTSYSTEMS_USB_62B_PID   0x9e56  /* USB-62B USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_S01_PID   0x9e57  /* USB-RTS01 USB to 3.5 mm stereo plug*/
+#define RTSYSTEMS_USB_63_PID    0x9e58  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_29C_PID   0x9e59  /* USB-29C USB to 4 pin modular plug*/
+#define RTSYSTEMS_USB_81B_PID   0x9e5A  /* USB-81 USB to 8 pin mini din plug*/
+#define RTSYSTEMS_USB_82B_PID   0x9e5B  /* USB-82 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_K5D_PID   0x9e5C  /* USB-K5D USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_K4Y_PID   0x9e5D  /* USB-K4Y USB to 2.5/3.5 mm plugs*/
+#define RTSYSTEMS_USB_K5G_PID   0x9e5E  /* USB-K5G USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_S05_PID   0x9e5F  /* USB-RTS05 USB to 2.5 mm stereo plug*/
+#define RTSYSTEMS_USB_60_PID    0x9e60  /* USB-60 USB to 6 pin din*/
+#define RTSYSTEMS_USB_61_PID    0x9e61  /* USB-61 USB to 6 pin mini din*/
+#define RTSYSTEMS_USB_62_PID    0x9e62  /* USB-62 USB to 8 pin mini din*/
+#define RTSYSTEMS_USB_63B_PID   0x9e63  /* USB-63 USB to 9 pin female*/
+#define RTSYSTEMS_USB_64_PID    0x9e64  /* USB-64 USB to 9 pin male*/
+#define RTSYSTEMS_USB_65_PID    0x9e65  /* USB-65 USB to 9 pin female null modem*/
+#define RTSYSTEMS_USB_92_PID    0x9e66  /* USB-92 USB to 12 pin plug*/
+#define RTSYSTEMS_USB_92D_PID   0x9e67  /* USB-92D USB to 12 pin plug data*/
+#define RTSYSTEMS_USB_W5R_PID   0x9e68  /* USB-W5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_A5R_PID   0x9e69  /* USB-A5R USB to 8 pin modular plug*/
+#define RTSYSTEMS_USB_PW1_PID   0x9e6A  /* USB-PW1 USB to 8 pin modular plug*/
 
 /*
  * Physik Instrumente
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 603fb70dde80..d953d674f222 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -183,7 +183,10 @@
 #define LED_ON_MS       500
 #define LED_OFF_MS      500
 
-static int device_type;
+enum mos7840_flag {
+        MOS7840_FLAG_CTRL_BUSY,
+        MOS7840_FLAG_LED_BUSY,
+};
 
 static const struct usb_device_id id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
@@ -238,9 +241,12 @@ struct moschip_port {
 
         /* For device(s) with LED indicator */
         bool has_led;
-        bool led_flag;
         struct timer_list led_timer1;   /* Timer for LED on */
         struct timer_list led_timer2;   /* Timer for LED off */
+        struct urb *led_urb;
+        struct usb_ctrlrequest *led_dr;
+
+        unsigned long flags;
 };
 
 /*
@@ -460,10 +466,10 @@ static void mos7840_control_callback(struct urb *urb)
         case -ESHUTDOWN:
                 /* this urb is terminated, clean up */
                 dev_dbg(dev, "%s - urb shutting down with status: %d\n", __func__, status);
-                return;
+                goto out;
         default:
                 dev_dbg(dev, "%s - nonzero urb status received: %d\n", __func__, status);
-                return;
+                goto out;
         }
 
         dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length);
@@ -476,6 +482,8 @@ static void mos7840_control_callback(struct urb *urb)
                 mos7840_handle_new_msr(mos7840_port, regval);
         else if (mos7840_port->MsrLsr == 1)
                 mos7840_handle_new_lsr(mos7840_port, regval);
+out:
+        clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
 }
 
 static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
@@ -486,6 +494,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
         unsigned char *buffer = mcs->ctrl_buf;
         int ret;
 
+        if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
+                return -EBUSY;
+
         dr->bRequestType = MCS_RD_RTYPE;
         dr->bRequest = MCS_RDREQ;
         dr->wValue = cpu_to_le16(Wval); /* 0 */
@@ -497,6 +508,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
                              mos7840_control_callback, mcs);
         mcs->control_urb->transfer_buffer_length = 2;
         ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        if (ret)
+                clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
+
         return ret;
 }
 
@@ -523,7 +537,7 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
                                 __u16 reg)
 {
         struct usb_device *dev = mcs->port->serial->dev;
-        struct usb_ctrlrequest *dr = mcs->dr;
+        struct usb_ctrlrequest *dr = mcs->led_dr;
 
         dr->bRequestType = MCS_WR_RTYPE;
         dr->bRequest = MCS_WRREQ;
@@ -531,10 +545,10 @@ static void mos7840_set_led_async(struct moschip_port *mcs, __u16 wval,
         dr->wIndex = cpu_to_le16(reg);
         dr->wLength = cpu_to_le16(0);
 
-        usb_fill_control_urb(mcs->control_urb, dev, usb_sndctrlpipe(dev, 0),
+        usb_fill_control_urb(mcs->led_urb, dev, usb_sndctrlpipe(dev, 0),
                 (unsigned char *)dr, NULL, 0, mos7840_set_led_callback, NULL);
 
-        usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+        usb_submit_urb(mcs->led_urb, GFP_ATOMIC);
 }
 
 static void mos7840_set_led_sync(struct usb_serial_port *port, __u16 reg,
@@ -560,7 +574,19 @@ static void mos7840_led_flag_off(unsigned long arg)
 {
         struct moschip_port *mcs = (struct moschip_port *) arg;
 
-        mcs->led_flag = false;
+        clear_bit_unlock(MOS7840_FLAG_LED_BUSY, &mcs->flags);
+}
+
+static void mos7840_led_activity(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7840_port = usb_get_serial_port_data(port);
+
+        if (test_and_set_bit_lock(MOS7840_FLAG_LED_BUSY, &mos7840_port->flags))
+                return;
+
+        mos7840_set_led_async(mos7840_port, 0x0301, MODEM_CONTROL_REGISTER);
+        mod_timer(&mos7840_port->led_timer1,
+                                jiffies + msecs_to_jiffies(LED_ON_MS));
 }
 
 /*****************************************************************************
@@ -758,14 +784,8 @@ static void mos7840_bulk_in_callback(struct urb *urb)
                 return;
         }
 
-        /* Turn on LED */
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
-                mos7840_port->led_flag = true;
-                mos7840_set_led_async(mos7840_port, 0x0301,
-                                        MODEM_CONTROL_REGISTER);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
+        if (mos7840_port->has_led)
+                mos7840_led_activity(port);
 
         mos7840_port->read_urb_busy = true;
         retval = usb_submit_urb(mos7840_port->read_urb, GFP_ATOMIC);
@@ -816,18 +836,6 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
 /************************************************************************/
 /*       D R I V E R  T T Y  I N T E R F A C E  F U N C T I O N S       */
 /************************************************************************/
-#ifdef MCSSerialProbe
-static int mos7840_serial_probe(struct usb_serial *serial,
-                                const struct usb_device_id *id)
-{
-
-        /*need to implement the mode_reg reading and updating\
-           structures usb_serial_ device_type\
-           (i.e num_ports, num_bulkin,bulkout etc) */
-        /* Also we can update the changes  attach */
-        return 1;
-}
-#endif
 
 /*****************************************************************************
  * mos7840_open
@@ -1454,13 +1462,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
         data1 = urb->transfer_buffer;
         dev_dbg(&port->dev, "bulkout endpoint is %d\n", port->bulk_out_endpointAddress);
 
-        /* Turn on LED */
-        if (mos7840_port->has_led && !mos7840_port->led_flag) {
-                mos7840_port->led_flag = true;
-                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0301);
-                mod_timer(&mos7840_port->led_timer1,
-                                jiffies + msecs_to_jiffies(LED_ON_MS));
-        }
+        if (mos7840_port->has_led)
+                mos7840_led_activity(port);
 
         /* send it down the pipe */
         status = usb_submit_urb(urb, GFP_ATOMIC);
@@ -2187,38 +2190,48 @@ static int mos7810_check(struct usb_serial *serial)
         return 0;
 }
 
-static int mos7840_calc_num_ports(struct usb_serial *serial)
+static int mos7840_probe(struct usb_serial *serial,
+                                const struct usb_device_id *id)
 {
-        __u16 data = 0x00;
+        u16 product = serial->dev->descriptor.idProduct;
         u8 *buf;
-        int mos7840_num_ports;
+        int device_type;
+
+        if (product == MOSCHIP_DEVICE_ID_7810 ||
+                product == MOSCHIP_DEVICE_ID_7820) {
+                device_type = product;
+                goto out;
+        }
 
         buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
-        if (buf) {
-                usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+        if (!buf)
+                return -ENOMEM;
+
+        usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                         MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf,
                         VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
-                data = *buf;
-                kfree(buf);
-        }
 
-        if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 ||
-                serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) {
-                device_type = serial->dev->descriptor.idProduct;
-        } else {
-                /* For a MCS7840 device GPIO0 must be set to 1 */
-                if ((data & 0x01) == 1)
-                        device_type = MOSCHIP_DEVICE_ID_7840;
-                else if (mos7810_check(serial))
-                        device_type = MOSCHIP_DEVICE_ID_7810;
-                else
-                        device_type = MOSCHIP_DEVICE_ID_7820;
-        }
+        /* For a MCS7840 device GPIO0 must be set to 1 */
+        if (buf[0] & 0x01)
+                device_type = MOSCHIP_DEVICE_ID_7840;
+        else if (mos7810_check(serial))
+                device_type = MOSCHIP_DEVICE_ID_7810;
+        else
+                device_type = MOSCHIP_DEVICE_ID_7820;
+
+        kfree(buf);
+out:
+        usb_set_serial_data(serial, (void *)(unsigned long)device_type);
+
+        return 0;
+}
+
+static int mos7840_calc_num_ports(struct usb_serial *serial)
+{
+        int device_type = (unsigned long)usb_get_serial_data(serial);
+        int mos7840_num_ports;
 
         mos7840_num_ports = (device_type >> 4) & 0x000F;
-        serial->num_bulk_in = mos7840_num_ports;
-        serial->num_bulk_out = mos7840_num_ports;
-        serial->num_ports = mos7840_num_ports;
 
         return mos7840_num_ports;
 }
@@ -2226,6 +2239,7 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
 static int mos7840_port_probe(struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
+        int device_type = (unsigned long)usb_get_serial_data(serial);
         struct moschip_port *mos7840_port;
         int status;
         int pnum;
@@ -2401,6 +2415,14 @@ static int mos7840_port_probe(struct usb_serial_port *port)
         if (device_type == MOSCHIP_DEVICE_ID_7810) {
                 mos7840_port->has_led = true;
 
+                mos7840_port->led_urb = usb_alloc_urb(0, GFP_KERNEL);
+                mos7840_port->led_dr = kmalloc(sizeof(*mos7840_port->led_dr),
+                                                                GFP_KERNEL);
+                if (!mos7840_port->led_urb || !mos7840_port->led_dr) {
+                        status = -ENOMEM;
+                        goto error;
+                }
+
                 init_timer(&mos7840_port->led_timer1);
                 mos7840_port->led_timer1.function = mos7840_led_off;
                 mos7840_port->led_timer1.expires =
@@ -2413,8 +2435,6 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                         jiffies + msecs_to_jiffies(LED_OFF_MS);
                 mos7840_port->led_timer2.data = (unsigned long)mos7840_port;
 
-                mos7840_port->led_flag = false;
-
                 /* Turn off LED */
                 mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
         }
@@ -2436,6 +2456,8 @@ out:
         }
         return 0;
 error:
+        kfree(mos7840_port->led_dr);
+        usb_free_urb(mos7840_port->led_urb);
         kfree(mos7840_port->dr);
         kfree(mos7840_port->ctrl_buf);
         usb_free_urb(mos7840_port->control_urb);
@@ -2456,6 +2478,10 @@ static int mos7840_port_remove(struct usb_serial_port *port)
 
                 del_timer_sync(&mos7840_port->led_timer1);
                 del_timer_sync(&mos7840_port->led_timer2);
+
+                usb_kill_urb(mos7840_port->led_urb);
+                usb_free_urb(mos7840_port->led_urb);
+                kfree(mos7840_port->led_dr);
         }
         usb_kill_urb(mos7840_port->control_urb);
         usb_free_urb(mos7840_port->control_urb);
@@ -2482,9 +2508,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
         .throttle = mos7840_throttle,
         .unthrottle = mos7840_unthrottle,
         .calc_num_ports = mos7840_calc_num_ports,
-#ifdef MCSSerialProbe
-        .probe = mos7840_serial_probe,
-#endif
+        .probe = mos7840_probe,
         .ioctl = mos7840_ioctl,
         .set_termios = mos7840_set_termios,
         .break_ctl = mos7840_break,
diff --git a/drivers/usb/serial/suunto.c b/drivers/usb/serial/suunto.c
new file mode 100644
index 000000000000..2248e7a7d5ad
--- /dev/null
+++ b/drivers/usb/serial/suunto.c
@@ -0,0 +1,41 @@
+/*
+ * Suunto ANT+ USB Driver
+ *
+ * Copyright (C) 2013 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+ * Copyright (C) 2013 Linux Foundation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation only.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+#include <linux/uaccess.h>
+
+static const struct usb_device_id id_table[] = {
+        { USB_DEVICE(0x0fcf, 0x1008) },
+        { },
+};
+MODULE_DEVICE_TABLE(usb, id_table);
+
+static struct usb_serial_driver suunto_device = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         KBUILD_MODNAME,
+        },
+        .id_table =             id_table,
+        .num_ports =            1,
+};
+
+static struct usb_serial_driver * const serial_drivers[] = {
+        &suunto_device,
+        NULL,
+};
+
+module_usb_serial_driver(serial_drivers, id_table);
+MODULE_LICENSE("GPL");
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index c5179e269df6..cef6002acbd4 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -137,8 +137,27 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
          */
         pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
 
-        if (vdev->reset_works)
-                __pci_reset_function(pdev);
+        /*
+         * Careful, device_lock may already be held.  This is the case if
+         * a driver unbind is blocked.  Try to get the locks ourselves to
+         * prevent a deadlock.
+         */
+        if (vdev->reset_works) {
+                bool reset_done = false;
+
+                if (pci_cfg_access_trylock(pdev)) {
+                        if (device_trylock(&pdev->dev)) {
+                                __pci_reset_function_locked(pdev);
+                                reset_done = true;
+                                device_unlock(&pdev->dev);
+                        }
+                        pci_cfg_access_unlock(pdev);
+                }
+
+                if (!reset_done)
+                        pr_warn("%s: Unable to acquire locks for reset of %s\n",
+                                __func__, dev_name(&pdev->dev));
+        }
 
         pci_restore_state(pdev);
 }
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index c488da5db7c7..842f4507883e 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -494,27 +494,6 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
         return 0;
 }
 
-static int vfio_group_nb_del_dev(struct vfio_group *group, struct device *dev)
-{
-        struct vfio_device *device;
-
-        /*
-         * Expect to fall out here.  If a device was in use, it would
-         * have been bound to a vfio sub-driver, which would have blocked
-         * in .remove at vfio_del_group_dev.  Sanity check that we no
-         * longer track the device, so it's safe to remove.
-         */
-        device = vfio_group_get_device(group, dev);
-        if (likely(!device))
-                return 0;
-
-        WARN("Device %s removed from live group %d!\n", dev_name(dev),
-             iommu_group_id(group->iommu_group));
-
-        vfio_device_put(device);
-        return 0;
-}
-
 static int vfio_group_nb_verify(struct vfio_group *group, struct device *dev)
 {
         /* We don't care what happens when the group isn't in use */
@@ -531,13 +510,11 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
         struct device *dev = data;
 
         /*
-         * Need to go through a group_lock lookup to get a reference or
-         * we risk racing a group being removed.  Leave a WARN_ON for
-         * debuging, but if the group no longer exists, a spurious notify
-         * is harmless.
+         * Need to go through a group_lock lookup to get a reference or we
+         * risk racing a group being removed.  Ignore spurious notifies.
          */
         group = vfio_group_try_get(group);
-        if (WARN_ON(!group))
+        if (!group)
                 return NOTIFY_OK;
 
         switch (action) {
@@ -545,7 +522,13 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
                 vfio_group_nb_add_dev(group, dev);
                 break;
         case IOMMU_GROUP_NOTIFY_DEL_DEVICE:
-                vfio_group_nb_del_dev(group, dev);
+                /*
+                 * Nothing to do here.  If the device is in use, then the
+                 * vfio sub-driver should block the remove callback until
+                 * it is unused.  If the device is unused or attached to a
+                 * stub driver, then it should be released and we don't
+                 * care that it will be going away.
+                 */
                 break;
         case IOMMU_GROUP_NOTIFY_BIND_DRIVER:
                 pr_debug("%s: Device %s, group %d binding to driver\n",
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index a89c15de9f45..9b0f12c5c284 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -435,8 +435,8 @@ static int correct_chipset(struct atyfb_par *par)
         const char *name;
         int i;
 
-        for (i = ARRAY_SIZE(aty_chips); i > 0; i--)
-                if (par->pci_id == aty_chips[i - 1].pci_id)
+        for (i = (int)ARRAY_SIZE(aty_chips) - 1; i >= 0; i--)
+                if (par->pci_id == aty_chips[i].pci_id)
                         break;
 
         if (i < 0)
diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index 3ba37713b1f9..dc09ebe4aba5 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -239,24 +239,6 @@ static const struct fb_bitfield def_rgb565[] = {
         }
 };
 
-static const struct fb_bitfield def_rgb666[] = {
-        [RED] = {
-                .offset = 16,
-                .length = 6,
-        },
-        [GREEN] = {
-                .offset = 8,
-                .length = 6,
-        },
-        [BLUE] = {
-                .offset = 0,
-                .length = 6,
-        },
-        [TRANSP] = {    /* no support for transparency */
-                .length = 0,
-        }
-};
-
 static const struct fb_bitfield def_rgb888[] = {
         [RED] = {
                 .offset = 16,
@@ -309,9 +291,6 @@ static int mxsfb_check_var(struct fb_var_screeninfo *var,
                         break;
                 case STMLCDIF_16BIT:
                 case STMLCDIF_18BIT:
-                        /* 24 bit to 18 bit mapping */
-                        rgb = def_rgb666;
-                        break;
                 case STMLCDIF_24BIT:
                         /* real 24 bit */
                         rgb = def_rgb888;
@@ -453,11 +432,6 @@ static int mxsfb_set_par(struct fb_info *fb_info)
                         return -EINVAL;
                 case STMLCDIF_16BIT:
                 case STMLCDIF_18BIT:
-                        /* 24 bit to 18 bit mapping */
-                        ctrl |= CTRL_DF24; /* ignore the upper 2 bits in
-                                            *  each colour component
-                                            */
-                        break;
                 case STMLCDIF_24BIT:
                         /* real 24 bit */
                         break;
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index 8c527e5b293c..796e5112ceee 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -587,8 +587,7 @@ static int nuc900fb_probe(struct platform_device *pdev)
         fbinfo->flags                   = FBINFO_FLAG_DEFAULT;
         fbinfo->pseudo_palette          = &fbi->pseudo_pal;
 
-        ret = request_irq(irq, nuc900fb_irqhandler, 0,
-                          pdev->name, fbinfo);
+        ret = request_irq(irq, nuc900fb_irqhandler, 0, pdev->name, fbi);
         if (ret) {
                 dev_err(&pdev->dev, "cannot register irq handler %d -err %d\n",
                         irq, ret);
diff --git a/drivers/video/omap2/displays-new/connector-analog-tv.c b/drivers/video/omap2/displays-new/connector-analog-tv.c
index 5338f362293b..1b60698f141e 100644
--- a/drivers/video/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/omap2/displays-new/connector-analog-tv.c
@@ -28,6 +28,20 @@ struct panel_drv_data {
         bool invert_polarity;
 };
 
+static const struct omap_video_timings tvc_pal_timings = {
+        .x_res          = 720,
+        .y_res          = 574,
+        .pixel_clock    = 13500,
+        .hsw            = 64,
+        .hfp            = 12,
+        .hbp            = 68,
+        .vsw            = 5,
+        .vfp            = 5,
+        .vbp            = 41,
+
+        .interlace      = true,
+};
+
 #define to_panel_data(x) container_of(x, struct panel_drv_data, dssdev)
 
 static int tvc_connect(struct omap_dss_device *dssdev)
@@ -212,14 +226,14 @@ static int tvc_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        ddata->timings = omap_dss_pal_timings;
+        ddata->timings = tvc_pal_timings;
 
         dssdev = &ddata->dssdev;
         dssdev->driver = &tvc_driver;
         dssdev->dev = &pdev->dev;
         dssdev->type = OMAP_DISPLAY_TYPE_VENC;
         dssdev->owner = THIS_MODULE;
-        dssdev->panel.timings = omap_dss_pal_timings;
+        dssdev->panel.timings = tvc_pal_timings;
 
         r = omapdss_register_display(dssdev);
         if (r) {
diff --git a/drivers/video/sgivwfb.c b/drivers/video/sgivwfb.c
index b2a8912f6435..a9ac3ce2d0e9 100644
--- a/drivers/video/sgivwfb.c
+++ b/drivers/video/sgivwfb.c
@@ -713,7 +713,7 @@ static int sgivwfb_mmap(struct fb_info *info,
         r = vm_iomap_memory(vma, sgivwfb_mem_phys, sgivwfb_mem_size);
 
         printk(KERN_DEBUG "sgivwfb: mmap framebuffer P(%lx)->V(%lx)\n",
-               offset, vma->vm_start);
+                sgivwfb_mem_phys + (vma->vm_pgoff << PAGE_SHIFT), vma->vm_start);
 
         return r;
 }
diff --git a/drivers/video/sh7760fb.c b/drivers/video/sh7760fb.c
index a8c6c43a4658..1265b25f9f99 100644
--- a/drivers/video/sh7760fb.c
+++ b/drivers/video/sh7760fb.c
@@ -567,7 +567,7 @@ static int sh7760fb_remove(struct platform_device *dev)
         fb_dealloc_cmap(&info->cmap);
         sh7760fb_free_mem(info);
         if (par->irq >= 0)
-                free_irq(par->irq, par);
+                free_irq(par->irq, &par->vsync);
         iounmap(par->base);
         release_mem_region(par->ioarea->start, resource_size(par->ioarea));
         framebuffer_release(info);
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 830ded45fd47..2827333703d9 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,7 +1265,6 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
 
 static void vga16fb_destroy(struct fb_info *info)
 {
-        struct platform_device *dev = container_of(info->device, struct platform_device, dev);
         iounmap(info->screen_base);
         fb_dealloc_cmap(&info->cmap);
         /* XXX unshare VGA regions */
diff --git a/drivers/video/xilinxfb.c b/drivers/video/xilinxfb.c
index f3d4a69e1e4e..6629b29a8202 100644
--- a/drivers/video/xilinxfb.c
+++ b/drivers/video/xilinxfb.c
@@ -341,8 +341,8 @@ static int xilinxfb_assign(struct platform_device *pdev,
 
         if (drvdata->flags & BUS_ACCESS_FLAG) {
                 /* Put a banner in the log (for DEBUG) */
-                dev_dbg(dev, "regs: phys=%x, virt=%p\n", drvdata->regs_phys,
-                                        drvdata->regs);
+                dev_dbg(dev, "regs: phys=%pa, virt=%p\n",
+                        &drvdata->regs_phys, drvdata->regs);
         }
         /* Put a banner in the log (for DEBUG) */
         dev_dbg(dev, "fb: phys=%llx, virt=%p, size=%x\n",
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 9e02d60a364b..23eae5cb69c2 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -145,7 +145,7 @@ config SWIOTLB_XEN
 
 config XEN_TMEM
         tristate
-        depends on !ARM
+        depends on !ARM && !ARM64
         default m if (CLEANCACHE || FRONTSWAP)
         help
           Shim to interface in-kernel Transcendent Memory hooks
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index eabd0ee1c2bc..14fe79d8634a 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -1,9 +1,8 @@
-ifneq ($(CONFIG_ARM),y)
-obj-y   += manage.o
+ifeq ($(filter y, $(CONFIG_ARM) $(CONFIG_ARM64)),)
 obj-$(CONFIG_HOTPLUG_CPU)               += cpu_hotplug.o
 endif
 obj-$(CONFIG_X86)                       += fallback.o
-obj-y   += grant-table.o features.o events.o balloon.o
+obj-y   += grant-table.o features.o events.o balloon.o manage.o
 obj-y   += xenbus/
 
 nostackp := $(call cc-option, -fno-stack-protector)
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 8feecf01d55c..b6165e047f48 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -379,18 +379,12 @@ static long evtchn_ioctl(struct file *file,
                 if (unbind.port >= NR_EVENT_CHANNELS)
                         break;
 
-                spin_lock_irq(&port_user_lock);
-
                 rc = -ENOTCONN;
-                if (get_port_user(unbind.port) != u) {
-                        spin_unlock_irq(&port_user_lock);
+                if (get_port_user(unbind.port) != u)
                         break;
-                }
 
                 disable_irq(irq_from_evtchn(unbind.port));
 
-                spin_unlock_irq(&port_user_lock);
-
                 evtchn_unbind_from_user(u, unbind.port);
 
                 rc = 0;
@@ -490,26 +484,15 @@ static int evtchn_release(struct inode *inode, struct file *filp)
         int i;
         struct per_user_data *u = filp->private_data;
 
-        spin_lock_irq(&port_user_lock);
-
-        free_page((unsigned long)u->ring);
-
         for (i = 0; i < NR_EVENT_CHANNELS; i++) {
                 if (get_port_user(i) != u)
                         continue;
 
                 disable_irq(irq_from_evtchn(i));
-        }
-
-        spin_unlock_irq(&port_user_lock);
-
-        for (i = 0; i < NR_EVENT_CHANNELS; i++) {
-                if (get_port_user(i) != u)
-                        continue;
-
                 evtchn_unbind_from_user(get_port_user(i), i);
         }
 
+        free_page((unsigned long)u->ring);
         kfree(u->name);
         kfree(u);
 
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 6ed8a9df4472..34b20bfa4e8c 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -115,7 +115,6 @@ static int xenbus_frontend_dev_resume(struct device *dev)
                         return -EFAULT;
                 }
 
-                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
                 queue_work(xenbus_frontend_wq, &xdev->work);
 
                 return 0;
@@ -124,6 +123,16 @@ static int xenbus_frontend_dev_resume(struct device *dev)
         return xenbus_dev_resume(dev);
 }
 
+static int xenbus_frontend_dev_probe(struct device *dev)
+{
+        if (xen_store_domain_type == XS_LOCAL) {
+                struct xenbus_device *xdev = to_xenbus_device(dev);
+                INIT_WORK(&xdev->work, xenbus_frontend_delayed_resume);
+        }
+
+        return xenbus_dev_probe(dev);
+}
+
 static const struct dev_pm_ops xenbus_pm_ops = {
         .suspend        = xenbus_dev_suspend,
         .resume         = xenbus_frontend_dev_resume,
@@ -142,7 +151,7 @@ static struct xen_bus_type xenbus_frontend = {
                 .name           = "xen",
                 .match          = xenbus_match,
                 .uevent         = xenbus_uevent_frontend,
-                .probe          = xenbus_dev_probe,
+                .probe          = xenbus_frontend_dev_probe,
                 .remove         = xenbus_dev_remove,
                 .shutdown       = xenbus_dev_shutdown,
                 .dev_attrs      = xenbus_dev_attrs,
@@ -474,7 +483,11 @@ static int __init xenbus_probe_frontend_init(void)
 
         register_xenstore_notifier(&xenstore_notifier);
 
-        xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+        if (xen_store_domain_type == XS_LOCAL) {
+                xenbus_frontend_wq = create_workqueue("xenbus_frontend");
+                if (!xenbus_frontend_wq)
+                        pr_warn("create xenbus frontend workqueue failed, S3 resume is likely to fail\n");
+        }
 
         return 0;
 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index eaf133384a8f..8bc5e8ccb091 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -36,16 +36,23 @@ static int check_extent_in_eb(struct btrfs_key *key, struct extent_buffer *eb,
                                 u64 extent_item_pos,
                                 struct extent_inode_elem **eie)
 {
-        u64 data_offset;
-        u64 data_len;
+        u64 offset = 0;
         struct extent_inode_elem *e;
 
-        data_offset = btrfs_file_extent_offset(eb, fi);
-        data_len = btrfs_file_extent_num_bytes(eb, fi);
+        if (!btrfs_file_extent_compression(eb, fi) &&
+            !btrfs_file_extent_encryption(eb, fi) &&
+            !btrfs_file_extent_other_encoding(eb, fi)) {
+                u64 data_offset;
+                u64 data_len;
 
-        if (extent_item_pos < data_offset ||
-            extent_item_pos >= data_offset + data_len)
-                return 1;
+                data_offset = btrfs_file_extent_offset(eb, fi);
+                data_len = btrfs_file_extent_num_bytes(eb, fi);
+
+                if (extent_item_pos < data_offset ||
+                    extent_item_pos >= data_offset + data_len)
+                        return 1;
+                offset = extent_item_pos - data_offset;
+        }
 
         e = kmalloc(sizeof(*e), GFP_NOFS);
         if (!e)
@@ -53,7 +60,7 @@ static int check_extent_in_eb(struct btrfs_key *key, struct extent_buffer *eb,
 
         e->next = *eie;
         e->inum = key->objectid;
-        e->offset = key->offset + (extent_item_pos - data_offset);
+        e->offset = key->offset + offset;
         *eie = e;
 
         return 0;
@@ -189,7 +196,7 @@ static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
         struct extent_buffer *eb;
         struct btrfs_key key;
         struct btrfs_file_extent_item *fi;
-        struct extent_inode_elem *eie = NULL;
+        struct extent_inode_elem *eie = NULL, *old = NULL;
         u64 disk_byte;
 
         if (level != 0) {
@@ -223,6 +230,7 @@ static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
 
                 if (disk_byte == wanted_disk_byte) {
                         eie = NULL;
+                        old = NULL;
                         if (extent_item_pos) {
                                 ret = check_extent_in_eb(&key, eb, fi,
                                                 *extent_item_pos,
@@ -230,18 +238,20 @@ static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
                                 if (ret < 0)
                                         break;
                         }
-                        if (!ret) {
-                                ret = ulist_add(parents, eb->start,
-                                                (uintptr_t)eie, GFP_NOFS);
-                                if (ret < 0)
-                                        break;
-                                if (!extent_item_pos) {
-                                        ret = btrfs_next_old_leaf(root, path,
-                                                        time_seq);
-                                        continue;
-                                }
+                        if (ret > 0)
+                                goto next;
+                        ret = ulist_add_merge(parents, eb->start,
+                                              (uintptr_t)eie,
+                                              (u64 *)&old, GFP_NOFS);
+                        if (ret < 0)
+                                break;
+                        if (!ret && extent_item_pos) {
+                                while (old->next)
+                                        old = old->next;
+                                old->next = eie;
                         }
                 }
+next:
                 ret = btrfs_next_old_item(root, path, time_seq);
         }
 
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 5bf4c39e2ad6..ed504607d8ec 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1271,7 +1271,6 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
                 BUG_ON(!eb_rewin);
         }
 
-        extent_buffer_get(eb_rewin);
         btrfs_tree_read_unlock(eb);
         free_extent_buffer(eb);
 
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 583d98bd065e..fe443fece851 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4048,7 +4048,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         }
 
         while (!end) {
-                u64 offset_in_extent;
+                u64 offset_in_extent = 0;
 
                 /* break if the extent we found is outside the range */
                 if (em->start >= max || extent_map_end(em) < off)
@@ -4064,9 +4064,12 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 
                 /*
                  * record the offset from the start of the extent
-                 * for adjusting the disk offset below
+                 * for adjusting the disk offset below.  Only do this if the
+                 * extent isn't compressed since our in ram offset may be past
+                 * what we have actually allocated on disk.
                  */
-                offset_in_extent = em_start - em->start;
+                if (!test_bit(EXTENT_FLAG_COMPRESSED, &em->flags))
+                        offset_in_extent = em_start - em->start;
                 em_end = extent_map_end(em);
                 em_len = em_end - em_start;
                 emflags = em->flags;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a005fe2c072a..8e686a427ce2 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -596,20 +596,29 @@ void btrfs_drop_extent_cache(struct inode *inode, u64 start, u64 end,
                 if (no_splits)
                         goto next;
 
-                if (em->block_start < EXTENT_MAP_LAST_BYTE &&
-                    em->start < start) {
+                if (em->start < start) {
                         split->start = em->start;
                         split->len = start - em->start;
-                        split->orig_start = em->orig_start;
-                        split->block_start = em->block_start;
 
-                        if (compressed)
-                                split->block_len = em->block_len;
-                        else
-                                split->block_len = split->len;
-                        split->ram_bytes = em->ram_bytes;
-                        split->orig_block_len = max(split->block_len,
-                                                    em->orig_block_len);
+                        if (em->block_start < EXTENT_MAP_LAST_BYTE) {
+                                split->orig_start = em->orig_start;
+                                split->block_start = em->block_start;
+
+                                if (compressed)
+                                        split->block_len = em->block_len;
+                                else
+                                        split->block_len = split->len;
+                                split->orig_block_len = max(split->block_len,
+                                                em->orig_block_len);
+                                split->ram_bytes = em->ram_bytes;
+                        } else {
+                                split->orig_start = split->start;
+                                split->block_len = 0;
+                                split->block_start = em->block_start;
+                                split->orig_block_len = 0;
+                                split->ram_bytes = split->len;
+                        }
+
                         split->generation = gen;
                         split->bdev = em->bdev;
                         split->flags = flags;
@@ -620,8 +629,7 @@ void btrfs_drop_extent_cache(struct inode *inode, u64 start, u64 end,
                         split = split2;
                         split2 = NULL;
                 }
-                if (em->block_start < EXTENT_MAP_LAST_BYTE &&
-                    testend && em->start + em->len > start + len) {
+                if (testend && em->start + em->len > start + len) {
                         u64 diff = start + len - em->start;
 
                         split->start = start + len;
@@ -630,18 +638,28 @@ void btrfs_drop_extent_cache(struct inode *inode, u64 start, u64 end,
                         split->flags = flags;
                         split->compress_type = em->compress_type;
                         split->generation = gen;
-                        split->orig_block_len = max(em->block_len,
+
+                        if (em->block_start < EXTENT_MAP_LAST_BYTE) {
+                                split->orig_block_len = max(em->block_len,
                                                     em->orig_block_len);
-                        split->ram_bytes = em->ram_bytes;
 
-                        if (compressed) {
-                                split->block_len = em->block_len;
-                                split->block_start = em->block_start;
-                                split->orig_start = em->orig_start;
+                                split->ram_bytes = em->ram_bytes;
+                                if (compressed) {
+                                        split->block_len = em->block_len;
+                                        split->block_start = em->block_start;
+                                        split->orig_start = em->orig_start;
+                                } else {
+                                        split->block_len = split->len;
+                                        split->block_start = em->block_start
+                                                + diff;
+                                        split->orig_start = em->orig_start;
+                                }
                         } else {
-                                split->block_len = split->len;
-                                split->block_start = em->block_start + diff;
-                                split->orig_start = em->orig_start;
+                                split->ram_bytes = split->len;
+                                split->orig_start = split->start;
+                                split->block_len = 0;
+                                split->block_start = em->block_start;
+                                split->orig_block_len = 0;
                         }
 
                         ret = add_extent_mapping(em_tree, split, modified);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 6d1b93c8aafb..021694c08181 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2166,16 +2166,23 @@ static noinline int record_one_backref(u64 inum, u64 offset, u64 root_id,
                 if (btrfs_file_extent_disk_bytenr(leaf, extent) != old->bytenr)
                         continue;
 
-                extent_offset = btrfs_file_extent_offset(leaf, extent);
-                if (key.offset - extent_offset != offset)
+                /*
+                 * 'offset' refers to the exact key.offset,
+                 * NOT the 'offset' field in btrfs_extent_data_ref, ie.
+                 * (key.offset - extent_offset).
+                 */
+                if (key.offset != offset)
                         continue;
 
+                extent_offset = btrfs_file_extent_offset(leaf, extent);
                 num_bytes = btrfs_file_extent_num_bytes(leaf, extent);
+
                 if (extent_offset >= old->extent_offset + old->offset +
                     old->len || extent_offset + num_bytes <=
                     old->extent_offset + old->offset)
                         continue;
 
+                ret = 0;
                 break;
         }
 
@@ -2187,7 +2194,7 @@ static noinline int record_one_backref(u64 inum, u64 offset, u64 root_id,
 
         backref->root_id = root_id;
         backref->inum = inum;
-        backref->file_pos = offset + extent_offset;
+        backref->file_pos = offset;
         backref->num_bytes = num_bytes;
         backref->extent_offset = extent_offset;
         backref->generation = btrfs_file_extent_generation(leaf, extent);
@@ -2210,7 +2217,8 @@ static noinline bool record_extent_backrefs(struct btrfs_path *path,
         new->path = path;
 
         list_for_each_entry_safe(old, tmp, &new->head, list) {
-                ret = iterate_inodes_from_logical(old->bytenr, fs_info,
+                ret = iterate_inodes_from_logical(old->bytenr +
+                                                  old->extent_offset, fs_info,
                                                   path, record_one_backref,
                                                   old);
                 BUG_ON(ret < 0 && ret != -ENOENT);
@@ -4391,9 +4399,6 @@ static int btrfs_setsize(struct inode *inode, struct iattr *attr)
         int mask = attr->ia_valid;
         int ret;
 
-        if (newsize == oldsize)
-                return 0;
-
         /*
          * The regular truncate() case without ATTR_CTIME and ATTR_MTIME is a
          * special case where we need to update the times despite not having
@@ -5165,14 +5170,31 @@ next:
         }
 
         /* Reached end of directory/root. Bump pos past the last item. */
-        if (key_type == BTRFS_DIR_INDEX_KEY)
-                /*
-                 * 32-bit glibc will use getdents64, but then strtol -
-                 * so the last number we can serve is this.
-                 */
-                ctx->pos = 0x7fffffff;
-        else
-                ctx->pos++;
+        ctx->pos++;
+
+        /*
+         * Stop new entries from being returned after we return the last
+         * entry.
+         *
+         * New directory entries are assigned a strictly increasing
+         * offset.  This means that new entries created during readdir
+         * are *guaranteed* to be seen in the future by that readdir.
+         * This has broken buggy programs which operate on names as
+         * they're returned by readdir.  Until we re-use freed offsets
+         * we have this hack to stop new entries from being returned
+         * under the assumption that they'll never reach this huge
+         * offset.
+         *
+         * This is being careful not to overflow 32bit loff_t unless the
+         * last entry requires it because doing so has broken 32bit apps
+         * in the past.
+         */
+        if (key_type == BTRFS_DIR_INDEX_KEY) {
+                if (ctx->pos >= INT_MAX)
+                        ctx->pos = LLONG_MAX;
+                else
+                        ctx->pos = INT_MAX;
+        }
 nopos:
         ret = 0;
 err:
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index d58cce77fc6c..af1931a5960d 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -983,12 +983,12 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
  * a dirty root struct and adds it into the list of dead roots that need to
  * be deleted
  */
-int btrfs_add_dead_root(struct btrfs_root *root)
+void btrfs_add_dead_root(struct btrfs_root *root)
 {
         spin_lock(&root->fs_info->trans_lock);
-        list_add_tail(&root->root_list, &root->fs_info->dead_roots);
+        if (list_empty(&root->root_list))
+                list_add_tail(&root->root_list, &root->fs_info->dead_roots);
         spin_unlock(&root->fs_info->trans_lock);
-        return 0;
 }
 
 /*
@@ -1925,7 +1925,7 @@ int btrfs_clean_one_deleted_snapshot(struct btrfs_root *root)
         }
         root = list_first_entry(&fs_info->dead_roots,
                         struct btrfs_root, root_list);
-        list_del(&root->root_list);
+        list_del_init(&root->root_list);
         spin_unlock(&fs_info->trans_lock);
 
         pr_debug("btrfs: cleaner removing %llu\n",
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 005b0375d18c..defbc4269897 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -143,7 +143,7 @@ int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid);
 int btrfs_write_and_wait_transaction(struct btrfs_trans_handle *trans,
                                      struct btrfs_root *root);
 
-int btrfs_add_dead_root(struct btrfs_root *root);
+void btrfs_add_dead_root(struct btrfs_root *root);
 int btrfs_defrag_root(struct btrfs_root *root);
 int btrfs_clean_one_deleted_snapshot(struct btrfs_root *root);
 int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 2c6791493637..ff60d8978ae2 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3746,8 +3746,9 @@ next_slot:
         }
 
 log_extents:
+        btrfs_release_path(path);
+        btrfs_release_path(dst_path);
         if (fast_search) {
-                btrfs_release_path(dst_path);
                 ret = btrfs_log_changed_extents(trans, root, inode, dst_path);
                 if (ret) {
                         err = ret;
@@ -3764,8 +3765,6 @@ log_extents:
         }
 
         if (inode_only == LOG_INODE_ALL && S_ISDIR(inode->i_mode)) {
-                btrfs_release_path(path);
-                btrfs_release_path(dst_path);
                 ret = log_directory_changes(trans, root, inode, path, dst_path);
                 if (ret) {
                         err = ret;
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 4888cb3fdef7..c7c83ff0f752 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -533,8 +533,7 @@ EXPORT_SYMBOL_GPL(debugfs_remove);
  */
 void debugfs_remove_recursive(struct dentry *dentry)
 {
-        struct dentry *child;
-        struct dentry *parent;
+        struct dentry *child, *next, *parent;
 
         if (IS_ERR_OR_NULL(dentry))
                 return;
@@ -544,61 +543,37 @@ void debugfs_remove_recursive(struct dentry *dentry)
                 return;
 
         parent = dentry;
+ down:
         mutex_lock(&parent->d_inode->i_mutex);
+        list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) {
+                if (!debugfs_positive(child))
+                        continue;
 
-        while (1) {
-                /*
-                 * When all dentries under "parent" has been removed,
-                 * walk up the tree until we reach our starting point.
-                 */
-                if (list_empty(&parent->d_subdirs)) {
-                        mutex_unlock(&parent->d_inode->i_mutex);
-                        if (parent == dentry)
-                                break;
-                        parent = parent->d_parent;
-                        mutex_lock(&parent->d_inode->i_mutex);
-                }
-                child = list_entry(parent->d_subdirs.next, struct dentry,
-                                d_u.d_child);
- next_sibling:
-
-                /*
-                 * If "child" isn't empty, walk down the tree and
-                 * remove all its descendants first.
-                 */
+                /* perhaps simple_empty(child) makes more sense */
                 if (!list_empty(&child->d_subdirs)) {
                         mutex_unlock(&parent->d_inode->i_mutex);
                         parent = child;
-                        mutex_lock(&parent->d_inode->i_mutex);
-                        continue;
+                        goto down;
                 }
-                __debugfs_remove(child, parent);
-                if (parent->d_subdirs.next == &child->d_u.d_child) {
-                        /*
-                         * Try the next sibling.
-                         */
-                        if (child->d_u.d_child.next != &parent->d_subdirs) {
-                                child = list_entry(child->d_u.d_child.next,
-                                                   struct dentry,
-                                                   d_u.d_child);
-                                goto next_sibling;
-                        }
-
-                        /*
-                         * Avoid infinite loop if we fail to remove
-                         * one dentry.
-                         */
-                        mutex_unlock(&parent->d_inode->i_mutex);
-                        break;
-                }
-                simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ up:
+                if (!__debugfs_remove(child, parent))
+                        simple_release_fs(&debugfs_mount, &debugfs_mount_count);
         }
 
-        parent = dentry->d_parent;
+        mutex_unlock(&parent->d_inode->i_mutex);
+        child = parent;
+        parent = parent->d_parent;
         mutex_lock(&parent->d_inode->i_mutex);
-        __debugfs_remove(dentry, parent);
+
+        if (child != dentry) {
+                next = list_entry(child->d_u.d_child.next, struct dentry,
+                                        d_u.d_child);
+                goto up;
+        }
+
+        if (!__debugfs_remove(child, parent))
+                simple_release_fs(&debugfs_mount, &debugfs_mount_count);
         mutex_unlock(&parent->d_inode->i_mutex);
-        simple_release_fs(&debugfs_mount, &debugfs_mount_count);
 }
 EXPORT_SYMBOL_GPL(debugfs_remove_recursive);
 
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 911649a47dd5..812149119fa3 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -686,7 +686,6 @@ static int device_close(struct inode *inode, struct file *file)
            device_remove_lockspace() */
 
         sigprocmask(SIG_SETMASK, &tmpsig, NULL);
-        recalc_sigpending();
 
         return 0;
 }
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index a61873808f76..72ba4705d4fa 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4412,7 +4412,7 @@ void ext4_ext_truncate(handle_t *handle, struct inode *inode)
 retry:
         err = ext4_es_remove_extent(inode, last_block,
                                     EXT_MAX_BLOCKS - last_block);
-        if (err == ENOMEM) {
+        if (err == -ENOMEM) {
                 cond_resched();
                 congestion_wait(BLK_RW_ASYNC, HZ/50);
                 goto retry;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index f03598c6ffd3..8bf5999875ee 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -734,11 +734,8 @@ repeat_in_this_group:
                 ino = ext4_find_next_zero_bit((unsigned long *)
                                               inode_bitmap_bh->b_data,
                                               EXT4_INODES_PER_GROUP(sb), ino);
-                if (ino >= EXT4_INODES_PER_GROUP(sb)) {
-                        if (++group == ngroups)
-                                group = 0;
-                        continue;
-                }
+                if (ino >= EXT4_INODES_PER_GROUP(sb))
+                        goto next_group;
                 if (group == 0 && (ino+1) < EXT4_FIRST_INO(sb)) {
                         ext4_error(sb, "reserved inode found cleared - "
                                    "inode=%lu", ino + 1);
@@ -769,6 +766,9 @@ repeat_in_this_group:
                         goto got; /* we grabbed the inode! */
                 if (ino < EXT4_INODES_PER_GROUP(sb))
                         goto repeat_in_this_group;
+next_group:
+                if (++group == ngroups)
+                        group = 0;
         }
         err = -ENOSPC;
         goto out;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ba33c67d6e48..dd32a2eacd0d 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -555,14 +555,13 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
                 int ret;
                 unsigned long long status;
 
-#ifdef ES_AGGRESSIVE_TEST
-                if (retval != map->m_len) {
-                        printk("ES len assertion failed for inode: %lu "
-                               "retval %d != map->m_len %d "
-                               "in %s (lookup)\n", inode->i_ino, retval,
-                               map->m_len, __func__);
+                if (unlikely(retval != map->m_len)) {
+                        ext4_warning(inode->i_sb,
+                                     "ES len assertion failed for inode "
+                                     "%lu: retval %d != map->m_len %d",
+                                     inode->i_ino, retval, map->m_len);
+                        WARN_ON(1);
                 }
-#endif
 
                 status = map->m_flags & EXT4_MAP_UNWRITTEN ?
                                 EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
@@ -656,14 +655,13 @@ found:
                 int ret;
                 unsigned long long status;
 
-#ifdef ES_AGGRESSIVE_TEST
-                if (retval != map->m_len) {
-                        printk("ES len assertion failed for inode: %lu "
-                               "retval %d != map->m_len %d "
-                               "in %s (allocation)\n", inode->i_ino, retval,
-                               map->m_len, __func__);
+                if (unlikely(retval != map->m_len)) {
+                        ext4_warning(inode->i_sb,
+                                     "ES len assertion failed for inode "
+                                     "%lu: retval %d != map->m_len %d",
+                                     inode->i_ino, retval, map->m_len);
+                        WARN_ON(1);
                 }
-#endif
 
                 /*
                  * If the extent has been zeroed out, we don't need to update
@@ -1637,14 +1635,13 @@ add_delayed:
                 int ret;
                 unsigned long long status;
 
-#ifdef ES_AGGRESSIVE_TEST
-                if (retval != map->m_len) {
-                        printk("ES len assertion failed for inode: %lu "
-                               "retval %d != map->m_len %d "
-                               "in %s (lookup)\n", inode->i_ino, retval,
-                               map->m_len, __func__);
+                if (unlikely(retval != map->m_len)) {
+                        ext4_warning(inode->i_sb,
+                                     "ES len assertion failed for inode "
+                                     "%lu: retval %d != map->m_len %d",
+                                     inode->i_ino, retval, map->m_len);
+                        WARN_ON(1);
                 }
-#endif
 
                 status = map->m_flags & EXT4_MAP_UNWRITTEN ?
                                 EXTENT_STATUS_UNWRITTEN : EXTENT_STATUS_WRITTEN;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index bca26f34edf4..36b141e420b7 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5481,6 +5481,7 @@ static void __exit ext4_exit_fs(void)
         kset_unregister(ext4_kset);
         ext4_exit_system_zone();
         ext4_exit_pageio();
+        ext4_exit_es();
 }
 
 MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 6599222536eb..65343c3741ff 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -730,14 +730,14 @@ static int __init fcntl_init(void)
          * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
          * is defined as O_NONBLOCK on some platforms and not on others.
          */
-        BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
+        BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
                 O_RDONLY        | O_WRONLY      | O_RDWR        |
                 O_CREAT         | O_EXCL        | O_NOCTTY      |
                 O_TRUNC         | O_APPEND      | /* O_NONBLOCK | */
                 __O_SYNC        | O_DSYNC       | FASYNC        |
                 O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                 O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                __FMODE_EXEC    | O_PATH
+                __FMODE_EXEC    | O_PATH        | __O_TMPFILE
                 ));
 
         fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 01bfe7662751..41e491b8e5d7 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -64,12 +64,17 @@ struct nlm_host *nlmclnt_init(const struct nlmclnt_initdata *nlm_init)
                                    nlm_init->protocol, nlm_version,
                                    nlm_init->hostname, nlm_init->noresvport,
                                    nlm_init->net);
-        if (host == NULL) {
-                lockd_down(nlm_init->net);
-                return ERR_PTR(-ENOLCK);
-        }
+        if (host == NULL)
+                goto out_nohost;
+        if (host->h_rpcclnt == NULL && nlm_bind_host(host) == NULL)
+                goto out_nobind;
 
         return host;
+out_nobind:
+        nlmclnt_release_host(host);
+out_nohost:
+        lockd_down(nlm_init->net);
+        return ERR_PTR(-ENOLCK);
 }
 EXPORT_SYMBOL_GPL(nlmclnt_init);
 
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index 9760ecb9b60f..acd394716349 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -125,14 +125,15 @@ static void nlmclnt_setlockargs(struct nlm_rqst *req, struct file_lock *fl)
 {
         struct nlm_args *argp = &req->a_args;
         struct nlm_lock *lock = &argp->lock;
+        char *nodename = req->a_host->h_rpcclnt->cl_nodename;
 
         nlmclnt_next_cookie(&argp->cookie);
         memcpy(&lock->fh, NFS_FH(file_inode(fl->fl_file)), sizeof(struct nfs_fh));
-        lock->caller  = utsname()->nodename;
+        lock->caller  = nodename;
         lock->oh.data = req->a_owner;
         lock->oh.len  = snprintf(req->a_owner, sizeof(req->a_owner), "%u@%s",
                                 (unsigned int)fl->fl_u.nfs_fl.owner->pid,
-                                utsname()->nodename);
+                                nodename);
         lock->svid = fl->fl_u.nfs_fl.owner->pid;
         lock->fl.fl_start = fl->fl_start;
         lock->fl.fl_end = fl->fl_end;
diff --git a/fs/namei.c b/fs/namei.c
index 8b61d103a8a7..89a612e392eb 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3671,15 +3671,11 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
         if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
                 return -EINVAL;
         /*
-         * To use null names we require CAP_DAC_READ_SEARCH
-         * This ensures that not everyone will be able to create
-         * handlink using the passed filedescriptor.
+         * Using empty names is equivalent to using AT_SYMLINK_FOLLOW
+         * on /proc/self/fd/<fd>.
          */
-        if (flags & AT_EMPTY_PATH) {
-                if (!capable(CAP_DAC_READ_SEARCH))
-                        return -ENOENT;
+        if (flags & AT_EMPTY_PATH)
                 how = LOOKUP_EMPTY;
-        }
 
         if (flags & AT_SYMLINK_FOLLOW)
                 how |= LOOKUP_FOLLOW;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index af6e806044d7..941246f2b43d 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -463,7 +463,6 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr, st
                 unlock_new_inode(inode);
         } else
                 nfs_refresh_inode(inode, fattr);
-                nfs_setsecurity(inode, fattr, label);
         dprintk("NFS: nfs_fhget(%s/%Ld fh_crc=0x%08x ct=%d)\n",
                 inode->i_sb->s_id,
                 (long long)NFS_FILEID(inode),
@@ -963,9 +962,15 @@ EXPORT_SYMBOL_GPL(nfs_revalidate_inode);
 static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
-        
+        int ret;
+
         if (mapping->nrpages != 0) {
-                int ret = invalidate_inode_pages2(mapping);
+                if (S_ISREG(inode->i_mode)) {
+                        ret = nfs_sync_mapping(mapping);
+                        if (ret < 0)
+                                return ret;
+                }
+                ret = invalidate_inode_pages2(mapping);
                 if (ret < 0)
                         return ret;
         }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index cf11799297c4..108a774095f7 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3071,15 +3071,13 @@ struct rpc_clnt *
 nfs4_proc_lookup_mountpoint(struct inode *dir, struct qstr *name,
                             struct nfs_fh *fhandle, struct nfs_fattr *fattr)
 {
+        struct rpc_clnt *client = NFS_CLIENT(dir);
         int status;
-        struct rpc_clnt *client = rpc_clone_client(NFS_CLIENT(dir));
 
         status = nfs4_proc_lookup_common(&client, dir, name, fhandle, fattr, NULL);
-        if (status < 0) {
-                rpc_shutdown_client(client);
+        if (status < 0)
                 return ERR_PTR(status);
-        }
-        return client;
+        return (client == NFS_CLIENT(dir)) ? rpc_clone_client(client) : client;
 }
 
 static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 71fdc0dfa0d2..f6db66d8f647 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2478,6 +2478,10 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server,
         if (server->flags & NFS_MOUNT_NOAC)
                 sb_mntdata.mntflags |= MS_SYNCHRONOUS;
 
+        if (mount_info->cloned != NULL && mount_info->cloned->sb != NULL)
+                if (mount_info->cloned->sb->s_flags & MS_SYNCHRONOUS)
+                        sb_mntdata.mntflags |= MS_SYNCHRONOUS;
+
         /* Get a superblock - note that we may end up sharing one that already exists */
         s = sget(nfs_mod->nfs_fs, compare_super, nfs_set_super, flags, &sb_mntdata);
         if (IS_ERR(s)) {
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 0d4c410e4589..419572f33b72 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1524,7 +1524,7 @@ static inline u32 nfsd4_write_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
 static inline u32 nfsd4_exchange_id_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op)
 {
         return (op_encode_hdr_size + 2 + 1 + /* eir_clientid, eir_sequenceid */\
-                1 + 1 + 0 + /* eir_flags, spr_how, SP4_NONE (for now) */\
+                1 + 1 + 2 + /* eir_flags, spr_how, spo_must_enforce & _allow */\
                 2 + /*eir_server_owner.so_minor_id */\
                 /* eir_server_owner.so_major_id<> */\
                 XDR_QUADLEN(NFS4_OPAQUE_LIMIT) + 1 +\
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 280acef6f0dc..43f42290e5df 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1264,6 +1264,8 @@ static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
         struct svc_cred *cr = &rqstp->rq_cred;
         u32 service;
 
+        if (!cr->cr_gss_mech)
+                return false;
         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
         return service == RPC_GSS_SVC_INTEGRITY ||
                service == RPC_GSS_SVC_PRIVACY;
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 0c0f3ea90de5..c2a4701d7286 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3360,7 +3360,8 @@ nfsd4_encode_exchange_id(struct nfsd4_compoundres *resp, __be32 nfserr,
                 8 /* eir_clientid */ +
                 4 /* eir_sequenceid */ +
                 4 /* eir_flags */ +
-                4 /* spr_how (SP4_NONE) */ +
+                4 /* spr_how */ +
+                8 /* spo_must_enforce, spo_must_allow */ +
                 8 /* so_minor_id */ +
                 4 /* so_major_id.len */ +
                 (XDR_QUADLEN(major_id_sz) * 4) +
@@ -3372,8 +3373,6 @@ nfsd4_encode_exchange_id(struct nfsd4_compoundres *resp, __be32 nfserr,
         WRITE32(exid->seqid);
         WRITE32(exid->flags);
 
-        /* state_protect4_r. Currently only support SP4_NONE */
-        BUG_ON(exid->spa_how != SP4_NONE);
         WRITE32(exid->spa_how);
         switch (exid->spa_how) {
         case SP4_NONE:
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 998b17eda09d..9f6b96a09615 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -2965,6 +2965,11 @@ int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                         to = map_end & (PAGE_CACHE_SIZE - 1);
 
                 page = find_or_create_page(mapping, page_index, GFP_NOFS);
+                if (!page) {
+                        ret = -ENOMEM;
+                        mlog_errno(ret);
+                        break;
+                }
 
                 /*
                  * In case PAGE_CACHE_SIZE <= CLUSTER_SIZE, This page
diff --git a/fs/open.c b/fs/open.c
index d53e29895082..7931f76acc2b 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -823,7 +823,7 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
         int lookup_flags = 0;
         int acc_mode;
 
-        if (flags & O_CREAT)
+        if (flags & (O_CREAT | __O_TMPFILE))
                 op->mode = (mode & S_IALLUGO) | S_IFREG;
         else
                 op->mode = 0;
diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
index 33532f79b4f7..a958444a75fc 100644
--- a/fs/reiserfs/procfs.c
+++ b/fs/reiserfs/procfs.c
@@ -19,12 +19,13 @@
 /*
  * LOCKING:
  *
- * We rely on new Alexander Viro's super-block locking.
+ * These guys are evicted from procfs as the very first step in ->kill_sb().
  *
  */
 
-static int show_version(struct seq_file *m, struct super_block *sb)
+static int show_version(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         char *format;
 
         if (REISERFS_SB(sb)->s_properties & (1 << REISERFS_3_6)) {
@@ -66,8 +67,9 @@ static int show_version(struct seq_file *m, struct super_block *sb)
 #define DJP( x ) le32_to_cpu( jp -> x )
 #define JF( x ) ( r -> s_journal -> x )
 
-static int show_super(struct seq_file *m, struct super_block *sb)
+static int show_super(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         struct reiserfs_sb_info *r = REISERFS_SB(sb);
 
         seq_printf(m, "state: \t%s\n"
@@ -128,8 +130,9 @@ static int show_super(struct seq_file *m, struct super_block *sb)
         return 0;
 }
 
-static int show_per_level(struct seq_file *m, struct super_block *sb)
+static int show_per_level(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         struct reiserfs_sb_info *r = REISERFS_SB(sb);
         int level;
 
@@ -186,8 +189,9 @@ static int show_per_level(struct seq_file *m, struct super_block *sb)
         return 0;
 }
 
-static int show_bitmap(struct seq_file *m, struct super_block *sb)
+static int show_bitmap(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         struct reiserfs_sb_info *r = REISERFS_SB(sb);
 
         seq_printf(m, "free_block: %lu\n"
@@ -218,8 +222,9 @@ static int show_bitmap(struct seq_file *m, struct super_block *sb)
         return 0;
 }
 
-static int show_on_disk_super(struct seq_file *m, struct super_block *sb)
+static int show_on_disk_super(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         struct reiserfs_sb_info *sb_info = REISERFS_SB(sb);
         struct reiserfs_super_block *rs = sb_info->s_rs;
         int hash_code = DFL(s_hash_function_code);
@@ -261,8 +266,9 @@ static int show_on_disk_super(struct seq_file *m, struct super_block *sb)
         return 0;
 }
 
-static int show_oidmap(struct seq_file *m, struct super_block *sb)
+static int show_oidmap(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         struct reiserfs_sb_info *sb_info = REISERFS_SB(sb);
         struct reiserfs_super_block *rs = sb_info->s_rs;
         unsigned int mapsize = le16_to_cpu(rs->s_v1.s_oid_cursize);
@@ -291,8 +297,9 @@ static int show_oidmap(struct seq_file *m, struct super_block *sb)
         return 0;
 }
 
-static int show_journal(struct seq_file *m, struct super_block *sb)
+static int show_journal(struct seq_file *m, void *unused)
 {
+        struct super_block *sb = m->private;
         struct reiserfs_sb_info *r = REISERFS_SB(sb);
         struct reiserfs_super_block *rs = r->s_rs;
         struct journal_params *jp = &rs->s_v1.s_journal;
@@ -383,92 +390,24 @@ static int show_journal(struct seq_file *m, struct super_block *sb)
         return 0;
 }
 
-/* iterator */
-static int test_sb(struct super_block *sb, void *data)
-{
-        return data == sb;
-}
-
-static int set_sb(struct super_block *sb, void *data)
-{
-        return -ENOENT;
-}
-
-struct reiserfs_seq_private {
-        struct super_block *sb;
-        int (*show) (struct seq_file *, struct super_block *);
-};
-
-static void *r_start(struct seq_file *m, loff_t * pos)
-{
-        struct reiserfs_seq_private *priv = m->private;
-        loff_t l = *pos;
-
-        if (l)
-                return NULL;
-
-        if (IS_ERR(sget(&reiserfs_fs_type, test_sb, set_sb, 0, priv->sb)))
-                return NULL;
-
-        up_write(&priv->sb->s_umount);
-        return priv->sb;
-}
-
-static void *r_next(struct seq_file *m, void *v, loff_t * pos)
-{
-        ++*pos;
-        if (v)
-                deactivate_super(v);
-        return NULL;
-}
-
-static void r_stop(struct seq_file *m, void *v)
-{
-        if (v)
-                deactivate_super(v);
-}
-
-static int r_show(struct seq_file *m, void *v)
-{
-        struct reiserfs_seq_private *priv = m->private;
-        return priv->show(m, v);
-}
-
-static const struct seq_operations r_ops = {
-        .start = r_start,
-        .next = r_next,
-        .stop = r_stop,
-        .show = r_show,
-};
-
 static int r_open(struct inode *inode, struct file *file)
 {
-        struct reiserfs_seq_private *priv;
-        int ret = seq_open_private(file, &r_ops,
-                                   sizeof(struct reiserfs_seq_private));
-
-        if (!ret) {
-                struct seq_file *m = file->private_data;
-                priv = m->private;
-                priv->sb = proc_get_parent_data(inode);
-                priv->show = PDE_DATA(inode);
-        }
-        return ret;
+        return single_open(file, PDE_DATA(inode), 
+                                proc_get_parent_data(inode));
 }
 
 static const struct file_operations r_file_operations = {
         .open = r_open,
         .read = seq_read,
         .llseek = seq_lseek,
-        .release = seq_release_private,
-        .owner = THIS_MODULE,
+        .release = single_release,
 };
 
 static struct proc_dir_entry *proc_info_root = NULL;
 static const char proc_info_root_name[] = "fs/reiserfs";
 
 static void add_file(struct super_block *sb, char *name,
-                     int (*func) (struct seq_file *, struct super_block *))
+                     int (*func) (struct seq_file *, void *))
 {
         proc_create_data(name, 0, REISERFS_SB(sb)->procdir,
                          &r_file_operations, func);
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index f8a23c3078f8..e2e202a07b31 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -499,6 +499,7 @@ int remove_save_link(struct inode *inode, int truncate)
 static void reiserfs_kill_sb(struct super_block *s)
 {
         if (REISERFS_SB(s)) {
+                reiserfs_proc_info_done(s);
                 /*
                  * Force any pending inode evictions to occur now. Any
                  * inodes to be removed that have extended attributes
@@ -554,8 +555,6 @@ static void reiserfs_put_super(struct super_block *s)
                                  REISERFS_SB(s)->reserved_blocks);
         }
 
-        reiserfs_proc_info_done(s);
-
         reiserfs_write_unlock(s);
         mutex_destroy(&REISERFS_SB(s)->lock);
         kfree(s->s_fs_info);
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 56e6b68c8d2f..94383a70c1a3 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -274,15 +274,12 @@ struct acpi_device_wakeup {
 };
 
 struct acpi_device_physical_node {
-        u8 node_id;
+        unsigned int node_id;
         struct list_head node;
         struct device *dev;
         bool put_online:1;
 };
 
-/* set maximum of physical nodes to 32 for expansibility */
-#define ACPI_MAX_PHYSICAL_NODE  32
-
 /* Device */
 struct acpi_device {
         int device_type;
@@ -302,10 +299,9 @@ struct acpi_device {
         struct acpi_driver *driver;
         void *driver_data;
         struct device dev;
-        u8 physical_node_count;
+        unsigned int physical_node_count;
         struct list_head physical_node_list;
         struct mutex physical_node_lock;
-        DECLARE_BITMAP(physical_node_id_bitmap, ACPI_MAX_PHYSICAL_NODE);
         struct list_head power_dependent;
         void (*remove)(struct acpi_device *);
 };
@@ -445,7 +441,11 @@ struct acpi_pci_root {
 };
 
 /* helper */
-acpi_handle acpi_get_child(acpi_handle, u64);
+acpi_handle acpi_find_child(acpi_handle, u64, bool);
+static inline acpi_handle acpi_get_child(acpi_handle handle, u64 addr)
+{
+        return acpi_find_child(handle, addr, false);
+}
 int acpi_is_root_bridge(acpi_handle);
 struct acpi_pci_root *acpi_pci_find_root(acpi_handle handle);
 #define DEVICE_ACPI_HANDLE(dev) ((acpi_handle)ACPI_HANDLE(dev))
diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
index f5e1168c7647..d639049a613d 100644
--- a/include/drm/drm_fixed.h
+++ b/include/drm/drm_fixed.h
@@ -84,12 +84,12 @@ static inline int drm_fixp2int(int64_t a)
         return ((s64)a) >> DRM_FIXED_POINT;
 }
 
-static inline s64 drm_fixp_msbset(int64_t a)
+static inline unsigned drm_fixp_msbset(int64_t a)
 {
         unsigned shift, sign = (a >> 63) & 1;
 
         for (shift = 62; shift > 0; --shift)
-                if ((a >> shift) != sign)
+                if (((a >> shift) & 1) != sign)
                         return shift;
 
         return 0;
@@ -100,9 +100,9 @@ static inline s64 drm_fixp_mul(s64 a, s64 b)
         unsigned shift = drm_fixp_msbset(a) + drm_fixp_msbset(b);
         s64 result;
 
-        if (shift > 63) {
-                shift = shift - 63;
-                a >>= shift >> 1;
+        if (shift > 61) {
+                shift = shift - 61;
+                a >>= (shift >> 1) + (shift & 1);
                 b >>= shift >> 1;
         } else
                 shift = 0;
@@ -120,7 +120,7 @@ static inline s64 drm_fixp_mul(s64 a, s64 b)
 
 static inline s64 drm_fixp_div(s64 a, s64 b)
 {
-        unsigned shift = 63 - drm_fixp_msbset(a);
+        unsigned shift = 62 - drm_fixp_msbset(a);
         s64 result;
 
         a <<= shift;
@@ -154,7 +154,7 @@ static inline s64 drm_fixp_exp(s64 x)
         }
 
         if (x < 0)
-                sum = drm_fixp_div(1, sum);
+                sum = drm_fixp_div(DRM_FIXED_ONE, sum);
 
         return sum;
 }
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 4372658c73ae..120d57a1c3a5 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -78,6 +78,11 @@ struct trace_iterator {
         /* trace_seq for __print_flags() and __print_symbolic() etc. */
         struct trace_seq        tmp_seq;
 
+        cpumask_var_t           started;
+
+        /* it's true when current open file is snapshot */
+        bool                    snapshot;
+
         /* The below is zeroed out in pipe_read */
         struct trace_seq        seq;
         struct trace_entry      *ent;
@@ -90,10 +95,7 @@ struct trace_iterator {
         loff_t                  pos;
         long                    idx;
 
-        cpumask_var_t           started;
-
-        /* it's true when current open file is snapshot */
-        bool                    snapshot;
+        /* All new field here will be zeroed out in pipe_read */
 };
 
 enum trace_iter_flags {
@@ -332,7 +334,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
                               const char *name, int offset, int size,
                               int is_signed, int filter_type);
 extern int trace_add_event_call(struct ftrace_event_call *call);
-extern void trace_remove_event_call(struct ftrace_event_call *call);
+extern int trace_remove_event_call(struct ftrace_event_call *call);
 
 #define is_signed_type(type)    (((type)(-1)) < (type)1)
 
diff --git a/include/linux/iio/trigger.h b/include/linux/iio/trigger.h
index 3869c525b052..369cf2cd5144 100644
--- a/include/linux/iio/trigger.h
+++ b/include/linux/iio/trigger.h
@@ -8,6 +8,7 @@
  */
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/atomic.h>
 
 #ifndef _IIO_TRIGGER_H_
 #define _IIO_TRIGGER_H_
@@ -61,7 +62,7 @@ struct iio_trigger {
 
         struct list_head                list;
         struct list_head                alloc_list;
-        int use_count;
+        atomic_t                        use_count;
 
         struct irq_chip                 subirq_chip;
         int                             subirq_base;
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 3bef14c6586b..482ad2d84a32 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -629,7 +629,7 @@ extern void ftrace_dump(enum ftrace_dump_mode oops_dump_mode);
 static inline void tracing_start(void) { }
 static inline void tracing_stop(void) { }
 static inline void ftrace_off_permanent(void) { }
-static inline void trace_dump_stack(void) { }
+static inline void trace_dump_stack(int skip) { }
 
 static inline void tracing_on(void) { }
 static inline void tracing_off(void) { }
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index 8d73fe29796a..db1791bb997a 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -113,11 +113,27 @@
 #define CNTRLREG_8WIRE          CNTRLREG_AFE_CTRL(3)
 #define CNTRLREG_TSCENB         BIT(7)
 
+/* FIFO READ Register */
+#define FIFOREAD_DATA_MASK (0xfff << 0)
+#define FIFOREAD_CHNLID_MASK (0xf << 16)
+
+/* Sequencer Status */
+#define SEQ_STATUS BIT(5)
+
 #define ADC_CLK                 3000000
 #define MAX_CLK_DIV             7
 #define TOTAL_STEPS             16
 #define TOTAL_CHANNELS          8
 
+/*
+* ADC runs at 3MHz, and it takes
+* 15 cycles to latch one data output.
+* Hence the idle time for ADC to
+* process one sample data would be
+* around 5 micro seconds.
+*/
+#define IDLE_TIMEOUT 5 /* microsec */
+
 #define TSCADC_CELLS            2
 
 struct ti_tscadc_dev {
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 8de8d8f22384..737685e9e852 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -690,6 +690,26 @@ struct mlx5_query_cq_mbox_out {
         __be64                  pas[0];
 };
 
+struct mlx5_enable_hca_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_enable_hca_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_disable_hca_mbox_in {
+        struct mlx5_inbox_hdr   hdr;
+        u8                      rsvd[8];
+};
+
+struct mlx5_disable_hca_mbox_out {
+        struct mlx5_outbox_hdr  hdr;
+        u8                      rsvd[8];
+};
+
 struct mlx5_eq_context {
         u8                      status;
         u8                      ec_oi;
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index f22e4419839b..2aa258b0ced1 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -101,6 +101,8 @@ enum {
         MLX5_CMD_OP_QUERY_ADAPTER               = 0x101,
         MLX5_CMD_OP_INIT_HCA                    = 0x102,
         MLX5_CMD_OP_TEARDOWN_HCA                = 0x103,
+        MLX5_CMD_OP_ENABLE_HCA                  = 0x104,
+        MLX5_CMD_OP_DISABLE_HCA                 = 0x105,
         MLX5_CMD_OP_QUERY_PAGES                 = 0x107,
         MLX5_CMD_OP_MANAGE_PAGES                = 0x108,
         MLX5_CMD_OP_SET_HCA_CAP                 = 0x109,
@@ -690,7 +692,7 @@ int mlx5_pagealloc_start(struct mlx5_core_dev *dev);
 void mlx5_pagealloc_stop(struct mlx5_core_dev *dev);
 void mlx5_core_req_pages_handler(struct mlx5_core_dev *dev, u16 func_id,
                                  s16 npages);
-int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev);
+int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot);
 int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev);
 void mlx5_register_debugfs(void);
 void mlx5_unregister_debugfs(void);
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index b62d4af6c667..45e921401b06 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -361,7 +361,8 @@ struct ssb_device_id {
         __u16   vendor;
         __u16   coreid;
         __u8    revision;
-};
+        __u8    __pad;
+} __attribute__((packed, aligned(2)));
 #define SSB_DEVICE(_vendor, _coreid, _revision)  \
         { .vendor = _vendor, .coreid = _coreid, .revision = _revision, }
 #define SSB_DEVTABLE_END  \
@@ -377,7 +378,7 @@ struct bcma_device_id {
         __u16   id;
         __u8    rev;
         __u8    class;
-};
+} __attribute__((packed,aligned(2)));
 #define BCMA_CORE(_manuf, _id, _rev, _class)  \
         { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, }
 #define BCMA_CORETABLE_END  \
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 0741a1e919a5..9a4156845e93 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -973,7 +973,7 @@ struct net_device_ops {
                                                      gfp_t gfp);
         void                    (*ndo_netpoll_cleanup)(struct net_device *dev);
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         int                     (*ndo_busy_poll)(struct napi_struct *dev);
 #endif
         int                     (*ndo_set_vf_mac)(struct net_device *dev,
diff --git a/include/linux/regmap.h b/include/linux/regmap.h
index 75981d0b57dc..580a5320cc96 100644
--- a/include/linux/regmap.h
+++ b/include/linux/regmap.h
@@ -15,6 +15,7 @@
 
 #include <linux/list.h>
 #include <linux/rbtree.h>
+#include <linux/err.h>
 
 struct module;
 struct device;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 50d04b92ceda..d722490da030 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1628,6 +1628,7 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
 #define PF_MEMPOLICY    0x10000000      /* Non-default NUMA mempolicy */
 #define PF_MUTEX_TESTER 0x20000000      /* Thread belongs to the rt mutex tester */
 #define PF_FREEZER_SKIP 0x40000000      /* Freezer should not count it as freezable */
+#define PF_SUSPEND_TASK 0x80000000      /* this thread called freeze_processes and should not be frozen */
 
 /*
  * Only the _current_ task can read/write to tsk->flags, but other
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5afefa01a13c..3b71a4e83642 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -501,7 +501,7 @@ struct sk_buff {
         /* 7/9 bit hole (depending on ndisc_nodetype presence) */
         kmemcheck_bitfield_end(flags2);
 
-#if defined CONFIG_NET_DMA || defined CONFIG_NET_LL_RX_POLL
+#if defined CONFIG_NET_DMA || defined CONFIG_NET_RX_BUSY_POLL
         union {
                 unsigned int    napi_id;
                 dma_cookie_t    dma_cookie;
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 6d870353674a..1821445708d6 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -121,6 +121,7 @@ struct rpc_task_setup {
 #define RPC_TASK_SOFTCONN       0x0400          /* Fail if can't connect */
 #define RPC_TASK_SENT           0x0800          /* message was sent */
 #define RPC_TASK_TIMEOUT        0x1000          /* fail with ETIMEDOUT on timeout */
+#define RPC_TASK_NOCONNECT      0x2000          /* return ENOTCONN if not connected */
 
 #define RPC_IS_ASYNC(t)         ((t)->tk_flags & RPC_TASK_ASYNC)
 #define RPC_IS_SWAPPER(t)       ((t)->tk_flags & RPC_TASK_SWAPPER)
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 9180f4b85e6d..62bd8b72873c 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -174,10 +174,4 @@ static inline void tick_nohz_task_switch(struct task_struct *tsk) { }
 #endif
 
 
-# ifdef CONFIG_CPU_IDLE_GOV_MENU
-extern void menu_hrtimer_cancel(void);
-# else
-static inline void menu_hrtimer_cancel(void) {}
-# endif /* CONFIG_CPU_IDLE_GOV_MENU */
-
 #endif
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index b6b215f13b45..14105c26a836 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -23,6 +23,7 @@ struct user_namespace {
         struct uid_gid_map      projid_map;
         atomic_t                count;
         struct user_namespace   *parent;
+        int                     level;
         kuid_t                  owner;
         kgid_t                  group;
         unsigned int            proc_inum;
diff --git a/include/linux/vmpressure.h b/include/linux/vmpressure.h
index 76be077340ea..7dc17e2456de 100644
--- a/include/linux/vmpressure.h
+++ b/include/linux/vmpressure.h
@@ -12,7 +12,7 @@ struct vmpressure {
         unsigned long scanned;
         unsigned long reclaimed;
         /* The lock is used to keep the scanned/reclaimed above in sync. */
-        struct mutex sr_lock;
+        struct spinlock sr_lock;
 
         /* The list of vmpressure_event structs. */
         struct list_head events;
@@ -30,6 +30,7 @@ extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
 extern void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio);
 
 extern void vmpressure_init(struct vmpressure *vmpr);
+extern void vmpressure_cleanup(struct vmpressure *vmpr);
 extern struct vmpressure *memcg_to_vmpressure(struct mem_cgroup *memcg);
 extern struct cgroup_subsys_state *vmpressure_to_css(struct vmpressure *vmpr);
 extern struct vmpressure *css_to_vmpressure(struct cgroup_subsys_state *css);
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
index 7343a27fe819..47ada23345a1 100644
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -22,6 +22,7 @@
 #define _V4L2_CTRLS_H
 
 #include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/videodev2.h>
 
 /* forward references */
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index a14339c2985f..f18b91966d3d 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -27,7 +27,7 @@
 #include <linux/netdevice.h>
 #include <net/ip.h>
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 
 struct napi_struct;
 extern unsigned int sysctl_net_busy_read __read_mostly;
@@ -146,7 +146,7 @@ static inline void sk_mark_napi_id(struct sock *sk, struct sk_buff *skb)
         sk->sk_napi_id = skb->napi_id;
 }
 
-#else /* CONFIG_NET_LL_RX_POLL */
+#else /* CONFIG_NET_RX_BUSY_POLL */
 static inline unsigned long net_busy_loop_on(void)
 {
         return 0;
@@ -181,5 +181,10 @@ static inline bool busy_loop_timeout(unsigned long end_time)
         return true;
 }
 
-#endif /* CONFIG_NET_LL_RX_POLL */
+static inline bool sk_busy_loop(struct sock *sk, int nonblock)
+{
+        return false;
+}
+
+#endif /* CONFIG_NET_RX_BUSY_POLL */
 #endif /* _LINUX_NET_BUSY_POLL_H */
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 2a601e7da1bf..48ec25a7fcb6 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -300,7 +300,7 @@ extern void			inet6_rt_notify(int event, struct rt6_info *rt,
                                                 struct nl_info *info);
 
 extern void                     fib6_run_gc(unsigned long expires,
-                                            struct net *net);
+                                            struct net *net, bool force);
 
 extern void                     fib6_gc_cleanup(void);
 
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 949d77528f2f..6fea32340ae8 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -119,7 +119,7 @@ extern struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
  * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
  * also need a pad of 2.
  */
-static int ndisc_addr_option_pad(unsigned short type)
+static inline int ndisc_addr_option_pad(unsigned short type)
 {
         switch (type) {
         case ARPHRD_INFINIBAND: return 2;
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 0af851c3b038..b64b7bce4b94 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -59,7 +59,7 @@ struct nfc_hci_ops {
                               struct nfc_target *target);
         int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
                               struct sk_buff *skb);
-        int (*fw_upload)(struct nfc_hci_dev *hdev, const char *firmware_name);
+        int (*fw_download)(struct nfc_hci_dev *hdev, const char *firmware_name);
         int (*discover_se)(struct nfc_hci_dev *dev);
         int (*enable_se)(struct nfc_hci_dev *dev, u32 se_idx);
         int (*disable_se)(struct nfc_hci_dev *dev, u32 se_idx);
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 0e353f1658bb..5f286b726bb6 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -68,7 +68,7 @@ struct nfc_ops {
                              void *cb_context);
         int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
-        int (*fw_upload)(struct nfc_dev *dev, const char *firmware_name);
+        int (*fw_download)(struct nfc_dev *dev, const char *firmware_name);
 
         /* Secure Element API */
         int (*discover_se)(struct nfc_dev *dev);
@@ -127,7 +127,7 @@ struct nfc_dev {
         int targets_generation;
         struct device dev;
         bool dev_up;
-        bool fw_upload_in_progress;
+        bool fw_download_in_progress;
         u8 rf_mode;
         bool polling;
         struct nfc_target *active_target;
diff --git a/include/net/sock.h b/include/net/sock.h
index 95a5a2c6925a..31d5cfbb51ec 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -327,7 +327,7 @@ struct sock {
 #ifdef CONFIG_RPS
         __u32                   sk_rxhash;
 #endif
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         unsigned int            sk_napi_id;
         unsigned int            sk_ll_usec;
 #endif
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index caed0f324d5f..8137dd8d2adf 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -69,8 +69,8 @@
  *      starting a poll from a device which has a secure element enabled means
  *      we want to do SE based card emulation.
  * @NFC_CMD_DISABLE_SE: Disable the physical link to a specific secure element.
- * @NFC_CMD_FW_UPLOAD: Request to Load/flash firmware, or event to inform that
- *      some firmware was loaded
+ * @NFC_CMD_FW_DOWNLOAD: Request to Load/flash firmware, or event to inform
+ *      that some firmware was loaded
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -94,7 +94,7 @@ enum nfc_commands {
         NFC_CMD_DISABLE_SE,
         NFC_CMD_LLC_SDREQ,
         NFC_EVENT_LLC_SDRES,
-        NFC_CMD_FW_UPLOAD,
+        NFC_CMD_FW_DOWNLOAD,
         NFC_EVENT_SE_ADDED,
         NFC_EVENT_SE_REMOVED,
 /* private: internal use only */
diff --git a/kernel/Makefile b/kernel/Makefile
index 470839d1a30e..35ef1185e359 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the linux kernel.
 #
 
-obj-y     = fork.o exec_domain.o panic.o printk.o \
+obj-y     = fork.o exec_domain.o panic.o \
             cpu.o exit.o itimer.o time.o softirq.o resource.o \
             sysctl.o sysctl_binary.o capability.o ptrace.o timer.o user.o \
             signal.o sys.o kmod.o workqueue.o pid.o task_work.o \
@@ -24,6 +24,7 @@ endif
 
 obj-y += sched/
 obj-y += power/
+obj-y += printk/
 obj-y += cpu/
 
 obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 789ec4683db3..781845a013ab 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4335,8 +4335,10 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                 }
 
                 err = percpu_ref_init(&css->refcnt, css_release);
-                if (err)
+                if (err) {
+                        ss->css_free(cgrp);
                         goto err_free_all;
+                }
 
                 init_cgroup_css(css, ss, cgrp);
 
diff --git a/kernel/freezer.c b/kernel/freezer.c
index 8b2afc1c9df0..b462fa197517 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -33,7 +33,7 @@ static DEFINE_SPINLOCK(freezer_lock);
  */
 bool freezing_slow_path(struct task_struct *p)
 {
-        if (p->flags & PF_NOFREEZE)
+        if (p->flags & (PF_NOFREEZE | PF_SUSPEND_TASK))
                 return false;
 
         if (pm_nosig_freezing || cgroup_freezing(p))
diff --git a/kernel/power/process.c b/kernel/power/process.c
index fc0df8486449..06ec8869dbf1 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -109,6 +109,8 @@ static int try_to_freeze_tasks(bool user_only)
 
 /**
  * freeze_processes - Signal user space processes to enter the refrigerator.
+ * The current thread will not be frozen.  The same process that calls
+ * freeze_processes must later call thaw_processes.
  *
  * On success, returns 0.  On failure, -errno and system is fully thawed.
  */
@@ -120,6 +122,9 @@ int freeze_processes(void)
         if (error)
                 return error;
 
+        /* Make sure this task doesn't get frozen */
+        current->flags |= PF_SUSPEND_TASK;
+
         if (!pm_freezing)
                 atomic_inc(&system_freezing_cnt);
 
@@ -168,6 +173,7 @@ int freeze_kernel_threads(void)
 void thaw_processes(void)
 {
         struct task_struct *g, *p;
+        struct task_struct *curr = current;
 
         if (pm_freezing)
                 atomic_dec(&system_freezing_cnt);
@@ -182,10 +188,15 @@ void thaw_processes(void)
 
         read_lock(&tasklist_lock);
         do_each_thread(g, p) {
+                /* No other threads should have PF_SUSPEND_TASK set */
+                WARN_ON((p != curr) && (p->flags & PF_SUSPEND_TASK));
                 __thaw_task(p);
         } while_each_thread(g, p);
         read_unlock(&tasklist_lock);
 
+        WARN_ON(!(curr->flags & PF_SUSPEND_TASK));
+        curr->flags &= ~PF_SUSPEND_TASK;
+
         usermodehelper_enable();
 
         schedule();
diff --git a/kernel/printk/Makefile b/kernel/printk/Makefile
new file mode 100644
index 000000000000..85405bdcf2b3
--- /dev/null
+++ b/kernel/printk/Makefile
@@ -0,0 +1,2 @@
+obj-y   = printk.o
+obj-$(CONFIG_A11Y_BRAILLE_CONSOLE)      += braille.o
diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
new file mode 100644
index 000000000000..276762f3a460
--- /dev/null
+++ b/kernel/printk/braille.c
@@ -0,0 +1,49 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/kernel.h>
+#include <linux/console.h>
+#include <linux/string.h>
+
+#include "console_cmdline.h"
+#include "braille.h"
+
+char *_braille_console_setup(char **str, char **brl_options)
+{
+        if (!memcmp(*str, "brl,", 4)) {
+                *brl_options = "";
+                *str += 4;
+        } else if (!memcmp(str, "brl=", 4)) {
+                *brl_options = *str + 4;
+                *str = strchr(*brl_options, ',');
+                if (!*str)
+                        pr_err("need port name after brl=\n");
+                else
+                        *((*str)++) = 0;
+        } else
+                return NULL;
+
+        return *str;
+}
+
+int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        int rtn = 0;
+
+        if (c->brl_options) {
+                console->flags |= CON_BRL;
+                rtn = braille_register_console(console, c->index, c->options,
+                                               c->brl_options);
+        }
+
+        return rtn;
+}
+
+int
+_braille_unregister_console(struct console *console)
+{
+        if (console->flags & CON_BRL)
+                return braille_unregister_console(console);
+
+        return 0;
+}
diff --git a/kernel/printk/braille.h b/kernel/printk/braille.h
new file mode 100644
index 000000000000..769d771145c8
--- /dev/null
+++ b/kernel/printk/braille.h
@@ -0,0 +1,48 @@
+#ifndef _PRINTK_BRAILLE_H
+#define _PRINTK_BRAILLE_H
+
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+        c->brl_options = brl_options;
+}
+
+char *
+_braille_console_setup(char **str, char **brl_options);
+
+int
+_braille_register_console(struct console *console, struct console_cmdline *c);
+
+int
+_braille_unregister_console(struct console *console);
+
+#else
+
+static inline void
+braille_set_options(struct console_cmdline *c, char *brl_options)
+{
+}
+
+static inline char *
+_braille_console_setup(char **str, char **brl_options)
+{
+        return NULL;
+}
+
+static inline int
+_braille_register_console(struct console *console, struct console_cmdline *c)
+{
+        return 0;
+}
+
+static inline int
+_braille_unregister_console(struct console *console)
+{
+        return 0;
+}
+
+#endif
+
+#endif
diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
new file mode 100644
index 000000000000..cbd69d842341
--- /dev/null
+++ b/kernel/printk/console_cmdline.h
@@ -0,0 +1,14 @@
+#ifndef _CONSOLE_CMDLINE_H
+#define _CONSOLE_CMDLINE_H
+
+struct console_cmdline
+{
+        char    name[8];                        /* Name of the driver       */
+        int     index;                          /* Minor dev. to use        */
+        char    *options;                       /* Options for the driver   */
+#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+        char    *brl_options;                   /* Options for braille driver */
+#endif
+};
+
+#endif
diff --git a/kernel/printk.c b/kernel/printk/printk.c
index 69b0890ed7e5..5b5a7080e2a5 100644
--- a/kernel/printk.c
+++ b/kernel/printk/printk.c
@@ -51,6 +51,9 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/printk.h>
 
+#include "console_cmdline.h"
+#include "braille.h"
+
 /* printk's without a loglevel use this.. */
 #define DEFAULT_MESSAGE_LOGLEVEL CONFIG_DEFAULT_MESSAGE_LOGLEVEL
 
@@ -105,19 +108,11 @@ static struct console *exclusive_console;
 /*
  *      Array of consoles built from command line options (console=)
  */
-struct console_cmdline
-{
-        char    name[8];                        /* Name of the driver       */
-        int     index;                          /* Minor dev. to use        */
-        char    *options;                       /* Options for the driver   */
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        char    *brl_options;                   /* Options for braille driver */
-#endif
-};
 
 #define MAX_CMDLINECONSOLES 8
 
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
+
 static int selected_console = -1;
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -178,7 +173,7 @@ static int console_may_schedule;
  *         67                           "g"
  *   0032     00 00 00                  padding to next message header
  *
- * The 'struct log' buffer header must never be directly exported to
+ * The 'struct printk_log' buffer header must never be directly exported to
  * userspace, it is a kernel-private implementation detail that might
  * need to be changed in the future, when the requirements change.
  *
@@ -200,7 +195,7 @@ enum log_flags {
         LOG_CONT        = 8,    /* text is a fragment of a continuation line */
 };
 
-struct log {
+struct printk_log {
         u64 ts_nsec;            /* timestamp in nanoseconds */
         u16 len;                /* length of entire record */
         u16 text_len;           /* length of text buffer */
@@ -248,7 +243,7 @@ static u32 clear_idx;
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 #define LOG_ALIGN 4
 #else
-#define LOG_ALIGN __alignof__(struct log)
+#define LOG_ALIGN __alignof__(struct printk_log)
 #endif
 #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
 static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
@@ -259,35 +254,35 @@ static u32 log_buf_len = __LOG_BUF_LEN;
 static volatile unsigned int logbuf_cpu = UINT_MAX;
 
 /* human readable text of the record */
-static char *log_text(const struct log *msg)
+static char *log_text(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log);
+        return (char *)msg + sizeof(struct printk_log);
 }
 
 /* optional key/value pair dictionary attached to the record */
-static char *log_dict(const struct log *msg)
+static char *log_dict(const struct printk_log *msg)
 {
-        return (char *)msg + sizeof(struct log) + msg->text_len;
+        return (char *)msg + sizeof(struct printk_log) + msg->text_len;
 }
 
 /* get record by index; idx must point to valid msg */
-static struct log *log_from_idx(u32 idx)
+static struct printk_log *log_from_idx(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
 
         /*
          * A length == 0 record is the end of buffer marker. Wrap around and
          * read the message at the start of the buffer.
          */
         if (!msg->len)
-                return (struct log *)log_buf;
+                return (struct printk_log *)log_buf;
         return msg;
 }
 
 /* get next record; idx must point to valid msg */
 static u32 log_next(u32 idx)
 {
-        struct log *msg = (struct log *)(log_buf + idx);
+        struct printk_log *msg = (struct printk_log *)(log_buf + idx);
 
         /* length == 0 indicates the end of the buffer; wrap */
         /*
@@ -296,7 +291,7 @@ static u32 log_next(u32 idx)
          * return the one after that.
          */
         if (!msg->len) {
-                msg = (struct log *)log_buf;
+                msg = (struct printk_log *)log_buf;
                 return msg->len;
         }
         return idx + msg->len;
@@ -308,11 +303,11 @@ static void log_store(int facility, int level,
                       const char *dict, u16 dict_len,
                       const char *text, u16 text_len)
 {
-        struct log *msg;
+        struct printk_log *msg;
         u32 size, pad_len;
 
         /* number of '\0' padding bytes to next message */
-        size = sizeof(struct log) + text_len + dict_len;
+        size = sizeof(struct printk_log) + text_len + dict_len;
         pad_len = (-size) & (LOG_ALIGN - 1);
         size += pad_len;
 
@@ -324,7 +319,7 @@ static void log_store(int facility, int level,
                 else
                         free = log_first_idx - log_next_idx;
 
-                if (free > size + sizeof(struct log))
+                if (free > size + sizeof(struct printk_log))
                         break;
 
                 /* drop old messages until we have enough contiuous space */
@@ -332,18 +327,18 @@ static void log_store(int facility, int level,
                 log_first_seq++;
         }
 
-        if (log_next_idx + size + sizeof(struct log) >= log_buf_len) {
+        if (log_next_idx + size + sizeof(struct printk_log) >= log_buf_len) {
                 /*
                  * This message + an additional empty header does not fit
                  * at the end of the buffer. Add an empty header with len == 0
                  * to signify a wrap around.
                  */
-                memset(log_buf + log_next_idx, 0, sizeof(struct log));
+                memset(log_buf + log_next_idx, 0, sizeof(struct printk_log));
                 log_next_idx = 0;
         }
 
         /* fill message */
-        msg = (struct log *)(log_buf + log_next_idx);
+        msg = (struct printk_log *)(log_buf + log_next_idx);
         memcpy(log_text(msg), text, text_len);
         msg->text_len = text_len;
         memcpy(log_dict(msg), dict, dict_len);
@@ -356,7 +351,7 @@ static void log_store(int facility, int level,
         else
                 msg->ts_nsec = local_clock();
         memset(log_dict(msg) + dict_len, 0, pad_len);
-        msg->len = sizeof(struct log) + text_len + dict_len + pad_len;
+        msg->len = sizeof(struct printk_log) + text_len + dict_len + pad_len;
 
         /* insert message */
         log_next_idx += msg->len;
@@ -479,7 +474,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
 {
         struct devkmsg_user *user = file->private_data;
-        struct log *msg;
+        struct printk_log *msg;
         u64 ts_usec;
         size_t i;
         char cont = '-';
@@ -724,14 +719,14 @@ void log_buf_kexec_setup(void)
         VMCOREINFO_SYMBOL(log_first_idx);
         VMCOREINFO_SYMBOL(log_next_idx);
         /*
-         * Export struct log size and field offsets. User space tools can
+         * Export struct printk_log size and field offsets. User space tools can
          * parse it and detect any changes to structure down the line.
          */
-        VMCOREINFO_STRUCT_SIZE(log);
-        VMCOREINFO_OFFSET(log, ts_nsec);
-        VMCOREINFO_OFFSET(log, len);
-        VMCOREINFO_OFFSET(log, text_len);
-        VMCOREINFO_OFFSET(log, dict_len);
+        VMCOREINFO_STRUCT_SIZE(printk_log);
+        VMCOREINFO_OFFSET(printk_log, ts_nsec);
+        VMCOREINFO_OFFSET(printk_log, len);
+        VMCOREINFO_OFFSET(printk_log, text_len);
+        VMCOREINFO_OFFSET(printk_log, dict_len);
 }
 #endif
 
@@ -884,7 +879,7 @@ static size_t print_time(u64 ts, char *buf)
                        (unsigned long)ts, rem_nsec / 1000);
 }
 
-static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
+static size_t print_prefix(const struct printk_log *msg, bool syslog, char *buf)
 {
         size_t len = 0;
         unsigned int prefix = (msg->facility << 3) | msg->level;
@@ -907,7 +902,7 @@ static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
         return len;
 }
 
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                              bool syslog, char *buf, size_t size)
 {
         const char *text = log_text(msg);
@@ -969,7 +964,7 @@ static size_t msg_print_text(const struct log *msg, enum log_flags prev,
 static int syslog_print(char __user *buf, int size)
 {
         char *text;
-        struct log *msg;
+        struct printk_log *msg;
         int len = 0;
 
         text = kmalloc(LOG_LINE_MAX + PREFIX_MAX, GFP_KERNEL);
@@ -1060,7 +1055,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 idx = clear_idx;
                 prev = 0;
                 while (seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
 
                         len += msg_print_text(msg, prev, true, NULL, 0);
                         prev = msg->flags;
@@ -1073,7 +1068,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 idx = clear_idx;
                 prev = 0;
                 while (len > size && seq < log_next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
 
                         len -= msg_print_text(msg, prev, true, NULL, 0);
                         prev = msg->flags;
@@ -1087,7 +1082,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 len = 0;
                 prev = 0;
                 while (len >= 0 && seq < next_seq) {
-                        struct log *msg = log_from_idx(idx);
+                        struct printk_log *msg = log_from_idx(idx);
                         int textlen;
 
                         textlen = msg_print_text(msg, prev, true, text,
@@ -1233,7 +1228,7 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
 
                         error = 0;
                         while (seq < log_next_seq) {
-                                struct log *msg = log_from_idx(idx);
+                                struct printk_log *msg = log_from_idx(idx);
 
                                 error += msg_print_text(msg, prev, true, NULL, 0);
                                 idx = log_next(idx);
@@ -1719,10 +1714,10 @@ static struct cont {
         u8 level;
         bool flushed:1;
 } cont;
-static struct log *log_from_idx(u32 idx) { return NULL; }
+static struct printk_log *log_from_idx(u32 idx) { return NULL; }
 static u32 log_next(u32 idx) { return 0; }
 static void call_console_drivers(int level, const char *text, size_t len) {}
-static size_t msg_print_text(const struct log *msg, enum log_flags prev,
+static size_t msg_print_text(const struct printk_log *msg, enum log_flags prev,
                              bool syslog, char *buf, size_t size) { return 0; }
 static size_t cont_print_text(char *text, size_t size) { return 0; }
 
@@ -1761,23 +1756,23 @@ static int __add_preferred_console(char *name, int idx, char *options,
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                if (!brl_options)
-                                        selected_console = i;
-                                return 0;
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
+                        if (!brl_options)
+                                selected_console = i;
+                        return 0;
                 }
+        }
         if (i == MAX_CMDLINECONSOLES)
                 return -E2BIG;
         if (!brl_options)
                 selected_console = i;
-        c = &console_cmdline[i];
         strlcpy(c->name, name, sizeof(c->name));
         c->options = options;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        c->brl_options = brl_options;
-#endif
+        braille_set_options(c, brl_options);
+
         c->index = idx;
         return 0;
 }
@@ -1790,20 +1785,8 @@ static int __init console_setup(char *str)
         char *s, *options, *brl_options = NULL;
         int idx;
 
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        if (!memcmp(str, "brl,", 4)) {
-                brl_options = "";
-                str += 4;
-        } else if (!memcmp(str, "brl=", 4)) {
-                brl_options = str + 4;
-                str = strchr(brl_options, ',');
-                if (!str) {
-                        printk(KERN_ERR "need port name after brl=\n");
-                        return 1;
-                }
-                *(str++) = 0;
-        }
-#endif
+        if (_braille_console_setup(&str, &brl_options))
+                return 1;
 
         /*
          * Decode str into name, index, options.
@@ -1858,15 +1841,15 @@ int update_console_cmdline(char *name, int idx, char *name_new, int idx_new, cha
         struct console_cmdline *c;
         int i;
 
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                c = &console_cmdline[i];
-                                strlcpy(c->name, name_new, sizeof(c->name));
-                                c->name[sizeof(c->name) - 1] = 0;
-                                c->options = options;
-                                c->index = idx_new;
-                                return i;
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++)
+                if (strcmp(c->name, name) == 0 && c->index == idx) {
+                        strlcpy(c->name, name_new, sizeof(c->name));
+                        c->name[sizeof(c->name) - 1] = 0;
+                        c->options = options;
+                        c->index = idx_new;
+                        return i;
                 }
         /* not found */
         return -1;
@@ -2046,7 +2029,7 @@ void console_unlock(void)
         console_cont_flush(text, sizeof(text));
 again:
         for (;;) {
-                struct log *msg;
+                struct printk_log *msg;
                 size_t len;
                 int level;
 
@@ -2241,6 +2224,7 @@ void register_console(struct console *newcon)
         int i;
         unsigned long flags;
         struct console *bcon = NULL;
+        struct console_cmdline *c;
 
         /*
          * before we register a new CON_BOOT console, make sure we don't
@@ -2288,30 +2272,25 @@ void register_console(struct console *newcon)
          *      See if this console matches one we selected on
          *      the command line.
          */
-        for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
-                        i++) {
-                if (strcmp(console_cmdline[i].name, newcon->name) != 0)
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
+                if (strcmp(c->name, newcon->name) != 0)
                         continue;
                 if (newcon->index >= 0 &&
-                    newcon->index != console_cmdline[i].index)
+                    newcon->index != c->index)
                         continue;
                 if (newcon->index < 0)
-                        newcon->index = console_cmdline[i].index;
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-                if (console_cmdline[i].brl_options) {
-                        newcon->flags |= CON_BRL;
-                        braille_register_console(newcon,
-                                        console_cmdline[i].index,
-                                        console_cmdline[i].options,
-                                        console_cmdline[i].brl_options);
+                        newcon->index = c->index;
+
+                if (_braille_register_console(newcon, c))
                         return;
-                }
-#endif
+
                 if (newcon->setup &&
                     newcon->setup(newcon, console_cmdline[i].options) != 0)
                         break;
                 newcon->flags |= CON_ENABLED;
-                newcon->index = console_cmdline[i].index;
+                newcon->index = c->index;
                 if (i == selected_console) {
                         newcon->flags |= CON_CONSDEV;
                         preferred_console = selected_console;
@@ -2394,13 +2373,13 @@ EXPORT_SYMBOL(register_console);
 int unregister_console(struct console *console)
 {
         struct console *a, *b;
-        int res = 1;
+        int res;
 
-#ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-        if (console->flags & CON_BRL)
-                return braille_unregister_console(console);
-#endif
+        res = _braille_unregister_console(console);
+        if (res)
+                return res;
 
+        res = 1;
         console_lock();
         if (console_drivers == console) {
                 console_drivers=console->next;
@@ -2666,7 +2645,7 @@ void kmsg_dump(enum kmsg_dump_reason reason)
 bool kmsg_dump_get_line_nolock(struct kmsg_dumper *dumper, bool syslog,
                                char *line, size_t size, size_t *len)
 {
-        struct log *msg;
+        struct printk_log *msg;
         size_t l = 0;
         bool ret = false;
 
@@ -2778,7 +2757,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         idx = dumper->cur_idx;
         prev = 0;
         while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l += msg_print_text(msg, prev, true, NULL, 0);
                 idx = log_next(idx);
@@ -2791,7 +2770,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         idx = dumper->cur_idx;
         prev = 0;
         while (l > size && seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l -= msg_print_text(msg, prev, true, NULL, 0);
                 idx = log_next(idx);
@@ -2806,7 +2785,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
         l = 0;
         prev = 0;
         while (seq < dumper->next_seq) {
-                struct log *msg = log_from_idx(idx);
+                struct printk_log *msg = log_from_idx(idx);
 
                 l += msg_print_text(msg, prev, syslog, buf + l, size - l);
                 idx = log_next(idx);
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 4041f5747e73..a146ee327f6a 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -469,7 +469,6 @@ static int ptrace_detach(struct task_struct *child, unsigned int data)
         /* Architecture-specific hardware disable .. */
         ptrace_disable(child);
         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
-        flush_ptrace_hw_breakpoint(child);
 
         write_lock_irq(&tasklist_lock);
         /*
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bb456f44b7b1..9565645e3202 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -851,7 +851,7 @@ void task_numa_fault(int node, int pages, bool migrated)
 {
         struct task_struct *p = current;
 
-        if (!sched_feat_numa(NUMA))
+        if (!numabalancing_enabled)
                 return;
 
         /* FIXME: Allocate task-specific structure for placement policy here */
@@ -5786,7 +5786,7 @@ static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued)
                 entity_tick(cfs_rq, se, queued);
         }
 
-        if (sched_feat_numa(NUMA))
+        if (numabalancing_enabled)
                 task_tick_numa(rq, curr);
 
         update_rq_runnable_avg(rq, 1);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index ac09d98490aa..07f6fc468e17 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2346,7 +2346,11 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
                                             int write, void *data)
 {
         if (write) {
-                *valp = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+                unsigned long jif = msecs_to_jiffies(*negp ? -*lvalp : *lvalp);
+
+                if (jif > INT_MAX)
+                        return 1;
+                *valp = (int)jif;
         } else {
                 int val = *valp;
                 unsigned long lval;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index e80183f4a6c4..e77edc97e036 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -827,13 +827,10 @@ void tick_nohz_irq_exit(void)
 {
         struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
 
-        if (ts->inidle) {
-                /* Cancel the timer because CPU already waken up from the C-states*/
-                menu_hrtimer_cancel();
+        if (ts->inidle)
                 __tick_nohz_idle_enter(ts);
-        } else {
+        else
                 tick_nohz_full_stop_tick(ts);
-        }
 }
 
 /**
@@ -931,8 +928,6 @@ void tick_nohz_idle_exit(void)
 
         ts->inidle = 0;
 
-        /* Cancel the timer because CPU already waken up from the C-states*/
-        menu_hrtimer_cancel();
         if (ts->idle_active || ts->tick_stopped)
                 now = ktime_get();
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 8ce9eefc5bb4..a6d098c6df3f 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2169,12 +2169,57 @@ static cycle_t		ftrace_update_time;
 static unsigned long    ftrace_update_cnt;
 unsigned long           ftrace_update_tot_cnt;
 
-static int ops_traces_mod(struct ftrace_ops *ops)
+static inline int ops_traces_mod(struct ftrace_ops *ops)
 {
-        struct ftrace_hash *hash;
+        /*
+         * Filter_hash being empty will default to trace module.
+         * But notrace hash requires a test of individual module functions.
+         */
+        return ftrace_hash_empty(ops->filter_hash) &&
+                ftrace_hash_empty(ops->notrace_hash);
+}
+
+/*
+ * Check if the current ops references the record.
+ *
+ * If the ops traces all functions, then it was already accounted for.
+ * If the ops does not trace the current record function, skip it.
+ * If the ops ignores the function via notrace filter, skip it.
+ */
+static inline bool
+ops_references_rec(struct ftrace_ops *ops, struct dyn_ftrace *rec)
+{
+        /* If ops isn't enabled, ignore it */
+        if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
+                return 0;
+
+        /* If ops traces all mods, we already accounted for it */
+        if (ops_traces_mod(ops))
+                return 0;
+
+        /* The function must be in the filter */
+        if (!ftrace_hash_empty(ops->filter_hash) &&
+            !ftrace_lookup_ip(ops->filter_hash, rec->ip))
+                return 0;
+
+        /* If in notrace hash, we ignore it too */
+        if (ftrace_lookup_ip(ops->notrace_hash, rec->ip))
+                return 0;
+
+        return 1;
+}
+
+static int referenced_filters(struct dyn_ftrace *rec)
+{
+        struct ftrace_ops *ops;
+        int cnt = 0;
 
-        hash = ops->filter_hash;
-        return ftrace_hash_empty(hash);
+        for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
+                if (ops_references_rec(ops, rec))
+                    cnt++;
+        }
+
+        return cnt;
 }
 
 static int ftrace_update_code(struct module *mod)
@@ -2183,6 +2228,7 @@ static int ftrace_update_code(struct module *mod)
         struct dyn_ftrace *p;
         cycle_t start, stop;
         unsigned long ref = 0;
+        bool test = false;
         int i;
 
         /*
@@ -2196,9 +2242,12 @@ static int ftrace_update_code(struct module *mod)
 
                 for (ops = ftrace_ops_list;
                      ops != &ftrace_list_end; ops = ops->next) {
-                        if (ops->flags & FTRACE_OPS_FL_ENABLED &&
-                            ops_traces_mod(ops))
-                                ref++;
+                        if (ops->flags & FTRACE_OPS_FL_ENABLED) {
+                                if (ops_traces_mod(ops))
+                                        ref++;
+                                else
+                                        test = true;
+                        }
                 }
         }
 
@@ -2208,12 +2257,16 @@ static int ftrace_update_code(struct module *mod)
         for (pg = ftrace_new_pgs; pg; pg = pg->next) {
 
                 for (i = 0; i < pg->index; i++) {
+                        int cnt = ref;
+
                         /* If something went wrong, bail without enabling anything */
                         if (unlikely(ftrace_disabled))
                                 return -1;
 
                         p = &pg->records[i];
-                        p->flags = ref;
+                        if (test)
+                                cnt += referenced_filters(p);
+                        p->flags = cnt;
 
                         /*
                          * Do the initial record conversion from mcount jump
@@ -2233,7 +2286,7 @@ static int ftrace_update_code(struct module *mod)
                          * conversion puts the module to the correct state, thus
                          * passing the ftrace_make_call check.
                          */
-                        if (ftrace_start_up && ref) {
+                        if (ftrace_start_up && cnt) {
                                 int failed = __ftrace_replace_code(p, 1);
                                 if (failed)
                                         ftrace_bug(failed, p->ip);
@@ -3384,6 +3437,12 @@ ftrace_match_addr(struct ftrace_hash *hash, unsigned long ip, int remove)
         return add_hash_entry(hash, ip);
 }
 
+static void ftrace_ops_update_code(struct ftrace_ops *ops)
+{
+        if (ops->flags & FTRACE_OPS_FL_ENABLED && ftrace_enabled)
+                ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+}
+
 static int
 ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
                 unsigned long ip, int remove, int reset, int enable)
@@ -3426,9 +3485,8 @@ ftrace_set_hash(struct ftrace_ops *ops, unsigned char *buf, int len,
 
         mutex_lock(&ftrace_lock);
         ret = ftrace_hash_move(ops, enable, orig_hash, hash);
-        if (!ret && ops->flags & FTRACE_OPS_FL_ENABLED
-            && ftrace_enabled)
-                ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+        if (!ret)
+                ftrace_ops_update_code(ops);
 
         mutex_unlock(&ftrace_lock);
 
@@ -3655,9 +3713,8 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
                 mutex_lock(&ftrace_lock);
                 ret = ftrace_hash_move(iter->ops, filter_hash,
                                        orig_hash, iter->hash);
-                if (!ret && (iter->ops->flags & FTRACE_OPS_FL_ENABLED)
-                    && ftrace_enabled)
-                        ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+                if (!ret)
+                        ftrace_ops_update_code(iter->ops);
 
                 mutex_unlock(&ftrace_lock);
         }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 882ec1dd1515..496f94d57698 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -243,20 +243,25 @@ int filter_current_check_discard(struct ring_buffer *buffer,
 }
 EXPORT_SYMBOL_GPL(filter_current_check_discard);
 
-cycle_t ftrace_now(int cpu)
+cycle_t buffer_ftrace_now(struct trace_buffer *buf, int cpu)
 {
         u64 ts;
 
         /* Early boot up does not have a buffer yet */
-        if (!global_trace.trace_buffer.buffer)
+        if (!buf->buffer)
                 return trace_clock_local();
 
-        ts = ring_buffer_time_stamp(global_trace.trace_buffer.buffer, cpu);
-        ring_buffer_normalize_time_stamp(global_trace.trace_buffer.buffer, cpu, &ts);
+        ts = ring_buffer_time_stamp(buf->buffer, cpu);
+        ring_buffer_normalize_time_stamp(buf->buffer, cpu, &ts);
 
         return ts;
 }
 
+cycle_t ftrace_now(int cpu)
+{
+        return buffer_ftrace_now(&global_trace.trace_buffer, cpu);
+}
+
 /**
  * tracing_is_enabled - Show if global_trace has been disabled
  *
@@ -1211,7 +1216,7 @@ void tracing_reset_online_cpus(struct trace_buffer *buf)
         /* Make sure all commits have finished */
         synchronize_sched();
 
-        buf->time_start = ftrace_now(buf->cpu);
+        buf->time_start = buffer_ftrace_now(buf, buf->cpu);
 
         for_each_online_cpu(cpu)
                 ring_buffer_reset_cpu(buffer, cpu);
@@ -1219,11 +1224,6 @@ void tracing_reset_online_cpus(struct trace_buffer *buf)
         ring_buffer_record_enable(buffer);
 }
 
-void tracing_reset_current(int cpu)
-{
-        tracing_reset(&global_trace.trace_buffer, cpu);
-}
-
 /* Must have trace_types_lock held */
 void tracing_reset_all_online_cpus(void)
 {
@@ -4151,6 +4151,7 @@ waitagain:
         memset(&iter->seq, 0,
                sizeof(struct trace_iterator) -
                offsetof(struct trace_iterator, seq));
+        cpumask_clear(iter->started);
         iter->pos = -1;
 
         trace_event_read_lock();
@@ -4468,7 +4469,7 @@ tracing_free_buffer_release(struct inode *inode, struct file *filp)
 
         /* disable tracing ? */
         if (trace_flags & TRACE_ITER_STOP_ON_FREE)
-                tracing_off();
+                tracer_tracing_off(tr);
         /* resize the ring buffer to 0 */
         tracing_resize_ring_buffer(tr, 0, RING_BUFFER_ALL_CPUS);
 
@@ -4633,12 +4634,12 @@ static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
          * New clock may not be consistent with the previous clock.
          * Reset the buffer so that it doesn't have incomparable timestamps.
          */
-        tracing_reset_online_cpus(&global_trace.trace_buffer);
+        tracing_reset_online_cpus(&tr->trace_buffer);
 
 #ifdef CONFIG_TRACER_MAX_TRACE
         if (tr->flags & TRACE_ARRAY_FL_GLOBAL && tr->max_buffer.buffer)
                 ring_buffer_set_clock(tr->max_buffer.buffer, trace_clocks[i].func);
-        tracing_reset_online_cpus(&global_trace.max_buffer);
+        tracing_reset_online_cpus(&tr->max_buffer);
 #endif
 
         mutex_unlock(&trace_types_lock);
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 898f868833f2..29a7ebcfb426 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -409,33 +409,42 @@ static void put_system(struct ftrace_subsystem_dir *dir)
         mutex_unlock(&event_mutex);
 }
 
-/*
- * Open and update trace_array ref count.
- * Must have the current trace_array passed to it.
- */
-static int tracing_open_generic_file(struct inode *inode, struct file *filp)
+static void remove_subsystem(struct ftrace_subsystem_dir *dir)
 {
-        struct ftrace_event_file *file = inode->i_private;
-        struct trace_array *tr = file->tr;
-        int ret;
+        if (!dir)
+                return;
 
-        if (trace_array_get(tr) < 0)
-                return -ENODEV;
+        if (!--dir->nr_events) {
+                debugfs_remove_recursive(dir->entry);
+                list_del(&dir->list);
+                __put_system_dir(dir);
+        }
+}
 
-        ret = tracing_open_generic(inode, filp);
-        if (ret < 0)
-                trace_array_put(tr);
-        return ret;
+static void *event_file_data(struct file *filp)
+{
+        return ACCESS_ONCE(file_inode(filp)->i_private);
 }
 
-static int tracing_release_generic_file(struct inode *inode, struct file *filp)
+static void remove_event_file_dir(struct ftrace_event_file *file)
 {
-        struct ftrace_event_file *file = inode->i_private;
-        struct trace_array *tr = file->tr;
+        struct dentry *dir = file->dir;
+        struct dentry *child;
 
-        trace_array_put(tr);
+        if (dir) {
+                spin_lock(&dir->d_lock);        /* probably unneeded */
+                list_for_each_entry(child, &dir->d_subdirs, d_u.d_child) {
+                        if (child->d_inode)     /* probably unneeded */
+                                child->d_inode->i_private = NULL;
+                }
+                spin_unlock(&dir->d_lock);
 
-        return 0;
+                debugfs_remove_recursive(dir);
+        }
+
+        list_del(&file->list);
+        remove_subsystem(file->system);
+        kmem_cache_free(file_cachep, file);
 }
 
 /*
@@ -679,15 +688,25 @@ static ssize_t
 event_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
                   loff_t *ppos)
 {
-        struct ftrace_event_file *file = filp->private_data;
+        struct ftrace_event_file *file;
+        unsigned long flags;
         char buf[4] = "0";
 
-        if (file->flags & FTRACE_EVENT_FL_ENABLED &&
-            !(file->flags & FTRACE_EVENT_FL_SOFT_DISABLED))
+        mutex_lock(&event_mutex);
+        file = event_file_data(filp);
+        if (likely(file))
+                flags = file->flags;
+        mutex_unlock(&event_mutex);
+
+        if (!file)
+                return -ENODEV;
+
+        if (flags & FTRACE_EVENT_FL_ENABLED &&
+            !(flags & FTRACE_EVENT_FL_SOFT_DISABLED))
                 strcpy(buf, "1");
 
-        if (file->flags & FTRACE_EVENT_FL_SOFT_DISABLED ||
-            file->flags & FTRACE_EVENT_FL_SOFT_MODE)
+        if (flags & FTRACE_EVENT_FL_SOFT_DISABLED ||
+            flags & FTRACE_EVENT_FL_SOFT_MODE)
                 strcat(buf, "*");
 
         strcat(buf, "\n");
@@ -699,13 +718,10 @@ static ssize_t
 event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
                    loff_t *ppos)
 {
-        struct ftrace_event_file *file = filp->private_data;
+        struct ftrace_event_file *file;
         unsigned long val;
         int ret;
 
-        if (!file)
-                return -EINVAL;
-
         ret = kstrtoul_from_user(ubuf, cnt, 10, &val);
         if (ret)
                 return ret;
@@ -717,8 +733,11 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
         switch (val) {
         case 0:
         case 1:
+                ret = -ENODEV;
                 mutex_lock(&event_mutex);
-                ret = ftrace_event_enable_disable(file, val);
+                file = event_file_data(filp);
+                if (likely(file))
+                        ret = ftrace_event_enable_disable(file, val);
                 mutex_unlock(&event_mutex);
                 break;
 
@@ -825,7 +844,7 @@ enum {
 
 static void *f_next(struct seq_file *m, void *v, loff_t *pos)
 {
-        struct ftrace_event_call *call = m->private;
+        struct ftrace_event_call *call = event_file_data(m->private);
         struct list_head *common_head = &ftrace_common_fields;
         struct list_head *head = trace_get_fields(call);
         struct list_head *node = v;
@@ -857,7 +876,7 @@ static void *f_next(struct seq_file *m, void *v, loff_t *pos)
 
 static int f_show(struct seq_file *m, void *v)
 {
-        struct ftrace_event_call *call = m->private;
+        struct ftrace_event_call *call = event_file_data(m->private);
         struct ftrace_event_field *field;
         const char *array_descriptor;
 
@@ -910,6 +929,11 @@ static void *f_start(struct seq_file *m, loff_t *pos)
         void *p = (void *)FORMAT_HEADER;
         loff_t l = 0;
 
+        /* ->stop() is called even if ->start() fails */
+        mutex_lock(&event_mutex);
+        if (!event_file_data(m->private))
+                return ERR_PTR(-ENODEV);
+
         while (l < *pos && p)
                 p = f_next(m, p, &l);
 
@@ -918,6 +942,7 @@ static void *f_start(struct seq_file *m, loff_t *pos)
 
 static void f_stop(struct seq_file *m, void *p)
 {
+        mutex_unlock(&event_mutex);
 }
 
 static const struct seq_operations trace_format_seq_ops = {
@@ -929,7 +954,6 @@ static const struct seq_operations trace_format_seq_ops = {
 
 static int trace_format_open(struct inode *inode, struct file *file)
 {
-        struct ftrace_event_call *call = inode->i_private;
         struct seq_file *m;
         int ret;
 
@@ -938,7 +962,7 @@ static int trace_format_open(struct inode *inode, struct file *file)
                 return ret;
 
         m = file->private_data;
-        m->private = call;
+        m->private = file;
 
         return 0;
 }
@@ -946,14 +970,18 @@ static int trace_format_open(struct inode *inode, struct file *file)
 static ssize_t
 event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
 {
-        struct ftrace_event_call *call = filp->private_data;
+        int id = (long)event_file_data(filp);
         char buf[32];
         int len;
 
         if (*ppos)
                 return 0;
 
-        len = sprintf(buf, "%d\n", call->event.type);
+        if (unlikely(!id))
+                return -ENODEV;
+
+        len = sprintf(buf, "%d\n", id);
+
         return simple_read_from_buffer(ubuf, cnt, ppos, buf, len);
 }
 
@@ -961,21 +989,28 @@ static ssize_t
 event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
                   loff_t *ppos)
 {
-        struct ftrace_event_call *call = filp->private_data;
+        struct ftrace_event_call *call;
         struct trace_seq *s;
-        int r;
+        int r = -ENODEV;
 
         if (*ppos)
                 return 0;
 
         s = kmalloc(sizeof(*s), GFP_KERNEL);
+
         if (!s)
                 return -ENOMEM;
 
         trace_seq_init(s);
 
-        print_event_filter(call, s);
-        r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->len);
+        mutex_lock(&event_mutex);
+        call = event_file_data(filp);
+        if (call)
+                print_event_filter(call, s);
+        mutex_unlock(&event_mutex);
+
+        if (call)
+                r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->len);
 
         kfree(s);
 
@@ -986,9 +1021,9 @@ static ssize_t
 event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,
                    loff_t *ppos)
 {
-        struct ftrace_event_call *call = filp->private_data;
+        struct ftrace_event_call *call;
         char *buf;
-        int err;
+        int err = -ENODEV;
 
         if (cnt >= PAGE_SIZE)
                 return -EINVAL;
@@ -1003,7 +1038,12 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,
         }
         buf[cnt] = '\0';
 
-        err = apply_event_filter(call, buf);
+        mutex_lock(&event_mutex);
+        call = event_file_data(filp);
+        if (call)
+                err = apply_event_filter(call, buf);
+        mutex_unlock(&event_mutex);
+
         free_page((unsigned long) buf);
         if (err < 0)
                 return err;
@@ -1225,10 +1265,9 @@ static const struct file_operations ftrace_set_event_fops = {
 };
 
 static const struct file_operations ftrace_enable_fops = {
-        .open = tracing_open_generic_file,
+        .open = tracing_open_generic,
         .read = event_enable_read,
         .write = event_enable_write,
-        .release = tracing_release_generic_file,
         .llseek = default_llseek,
 };
 
@@ -1240,7 +1279,6 @@ static const struct file_operations ftrace_event_format_fops = {
 };
 
 static const struct file_operations ftrace_event_id_fops = {
-        .open = tracing_open_generic,
         .read = event_id_read,
         .llseek = default_llseek,
 };
@@ -1488,8 +1526,8 @@ event_create_dir(struct dentry *parent,
 
 #ifdef CONFIG_PERF_EVENTS
         if (call->event.type && call->class->reg)
-                trace_create_file("id", 0444, file->dir, call,
-                                  id);
+                trace_create_file("id", 0444, file->dir,
+                                  (void *)(long)call->event.type, id);
 #endif
 
         /*
@@ -1514,33 +1552,16 @@ event_create_dir(struct dentry *parent,
         return 0;
 }
 
-static void remove_subsystem(struct ftrace_subsystem_dir *dir)
-{
-        if (!dir)
-                return;
-
-        if (!--dir->nr_events) {
-                debugfs_remove_recursive(dir->entry);
-                list_del(&dir->list);
-                __put_system_dir(dir);
-        }
-}
-
 static void remove_event_from_tracers(struct ftrace_event_call *call)
 {
         struct ftrace_event_file *file;
         struct trace_array *tr;
 
         do_for_each_event_file_safe(tr, file) {
-
                 if (file->event_call != call)
                         continue;
 
-                list_del(&file->list);
-                debugfs_remove_recursive(file->dir);
-                remove_subsystem(file->system);
-                kmem_cache_free(file_cachep, file);
-
+                remove_event_file_dir(file);
                 /*
                  * The do_for_each_event_file_safe() is
                  * a double loop. After finding the call for this
@@ -1692,16 +1713,53 @@ static void __trace_remove_event_call(struct ftrace_event_call *call)
         destroy_preds(call);
 }
 
+static int probe_remove_event_call(struct ftrace_event_call *call)
+{
+        struct trace_array *tr;
+        struct ftrace_event_file *file;
+
+#ifdef CONFIG_PERF_EVENTS
+        if (call->perf_refcount)
+                return -EBUSY;
+#endif
+        do_for_each_event_file(tr, file) {
+                if (file->event_call != call)
+                        continue;
+                /*
+                 * We can't rely on ftrace_event_enable_disable(enable => 0)
+                 * we are going to do, FTRACE_EVENT_FL_SOFT_MODE can suppress
+                 * TRACE_REG_UNREGISTER.
+                 */
+                if (file->flags & FTRACE_EVENT_FL_ENABLED)
+                        return -EBUSY;
+                /*
+                 * The do_for_each_event_file_safe() is
+                 * a double loop. After finding the call for this
+                 * trace_array, we use break to jump to the next
+                 * trace_array.
+                 */
+                break;
+        } while_for_each_event_file();
+
+        __trace_remove_event_call(call);
+
+        return 0;
+}
+
 /* Remove an event_call */
-void trace_remove_event_call(struct ftrace_event_call *call)
+int trace_remove_event_call(struct ftrace_event_call *call)
 {
+        int ret;
+
         mutex_lock(&trace_types_lock);
         mutex_lock(&event_mutex);
         down_write(&trace_event_sem);
-        __trace_remove_event_call(call);
+        ret = probe_remove_event_call(call);
         up_write(&trace_event_sem);
         mutex_unlock(&event_mutex);
         mutex_unlock(&trace_types_lock);
+
+        return ret;
 }
 
 #define for_each_event(event, start, end)                       \
@@ -2270,12 +2328,8 @@ __trace_remove_event_dirs(struct trace_array *tr)
 {
         struct ftrace_event_file *file, *next;
 
-        list_for_each_entry_safe(file, next, &tr->events, list) {
-                list_del(&file->list);
-                debugfs_remove_recursive(file->dir);
-                remove_subsystem(file->system);
-                kmem_cache_free(file_cachep, file);
-        }
+        list_for_each_entry_safe(file, next, &tr->events, list)
+                remove_event_file_dir(file);
 }
 
 static void
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 0c7b75a8acc8..97daa8cf958d 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -637,17 +637,15 @@ static void append_filter_err(struct filter_parse_state *ps,
         free_page((unsigned long) buf);
 }
 
+/* caller must hold event_mutex */
 void print_event_filter(struct ftrace_event_call *call, struct trace_seq *s)
 {
-        struct event_filter *filter;
+        struct event_filter *filter = call->filter;
 
-        mutex_lock(&event_mutex);
-        filter = call->filter;
         if (filter && filter->filter_string)
                 trace_seq_printf(s, "%s\n", filter->filter_string);
         else
                 trace_seq_puts(s, "none\n");
-        mutex_unlock(&event_mutex);
 }
 
 void print_subsystem_event_filter(struct event_subsystem *system,
@@ -1841,23 +1839,22 @@ static int create_system_filter(struct event_subsystem *system,
         return err;
 }
 
+/* caller must hold event_mutex */
 int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
 {
         struct event_filter *filter;
-        int err = 0;
-
-        mutex_lock(&event_mutex);
+        int err;
 
         if (!strcmp(strstrip(filter_string), "0")) {
                 filter_disable(call);
                 filter = call->filter;
                 if (!filter)
-                        goto out_unlock;
+                        return 0;
                 RCU_INIT_POINTER(call->filter, NULL);
                 /* Make sure the filter is not being used */
                 synchronize_sched();
                 __free_filter(filter);
-                goto out_unlock;
+                return 0;
         }
 
         err = create_filter(call, filter_string, true, &filter);
@@ -1884,8 +1881,6 @@ int apply_event_filter(struct ftrace_event_call *call, char *filter_string)
                         __free_filter(tmp);
                 }
         }
-out_unlock:
-        mutex_unlock(&event_mutex);
 
         return err;
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 3811487e7a7a..243f6834d026 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -95,7 +95,7 @@ static __kprobes bool trace_probe_is_on_module(struct trace_probe *tp)
 }
 
 static int register_probe_event(struct trace_probe *tp);
-static void unregister_probe_event(struct trace_probe *tp);
+static int unregister_probe_event(struct trace_probe *tp);
 
 static DEFINE_MUTEX(probe_lock);
 static LIST_HEAD(probe_list);
@@ -351,9 +351,12 @@ static int unregister_trace_probe(struct trace_probe *tp)
         if (trace_probe_is_enabled(tp))
                 return -EBUSY;
 
+        /* Will fail if probe is being used by ftrace or perf */
+        if (unregister_probe_event(tp))
+                return -EBUSY;
+
         __unregister_trace_probe(tp);
         list_del(&tp->list);
-        unregister_probe_event(tp);
 
         return 0;
 }
@@ -632,7 +635,9 @@ static int release_all_trace_probes(void)
         /* TODO: Use batch unregistration */
         while (!list_empty(&probe_list)) {
                 tp = list_entry(probe_list.next, struct trace_probe, list);
-                unregister_trace_probe(tp);
+                ret = unregister_trace_probe(tp);
+                if (ret)
+                        goto end;
                 free_trace_probe(tp);
         }
 
@@ -1247,11 +1252,15 @@ static int register_probe_event(struct trace_probe *tp)
         return ret;
 }
 
-static void unregister_probe_event(struct trace_probe *tp)
+static int unregister_probe_event(struct trace_probe *tp)
 {
+        int ret;
+
         /* tp->event is unregistered in trace_remove_event_call() */
-        trace_remove_event_call(&tp->call);
-        kfree(tp->call.print_fmt);
+        ret = trace_remove_event_call(&tp->call);
+        if (!ret)
+                kfree(tp->call.print_fmt);
+        return ret;
 }
 
 /* Make a debugfs interface for controlling probe points */
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index a23d2d71188e..272261b5f94f 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -70,7 +70,7 @@ struct trace_uprobe {
         (sizeof(struct probe_arg) * (n)))
 
 static int register_uprobe_event(struct trace_uprobe *tu);
-static void unregister_uprobe_event(struct trace_uprobe *tu);
+static int unregister_uprobe_event(struct trace_uprobe *tu);
 
 static DEFINE_MUTEX(uprobe_lock);
 static LIST_HEAD(uprobe_list);
@@ -164,11 +164,17 @@ static struct trace_uprobe *find_probe_event(const char *event, const char *grou
 }
 
 /* Unregister a trace_uprobe and probe_event: call with locking uprobe_lock */
-static void unregister_trace_uprobe(struct trace_uprobe *tu)
+static int unregister_trace_uprobe(struct trace_uprobe *tu)
 {
+        int ret;
+
+        ret = unregister_uprobe_event(tu);
+        if (ret)
+                return ret;
+
         list_del(&tu->list);
-        unregister_uprobe_event(tu);
         free_trace_uprobe(tu);
+        return 0;
 }
 
 /* Register a trace_uprobe and probe_event */
@@ -181,9 +187,12 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
 
         /* register as an event */
         old_tp = find_probe_event(tu->call.name, tu->call.class->system);
-        if (old_tp)
+        if (old_tp) {
                 /* delete old event */
-                unregister_trace_uprobe(old_tp);
+                ret = unregister_trace_uprobe(old_tp);
+                if (ret)
+                        goto end;
+        }
 
         ret = register_uprobe_event(tu);
         if (ret) {
@@ -256,6 +265,8 @@ static int create_trace_uprobe(int argc, char **argv)
                 group = UPROBE_EVENT_SYSTEM;
 
         if (is_delete) {
+                int ret;
+
                 if (!event) {
                         pr_info("Delete command needs an event name.\n");
                         return -EINVAL;
@@ -269,9 +280,9 @@ static int create_trace_uprobe(int argc, char **argv)
                         return -ENOENT;
                 }
                 /* delete an event */
-                unregister_trace_uprobe(tu);
+                ret = unregister_trace_uprobe(tu);
                 mutex_unlock(&uprobe_lock);
-                return 0;
+                return ret;
         }
 
         if (argc < 2) {
@@ -408,16 +419,20 @@ fail_address_parse:
         return ret;
 }
 
-static void cleanup_all_probes(void)
+static int cleanup_all_probes(void)
 {
         struct trace_uprobe *tu;
+        int ret = 0;
 
         mutex_lock(&uprobe_lock);
         while (!list_empty(&uprobe_list)) {
                 tu = list_entry(uprobe_list.next, struct trace_uprobe, list);
-                unregister_trace_uprobe(tu);
+                ret = unregister_trace_uprobe(tu);
+                if (ret)
+                        break;
         }
         mutex_unlock(&uprobe_lock);
+        return ret;
 }
 
 /* Probes listing interfaces */
@@ -462,8 +477,13 @@ static const struct seq_operations probes_seq_op = {
 
 static int probes_open(struct inode *inode, struct file *file)
 {
-        if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC))
-                cleanup_all_probes();
+        int ret;
+
+        if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) {
+                ret = cleanup_all_probes();
+                if (ret)
+                        return ret;
+        }
 
         return seq_open(file, &probes_seq_op);
 }
@@ -968,12 +988,17 @@ static int register_uprobe_event(struct trace_uprobe *tu)
         return ret;
 }
 
-static void unregister_uprobe_event(struct trace_uprobe *tu)
+static int unregister_uprobe_event(struct trace_uprobe *tu)
 {
+        int ret;
+
         /* tu->event is unregistered in trace_remove_event_call() */
-        trace_remove_event_call(&tu->call);
+        ret = trace_remove_event_call(&tu->call);
+        if (ret)
+                return ret;
         kfree(tu->call.print_fmt);
         tu->call.print_fmt = NULL;
+        return 0;
 }
 
 /* Make a trace interface for controling probe points */
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index d8c30db06c5b..9064b919a406 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -62,6 +62,9 @@ int create_user_ns(struct cred *new)
         kgid_t group = new->egid;
         int ret;
 
+        if (parent_ns->level > 32)
+                return -EUSERS;
+
         /*
          * Verify that we can not violate the policy of which files
          * may be accessed that is specified by the root directory,
@@ -92,6 +95,7 @@ int create_user_ns(struct cred *new)
         atomic_set(&ns->count, 1);
         /* Leave the new->user_ns reference with the new user namespace. */
         ns->parent = parent_ns;
+        ns->level = parent_ns->level + 1;
         ns->owner = owner;
         ns->group = group;
 
@@ -105,16 +109,21 @@ int create_user_ns(struct cred *new)
 int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
 {
         struct cred *cred;
+        int err = -ENOMEM;
 
         if (!(unshare_flags & CLONE_NEWUSER))
                 return 0;
 
         cred = prepare_creds();
-        if (!cred)
-                return -ENOMEM;
+        if (cred) {
+                err = create_user_ns(cred);
+                if (err)
+                        put_cred(cred);
+                else
+                        *new_cred = cred;
+        }
 
-        *new_cred = cred;
-        return create_user_ns(cred);
+        return err;
 }
 
 void free_user_ns(struct user_namespace *ns)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 0b72e816b8d0..7f5d4be22034 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2817,6 +2817,19 @@ already_gone:
         return false;
 }
 
+static bool __flush_work(struct work_struct *work)
+{
+        struct wq_barrier barr;
+
+        if (start_flush_work(work, &barr)) {
+                wait_for_completion(&barr.done);
+                destroy_work_on_stack(&barr.work);
+                return true;
+        } else {
+                return false;
+        }
+}
+
 /**
  * flush_work - wait for a work to finish executing the last queueing instance
  * @work: the work to flush
@@ -2830,18 +2843,10 @@ already_gone:
  */
 bool flush_work(struct work_struct *work)
 {
-        struct wq_barrier barr;
-
         lock_map_acquire(&work->lockdep_map);
         lock_map_release(&work->lockdep_map);
 
-        if (start_flush_work(work, &barr)) {
-                wait_for_completion(&barr.done);
-                destroy_work_on_stack(&barr.work);
-                return true;
-        } else {
-                return false;
-        }
+        return __flush_work(work);
 }
 EXPORT_SYMBOL_GPL(flush_work);
 
@@ -3411,6 +3416,12 @@ static void copy_workqueue_attrs(struct workqueue_attrs *to,
 {
         to->nice = from->nice;
         cpumask_copy(to->cpumask, from->cpumask);
+        /*
+         * Unlike hash and equality test, this function doesn't ignore
+         * ->no_numa as it is used for both pool and wq attrs.  Instead,
+         * get_unbound_pool() explicitly clears ->no_numa after copying.
+         */
+        to->no_numa = from->no_numa;
 }
 
 /* hash value of the content of @attr */
@@ -3578,6 +3589,12 @@ static struct worker_pool *get_unbound_pool(const struct workqueue_attrs *attrs)
         lockdep_set_subclass(&pool->lock, 1);   /* see put_pwq() */
         copy_workqueue_attrs(pool->attrs, attrs);
 
+        /*
+         * no_numa isn't a worker_pool attribute, always clear it.  See
+         * 'struct workqueue_attrs' comments for detail.
+         */
+        pool->attrs->no_numa = false;
+
         /* if cpumask is contained inside a NUMA node, we belong to that node */
         if (wq_numa_enabled) {
                 for_each_node(node) {
@@ -4756,7 +4773,14 @@ long work_on_cpu(int cpu, long (*fn)(void *), void *arg)
 
         INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
         schedule_work_on(cpu, &wfc.work);
-        flush_work(&wfc.work);
+
+        /*
+         * The work item is on-stack and can't lead to deadlock through
+         * flushing.  Use __flush_work() to avoid spurious lockdep warnings
+         * when work_on_cpu()s are nested.
+         */
+        __flush_work(&wfc.work);
+
         return wfc.ret;
 }
 EXPORT_SYMBOL_GPL(work_on_cpu);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 243e710c6039..a92012a71702 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1620,7 +1620,9 @@ static void __split_huge_page_refcount(struct page *page,
                                      ((1L << PG_referenced) |
                                       (1L << PG_swapbacked) |
                                       (1L << PG_mlocked) |
-                                      (1L << PG_uptodate)));
+                                      (1L << PG_uptodate) |
+                                      (1L << PG_active) |
+                                      (1L << PG_unevictable)));
                 page_tail->flags |= (1L << PG_dirty);
 
                 /* clear PageTail before overwriting first_page */
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 00a7a664b9c1..c290a1cf3862 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6335,6 +6335,7 @@ static void mem_cgroup_css_offline(struct cgroup *cont)
         mem_cgroup_invalidate_reclaim_iterators(memcg);
         mem_cgroup_reparent_charges(memcg);
         mem_cgroup_destroy_all_caches(memcg);
+        vmpressure_cleanup(&memcg->vmpressure);
 }
 
 static void mem_cgroup_css_free(struct cgroup *cont)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 74310017296e..4baf12e534d1 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -732,7 +732,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                 if (prev) {
                         vma = prev;
                         next = vma->vm_next;
-                        continue;
+                        if (mpol_equal(vma_policy(vma), new_pol))
+                                continue;
+                        /* vma_merge() joined vma && vma->next, case 8 */
+                        goto replace;
                 }
                 if (vma->vm_start != vmstart) {
                         err = split_vma(vma->vm_mm, vma, vmstart, 1);
@@ -744,6 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                         if (err)
                                 goto out;
                 }
+ replace:
                 err = vma_replace_policy(vma, new_pol);
                 if (err)
                         goto out;
diff --git a/mm/mmap.c b/mm/mmap.c
index fbad7b091090..1edbaa3136c3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -865,7 +865,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                 if (next->anon_vma)
                         anon_vma_merge(vma, next);
                 mm->map_count--;
-                vma_set_policy(vma, vma_policy(next));
+                mpol_put(vma_policy(next));
                 kmem_cache_free(vm_area_cachep, next);
                 /*
                  * In mprotect's case 6 (see comments on vma_merge),
diff --git a/mm/shmem.c b/mm/shmem.c
index a87990cf9f94..8335dbd3fc35 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1798,7 +1798,8 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)
                 }
         }
 
-        offset = vfs_setpos(file, offset, MAX_LFS_FILESIZE);
+        if (offset >= 0)
+                offset = vfs_setpos(file, offset, MAX_LFS_FILESIZE);
         mutex_unlock(&inode->i_mutex);
         return offset;
 }
diff --git a/mm/slub.c b/mm/slub.c
index 2b02d666bf63..e3ba1f2cf60c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1968,9 +1968,6 @@ static void put_cpu_partial(struct kmem_cache *s, struct page *page, int drain)
         int pages;
         int pobjects;
 
-        if (!s->cpu_partial)
-                return;
-
         do {
                 pages = 0;
                 pobjects = 0;
diff --git a/mm/swap.c b/mm/swap.c
index 4a1d0d2c52fa..62b78a6e224f 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -512,12 +512,7 @@ EXPORT_SYMBOL(__lru_cache_add);
  */
 void lru_cache_add(struct page *page)
 {
-        if (PageActive(page)) {
-                VM_BUG_ON(PageUnevictable(page));
-        } else if (PageUnevictable(page)) {
-                VM_BUG_ON(PageActive(page));
-        }
-
+        VM_BUG_ON(PageActive(page) && PageUnevictable(page));
         VM_BUG_ON(PageLRU(page));
         __lru_cache_add(page);
 }
@@ -539,6 +534,7 @@ void add_page_to_unevictable_list(struct page *page)
 
         spin_lock_irq(&zone->lru_lock);
         lruvec = mem_cgroup_page_lruvec(page, zone);
+        ClearPageActive(page);
         SetPageUnevictable(page);
         SetPageLRU(page);
         add_page_to_lru_list(page, lruvec, LRU_UNEVICTABLE);
@@ -774,8 +770,6 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct page *page, struct page *page_tail,
                        struct lruvec *lruvec, struct list_head *list)
 {
-        int uninitialized_var(active);
-        enum lru_list lru;
         const int file = 0;
 
         VM_BUG_ON(!PageHead(page));
@@ -787,20 +781,6 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
         if (!list)
                 SetPageLRU(page_tail);
 
-        if (page_evictable(page_tail)) {
-                if (PageActive(page)) {
-                        SetPageActive(page_tail);
-                        active = 1;
-                        lru = LRU_ACTIVE_ANON;
-                } else {
-                        active = 0;
-                        lru = LRU_INACTIVE_ANON;
-                }
-        } else {
-                SetPageUnevictable(page_tail);
-                lru = LRU_UNEVICTABLE;
-        }
-
         if (likely(PageLRU(page)))
                 list_add_tail(&page_tail->lru, &page->lru);
         else if (list) {
@@ -816,13 +796,13 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
                  * Use the standard add function to put page_tail on the list,
                  * but then correct its position so they all end up in order.
                  */
-                add_page_to_lru_list(page_tail, lruvec, lru);
+                add_page_to_lru_list(page_tail, lruvec, page_lru(page_tail));
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
 
         if (!PageUnevictable(page))
-                update_page_reclaim_stat(lruvec, file, active);
+                update_page_reclaim_stat(lruvec, file, PageActive(page_tail));
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -833,7 +813,6 @@ static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec,
         int active = PageActive(page);
         enum lru_list lru = page_lru(page);
 
-        VM_BUG_ON(PageUnevictable(page));
         VM_BUG_ON(PageLRU(page));
 
         SetPageLRU(page);
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 736a6011c2c8..0c1e37d829fa 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -180,12 +180,12 @@ static void vmpressure_work_fn(struct work_struct *work)
         if (!vmpr->scanned)
                 return;
 
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
         scanned = vmpr->scanned;
         reclaimed = vmpr->reclaimed;
         vmpr->scanned = 0;
         vmpr->reclaimed = 0;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
 
         do {
                 if (vmpressure_event(vmpr, scanned, reclaimed))
@@ -240,13 +240,13 @@ void vmpressure(gfp_t gfp, struct mem_cgroup *memcg,
         if (!scanned)
                 return;
 
-        mutex_lock(&vmpr->sr_lock);
+        spin_lock(&vmpr->sr_lock);
         vmpr->scanned += scanned;
         vmpr->reclaimed += reclaimed;
         scanned = vmpr->scanned;
-        mutex_unlock(&vmpr->sr_lock);
+        spin_unlock(&vmpr->sr_lock);
 
-        if (scanned < vmpressure_win || work_pending(&vmpr->work))
+        if (scanned < vmpressure_win)
                 return;
         schedule_work(&vmpr->work);
 }
@@ -367,8 +367,24 @@ void vmpressure_unregister_event(struct cgroup *cg, struct cftype *cft,
  */
 void vmpressure_init(struct vmpressure *vmpr)
 {
-        mutex_init(&vmpr->sr_lock);
+        spin_lock_init(&vmpr->sr_lock);
         mutex_init(&vmpr->events_lock);
         INIT_LIST_HEAD(&vmpr->events);
         INIT_WORK(&vmpr->work, vmpressure_work_fn);
 }
+
+/**
+ * vmpressure_cleanup() - shuts down vmpressure control structure
+ * @vmpr:       Structure to be cleaned up
+ *
+ * This function should be called before the structure in which it is
+ * embedded is cleaned up.
+ */
+void vmpressure_cleanup(struct vmpressure *vmpr)
+{
+        /*
+         * Make sure there is no pending work before eventfd infrastructure
+         * goes away.
+         */
+        flush_work(&vmpr->work);
+}
diff --git a/mm/zbud.c b/mm/zbud.c
index 9bb4710e3589..ad1e781284fd 100644
--- a/mm/zbud.c
+++ b/mm/zbud.c
@@ -257,7 +257,7 @@ int zbud_alloc(struct zbud_pool *pool, int size, gfp_t gfp,
 
         if (size <= 0 || gfp & __GFP_HIGHMEM)
                 return -EINVAL;
-        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED)
+        if (size > PAGE_SIZE - ZHDR_SIZE_ALIGNED - CHUNK_SIZE)
                 return -ENOSPC;
         chunks = size_to_chunks(size);
         spin_lock(&pool->lock);
diff --git a/net/Kconfig b/net/Kconfig
index 37702491abe9..2b406608a1a4 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -244,7 +244,7 @@ config NETPRIO_CGROUP
           Cgroup subsystem for use in assigning processes to network priorities on
           a per-interface basis
 
-config NET_LL_RX_POLL
+config NET_RX_BUSY_POLL
         boolean
         default y
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e3a349977595..cc27297da5a9 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -513,7 +513,10 @@ static void hci_init2_req(struct hci_request *req, unsigned long opt)
 
         hci_setup_event_mask(req);
 
-        if (hdev->hci_ver > BLUETOOTH_VER_1_1)
+        /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
+         * local supported commands HCI command.
+         */
+        if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 
         if (lmp_ssp_capable(hdev)) {
@@ -2165,10 +2168,6 @@ int hci_register_dev(struct hci_dev *hdev)
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
-        write_lock(&hci_dev_list_lock);
-        list_add(&hdev->list, &hci_dev_list);
-        write_unlock(&hci_dev_list_lock);
-
         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
                                           WQ_MEM_RECLAIM, 1, hdev->name);
         if (!hdev->workqueue) {
@@ -2203,6 +2202,10 @@ int hci_register_dev(struct hci_dev *hdev)
         if (hdev->dev_type != HCI_AMP)
                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
 
+        write_lock(&hci_dev_list_lock);
+        list_add(&hdev->list, &hci_dev_list);
+        write_unlock(&hci_dev_list_lock);
+
         hci_notify(hdev, HCI_DEV_REG);
         hci_dev_hold(hdev);
 
@@ -2215,9 +2218,6 @@ err_wqueue:
         destroy_workqueue(hdev->req_workqueue);
 err:
         ida_simple_remove(&hci_index_ida, hdev->id);
-        write_lock(&hci_dev_list_lock);
-        list_del(&hdev->list);
-        write_unlock(&hci_dev_list_lock);
 
         return error;
 }
@@ -3399,8 +3399,16 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
          */
         if (hdev->sent_cmd) {
                 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
-                if (req_complete)
+
+                if (req_complete) {
+                        /* We must set the complete callback to NULL to
+                         * avoid calling the callback more than once if
+                         * this function gets called again.
+                         */
+                        bt_cb(hdev->sent_cmd)->req.complete = NULL;
+
                         goto call_complete;
+                }
         }
 
         /* Remove all pending commands belonging to this request */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 2ef66781fedb..69363bd37f64 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -70,7 +70,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
 
                 mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br))
                         br_multicast_deliver(mdst, skb);
                 else
                         br_flood_deliver(br, skb, false);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 1b8b8b824cd7..8c561c0aa636 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -101,7 +101,8 @@ int br_handle_frame_finish(struct sk_buff *skb)
                 unicast = false;
         } else if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br)) {
                         if ((mdst && mdst->mglist) ||
                             br_multicast_is_router(br))
                                 skb2 = skb;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 69af490cce44..61c5e819380e 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -619,6 +619,9 @@ rehash:
         mp->br = br;
         mp->addr = *group;
 
+        setup_timer(&mp->timer, br_multicast_group_expired,
+                    (unsigned long)mp);
+
         hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
         mdb->size++;
 
@@ -1011,6 +1014,16 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 }
 #endif
 
+static void br_multicast_update_querier_timer(struct net_bridge *br,
+                                              unsigned long max_delay)
+{
+        if (!timer_pending(&br->multicast_querier_timer))
+                br->multicast_querier_delay_time = jiffies + max_delay;
+
+        mod_timer(&br->multicast_querier_timer,
+                  jiffies + br->multicast_querier_interval);
+}
+
 /*
  * Add port to router_list
  *  list is maintained ordered by pointer value
@@ -1061,11 +1074,11 @@ timer:
 
 static void br_multicast_query_received(struct net_bridge *br,
                                         struct net_bridge_port *port,
-                                        int saddr)
+                                        int saddr,
+                                        unsigned long max_delay)
 {
         if (saddr)
-                mod_timer(&br->multicast_querier_timer,
-                          jiffies + br->multicast_querier_interval);
+                br_multicast_update_querier_timer(br, max_delay);
         else if (timer_pending(&br->multicast_querier_timer))
                 return;
 
@@ -1093,8 +1106,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, !!iph->saddr);
-
         group = ih->group;
 
         if (skb->len == sizeof(*ih)) {
@@ -1118,6 +1129,8 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                             IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
+        br_multicast_query_received(br, port, !!iph->saddr, max_delay);
+
         if (!group)
                 goto out;
 
@@ -1126,7 +1139,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
         mod_timer(&mp->timer, now + br->multicast_membership_interval);
         mp->timer_armed = true;
 
@@ -1174,8 +1186,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr));
-
         if (skb->len == sizeof(*mld)) {
                 if (!pskb_may_pull(skb, sizeof(*mld))) {
                         err = -EINVAL;
@@ -1196,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
         }
 
+        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
+                                    max_delay);
+
         if (!group)
                 goto out;
 
@@ -1204,7 +1217,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
         mod_timer(&mp->timer, now + br->multicast_membership_interval);
         mp->timer_armed = true;
 
@@ -1642,6 +1654,8 @@ void br_multicast_init(struct net_bridge *br)
         br->multicast_querier_interval = 255 * HZ;
         br->multicast_membership_interval = 260 * HZ;
 
+        br->multicast_querier_delay_time = 0;
+
         spin_lock_init(&br->multicast_lock);
         setup_timer(&br->multicast_router_timer,
                     br_multicast_local_router_expired, 0);
@@ -1830,6 +1844,8 @@ unlock:
 
 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
 {
+        unsigned long max_delay;
+
         val = !!val;
 
         spin_lock_bh(&br->multicast_lock);
@@ -1837,8 +1853,14 @@ int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
                 goto unlock;
 
         br->multicast_querier = val;
-        if (val)
-                br_multicast_start_querier(br);
+        if (!val)
+                goto unlock;
+
+        max_delay = br->multicast_query_response_interval;
+        if (!timer_pending(&br->multicast_querier_timer))
+                br->multicast_querier_delay_time = jiffies + max_delay;
+
+        br_multicast_start_querier(br);
 
 unlock:
         spin_unlock_bh(&br->multicast_lock);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 3be89b3ce17b..2f7da41851bf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -267,6 +267,7 @@ struct net_bridge
         unsigned long                   multicast_query_interval;
         unsigned long                   multicast_query_response_interval;
         unsigned long                   multicast_startup_query_interval;
+        unsigned long                   multicast_querier_delay_time;
 
         spinlock_t                      multicast_lock;
         struct net_bridge_mdb_htable __rcu *mdb;
@@ -501,6 +502,13 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
                (br->multicast_router == 1 &&
                 timer_pending(&br->multicast_router_timer));
 }
+
+static inline bool br_multicast_querier_exists(struct net_bridge *br)
+{
+        return time_is_before_jiffies(br->multicast_querier_delay_time) &&
+               (br->multicast_querier ||
+                timer_pending(&br->multicast_querier_timer));
+}
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
                                    struct net_bridge_port *port,
@@ -557,6 +565,10 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 {
         return 0;
 }
+static inline bool br_multicast_querier_exists(struct net_bridge *br)
+{
+        return false;
+}
 static inline void br_mdb_init(void)
 {
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b7de821f98df..9232c68941ab 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2767,6 +2767,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 
 static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -2819,19 +2820,25 @@ static struct neigh_sysctl_table {
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_UCAST_PROBE] = {
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_APP_PROBE] = {
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_RETRANS_TIME] = {
                         .procname       = "retrans_time",
@@ -2874,7 +2881,9 @@ static struct neigh_sysctl_table {
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_ANYCAST_DELAY] = {
                         .procname       = "anycast_delay",
@@ -2916,19 +2925,25 @@ static struct neigh_sysctl_table {
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH2] = {
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH3] = {
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 {},
         },
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 20e02d2605ec..2c3d0f53d198 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -309,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
  * @frag_size: size of fragment, or 0 if head was kmalloced
  *
  * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
  * The return is the new skb buffer.
  * On a failure the return is %NULL, and @data is not freed.
  * Notes :
@@ -739,7 +740,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 
         skb_copy_secmark(new, old);
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         new->napi_id    = old->napi_id;
 #endif
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 548d716c5f62..2c097c5a35dd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -900,7 +900,7 @@ set_rcvbuf:
                 sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
                 break;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         case SO_BUSY_POLL:
                 /* allow unprivileged users to decrease the value */
                 if ((val > sk->sk_ll_usec) && !capable(CAP_NET_ADMIN))
@@ -1170,7 +1170,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
                 break;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         case SO_BUSY_POLL:
                 v.val = sk->sk_ll_usec;
                 break;
@@ -2292,7 +2292,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         sk->sk_napi_id          =       0;
         sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 660968616637..31107abd2783 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -21,7 +21,9 @@
 #include <net/net_ratelimit.h>
 #include <net/busy_poll.h>
 
+static int zero = 0;
 static int one = 1;
+static int ushort_max = USHRT_MAX;
 
 #ifdef CONFIG_RPS
 static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
@@ -298,7 +300,7 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = flow_limit_table_len_sysctl
         },
 #endif /* CONFIG_NET_FLOW_LIMIT */
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         {
                 .procname       = "busy_poll",
                 .data           = &sysctl_net_busy_poll,
@@ -339,7 +341,9 @@ static struct ctl_table netns_core_table[] = {
                 .data           = &init_net.core.sysctl_somaxconn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .extra1         = &zero,
+                .extra2         = &ushort_max,
+                .proc_handler   = proc_dointvec_minmax
         },
         { }
 };
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 8d48c392adcc..34ca6d5a3a4b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -772,7 +772,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                 ci = nla_data(tb[IFA_CACHEINFO]);
                 if (!ci->ifa_valid || ci->ifa_prefered > ci->ifa_valid) {
                         err = -EINVAL;
-                        goto errout;
+                        goto errout_free;
                 }
                 *pvalid_lft = ci->ifa_valid;
                 *pprefered_lft = ci->ifa_prefered;
@@ -780,6 +780,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
 
         return ifa;
 
+errout_free:
+        inet_free_ifa(ifa);
 errout:
         return ERR_PTR(err);
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..108a1e9c9eac 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
                 max--;
 
         pointers = 0;
-        for (i = 1; i <= max; i++)
+        for (i = 1; i < max; i++)
                 if (stat->nodesizes[i] != 0) {
                         seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
                         pointers += (1<<i) * stat->nodesizes[i];
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b2c123c44d69..610e324348d1 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int ip_ttl_min = 1;
 static int ip_ttl_max = 255;
+static int tcp_syn_retries_min = 1;
+static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 
@@ -332,7 +334,9 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_syn_retries_min,
+                .extra2         = &tcp_syn_retries_max
         },
         {
                 .procname       = "tcp_synack_retries",
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cfdcf7b2daf6..da4241c8c7da 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -813,8 +813,9 @@ static u32 inet6_addr_hash(const struct in6_addr *addr)
 /* On success it returns ifp with increased reference count */
 
 static struct inet6_ifaddr *
-ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
-              int scope, u32 flags)
+ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
+              const struct in6_addr *peer_addr, int pfxlen,
+              int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
 {
         struct inet6_ifaddr *ifa = NULL;
         struct rt6_info *rt;
@@ -863,6 +864,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         }
 
         ifa->addr = *addr;
+        if (peer_addr)
+                ifa->peer_addr = *peer_addr;
 
         spin_lock_init(&ifa->lock);
         spin_lock_init(&ifa->state_lock);
@@ -872,6 +875,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         ifa->scope = scope;
         ifa->prefix_len = pfxlen;
         ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->valid_lft = valid_lft;
+        ifa->prefered_lft = prefered_lft;
         ifa->cstamp = ifa->tstamp = jiffies;
         ifa->tokenized = false;
 
@@ -1123,8 +1128,9 @@ retry:
 
         ift = !max_addresses ||
               ipv6_count_addresses(idev) < max_addresses ?
-                ipv6_add_addr(idev, &addr, tmp_plen, ipv6_addr_scope(&addr),
-                              addr_flags) : NULL;
+                ipv6_add_addr(idev, &addr, NULL, tmp_plen,
+                              ipv6_addr_scope(&addr), addr_flags,
+                              tmp_valid_lft, tmp_prefered_lft) : NULL;
         if (IS_ERR_OR_NULL(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
@@ -1136,8 +1142,6 @@ retry:
 
         spin_lock_bh(&ift->lock);
         ift->ifpub = ifp;
-        ift->valid_lft = tmp_valid_lft;
-        ift->prefered_lft = tmp_prefered_lft;
         ift->cstamp = now;
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
@@ -2179,16 +2183,19 @@ ok:
                          */
                         if (!max_addresses ||
                             ipv6_count_addresses(in6_dev) < max_addresses)
-                                ifp = ipv6_add_addr(in6_dev, &addr, pinfo->prefix_len,
+                                ifp = ipv6_add_addr(in6_dev, &addr, NULL,
+                                                    pinfo->prefix_len,
                                                     addr_type&IPV6_ADDR_SCOPE_MASK,
-                                                    addr_flags);
+                                                    addr_flags, valid_lft,
+                                                    prefered_lft);
 
                         if (IS_ERR_OR_NULL(ifp)) {
                                 in6_dev_put(in6_dev);
                                 return;
                         }
 
-                        update_lft = create = 1;
+                        update_lft = 0;
+                        create = 1;
                         ifp->cstamp = jiffies;
                         ifp->tokenized = tokenized;
                         addrconf_dad_start(ifp);
@@ -2209,7 +2216,7 @@ ok:
                                 stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
                         else
                                 stored_lft = 0;
-                        if (!update_lft && stored_lft) {
+                        if (!update_lft && !create && stored_lft) {
                                 if (valid_lft > MIN_VALID_LIFETIME ||
                                     valid_lft > stored_lft)
                                         update_lft = 1;
@@ -2455,17 +2462,10 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                 prefered_lft = timeout;
         }
 
-        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
+        ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
+                            valid_lft, prefered_lft);
 
         if (!IS_ERR(ifp)) {
-                spin_lock_bh(&ifp->lock);
-                ifp->valid_lft = valid_lft;
-                ifp->prefered_lft = prefered_lft;
-                ifp->tstamp = jiffies;
-                if (peer_pfx)
-                        ifp->peer_addr = *peer_pfx;
-                spin_unlock_bh(&ifp->lock);
-
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
                                       expires, flags);
                 /*
@@ -2557,7 +2557,8 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
 {
         struct inet6_ifaddr *ifp;
 
-        ifp = ipv6_add_addr(idev, addr, plen, scope, IFA_F_PERMANENT);
+        ifp = ipv6_add_addr(idev, addr, NULL, plen,
+                            scope, IFA_F_PERMANENT, 0, 0);
         if (!IS_ERR(ifp)) {
                 spin_lock_bh(&ifp->lock);
                 ifp->flags &= ~IFA_F_TENTATIVE;
@@ -2683,7 +2684,7 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 #endif
 
 
-        ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
+        ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags, 0, 0);
         if (!IS_ERR(ifp)) {
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
                 addrconf_dad_start(ifp);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 5fc9c7a68d8d..bff3d821c7eb 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1632,27 +1632,28 @@ static int fib6_age(struct rt6_info *rt, void *arg)
 
 static DEFINE_SPINLOCK(fib6_gc_lock);
 
-void fib6_run_gc(unsigned long expires, struct net *net)
+void fib6_run_gc(unsigned long expires, struct net *net, bool force)
 {
-        if (expires != ~0UL) {
+        unsigned long now;
+
+        if (force) {
                 spin_lock_bh(&fib6_gc_lock);
-                gc_args.timeout = expires ? (int)expires :
-                        net->ipv6.sysctl.ip6_rt_gc_interval;
-        } else {
-                if (!spin_trylock_bh(&fib6_gc_lock)) {
-                        mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
-                        return;
-                }
-                gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
+        } else if (!spin_trylock_bh(&fib6_gc_lock)) {
+                mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
+                return;
         }
+        gc_args.timeout = expires ? (int)expires :
+                          net->ipv6.sysctl.ip6_rt_gc_interval;
 
         gc_args.more = icmp6_dst_gc();
 
         fib6_clean_all(net, fib6_age, 0, NULL);
+        now = jiffies;
+        net->ipv6.ip6_rt_last_gc = now;
 
         if (gc_args.more)
                 mod_timer(&net->ipv6.ip6_fib_timer,
-                          round_jiffies(jiffies
+                          round_jiffies(now
                                         + net->ipv6.sysctl.ip6_rt_gc_interval));
         else
                 del_timer(&net->ipv6.ip6_fib_timer);
@@ -1661,7 +1662,7 @@ void fib6_run_gc(unsigned long expires, struct net *net)
 
 static void fib6_gc_timer_cb(unsigned long arg)
 {
-        fib6_run_gc(0, (struct net *)arg);
+        fib6_run_gc(0, (struct net *)arg, true);
 }
 
 static int __net_init fib6_net_init(struct net *net)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 583e8d435f9a..03986d31fa41 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
         struct mr6_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
+        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
 
 static void __net_exit ip6mr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ip6mr_free_table(net->ipv6.mrt6);
+        net->ipv6.mrt6 = NULL;
+        rtnl_unlock();
 }
 #endif
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 24c03396e008..79aa9652ed86 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1576,7 +1576,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                 idev = in6_dev_get(dev);
                 if (!idev)
                         break;
@@ -1586,7 +1586,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                 break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                 break;
         case NETDEV_NOTIFY_PEERS:
                 ndisc_send_unsol_na(dev);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a8c891aa2464..b70f8979003b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1311,7 +1311,6 @@ static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
 
 static int ip6_dst_gc(struct dst_ops *ops)
 {
-        unsigned long now = jiffies;
         struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
         int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
         int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
@@ -1321,13 +1320,12 @@ static int ip6_dst_gc(struct dst_ops *ops)
         int entries;
 
         entries = dst_entries_get_fast(ops);
-        if (time_after(rt_last_gc + rt_min_interval, now) &&
+        if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
             entries <= rt_max_size)
                 goto out;
 
         net->ipv6.ip6_rt_gc_expire++;
-        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
-        net->ipv6.ip6_rt_last_gc = now;
+        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
         entries = dst_entries_get_slow(ops);
         if (entries < ops->gc_thresh)
                 net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
@@ -2827,7 +2825,7 @@ int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
         net = (struct net *)ctl->extra1;
         delay = net->ipv6.sysctl.flush_delay;
         proc_dointvec(ctl, write, buffer, lenp, ppos);
-        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
         return 0;
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9da862070dd8..ab8bd2cabfa0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
                         pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
         }
         pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
         pol->sadb_x_policy_priority = xp->priority;
 
@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = xp->index;
+        pol->sadb_x_policy_priority = xp->priority;
 
         /* Set sadb_comb's. */
         if (x->id.proto == IPPROTO_AH)
@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
         pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
         pol->sadb_x_policy_dir = dir + 1;
+        pol->sadb_x_policy_reserved = 0;
         pol->sadb_x_policy_id = 0;
         pol->sadb_x_policy_priority = 0;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8184d121ff09..43dd7525bfcb 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -666,6 +666,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                         if (sta->sdata->dev != dev)
                                 continue;
 
+                        sinfo.filled = 0;
+                        sta_set_sinfo(sta, &sinfo);
                         i = 0;
                         ADD_STA_STATS(sta);
                 }
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 3b7bfc01ee36..22290a929b94 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(struct sta_info *sta)
         enum nl80211_mesh_power_mode pm;
         bool do_buffer;
 
+        /* For non-assoc STA, prevent buffering or frame transmission */
+        if (sta->sta_state < IEEE80211_STA_ASSOC)
+                return;
+
         /*
          * use peer-specific power mode if peering is established and the
          * peer's power mode is known
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7fc5d0d8149a..340126204343 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         }
         mutex_unlock(&local->sta_mtx);
 
-        /* remove all interfaces */
+        /* remove all interfaces that were created in the driver */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
+                if (!ieee80211_sdata_running(sdata) ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_MONITOR)
                         continue;
+
                 drv_remove_interface(local, sdata);
         }
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index ac7ef5414bde..e6512e2ffd20 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         struct minstrel_rate *msr, *mr;
         unsigned int ndx;
         bool mrr_capable;
-        bool prev_sample = mi->prev_sample;
+        bool prev_sample;
         int delta;
         int sampling_ratio;
 
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta < 0: no sampling required */
+        prev_sample = mi->prev_sample;
         mi->prev_sample = false;
         if (delta < 0 || (!mrr_capable && prev_sample))
                 return;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5b2d3012b983..f5aed963b22e 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
         sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
         info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        rate->count = 1;
+
+        if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+                rate->idx = mp->cck_rates[idx];
+                rate->flags = 0;
+                return;
+        }
+
         rate->idx = sample_idx % MCS_GROUP_RATES +
                     (sample_group->streams - 1) * MCS_GROUP_RATES;
         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-        rate->count = 1;
 }
 
 static void
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 23dbcfc69b3b..2c5a79bd3777 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 
-        /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
-        if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+        /*
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (rx->skb->len >= 24 && rx->sta &&
+            !ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1)) {
                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
                              hdr->seq_ctrl)) {
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c63b618cd619..4fd1ca94fd4a 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -293,6 +293,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
                        sizeof(exp->tuple.dst.u3) - len);
 
         exp->tuple.dst.u.all = *dst;
+
+#ifdef CONFIG_NF_NAT_NEEDED
+        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index f8b71911037a..20b15916f403 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -172,7 +172,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
@@ -196,7 +196,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 static bool
 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        return socket_match(skb, par, NULL);
+        static struct xt_socket_mtinfo1 xt_info_v0 = {
+                .flags = 0,
+        };
+
+        return socket_match(skb, par, &xt_info_v0);
 }
 
 static bool
@@ -314,7 +318,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                         transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                         inet_sk(sk)->transparent) ||
                                        (sk->sk_state == TCP_TIME_WAIT &&
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index c15042f987bd..a1100640495d 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -691,8 +691,8 @@ static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
 {
         struct netlbl_domhsh_walk_arg *cb_arg = arg;
 
-        if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
-            entry->type_def.cipsov4->doi == cb_arg->doi)
+        if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
+            entry->def.cipso->doi == cb_arg->doi)
                 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
 
         return 0;
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 6bb1d42f0fac..85d842e6e431 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -84,15 +84,15 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry)
 #endif /* IPv6 */
 
         ptr = container_of(entry, struct netlbl_dom_map, rcu);
-        if (ptr->type == NETLBL_NLTYPE_ADDRSELECT) {
+        if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                 netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &ptr->type_def.addrsel->list4) {
+                                            &ptr->def.addrsel->list4) {
                         netlbl_af4list_remove_entry(iter4);
                         kfree(netlbl_domhsh_addr4_entry(iter4));
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &ptr->type_def.addrsel->list6) {
+                                            &ptr->def.addrsel->list6) {
                         netlbl_af6list_remove_entry(iter6);
                         kfree(netlbl_domhsh_addr6_entry(iter6));
                 }
@@ -213,21 +213,21 @@ static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,
                 if (addr4 != NULL) {
                         struct netlbl_domaddr4_map *map4;
                         map4 = netlbl_domhsh_addr4_entry(addr4);
-                        type = map4->type;
-                        cipsov4 = map4->type_def.cipsov4;
+                        type = map4->def.type;
+                        cipsov4 = map4->def.cipso;
                         netlbl_af4list_audit_addr(audit_buf, 0, NULL,
                                                   addr4->addr, addr4->mask);
 #if IS_ENABLED(CONFIG_IPV6)
                 } else if (addr6 != NULL) {
                         struct netlbl_domaddr6_map *map6;
                         map6 = netlbl_domhsh_addr6_entry(addr6);
-                        type = map6->type;
+                        type = map6->def.type;
                         netlbl_af6list_audit_addr(audit_buf, 0, NULL,
                                                   &addr6->addr, &addr6->mask);
 #endif /* IPv6 */
                 } else {
-                        type = entry->type;
-                        cipsov4 = entry->type_def.cipsov4;
+                        type = entry->def.type;
+                        cipsov4 = entry->def.cipso;
                 }
                 switch (type) {
                 case NETLBL_NLTYPE_UNLABELED:
@@ -265,26 +265,25 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
         if (entry == NULL)
                 return -EINVAL;
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_UNLABELED:
-                if (entry->type_def.cipsov4 != NULL ||
-                    entry->type_def.addrsel != NULL)
+                if (entry->def.cipso != NULL || entry->def.addrsel != NULL)
                         return -EINVAL;
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
-                if (entry->type_def.cipsov4 == NULL)
+                if (entry->def.cipso == NULL)
                         return -EINVAL;
                 break;
         case NETLBL_NLTYPE_ADDRSELECT:
-                netlbl_af4list_foreach(iter4, &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) {
                         map4 = netlbl_domhsh_addr4_entry(iter4);
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                         case NETLBL_NLTYPE_UNLABELED:
-                                if (map4->type_def.cipsov4 != NULL)
+                                if (map4->def.cipso != NULL)
                                         return -EINVAL;
                                 break;
                         case NETLBL_NLTYPE_CIPSOV4:
-                                if (map4->type_def.cipsov4 == NULL)
+                                if (map4->def.cipso == NULL)
                                         return -EINVAL;
                                 break;
                         default:
@@ -292,9 +291,9 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
                         }
                 }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach(iter6, &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) {
                         map6 = netlbl_domhsh_addr6_entry(iter6);
-                        switch (map6->type) {
+                        switch (map6->def.type) {
                         case NETLBL_NLTYPE_UNLABELED:
                                 break;
                         default:
@@ -402,32 +401,31 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                         rcu_assign_pointer(netlbl_domhsh_def, entry);
                 }
 
-                if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+                if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                         netlbl_af4list_foreach_rcu(iter4,
-                                               &entry->type_def.addrsel->list4)
+                                                   &entry->def.addrsel->list4)
                                 netlbl_domhsh_audit_add(entry, iter4, NULL,
                                                         ret_val, audit_info);
 #if IS_ENABLED(CONFIG_IPV6)
                         netlbl_af6list_foreach_rcu(iter6,
-                                               &entry->type_def.addrsel->list6)
+                                                   &entry->def.addrsel->list6)
                                 netlbl_domhsh_audit_add(entry, NULL, iter6,
                                                         ret_val, audit_info);
 #endif /* IPv6 */
                 } else
                         netlbl_domhsh_audit_add(entry, NULL, NULL,
                                                 ret_val, audit_info);
-        } else if (entry_old->type == NETLBL_NLTYPE_ADDRSELECT &&
-                   entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+        } else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT &&
+                   entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                 struct list_head *old_list4;
                 struct list_head *old_list6;
 
-                old_list4 = &entry_old->type_def.addrsel->list4;
-                old_list6 = &entry_old->type_def.addrsel->list6;
+                old_list4 = &entry_old->def.addrsel->list4;
+                old_list6 = &entry_old->def.addrsel->list6;
 
                 /* we only allow the addition of address selectors if all of
                  * the selectors do not exist in the existing domain map */
-                netlbl_af4list_foreach_rcu(iter4,
-                                           &entry->type_def.addrsel->list4)
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4)
                         if (netlbl_af4list_search_exact(iter4->addr,
                                                         iter4->mask,
                                                         old_list4)) {
@@ -435,8 +433,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                                 goto add_return;
                         }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
-                                           &entry->type_def.addrsel->list6)
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6)
                         if (netlbl_af6list_search_exact(&iter6->addr,
                                                         &iter6->mask,
                                                         old_list6)) {
@@ -446,7 +443,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
 #endif /* IPv6 */
 
                 netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &entry->type_def.addrsel->list4) {
+                                            &entry->def.addrsel->list4) {
                         netlbl_af4list_remove_entry(iter4);
                         iter4->valid = 1;
                         ret_val = netlbl_af4list_add(iter4, old_list4);
@@ -457,7 +454,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 }
 #if IS_ENABLED(CONFIG_IPV6)
                 netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &entry->type_def.addrsel->list6) {
+                                            &entry->def.addrsel->list6) {
                         netlbl_af6list_remove_entry(iter6);
                         iter6->valid = 1;
                         ret_val = netlbl_af6list_add(iter6, old_list6);
@@ -538,18 +535,18 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
                 struct netlbl_af4list *iter4;
                 struct netlbl_domaddr4_map *map4;
 
-                switch (entry->type) {
+                switch (entry->def.type) {
                 case NETLBL_NLTYPE_ADDRSELECT:
                         netlbl_af4list_foreach_rcu(iter4,
-                                             &entry->type_def.addrsel->list4) {
+                                             &entry->def.addrsel->list4) {
                                 map4 = netlbl_domhsh_addr4_entry(iter4);
-                                cipso_v4_doi_putdef(map4->type_def.cipsov4);
+                                cipso_v4_doi_putdef(map4->def.cipso);
                         }
                         /* no need to check the IPv6 list since we currently
                          * support only unlabeled protocols for IPv6 */
                         break;
                 case NETLBL_NLTYPE_CIPSOV4:
-                        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+                        cipso_v4_doi_putdef(entry->def.cipso);
                         break;
                 }
                 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
@@ -590,20 +587,21 @@ int netlbl_domhsh_remove_af4(const char *domain,
                 entry_map = netlbl_domhsh_search(domain);
         else
                 entry_map = netlbl_domhsh_search_def(domain);
-        if (entry_map == NULL || entry_map->type != NETLBL_NLTYPE_ADDRSELECT)
+        if (entry_map == NULL ||
+            entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)
                 goto remove_af4_failure;
 
         spin_lock(&netlbl_domhsh_lock);
         entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
-                                           &entry_map->type_def.addrsel->list4);
+                                           &entry_map->def.addrsel->list4);
         spin_unlock(&netlbl_domhsh_lock);
 
         if (entry_addr == NULL)
                 goto remove_af4_failure;
-        netlbl_af4list_foreach_rcu(iter4, &entry_map->type_def.addrsel->list4)
+        netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)
                 goto remove_af4_single_addr;
 #if IS_ENABLED(CONFIG_IPV6)
-        netlbl_af6list_foreach_rcu(iter6, &entry_map->type_def.addrsel->list6)
+        netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)
                 goto remove_af4_single_addr;
 #endif /* IPv6 */
         /* the domain mapping is empty so remove it from the mapping table */
@@ -616,7 +614,7 @@ remove_af4_single_addr:
          * shouldn't be a problem */
         synchronize_rcu();
         entry = netlbl_domhsh_addr4_entry(entry_addr);
-        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+        cipso_v4_doi_putdef(entry->def.cipso);
         kfree(entry);
         return 0;
 
@@ -693,8 +691,8 @@ struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
  * responsible for ensuring that rcu_read_[un]lock() is called.
  *
  */
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
+                                                     __be32 addr)
 {
         struct netlbl_dom_map *dom_iter;
         struct netlbl_af4list *addr_iter;
@@ -702,15 +700,13 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
         dom_iter = netlbl_domhsh_search_def(domain);
         if (dom_iter == NULL)
                 return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
 
-        addr_iter = netlbl_af4list_search(addr,
-                                          &dom_iter->type_def.addrsel->list4);
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
+                return &dom_iter->def;
+        addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4);
         if (addr_iter == NULL)
                 return NULL;
-
-        return netlbl_domhsh_addr4_entry(addr_iter);
+        return &(netlbl_domhsh_addr4_entry(addr_iter)->def);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -725,7 +721,7 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
  * responsible for ensuring that rcu_read_[un]lock() is called.
  *
  */
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
                                                    const struct in6_addr *addr)
 {
         struct netlbl_dom_map *dom_iter;
@@ -734,15 +730,13 @@ struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
         dom_iter = netlbl_domhsh_search_def(domain);
         if (dom_iter == NULL)
                 return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
 
-        addr_iter = netlbl_af6list_search(addr,
-                                          &dom_iter->type_def.addrsel->list6);
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
+                return &dom_iter->def;
+        addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6);
         if (addr_iter == NULL)
                 return NULL;
-
-        return netlbl_domhsh_addr6_entry(addr_iter);
+        return &(netlbl_domhsh_addr6_entry(addr_iter)->def);
 }
 #endif /* IPv6 */
 
diff --git a/net/netlabel/netlabel_domainhash.h b/net/netlabel/netlabel_domainhash.h
index 90872c4ca30f..b9be0eed8980 100644
--- a/net/netlabel/netlabel_domainhash.h
+++ b/net/netlabel/netlabel_domainhash.h
@@ -43,37 +43,35 @@
 #define NETLBL_DOMHSH_BITSIZE       7
 
 /* Domain mapping definition structures */
+struct netlbl_domaddr_map {
+        struct list_head list4;
+        struct list_head list6;
+};
+struct netlbl_dommap_def {
+        u32 type;
+        union {
+                struct netlbl_domaddr_map *addrsel;
+                struct cipso_v4_doi *cipso;
+        };
+};
 #define netlbl_domhsh_addr4_entry(iter) \
         container_of(iter, struct netlbl_domaddr4_map, list)
 struct netlbl_domaddr4_map {
-        u32 type;
-        union {
-                struct cipso_v4_doi *cipsov4;
-        } type_def;
+        struct netlbl_dommap_def def;
 
         struct netlbl_af4list list;
 };
 #define netlbl_domhsh_addr6_entry(iter) \
         container_of(iter, struct netlbl_domaddr6_map, list)
 struct netlbl_domaddr6_map {
-        u32 type;
-
-        /* NOTE: no 'type_def' union needed at present since we don't currently
-         *       support any IPv6 labeling protocols */
+        struct netlbl_dommap_def def;
 
         struct netlbl_af6list list;
 };
-struct netlbl_domaddr_map {
-        struct list_head list4;
-        struct list_head list6;
-};
+
 struct netlbl_dom_map {
         char *domain;
-        u32 type;
-        union {
-                struct cipso_v4_doi *cipsov4;
-                struct netlbl_domaddr_map *addrsel;
-        } type_def;
+        struct netlbl_dommap_def def;
 
         u32 valid;
         struct list_head list;
@@ -97,16 +95,16 @@ int netlbl_domhsh_remove_af4(const char *domain,
 int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);
 int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info);
 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain);
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr);
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
+                                                     __be32 addr);
+#if IS_ENABLED(CONFIG_IPV6)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
+                                                   const struct in6_addr *addr);
+#endif /* IPv6 */
+
 int netlbl_domhsh_walk(u32 *skip_bkt,
                      u32 *skip_chain,
                      int (*callback) (struct netlbl_dom_map *entry, void *arg),
                      void *cb_arg);
 
-#if IS_ENABLED(CONFIG_IPV6)
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
-                                                  const struct in6_addr *addr);
-#endif /* IPv6 */
-
 #endif
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 7c94aedd0912..96a458e12f60 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -122,7 +122,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
         }
 
         if (addr == NULL && mask == NULL)
-                entry->type = NETLBL_NLTYPE_UNLABELED;
+                entry->def.type = NETLBL_NLTYPE_UNLABELED;
         else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
@@ -137,7 +137,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
                         if (map4 == NULL)
                                 goto cfg_unlbl_map_add_failure;
-                        map4->type = NETLBL_NLTYPE_UNLABELED;
+                        map4->def.type = NETLBL_NLTYPE_UNLABELED;
                         map4->list.addr = addr4->s_addr & mask4->s_addr;
                         map4->list.mask = mask4->s_addr;
                         map4->list.valid = 1;
@@ -154,7 +154,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
                         if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
-                        map6->type = NETLBL_NLTYPE_UNLABELED;
+                        map6->def.type = NETLBL_NLTYPE_UNLABELED;
                         map6->list.addr = *addr6;
                         map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
                         map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
@@ -174,8 +174,8 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         break;
                 }
 
-                entry->type_def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
                 goto cfg_unlbl_map_add_failure;
@@ -355,8 +355,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
         }
 
         if (addr == NULL && mask == NULL) {
-                entry->type_def.cipsov4 = doi_def;
-                entry->type = NETLBL_NLTYPE_CIPSOV4;
+                entry->def.cipso = doi_def;
+                entry->def.type = NETLBL_NLTYPE_CIPSOV4;
         } else if (addr != NULL && mask != NULL) {
                 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                 if (addrmap == NULL)
@@ -367,8 +367,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                 if (addrinfo == NULL)
                         goto out_addrinfo;
-                addrinfo->type_def.cipsov4 = doi_def;
-                addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
+                addrinfo->def.cipso = doi_def;
+                addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
                 addrinfo->list.addr = addr->s_addr & mask->s_addr;
                 addrinfo->list.mask = mask->s_addr;
                 addrinfo->list.valid = 1;
@@ -376,8 +376,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                 if (ret_val != 0)
                         goto cfg_cipsov4_map_add_failure;
 
-                entry->type_def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
         } else {
                 ret_val = -EINVAL;
                 goto out_addrmap;
@@ -657,14 +657,14 @@ int netlbl_sock_setattr(struct sock *sk,
         }
         switch (family) {
         case AF_INET:
-                switch (dom_entry->type) {
+                switch (dom_entry->def.type) {
                 case NETLBL_NLTYPE_ADDRSELECT:
                         ret_val = -EDESTADDRREQ;
                         break;
                 case NETLBL_NLTYPE_CIPSOV4:
                         ret_val = cipso_v4_sock_setattr(sk,
-                                                    dom_entry->type_def.cipsov4,
-                                                    secattr);
+                                                        dom_entry->def.cipso,
+                                                        secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         ret_val = 0;
@@ -754,23 +754,22 @@ int netlbl_conn_setattr(struct sock *sk,
 {
         int ret_val;
         struct sockaddr_in *addr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
         switch (addr->sa_family) {
         case AF_INET:
                 addr4 = (struct sockaddr_in *)addr;
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       addr4->sin_addr.s_addr);
-                if (af4_entry == NULL) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                                                   addr4->sin_addr.s_addr);
+                if (entry == NULL) {
                         ret_val = -ENOENT;
                         goto conn_setattr_return;
                 }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
                         ret_val = cipso_v4_sock_setattr(sk,
-                                                   af4_entry->type_def.cipsov4,
-                                                   secattr);
+                                                        entry->cipso, secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
@@ -812,36 +811,21 @@ int netlbl_req_setattr(struct request_sock *req,
                        const struct netlbl_lsm_secattr *secattr)
 {
         int ret_val;
-        struct netlbl_dom_map *dom_entry;
-        struct netlbl_domaddr4_map *af4_entry;
-        u32 proto_type;
-        struct cipso_v4_doi *proto_cv4;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
-        dom_entry = netlbl_domhsh_getentry(secattr->domain);
-        if (dom_entry == NULL) {
-                ret_val = -ENOENT;
-                goto req_setattr_return;
-        }
         switch (req->rsk_ops->family) {
         case AF_INET:
-                if (dom_entry->type == NETLBL_NLTYPE_ADDRSELECT) {
-                        struct inet_request_sock *req_inet = inet_rsk(req);
-                        af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                            req_inet->rmt_addr);
-                        if (af4_entry == NULL) {
-                                ret_val = -ENOENT;
-                                goto req_setattr_return;
-                        }
-                        proto_type = af4_entry->type;
-                        proto_cv4 = af4_entry->type_def.cipsov4;
-                } else {
-                        proto_type = dom_entry->type;
-                        proto_cv4 = dom_entry->type_def.cipsov4;
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                                                   inet_rsk(req)->rmt_addr);
+                if (entry == NULL) {
+                        ret_val = -ENOENT;
+                        goto req_setattr_return;
                 }
-                switch (proto_type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_req_setattr(req, proto_cv4, secattr);
+                        ret_val = cipso_v4_req_setattr(req,
+                                                       entry->cipso, secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
@@ -899,23 +883,21 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,
 {
         int ret_val;
         struct iphdr *hdr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
 
         rcu_read_lock();
         switch (family) {
         case AF_INET:
                 hdr4 = ip_hdr(skb);
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       hdr4->daddr);
-                if (af4_entry == NULL) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,hdr4->daddr);
+                if (entry == NULL) {
                         ret_val = -ENOENT;
                         goto skbuff_setattr_return;
                 }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                 case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_skbuff_setattr(skb,
-                                                   af4_entry->type_def.cipsov4,
-                                                   secattr);
+                        ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
+                                                          secattr);
                         break;
                 case NETLBL_NLTYPE_UNLABELED:
                         /* just delete the protocols we support for right now
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index c5384ffc6146..dd1c37d7acbc 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -104,7 +104,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 ret_val = -ENOMEM;
                 goto add_failure;
         }
-        entry->type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
+        entry->def.type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
         if (info->attrs[NLBL_MGMT_A_DOMAIN]) {
                 size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]);
                 entry->domain = kmalloc(tmp_size, GFP_KERNEL);
@@ -116,12 +116,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                             info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size);
         }
 
-        /* NOTE: internally we allow/use a entry->type value of
+        /* NOTE: internally we allow/use a entry->def.type value of
          *       NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users
          *       to pass that as a protocol value because we need to know the
          *       "real" protocol */
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_UNLABELED:
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
@@ -132,7 +132,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 cipsov4 = cipso_v4_doi_getdef(tmp_val);
                 if (cipsov4 == NULL)
                         goto add_failure;
-                entry->type_def.cipsov4 = cipsov4;
+                entry->def.cipso = cipsov4;
                 break;
         default:
                 goto add_failure;
@@ -172,9 +172,9 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 map->list.addr = addr->s_addr & mask->s_addr;
                 map->list.mask = mask->s_addr;
                 map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
                 if (cipsov4)
-                        map->type_def.cipsov4 = cipsov4;
+                        map->def.cipso = cipsov4;
 
                 ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
                 if (ret_val != 0) {
@@ -182,8 +182,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                         goto add_failure;
                 }
 
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
 #if IS_ENABLED(CONFIG_IPV6)
         } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) {
                 struct in6_addr *addr;
@@ -223,7 +223,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                 map->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
                 map->list.mask = *mask;
                 map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
 
                 ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
                 if (ret_val != 0) {
@@ -231,8 +231,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                         goto add_failure;
                 }
 
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.addrsel = addrmap;
 #endif /* IPv6 */
         }
 
@@ -281,14 +281,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                         return ret_val;
         }
 
-        switch (entry->type) {
+        switch (entry->def.type) {
         case NETLBL_NLTYPE_ADDRSELECT:
                 nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST);
                 if (nla_a == NULL)
                         return -ENOMEM;
 
-                netlbl_af4list_foreach_rcu(iter4,
-                                           &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
                         struct netlbl_domaddr4_map *map4;
                         struct in_addr addr_struct;
 
@@ -310,13 +309,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                 return ret_val;
                         map4 = netlbl_domhsh_addr4_entry(iter4);
                         ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map4->type);
+                                              map4->def.type);
                         if (ret_val != 0)
                                 return ret_val;
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                         case NETLBL_NLTYPE_CIPSOV4:
                                 ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                                  map4->type_def.cipsov4->doi);
+                                                      map4->def.cipso->doi);
                                 if (ret_val != 0)
                                         return ret_val;
                                 break;
@@ -325,8 +324,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                         nla_nest_end(skb, nla_b);
                 }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
-                                           &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
                         struct netlbl_domaddr6_map *map6;
 
                         nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR);
@@ -345,7 +343,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                 return ret_val;
                         map6 = netlbl_domhsh_addr6_entry(iter6);
                         ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map6->type);
+                                              map6->def.type);
                         if (ret_val != 0)
                                 return ret_val;
 
@@ -356,14 +354,14 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                 nla_nest_end(skb, nla_a);
                 break;
         case NETLBL_NLTYPE_UNLABELED:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                 if (ret_val != 0)
                         return ret_val;
                 ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                      entry->type_def.cipsov4->doi);
+                                      entry->def.cipso->doi);
                 break;
         }
 
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index af3531926ee0..8f0897407a2c 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1541,7 +1541,7 @@ int __init netlbl_unlabel_defconf(void)
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL)
                 return -ENOMEM;
-        entry->type = NETLBL_NLTYPE_UNLABELED;
+        entry->def.type = NETLBL_NLTYPE_UNLABELED;
         ret_val = netlbl_domhsh_add_default(entry, &audit_info);
         if (ret_val != 0)
                 return ret_val;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 2fd6dbea327a..512718adb0d5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -571,7 +571,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
             !capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = ops->dumpit,
                         .done = ops->done,
@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                 if (res == NULL) {
                         genl_unlock();
+                        up_read(&cb_lock);
                         request_module("net-pf-%d-proto-%d-family-%s",
                                        PF_NETLINK, NETLINK_GENERIC, name);
+                        down_read(&cb_lock);
                         genl_lock();
                         res = genl_family_find_byname(name);
                 }
diff --git a/net/nfc/core.c b/net/nfc/core.c
index dc96a83aa6ab..1d074dd1650f 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -44,7 +44,7 @@ DEFINE_MUTEX(nfc_devlist_mutex);
 /* NFC device ID bitmap */
 static DEFINE_IDA(nfc_index_ida);
 
-int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name)
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name)
 {
         int rc = 0;
 
@@ -62,28 +62,28 @@ int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name)
                 goto error;
         }
 
-        if (!dev->ops->fw_upload) {
+        if (!dev->ops->fw_download) {
                 rc = -EOPNOTSUPP;
                 goto error;
         }
 
-        dev->fw_upload_in_progress = true;
-        rc = dev->ops->fw_upload(dev, firmware_name);
+        dev->fw_download_in_progress = true;
+        rc = dev->ops->fw_download(dev, firmware_name);
         if (rc)
-                dev->fw_upload_in_progress = false;
+                dev->fw_download_in_progress = false;
 
 error:
         device_unlock(&dev->dev);
         return rc;
 }
 
-int nfc_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
 {
-        dev->fw_upload_in_progress = false;
+        dev->fw_download_in_progress = false;
 
-        return nfc_genl_fw_upload_done(dev, firmware_name);
+        return nfc_genl_fw_download_done(dev, firmware_name);
 }
-EXPORT_SYMBOL(nfc_fw_upload_done);
+EXPORT_SYMBOL(nfc_fw_download_done);
 
 /**
  * nfc_dev_up - turn on the NFC device
@@ -110,7 +110,7 @@ int nfc_dev_up(struct nfc_dev *dev)
                 goto error;
         }
 
-        if (dev->fw_upload_in_progress) {
+        if (dev->fw_download_in_progress) {
                 rc = -EBUSY;
                 goto error;
         }
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 7b1c186736eb..fe66908401f5 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -809,14 +809,14 @@ static void nfc_hci_recv_from_llc(struct nfc_hci_dev *hdev, struct sk_buff *skb)
         }
 }
 
-static int hci_fw_upload(struct nfc_dev *nfc_dev, const char *firmware_name)
+static int hci_fw_download(struct nfc_dev *nfc_dev, const char *firmware_name)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
-        if (!hdev->ops->fw_upload)
+        if (!hdev->ops->fw_download)
                 return -ENOTSUPP;
 
-        return hdev->ops->fw_upload(hdev, firmware_name);
+        return hdev->ops->fw_download(hdev, firmware_name);
 }
 
 static struct nfc_ops hci_nfc_ops = {
@@ -831,7 +831,7 @@ static struct nfc_ops hci_nfc_ops = {
         .im_transceive = hci_transceive,
         .tm_send = hci_tm_send,
         .check_presence = hci_check_presence,
-        .fw_upload = hci_fw_upload,
+        .fw_download = hci_fw_download,
         .discover_se = hci_discover_se,
         .enable_se = hci_enable_se,
         .disable_se = hci_disable_se,
diff --git a/net/nfc/nci/Kconfig b/net/nfc/nci/Kconfig
index 2a2416080b4f..a4f1e42e3481 100644
--- a/net/nfc/nci/Kconfig
+++ b/net/nfc/nci/Kconfig
@@ -11,6 +11,7 @@ config NFC_NCI
 
 config NFC_NCI_SPI
         depends on NFC_NCI && SPI
+        select CRC_CCITT
         bool "NCI over SPI protocol support"
         default n
         help
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index b05ad909778f..f16fd59d4160 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1089,7 +1089,7 @@ exit:
         return rc;
 }
 
-static int nfc_genl_fw_upload(struct sk_buff *skb, struct genl_info *info)
+static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
 {
         struct nfc_dev *dev;
         int rc;
@@ -1108,13 +1108,13 @@ static int nfc_genl_fw_upload(struct sk_buff *skb, struct genl_info *info)
         nla_strlcpy(firmware_name, info->attrs[NFC_ATTR_FIRMWARE_NAME],
                     sizeof(firmware_name));
 
-        rc = nfc_fw_upload(dev, firmware_name);
+        rc = nfc_fw_download(dev, firmware_name);
 
         nfc_put_device(dev);
         return rc;
 }
 
-int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -1124,7 +1124,7 @@ int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
                 return -ENOMEM;
 
         hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                          NFC_CMD_FW_UPLOAD);
+                          NFC_CMD_FW_DOWNLOAD);
         if (!hdr)
                 goto free_msg;
 
@@ -1251,8 +1251,8 @@ static struct genl_ops nfc_genl_ops[] = {
                 .policy = nfc_genl_policy,
         },
         {
-                .cmd = NFC_CMD_FW_UPLOAD,
-                .doit = nfc_genl_fw_upload,
+                .cmd = NFC_CMD_FW_DOWNLOAD,
+                .doit = nfc_genl_fw_download,
                 .policy = nfc_genl_policy,
         },
         {
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index ee85a1fc1b24..820a7850c36a 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -123,10 +123,10 @@ static inline void nfc_device_iter_exit(struct class_dev_iter *iter)
         class_dev_iter_exit(iter);
 }
 
-int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name);
-int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name);
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
 
-int nfc_fw_upload_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
 
 int nfc_dev_up(struct nfc_dev *dev);
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index ca8e0a57d945..1f9c31411f19 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
                 struct sockaddr_atmpvc pvc;
                 int state;
 
+                memset(&pvc, 0, sizeof(pvc));
                 pvc.sap_family = AF_ATMPVC;
                 pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
                 pvc.sap_addr.vpi = flow->vcc->vpi;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 71a568862557..7a42c81a19eb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_cbq_wrropt opt;
 
+        memset(&opt, 0, sizeof(opt));
         opt.flags = 0;
         opt.allot = cl->allot;
         opt.priority = cl->priority + 1;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c2124ea29f45..45e751527dfc 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -100,7 +100,7 @@ struct htb_class {
         struct psched_ratecfg   ceil;
         s64                     buffer, cbuffer;/* token bucket depth/rate */
         s64                     mbuffer;        /* max wait time */
-        int                     prio;           /* these two are used only by leaves... */
+        u32                     prio;           /* these two are used only by leaves... */
         int                     quantum;        /* but stored for parent-to-leaf return */
 
         struct tcf_proto        *filter_list;   /* class attached filters */
diff --git a/net/socket.c b/net/socket.c
index 829b460acb87..b2d7c629eeb9 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -106,7 +106,7 @@
 #include <linux/atalk.h>
 #include <net/busy_poll.h>
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 unsigned int sysctl_net_busy_read __read_mostly;
 unsigned int sysctl_net_busy_poll __read_mostly;
 #endif
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index d304f41260f2..af7ffd447fee 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -120,7 +120,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
         if (IS_ERR(clnt)) {
                 dprintk("RPC:       failed to create AF_LOCAL gssproxy "
                                 "client (errno %ld).\n", PTR_ERR(clnt));
-                result = -PTR_ERR(clnt);
+                result = PTR_ERR(clnt);
                 *_clnt = NULL;
                 goto out;
         }
@@ -328,7 +328,6 @@ void gssp_free_upcall_data(struct gssp_upcall_data *data)
         kfree(data->in_handle.data);
         kfree(data->out_handle.data);
         kfree(data->out_token.data);
-        kfree(data->mech_oid.data);
         free_svc_cred(&data->creds);
 }
 
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index 357f613df7ff..3c85d1c8a028 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
 static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
                                     struct gssx_name_attr_array *naa)
 {
-        struct gssx_name_attr dummy;
+        struct gssx_name_attr dummy = { .attr = {.len = 0} };
         u32 count, i;
         __be32 *p;
 
@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
         return err;
 }
 
+
 static int gssx_dec_name(struct xdr_stream *xdr,
                          struct gssx_name *name)
 {
-        struct xdr_netobj dummy_netobj;
-        struct gssx_name_attr_array dummy_name_attr_array;
-        struct gssx_option_array dummy_option_array;
+        struct xdr_netobj dummy_netobj = { .len = 0 };
+        struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
+        struct gssx_option_array dummy_option_array = { .count = 0 };
         int err;
 
         /* name->display_name */
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index d0347d148b34..09fb638bcaa4 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1180,6 +1180,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
                 gm = gss_mech_get_by_OID(&ud->mech_oid);
                 if (!gm)
                         goto out;
+                rsci.cred.cr_gss_mech = gm;
 
                 status = -EINVAL;
                 /* mech-specific data: */
@@ -1195,7 +1196,6 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
         rscp = rsc_update(cd, &rsci, rscp);
         status = 0;
 out:
-        gss_mech_put(gm);
         rsc_free(&rsci);
         if (rscp)
                 cache_put(&rscp->h, cd);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 74f6a704e374..ecbc4e3d83ad 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1660,6 +1660,10 @@ call_connect(struct rpc_task *task)
                 task->tk_action = call_connect_status;
                 if (task->tk_status < 0)
                         return;
+                if (task->tk_flags & RPC_TASK_NOCONNECT) {
+                        rpc_exit(task, -ENOTCONN);
+                        return;
+                }
                 xprt_connect(task);
         }
 }
diff --git a/net/sunrpc/netns.h b/net/sunrpc/netns.h
index 74d948f5d5a1..779742cfc1ff 100644
--- a/net/sunrpc/netns.h
+++ b/net/sunrpc/netns.h
@@ -23,6 +23,7 @@ struct sunrpc_net {
         struct rpc_clnt *rpcb_local_clnt4;
         spinlock_t rpcb_clnt_lock;
         unsigned int rpcb_users;
+        unsigned int rpcb_is_af_local : 1;
 
         struct mutex gssp_lock;
         wait_queue_head_t gssp_wq;
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 3df764dc330c..1891a1022c17 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -204,13 +204,15 @@ void rpcb_put_local(struct net *net)
 }
 
 static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
-                        struct rpc_clnt *clnt4)
+                        struct rpc_clnt *clnt4,
+                        bool is_af_local)
 {
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
 
         /* Protected by rpcb_create_local_mutex */
         sn->rpcb_local_clnt = clnt;
         sn->rpcb_local_clnt4 = clnt4;
+        sn->rpcb_is_af_local = is_af_local ? 1 : 0;
         smp_wmb(); 
         sn->rpcb_users = 1;
         dprintk("RPC:       created new rpcb local clients (rpcb_local_clnt: "
@@ -238,6 +240,14 @@ static int rpcb_create_local_unix(struct net *net)
                 .program        = &rpcb_program,
                 .version        = RPCBVERS_2,
                 .authflavor     = RPC_AUTH_NULL,
+                /*
+                 * We turn off the idle timeout to prevent the kernel
+                 * from automatically disconnecting the socket.
+                 * Otherwise, we'd have to cache the mount namespace
+                 * of the caller and somehow pass that to the socket
+                 * reconnect code.
+                 */
+                .flags          = RPC_CLNT_CREATE_NO_IDLE_TIMEOUT,
         };
         struct rpc_clnt *clnt, *clnt4;
         int result = 0;
@@ -263,7 +273,7 @@ static int rpcb_create_local_unix(struct net *net)
                 clnt4 = NULL;
         }
 
-        rpcb_set_local(net, clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4, true);
 
 out:
         return result;
@@ -315,7 +325,7 @@ static int rpcb_create_local_net(struct net *net)
                 clnt4 = NULL;
         }
 
-        rpcb_set_local(net, clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4, false);
 
 out:
         return result;
@@ -376,13 +386,16 @@ static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
         return rpc_create(&args);
 }
 
-static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
+static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt, struct rpc_message *msg, bool is_set)
 {
-        int result, error = 0;
+        int flags = RPC_TASK_NOCONNECT;
+        int error, result = 0;
 
+        if (is_set || !sn->rpcb_is_af_local)
+                flags = RPC_TASK_SOFTCONN;
         msg->rpc_resp = &result;
 
-        error = rpc_call_sync(clnt, msg, RPC_TASK_SOFTCONN);
+        error = rpc_call_sync(clnt, msg, flags);
         if (error < 0) {
                 dprintk("RPC:       failed to contact local rpcbind "
                                 "server (errno %d).\n", -error);
@@ -439,16 +452,19 @@ int rpcb_register(struct net *net, u32 prog, u32 vers, int prot, unsigned short
                 .rpc_argp       = &map,
         };
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        bool is_set = false;
 
         dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                         "rpcbind\n", (port ? "" : "un"),
                         prog, vers, prot, port);
 
         msg.rpc_proc = &rpcb_procedures2[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                 msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
+                is_set = true;
+        }
 
-        return rpcb_register_call(sn->rpcb_local_clnt, &msg);
+        return rpcb_register_call(sn, sn->rpcb_local_clnt, &msg, is_set);
 }
 
 /*
@@ -461,6 +477,7 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
         const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
         struct rpcbind_args *map = msg->rpc_argp;
         unsigned short port = ntohs(sin->sin_port);
+        bool is_set = false;
         int result;
 
         map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
@@ -471,10 +488,12 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
                         map->r_addr, map->r_netid);
 
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+                is_set = true;
+        }
 
-        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
         kfree(map->r_addr);
         return result;
 }
@@ -489,6 +508,7 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
         const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)sap;
         struct rpcbind_args *map = msg->rpc_argp;
         unsigned short port = ntohs(sin6->sin6_port);
+        bool is_set = false;
         int result;
 
         map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
@@ -499,10 +519,12 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
                         map->r_addr, map->r_netid);
 
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+                is_set = true;
+        }
 
-        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
         kfree(map->r_addr);
         return result;
 }
@@ -519,7 +541,7 @@ static int rpcb_unregister_all_protofamilies(struct sunrpc_net *sn,
         map->r_addr = "";
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
 
-        return rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        return rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, false);
 }
 
 /**
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 305374d4fb98..7762b9f8a8b7 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1193,7 +1193,9 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt)
         if (test_bit(XPT_LISTENER, &xprt->xpt_flags))
                 return 1;
         required = atomic_read(&xprt->xpt_reserved) + serv->sv_max_mesg;
-        if (sk_stream_wspace(svsk->sk_sk) >= required)
+        if (sk_stream_wspace(svsk->sk_sk) >= required ||
+            (sk_stream_min_wspace(svsk->sk_sk) == 0 &&
+             atomic_read(&xprt->xpt_reserved) == 0))
                 return 1;
         set_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
         return 0;
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 19da5abe0fa6..fd3fa57a410e 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -355,8 +355,12 @@ static int tipc_open_listening_sock(struct tipc_server *s)
                 return PTR_ERR(con);
 
         sock = tipc_create_listen_sock(con);
-        if (!sock)
+        if (!sock) {
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                kfree(con);
                 return -EINVAL;
+        }
 
         tipc_register_callbacks(sock, con);
         return 0;
@@ -563,9 +567,14 @@ int tipc_server_start(struct tipc_server *s)
                 kmem_cache_destroy(s->rcvbuf_cache);
                 return ret;
         }
+        ret = tipc_open_listening_sock(s);
+        if (ret < 0) {
+                tipc_work_stop(s);
+                kmem_cache_destroy(s->rcvbuf_cache);
+                return ret;
+        }
         s->enabled = 1;
-
-        return tipc_open_listening_sock(s);
+        return ret;
 }
 
 void tipc_server_stop(struct tipc_server *s)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1cc47aca7f05..25d217d90807 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4770,9 +4770,9 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                   mask, NL80211_MESHCONF_FORWARDING,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
-                                  nla_get_u32);
+                                  nla_get_s32);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                   mask, NL80211_MESHCONF_HT_OPMODE,
                                   nla_get_u16);
@@ -6613,12 +6613,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
 
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 {
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
         void *hdr = ((void **)skb->cb)[1];
         struct nlattr *data = ((void **)skb->cb)[2];
 
         nla_nest_end(skb, data);
         genlmsg_end(skb, hdr);
-        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+                                nl80211_testmode_mcgrp.id, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -10064,7 +10066,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
 
         genlmsg_end(msg, hdr);
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
         return;
 
  nla_put_failure:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5a24c986f34b..de06d5d1287f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
+        struct regulatory_request *lr;
+
         if (!reg_dev_ignore_cell_hint(wiphy))
                 reg_num_devs_support_basehint++;
 
-        wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
+        lr = get_last_request();
+        wiphy_update_regulatory(wiphy, lr->initiator);
 }
 
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
@@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
 static void reg_timeout_work(struct work_struct *work)
 {
         REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
+        rtnl_lock();
         restore_regulatory_settings(true);
+        rtnl_unlock();
 }
 
 int __init regulatory_init(void)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 1d3cfb1a3f28..81c8a10d743c 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -34,8 +34,10 @@ struct cfg80211_conn {
                 CFG80211_CONN_SCAN_AGAIN,
                 CFG80211_CONN_AUTHENTICATE_NEXT,
                 CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_AUTH_FAILED,
                 CFG80211_CONN_ASSOCIATE_NEXT,
                 CFG80211_CONN_ASSOCIATING,
+                CFG80211_CONN_ASSOC_FAILED,
                 CFG80211_CONN_DEAUTH,
                 CFG80211_CONN_CONNECTED,
         } state;
@@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                           NULL, 0,
                                           params->key, params->key_len,
                                           params->key_idx, NULL, 0);
+        case CFG80211_CONN_AUTH_FAILED:
+                return -ENOTCONN;
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                              WLAN_REASON_DEAUTH_LEAVING,
                                              false);
                 return err;
+        case CFG80211_CONN_ASSOC_FAILED:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                return -ENOTCONN;
         case CFG80211_CONN_DEAUTH:
                 cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                      NULL, 0,
                                      WLAN_REASON_DEAUTH_LEAVING, false);
+                /* free directly, disconnected event already sent */
+                cfg80211_sme_free(wdev);
                 return 0;
         default:
                 return 0;
@@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
                 return true;
         }
 
-        wdev->conn->state = CFG80211_CONN_DEAUTH;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
         schedule_work(&rdev->conn_work);
         return false;
 }
@@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless_dev *wdev)
 
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_free(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 
 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
@@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_disassoc(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+
+        if (!wdev->conn)
+                return;
+
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 
 static int cfg80211_sme_connect(struct wireless_dev *wdev,
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 3f7682a387b7..eefbd10e408f 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1998,12 +1998,11 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address)
  *
  * Create or update the port list entry
  */
-static int smk_ipv6_port_check(struct sock *sk, struct sockaddr *address,
+static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
                                 int act)
 {
         __be16 *bep;
         __be32 *be32p;
-        struct sockaddr_in6 *addr6;
         struct smk_port_label *spp;
         struct socket_smack *ssp = sk->sk_security;
         struct smack_known *skp;
@@ -2025,10 +2024,9 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr *address,
         /*
          * Get the IP address and port from the address.
          */
-        addr6 = (struct sockaddr_in6 *)address;
-        port = ntohs(addr6->sin6_port);
-        bep = (__be16 *)(&addr6->sin6_addr);
-        be32p = (__be32 *)(&addr6->sin6_addr);
+        port = ntohs(address->sin6_port);
+        bep = (__be16 *)(&address->sin6_addr);
+        be32p = (__be32 *)(&address->sin6_addr);
 
         /*
          * It's remote, so port lookup does no good.
@@ -2060,9 +2058,9 @@ auditout:
         ad.a.u.net->family = sk->sk_family;
         ad.a.u.net->dport = port;
         if (act == SMK_RECEIVING)
-                ad.a.u.net->v6info.saddr = addr6->sin6_addr;
+                ad.a.u.net->v6info.saddr = address->sin6_addr;
         else
-                ad.a.u.net->v6info.daddr = addr6->sin6_addr;
+                ad.a.u.net->v6info.daddr = address->sin6_addr;
 #endif
         return smk_access(skp, object, MAY_WRITE, &ad);
 }
@@ -2201,7 +2199,8 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
         case PF_INET6:
                 if (addrlen < sizeof(struct sockaddr_in6))
                         return -EINVAL;
-                rc = smk_ipv6_port_check(sock->sk, sap, SMK_CONNECTING);
+                rc = smk_ipv6_port_check(sock->sk, (struct sockaddr_in6 *)sap,
+                                                SMK_CONNECTING);
                 break;
         }
         return rc;
@@ -3034,7 +3033,7 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
                                 int size)
 {
         struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name;
-        struct sockaddr *sap = (struct sockaddr *) msg->msg_name;
+        struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name;
         int rc = 0;
 
         /*
@@ -3121,9 +3120,8 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
         return smack_net_ambient;
 }
 
-static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr *sap)
+static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
 {
-        struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;
         u8 nexthdr;
         int offset;
         int proto = -EINVAL;
@@ -3181,7 +3179,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         struct netlbl_lsm_secattr secattr;
         struct socket_smack *ssp = sk->sk_security;
         struct smack_known *skp;
-        struct sockaddr sadd;
+        struct sockaddr_in6 sadd;
         int rc = 0;
         struct smk_audit_info ad;
 #ifdef CONFIG_AUDIT
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 99db892d7299..98969541cbcc 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -743,7 +743,7 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
         mutex_lock(&stream->device->lock);
         switch (_IOC_NR(cmd)) {
         case _IOC_NR(SNDRV_COMPRESS_IOCTL_VERSION):
-                put_user(SNDRV_COMPRESS_VERSION,
+                retval = put_user(SNDRV_COMPRESS_VERSION,
                                 (int __user *)arg) ? -EFAULT : 0;
                 break;
         case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
index 7c11d46b84d3..48a9d004d6d9 100644
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -860,7 +860,7 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
                 }
         }
         if (id < 0 && quirk) {
-                for (q = quirk; q->subvendor; q++) {
+                for (q = quirk; q->subvendor || q->subdevice; q++) {
                         unsigned int vendorid =
                                 q->subdevice | (q->subvendor << 16);
                         unsigned int mask = 0xffff0000 | q->subdevice_mask;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 92b9b4324372..6d1924c19abf 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -2819,6 +2819,7 @@ static const struct hda_pintbl ecs202_pin_configs[] = {
 
 /* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */
 static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x0000, 0x0100, "Mac Mini", STAC_INTEL_MAC_V3),
         SND_PCI_QUIRK(0x106b, 0x0800, "Mac", STAC_INTEL_MAC_V1),
         SND_PCI_QUIRK(0x106b, 0x0600, "Mac", STAC_INTEL_MAC_V2),
         SND_PCI_QUIRK(0x106b, 0x0700, "Mac", STAC_INTEL_MAC_V2),
diff --git a/sound/soc/au1x/ac97c.c b/sound/soc/au1x/ac97c.c
index d6f7694fcad4..c8a2de103c5f 100644
--- a/sound/soc/au1x/ac97c.c
+++ b/sound/soc/au1x/ac97c.c
@@ -341,7 +341,7 @@ static struct platform_driver au1xac97c_driver = {
         .remove         = au1xac97c_drvremove,
 };
 
-module_platform_driver(&au1xac97c_driver);
+module_platform_driver(au1xac97c_driver);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Au1000/1500/1100 AC97C ASoC driver");
diff --git a/sound/soc/blackfin/bf5xx-ac97.c b/sound/soc/blackfin/bf5xx-ac97.c
index efb1daecd0dd..e82eb373a731 100644
--- a/sound/soc/blackfin/bf5xx-ac97.c
+++ b/sound/soc/blackfin/bf5xx-ac97.c
@@ -294,11 +294,12 @@ static int asoc_bfin_ac97_probe(struct platform_device *pdev)
         /* Request PB3 as reset pin */
         ret = devm_gpio_request_one(&pdev->dev,
                                     CONFIG_SND_BF5XX_RESET_GPIO_NUM,
-                                    GPIOF_OUT_INIT_HIGH, "SND_AD198x RESET") {
+                                    GPIOF_OUT_INIT_HIGH, "SND_AD198x RESET");
+        if (ret) {
                 dev_err(&pdev->dev,
                         "Failed to request GPIO_%d for reset: %d\n",
                         CONFIG_SND_BF5XX_RESET_GPIO_NUM, ret);
-                goto gpio_err;
+                return ret;
         }
 #endif
 
diff --git a/sound/soc/blackfin/bf5xx-ac97.h b/sound/soc/blackfin/bf5xx-ac97.h
index 15c635e33f4d..0c3e22d90a8d 100644
--- a/sound/soc/blackfin/bf5xx-ac97.h
+++ b/sound/soc/blackfin/bf5xx-ac97.h
@@ -9,7 +9,6 @@
 #ifndef _BF5XX_AC97_H
 #define _BF5XX_AC97_H
 
-extern struct snd_ac97_bus_ops bf5xx_ac97_ops;
 extern struct snd_ac97 *ac97;
 /* Frame format in memory, only support stereo currently */
 struct ac97_frame {
diff --git a/sound/soc/codecs/wm0010.c b/sound/soc/codecs/wm0010.c
index f5e835662cdc..10adc4145d46 100644
--- a/sound/soc/codecs/wm0010.c
+++ b/sound/soc/codecs/wm0010.c
@@ -410,6 +410,16 @@ static int wm0010_firmware_load(const char *name, struct snd_soc_codec *codec)
                         rec->command, rec->length);
                 len = rec->length + 8;
 
+                xfer = kzalloc(sizeof(*xfer), GFP_KERNEL);
+                if (!xfer) {
+                        dev_err(codec->dev, "Failed to allocate xfer\n");
+                        ret = -ENOMEM;
+                        goto abort;
+                }
+
+                xfer->codec = codec;
+                list_add_tail(&xfer->list, &xfer_list);
+
                 out = kzalloc(len, GFP_KERNEL);
                 if (!out) {
                         dev_err(codec->dev,
@@ -417,6 +427,7 @@ static int wm0010_firmware_load(const char *name, struct snd_soc_codec *codec)
                         ret = -ENOMEM;
                         goto abort1;
                 }
+                xfer->t.rx_buf = out;
 
                 img = kzalloc(len, GFP_KERNEL);
                 if (!img) {
@@ -425,24 +436,13 @@ static int wm0010_firmware_load(const char *name, struct snd_soc_codec *codec)
                         ret = -ENOMEM;
                         goto abort1;
                 }
+                xfer->t.tx_buf = img;
 
                 byte_swap_64((u64 *)&rec->command, img, len);
 
-                xfer = kzalloc(sizeof(*xfer), GFP_KERNEL);
-                if (!xfer) {
-                        dev_err(codec->dev, "Failed to allocate xfer\n");
-                        ret = -ENOMEM;
-                        goto abort1;
-                }
-
-                xfer->codec = codec;
-                list_add_tail(&xfer->list, &xfer_list);
-
                 spi_message_init(&xfer->m);
                 xfer->m.complete = wm0010_boot_xfer_complete;
                 xfer->m.context = xfer;
-                xfer->t.tx_buf = img;
-                xfer->t.rx_buf = out;
                 xfer->t.len = len;
                 xfer->t.bits_per_word = 8;
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index b94190820e8c..bd16010441cc 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2733,7 +2733,7 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
         }
 
         mutex_unlock(&card->dapm_mutex);
-        return 0;
+        return change;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_put_volsw);
 
@@ -2861,7 +2861,6 @@ int snd_soc_dapm_put_enum_virt(struct snd_kcontrol *kcontrol,
         struct soc_enum *e =
                 (struct soc_enum *)kcontrol->private_value;
         int change;
-        int ret = 0;
         int wi;
 
         if (ucontrol->value.enumerated.item[0] >= e->max)
@@ -2881,7 +2880,7 @@ int snd_soc_dapm_put_enum_virt(struct snd_kcontrol *kcontrol,
         }
 
         mutex_unlock(&card->dapm_mutex);
-        return ret;
+        return change;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_put_enum_virt);
 
diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c
index 9e6e3ffd86bb..23452ee617e1 100644
--- a/sound/usb/6fire/comm.c
+++ b/sound/usb/6fire/comm.c
@@ -110,19 +110,37 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev)
 static int usb6fire_comm_write8(struct comm_runtime *rt, u8 request,
                 u8 reg, u8 value)
 {
-        u8 buffer[13]; /* 13: maximum length of message */
+        u8 *buffer;
+        int ret;
+
+        /* 13: maximum length of message */
+        buffer = kmalloc(13, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
 
         usb6fire_comm_init_buffer(buffer, 0x00, request, reg, value, 0x00);
-        return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+        ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+
+        kfree(buffer);
+        return ret;
 }
 
 static int usb6fire_comm_write16(struct comm_runtime *rt, u8 request,
                 u8 reg, u8 vl, u8 vh)
 {
-        u8 buffer[13]; /* 13: maximum length of message */
+        u8 *buffer;
+        int ret;
+
+        /* 13: maximum length of message */
+        buffer = kmalloc(13, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
 
         usb6fire_comm_init_buffer(buffer, 0x00, request, reg, vl, vh);
-        return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+        ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+
+        kfree(buffer);
+        return ret;
 }
 
 int usb6fire_comm_init(struct sfire_chip *chip)
@@ -135,6 +153,12 @@ int usb6fire_comm_init(struct sfire_chip *chip)
         if (!rt)
                 return -ENOMEM;
 
+        rt->receiver_buffer = kzalloc(COMM_RECEIVER_BUFSIZE, GFP_KERNEL);
+        if (!rt->receiver_buffer) {
+                kfree(rt);
+                return -ENOMEM;
+        }
+
         urb = &rt->receiver;
         rt->serial = 1;
         rt->chip = chip;
@@ -153,6 +177,7 @@ int usb6fire_comm_init(struct sfire_chip *chip)
         urb->interval = 1;
         ret = usb_submit_urb(urb, GFP_KERNEL);
         if (ret < 0) {
+                kfree(rt->receiver_buffer);
                 kfree(rt);
                 snd_printk(KERN_ERR PREFIX "cannot create comm data receiver.");
                 return ret;
@@ -171,6 +196,9 @@ void usb6fire_comm_abort(struct sfire_chip *chip)
 
 void usb6fire_comm_destroy(struct sfire_chip *chip)
 {
-        kfree(chip->comm);
+        struct comm_runtime *rt = chip->comm;
+
+        kfree(rt->receiver_buffer);
+        kfree(rt);
         chip->comm = NULL;
 }
diff --git a/sound/usb/6fire/comm.h b/sound/usb/6fire/comm.h
index 6a0840b0dcff..780d5ed8e5d8 100644
--- a/sound/usb/6fire/comm.h
+++ b/sound/usb/6fire/comm.h
@@ -24,7 +24,7 @@ struct comm_runtime {
         struct sfire_chip *chip;
 
         struct urb receiver;
-        u8 receiver_buffer[COMM_RECEIVER_BUFSIZE];
+        u8 *receiver_buffer;
 
         u8 serial; /* urb serial */
 
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 7a444b5501d9..659950e5b94f 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -591,17 +591,16 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
         ep->stride = frame_bits >> 3;
         ep->silence_value = pcm_format == SNDRV_PCM_FORMAT_U8 ? 0x80 : 0;
 
-        /* calculate max. frequency */
-        if (ep->maxpacksize) {
+        /* assume max. frequency is 25% higher than nominal */
+        ep->freqmax = ep->freqn + (ep->freqn >> 2);
+        maxsize = ((ep->freqmax + 0xffff) * (frame_bits >> 3))
+                                >> (16 - ep->datainterval);
+        /* but wMaxPacketSize might reduce this */
+        if (ep->maxpacksize && ep->maxpacksize < maxsize) {
                 /* whatever fits into a max. size packet */
                 maxsize = ep->maxpacksize;
                 ep->freqmax = (maxsize / (frame_bits >> 3))
                                 << (16 - ep->datainterval);
-        } else {
-                /* no max. packet size: just take 25% higher than nominal */
-                ep->freqmax = ep->freqn + (ep->freqn >> 2);
-                maxsize = ((ep->freqmax + 0xffff) * (frame_bits >> 3))
-                                >> (16 - ep->datainterval);
         }
 
         if (ep->fill_max)