262 files changed, 2175 insertions, 1270 deletions
diff --git a/Documentation/DocBook/media/v4l/dev-codec.xml b/Documentation/DocBook/media/v4l/dev-codec.xml
index dca0ecd54dc6..ff44c16fc080 100644
--- a/Documentation/DocBook/media/v4l/dev-codec.xml
+++ b/Documentation/DocBook/media/v4l/dev-codec.xml
@@ -1,18 +1,27 @@
  <title>Codec Interface</title>
-  <note>
+  <para>A V4L2 codec can compress, decompress, transform, or otherwise
-    <title>Suspended</title>
+convert video data from one format into another format, in memory. Typically
+such devices are memory-to-memory devices (i.e. devices with the
+<constant>V4L2_CAP_VIDEO_M2M</constant> or <constant>V4L2_CAP_VIDEO_M2M_MPLANE</constant>
+capability set).
+</para>
-    <para>This interface has been be suspended from the V4L2 API
+  <para>A memory-to-memory video node acts just like a normal video node, but it
-implemented in Linux 2.6 until we have more experience with codec
+supports both output (sending frames from memory to the codec hardware) and
-device interfaces.</para>
+capture (receiving the processed frames from the codec hardware into memory)
-  </note>
+stream I/O. An application will have to setup the stream
+I/O for both sides and finally call &VIDIOC-STREAMON; for both capture and output
+to start the codec.</para>
-  <para>A V4L2 codec can compress, decompress, transform, or otherwise
+  <para>Video compression codecs use the MPEG controls to setup their codec parameters
-convert video data from one format into another format, in memory.
+(note that the MPEG controls actually support many more codecs than just MPEG).
-Applications send data to be converted to the driver through a
+See <xref linkend="mpeg-controls"></xref>.</para>
-&func-write; call, and receive the converted data through a
-&func-read; call. For efficiency a driver may also support streaming
-I/O.</para>
-  <para>[to do]</para>
+  <para>Memory-to-memory devices can often be used as a shared resource: you can
+open the video node multiple times, each application setting up their own codec properties
+that are local to the file handle, and each can use it independently from the others.
+The driver will arbitrate access to the codec and reprogram it whenever another file
+handler gets access. This is different from the usual video node behavior where the video properties
+are global to the device (i.e. changing something through one file handle is visible
+through another file handle).</para>
diff --git a/Documentation/DocBook/media/v4l/v4l2.xml b/Documentation/DocBook/media/v4l/v4l2.xml
index bfc93cdcf696..bfe823dd0f31 100644
--- a/Documentation/DocBook/media/v4l/v4l2.xml
+++ b/Documentation/DocBook/media/v4l/v4l2.xml
@@ -493,7 +493,7 @@ and discussions on the V4L mailing list.</revremark>
 </partinfo>
 <title>Video for Linux Two API Specification</title>
- <subtitle>Revision 3.9</subtitle>
+ <subtitle>Revision 3.10</subtitle>
  <chapter id="common">
    &sub-common;
diff --git a/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt b/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt
index 3f62adfb3e0b..de9f6b78ee51 100644
--- a/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt
+++ b/Documentation/devicetree/bindings/media/exynos-fimc-lite.txt
@@ -2,7 +2,7 @@ Exynos4x12/Exynos5 SoC series camera host interface (FIMC-LITE)
 Required properties:
- compatible    : should be "samsung,exynos4212-fimc" for Exynos4212 and
+- compatible    : should be "samsung,exynos4212-fimc-lite" for Exynos4212 and
                  Exynos4412 SoCs;
 - reg           : physical base address and size of the device memory mapped
                  registers;
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 36e5a402ed0e..10742902146f 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -420,10 +420,10 @@ tcp_synack_retries - INTEGER
        for a passive TCP connection will happen after 63seconds.
 tcp_syncookies - BOOLEAN
-        Only valid when the kernel was compiled with CONFIG_SYNCOOKIES
+        Only valid when the kernel was compiled with CONFIG_SYN_COOKIES
        Send out syncookies when the syn backlog queue of a socket
        overflows. This is to prevent against the common 'SYN flood attack'
-        Default: FALSE
+        Default: 1
        Note, that syncookies is fallback facility.
        It MUST NOT be used to help highly loaded servers to stand
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index bb8b0dc532b8..77d68e23b247 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -29,6 +29,8 @@ ALC269/270/275/276/280/282
  alc271-dmic   Enable ALC271X digital mic workaround
  inv-dmic      Inverted internal mic workaround
  lenovo-dock   Enables docking station I/O for some Lenovos
+  dell-headset-multi    Headset jack, which can also be used as mic-in
+  dell-headset-dock     Headset jack (without mic-in), and also dock I/O
 ALC662/663/272
 ==============
@@ -42,6 +44,7 @@ ALC662/663/272
  asus-mode7    ASUS
  asus-mode8    ASUS
  inv-dmic      Inverted internal mic workaround
+  dell-headset-multi    Headset jack, which can also be used as mic-in
 ALC680
 ======
diff --git a/MAINTAINERS b/MAINTAINERS
index 60d6a3393500..2cdbf904dcdc 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3225,7 +3225,7 @@ F:	lib/fault-inject.c
 FCOE SUBSYSTEM (libfc, libfcoe, fcoe)
 M:      Robert Love <robert.w.love@intel.com>
-L:      devel@open-fcoe.org
+L:      fcoe-devel@open-fcoe.org
 W:      www.Open-FCoE.org
 S:      Supported
 F:      drivers/scsi/libfc/
diff --git a/Makefile b/Makefile
index c6863b55f7c7..e5e3ba085191 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION =
 NAME = Unicycling Gorilla
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 49d993cee512..136f263ed47b 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1087,6 +1087,20 @@ if !MMU
 source "arch/arm/Kconfig-nommu"
 endif
+config PJ4B_ERRATA_4742
+        bool "PJ4B Errata 4742: IDLE Wake Up Commands can Cause the CPU Core to Cease Operation"
+        depends on CPU_PJ4B && MACH_ARMADA_370
+        default y
+        help
+          When coming out of either a Wait for Interrupt (WFI) or a Wait for
+          Event (WFE) IDLE states, a specific timing sensitivity exists between
+          the retiring WFI/WFE instructions and the newly issued subsequent
+          instructions.  This sensitivity can result in a CPU hang scenario.
+          Workaround:
+          The software must insert either a Data Synchronization Barrier (DSB)
+          or Data Memory Barrier (DMB) command immediately after the WFI/WFE
+          instruction
 config ARM_ERRATA_326103
        bool "ARM errata: FSR write bit incorrect on a SWP to read-only memory"
        depends on CPU_V6
@@ -1189,6 +1203,16 @@ config PL310_ERRATA_588369
           is not correctly implemented in PL310 as clean lines are not
           invalidated as a result of these operations.
+config ARM_ERRATA_643719
+        bool "ARM errata: LoUIS bit field in CLIDR register is incorrect"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for the 643719 Cortex-A9 (prior to
+          r1p0) erratum. On affected cores the LoUIS bit field of the CLIDR
+          register returns zero when it should return one. The workaround
+          corrects this value, ensuring cache maintenance operations which use
+          it behave as intended and avoiding data corruption.
 config ARM_ERRATA_720789
        bool "ARM errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID"
        depends on CPU_V7
@@ -2006,7 +2030,7 @@ config XIP_PHYS_ADDR
 config KEXEC
        bool "Kexec system call (EXPERIMENTAL)"
-        depends on (!SMP || HOTPLUG_CPU)
+        depends on (!SMP || PM_SLEEP_SMP)
        help
          kexec is a system call that implements the ability to shutdown your
          current kernel, and to start another kernel.  It is like a reboot
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 79e9bdbfc491..120b83bfde20 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -116,7 +116,8 @@ targets       := vmlinux vmlinux.lds \
 # Make sure files are removed during clean
 extra-y       += piggy.gzip piggy.lzo piggy.lzma piggy.xzkern \
-                 lib1funcs.S ashldi3.S $(libfdt) $(libfdt_hdrs)
+                 lib1funcs.S ashldi3.S $(libfdt) $(libfdt_hdrs) \
+                 hyp-stub.S
 ifeq ($(CONFIG_FUNCTION_TRACER),y)
 ORIG_CFLAGS := $(KBUILD_CFLAGS)
diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
index d1650fb34c0a..ded558bb0f3b 100644
--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
+++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi
@@ -763,7 +763,7 @@
                };
        };
-        pinctrl@03680000 {
+        pinctrl@03860000 {
                gpz: gpz {
                        gpio-controller;
                        #gpio-cells = <2>;
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 0673524238a6..fc9fb3d526e2 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -161,9 +161,9 @@
                interrupts = <0 50 0>;
        };
-        pinctrl_3: pinctrl@03680000 {
+        pinctrl_3: pinctrl@03860000 {
                compatible = "samsung,exynos5250-pinctrl";
-                reg = <0x0368000 0x1000>;
+                reg = <0x03860000 0x1000>;
                interrupts = <0 47 0>;
        };
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index bff71388e72a..17d0ae8672fa 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -320,9 +320,7 @@ static inline void flush_anon_page(struct vm_area_struct *vma,
 }
 #define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
-static inline void flush_kernel_dcache_page(struct page *page)
+extern void flush_kernel_dcache_page(struct page *);
-{
-}
 #define flush_dcache_mmap_lock(mapping) \
        spin_lock_irq(&(mapping)->tree_lock)
diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index 7652712d1d14..dba62cb1ad08 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -32,6 +32,8 @@
 #define MPIDR_HWID_BITMASK 0xFFFFFF
+#define MPIDR_INVALID (~MPIDR_HWID_BITMASK)
 #define MPIDR_LEVEL_BITS 8
 #define MPIDR_LEVEL_MASK ((1 << MPIDR_LEVEL_BITS) - 1)
diff --git a/arch/arm/include/asm/glue-proc.h b/arch/arm/include/asm/glue-proc.h
index ac1dd54724b6..8017e94acc5e 100644
--- a/arch/arm/include/asm/glue-proc.h
+++ b/arch/arm/include/asm/glue-proc.h
@@ -230,6 +230,15 @@
 # endif
 #endif
+#ifdef CONFIG_CPU_PJ4B
+# ifdef CPU_NAME
+#  undef  MULTI_CPU
+#  define MULTI_CPU
+# else
+#  define CPU_NAME cpu_pj4b
+# endif
+#endif
 #ifndef MULTI_CPU
 #define cpu_proc_init                   __glue(CPU_NAME,_proc_init)
 #define cpu_proc_fin                    __glue(CPU_NAME,_proc_fin)
diff --git a/arch/arm/include/asm/smp_plat.h b/arch/arm/include/asm/smp_plat.h
index aaa61b6f50ff..e78983202737 100644
--- a/arch/arm/include/asm/smp_plat.h
+++ b/arch/arm/include/asm/smp_plat.h
@@ -49,7 +49,7 @@ static inline int cache_ops_need_broadcast(void)
 /*
 * Logical CPU mapping.
 */
-extern int __cpu_logical_map[];
+extern u32 __cpu_logical_map[];
 #define cpu_logical_map(cpu)    __cpu_logical_map[cpu]
 /*
 * Retrieve logical cpu index corresponding to a given MPIDR[23:0]
diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
index 5af04f6daa33..5859c8bc727c 100644
--- a/arch/arm/kernel/devtree.c
+++ b/arch/arm/kernel/devtree.c
@@ -82,7 +82,7 @@ void __init arm_dt_init_cpu_maps(void)
        u32 i, j, cpuidx = 1;
        u32 mpidr = is_smp() ? read_cpuid_mpidr() & MPIDR_HWID_BITMASK : 0;
-        u32 tmp_map[NR_CPUS] = { [0 ... NR_CPUS-1] = UINT_MAX };
+        u32 tmp_map[NR_CPUS] = { [0 ... NR_CPUS-1] = MPIDR_INVALID };
        bool bootcpu_valid = false;
        cpus = of_find_node_by_path("/cpus");
@@ -92,6 +92,9 @@ void __init arm_dt_init_cpu_maps(void)
        for_each_child_of_node(cpus, cpu) {
                u32 hwid;
+                if (of_node_cmp(cpu->type, "cpu"))
+                        continue;
                pr_debug(" * %s...\n", cpu->full_name);
                /*
                 * A device tree containing CPU nodes with missing "reg"
@@ -149,9 +152,10 @@ void __init arm_dt_init_cpu_maps(void)
                tmp_map[i] = hwid;
        }
-        if (WARN(!bootcpu_valid, "DT missing boot CPU MPIDR[23:0], "
+        if (!bootcpu_valid) {
-                                 "fall back to default cpu_logical_map\n"))
+                pr_warn("DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map\n");
                return;
+        }
        /*
         * Since the boot CPU node contains proper data, and all nodes have
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 8ef8c9337809..4fb074c446bf 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -134,6 +134,10 @@ void machine_kexec(struct kimage *image)
        unsigned long reboot_code_buffer_phys;
        void *reboot_code_buffer;
+        if (num_online_cpus() > 1) {
+                pr_err("kexec: error: multiple CPUs still online\n");
+                return;
+        }
        page_list = image->head & PAGE_MASK;
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 282de4826abb..6e8931ccf13e 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -184,30 +184,61 @@ int __init reboot_setup(char *str)
 __setup("reboot=", reboot_setup);
+/*
+ * Called by kexec, immediately prior to machine_kexec().
+ *
+ * This must completely disable all secondary CPUs; simply causing those CPUs
+ * to execute e.g. a RAM-based pin loop is not sufficient. This allows the
+ * kexec'd kernel to use any and all RAM as it sees fit, without having to
+ * avoid any code or data used by any SW CPU pin loop. The CPU hotplug
+ * functionality embodied in disable_nonboot_cpus() to achieve this.
+ */
 void machine_shutdown(void)
 {
-#ifdef CONFIG_SMP
+        disable_nonboot_cpus();
-        smp_send_stop();
-#endif
 }
+/*
+ * Halting simply requires that the secondary CPUs stop performing any
+ * activity (executing tasks, handling interrupts). smp_send_stop()
+ * achieves this.
+ */
 void machine_halt(void)
 {
-        machine_shutdown();
+        smp_send_stop();
        local_irq_disable();
        while (1);
 }
+/*
+ * Power-off simply requires that the secondary CPUs stop performing any
+ * activity (executing tasks, handling interrupts). smp_send_stop()
+ * achieves this. When the system power is turned off, it will take all CPUs
+ * with it.
+ */
 void machine_power_off(void)
 {
-        machine_shutdown();
+        smp_send_stop();
        if (pm_power_off)
                pm_power_off();
 }
+/*
+ * Restart requires that the secondary CPUs stop performing any activity
+ * while the primary CPU resets the system. Systems with a single CPU can
+ * use soft_restart() as their machine descriptor's .restart hook, since that
+ * will cause the only available CPU to reset. Systems with multiple CPUs must
+ * provide a HW restart implementation, to ensure that all CPUs reset at once.
+ * This is required so that any code running after reset on the primary CPU
+ * doesn't have to co-ordinate with other CPUs to ensure they aren't still
+ * executing pre-reset code, and using RAM that the primary CPU's code wishes
+ * to use. Implementing such co-ordination would be essentially impossible.
+ */
 void machine_restart(char *cmd)
 {
-        machine_shutdown();
+        smp_send_stop();
        arm_pm_restart(reboot_mode, cmd);
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 1522c7ae31b0..b4b1d397592b 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -444,7 +444,7 @@ void notrace cpu_init(void)
            : "r14");
 }
-int __cpu_logical_map[NR_CPUS];
+u32 __cpu_logical_map[NR_CPUS] = { [0 ... NR_CPUS-1] = MPIDR_INVALID };
 void __init smp_setup_processor_id(void)
 {
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 550d63cef68e..5919eb451bb9 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -651,17 +651,6 @@ void smp_send_reschedule(int cpu)
        smp_cross_call(cpumask_of(cpu), IPI_RESCHEDULE);
 }
-#ifdef CONFIG_HOTPLUG_CPU
-static void smp_kill_cpus(cpumask_t *mask)
-{
-        unsigned int cpu;
-        for_each_cpu(cpu, mask)
-                platform_cpu_kill(cpu);
-}
-#else
-static void smp_kill_cpus(cpumask_t *mask) { }
-#endif
 void smp_send_stop(void)
 {
        unsigned long timeout;
@@ -679,8 +668,6 @@ void smp_send_stop(void)
        if (num_online_cpus() > 1)
                pr_warning("SMP: failed to stop secondary CPUs\n");
-        smp_kill_cpus(&mask);
 }
 /*
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 15451ee4acc8..515b00064da8 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -92,6 +92,14 @@ ENTRY(v7_flush_dcache_louis)
        mrc     p15, 1, r0, c0, c0, 1           @ read clidr, r0 = clidr
        ALT_SMP(ands    r3, r0, #(7 << 21))     @ extract LoUIS from clidr
        ALT_UP(ands     r3, r0, #(7 << 27))     @ extract LoUU from clidr
+#ifdef CONFIG_ARM_ERRATA_643719
+        ALT_SMP(mrceq   p15, 0, r2, c0, c0, 0)  @ read main ID register
+        ALT_UP(moveq    pc, lr)                 @ LoUU is zero, so nothing to do
+        ldreq   r1, =0x410fc090                 @ ID of ARM Cortex A9 r0p?
+        biceq   r2, r2, #0x0000000f             @ clear minor revision number
+        teqeq   r2, r1                          @ test for errata affected core and if so...
+        orreqs  r3, #(1 << 21)                  @   fix LoUIS value (and set flags state to 'ne')
+#endif
        ALT_SMP(mov     r3, r3, lsr #20)        @ r3 = LoUIS * 2
        ALT_UP(mov      r3, r3, lsr #26)        @ r3 = LoUU * 2
        moveq   pc, lr                          @ return if level == 0
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 0d473cce501c..32aa5861119f 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -301,6 +301,39 @@ void flush_dcache_page(struct page *page)
 EXPORT_SYMBOL(flush_dcache_page);
 /*
+ * Ensure cache coherency for the kernel mapping of this page. We can
+ * assume that the page is pinned via kmap.
+ *
+ * If the page only exists in the page cache and there are no user
+ * space mappings, this is a no-op since the page was already marked
+ * dirty at creation.  Otherwise, we need to flush the dirty kernel
+ * cache lines directly.
+ */
+void flush_kernel_dcache_page(struct page *page)
+{
+        if (cache_is_vivt() || cache_is_vipt_aliasing()) {
+                struct address_space *mapping;
+                mapping = page_mapping(page);
+                if (!mapping || mapping_mapped(mapping)) {
+                        void *addr;
+                        addr = page_address(page);
+                        /*
+                         * kmap_atomic() doesn't set the page virtual
+                         * address for highmem pages, and
+                         * kunmap_atomic() takes care of cache
+                         * flushing already.
+                         */
+                        if (!IS_ENABLED(CONFIG_HIGHMEM) || addr)
+                                __cpuc_flush_dcache_area(addr, PAGE_SIZE);
+                }
+        }
+}
+EXPORT_SYMBOL(flush_kernel_dcache_page);
+/*
 * Flush an anonymous page so that users of get_user_pages()
 * can safely access the data.  The expected sequence is:
 *
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e0d8565671a6..4d409e6a552d 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -616,10 +616,12 @@ static void __init alloc_init_pte(pmd_t *pmd, unsigned long addr,
        } while (pte++, addr += PAGE_SIZE, addr != end);
 }
-static void __init map_init_section(pmd_t *pmd, unsigned long addr,
+static void __init __map_init_section(pmd_t *pmd, unsigned long addr,
                        unsigned long end, phys_addr_t phys,
                        const struct mem_type *type)
 {
+        pmd_t *p = pmd;
 #ifndef CONFIG_ARM_LPAE
        /*
         * In classic MMU format, puds and pmds are folded in to
@@ -638,7 +640,7 @@ static void __init map_init_section(pmd_t *pmd, unsigned long addr,
                phys += SECTION_SIZE;
        } while (pmd++, addr += SECTION_SIZE, addr != end);
-        flush_pmd_entry(pmd);
+        flush_pmd_entry(p);
 }
 static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
@@ -661,7 +663,7 @@ static void __init alloc_init_pmd(pud_t *pud, unsigned long addr,
                 */
                if (type->prot_sect &&
                                ((addr | next | phys) & ~SECTION_MASK) == 0) {
-                        map_init_section(pmd, addr, next, phys, type);
+                        __map_init_section(pmd, addr, next, phys, type);
                } else {
                        alloc_init_pte(pmd, addr, next,
                                                __phys_to_pfn(phys), type);
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index d51225f90ae2..eb5293a69a84 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -57,6 +57,12 @@ void flush_dcache_page(struct page *page)
 }
 EXPORT_SYMBOL(flush_dcache_page);
+void flush_kernel_dcache_page(struct page *page)
+{
+        __cpuc_flush_dcache_area(page_address(page), PAGE_SIZE);
+}
+EXPORT_SYMBOL(flush_kernel_dcache_page);
 void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
                       unsigned long uaddr, void *dst, const void *src,
                       unsigned long len)
diff --git a/arch/arm/mm/proc-fa526.S b/arch/arm/mm/proc-fa526.S
index d217e9795d74..aaeb6c127c7a 100644
--- a/arch/arm/mm/proc-fa526.S
+++ b/arch/arm/mm/proc-fa526.S
@@ -81,7 +81,6 @@ ENDPROC(cpu_fa526_reset)
 */
        .align  4
 ENTRY(cpu_fa526_do_idle)
-        mcr     p15, 0, r0, c7, c0, 4           @ Wait for interrupt
        mov     pc, lr
diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index f9a0aa725ea9..e3c48a3fe063 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -333,3 +333,8 @@ ENTRY(\name\()_tlb_fns)
        .endif
        .size   \name\()_tlb_fns, . - \name\()_tlb_fns
 .endm
+.macro globl_equ x, y
+        .globl  \x
+        .equ    \x, \y
+.endm
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 2c73a7301ff7..e35fec34453e 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -140,6 +140,29 @@ ENTRY(cpu_v7_do_resume)
 ENDPROC(cpu_v7_do_resume)
 #endif
+#ifdef CONFIG_CPU_PJ4B
+        globl_equ       cpu_pj4b_switch_mm,     cpu_v7_switch_mm
+        globl_equ       cpu_pj4b_set_pte_ext,   cpu_v7_set_pte_ext
+        globl_equ       cpu_pj4b_proc_init,     cpu_v7_proc_init
+        globl_equ       cpu_pj4b_proc_fin,      cpu_v7_proc_fin
+        globl_equ       cpu_pj4b_reset,         cpu_v7_reset
+#ifdef CONFIG_PJ4B_ERRATA_4742
+ENTRY(cpu_pj4b_do_idle)
+        dsb                                     @ WFI may enter a low-power mode
+        wfi
+        dsb                                     @barrier
+        mov     pc, lr
+ENDPROC(cpu_pj4b_do_idle)
+#else
+        globl_equ       cpu_pj4b_do_idle,       cpu_v7_do_idle
+#endif
+        globl_equ       cpu_pj4b_dcache_clean_area,     cpu_v7_dcache_clean_area
+        globl_equ       cpu_pj4b_do_suspend,    cpu_v7_do_suspend
+        globl_equ       cpu_pj4b_do_resume,     cpu_v7_do_resume
+        globl_equ       cpu_pj4b_suspend_size,  cpu_v7_suspend_size
+#endif
        __CPUINIT
 /*
@@ -350,6 +373,9 @@ __v7_setup_stack:
        @ define struct processor (see <asm/proc-fns.h> and proc-macros.S)
        define_processor_functions v7, dabort=v7_early_abort, pabort=v7_pabort, suspend=1
+#ifdef CONFIG_CPU_PJ4B
+        define_processor_functions pj4b, dabort=v7_early_abort, pabort=v7_pabort, suspend=1
+#endif
        .section ".rodata"
@@ -362,7 +388,7 @@ __v7_setup_stack:
        /*
         * Standard v7 proc info content
         */
-.macro __v7_proc initfunc, mm_mmuflags = 0, io_mmuflags = 0, hwcaps = 0
+.macro __v7_proc initfunc, mm_mmuflags = 0, io_mmuflags = 0, hwcaps = 0, proc_fns = v7_processor_functions
        ALT_SMP(.long   PMD_TYPE_SECT | PMD_SECT_AP_WRITE | PMD_SECT_AP_READ | \
                        PMD_SECT_AF | PMD_FLAGS_SMP | \mm_mmuflags)
        ALT_UP(.long    PMD_TYPE_SECT | PMD_SECT_AP_WRITE | PMD_SECT_AP_READ | \
@@ -375,7 +401,7 @@ __v7_setup_stack:
        .long   HWCAP_SWP | HWCAP_HALF | HWCAP_THUMB | HWCAP_FAST_MULT | \
                HWCAP_EDSP | HWCAP_TLS | \hwcaps
        .long   cpu_v7_name
-        .long   v7_processor_functions
+        .long   \proc_fns
        .long   v7wbi_tlb_fns
        .long   v6_user_fns
        .long   v7_cache_fns
@@ -407,12 +433,14 @@ __v7_ca9mp_proc_info:
        /*
         * Marvell PJ4B processor.
         */
+#ifdef CONFIG_CPU_PJ4B
        .type   __v7_pj4b_proc_info, #object
 __v7_pj4b_proc_info:
-        .long   0x562f5840
+        .long   0x560f5800
-        .long   0xfffffff0
+        .long   0xff0fff00
-        __v7_proc __v7_pj4b_setup
+        __v7_proc __v7_pj4b_setup, proc_fns = pj4b_processor_functions
        .size   __v7_pj4b_proc_info, . - __v7_pj4b_proc_info
+#endif
        /*
         * ARM Ltd. Cortex A7 processor.
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index 1e49e5eb81e9..9ba33c40cdf8 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -1336,6 +1336,7 @@ void perf_callchain_user(struct perf_callchain_entry *entry,
                return;
        }
+        perf_callchain_store(entry, regs->pc);
        tail = (struct frame_tail __user *)regs->regs[29];
        while (entry->nr < PERF_MAX_STACK_DEPTH &&
diff --git a/arch/ia64/include/asm/irqflags.h b/arch/ia64/include/asm/irqflags.h
index 1bf2cf2f4ab4..cec6c06b52c0 100644
--- a/arch/ia64/include/asm/irqflags.h
+++ b/arch/ia64/include/asm/irqflags.h
@@ -11,6 +11,7 @@
 #define _ASM_IA64_IRQFLAGS_H
 #include <asm/pal.h>
+#include <asm/kregs.h>
 #ifdef CONFIG_IA64_DEBUG_IRQ
 extern unsigned long last_cli_ip;
diff --git a/arch/metag/include/asm/hugetlb.h b/arch/metag/include/asm/hugetlb.h
index f545477e61f3..471f481e67f3 100644
--- a/arch/metag/include/asm/hugetlb.h
+++ b/arch/metag/include/asm/hugetlb.h
@@ -2,6 +2,7 @@
 #define _ASM_METAG_HUGETLB_H
 #include <asm/page.h>
+#include <asm-generic/hugetlb.h>
 static inline int is_hugepage_only_range(struct mm_struct *mm,
diff --git a/arch/mn10300/include/asm/irqflags.h b/arch/mn10300/include/asm/irqflags.h
index 678f68d5f37b..8730c0a3c37d 100644
--- a/arch/mn10300/include/asm/irqflags.h
+++ b/arch/mn10300/include/asm/irqflags.h
@@ -13,9 +13,8 @@
 #define _ASM_IRQFLAGS_H
 #include <asm/cpu-regs.h>
-#ifndef __ASSEMBLY__
+/* linux/smp.h <- linux/irqflags.h needs asm/smp.h first */
-#include <linux/smp.h>
+#include <asm/smp.h>
-#endif
 /*
 * interrupt control
diff --git a/arch/mn10300/include/asm/smp.h b/arch/mn10300/include/asm/smp.h
index 6745dbe64944..56c42417d428 100644
--- a/arch/mn10300/include/asm/smp.h
+++ b/arch/mn10300/include/asm/smp.h
@@ -24,6 +24,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/threads.h>
 #include <linux/cpumask.h>
+#include <linux/thread_info.h>
 #endif
 #ifdef CONFIG_SMP
@@ -85,7 +86,7 @@ extern cpumask_t cpu_boot_map;
 extern void smp_init_cpus(void);
 extern void smp_cache_interrupt(void);
 extern void send_IPI_allbutself(int irq);
-extern int smp_nmi_call_function(smp_call_func_t func, void *info, int wait);
+extern int smp_nmi_call_function(void (*func)(void *), void *info, int wait);
 extern void arch_send_call_function_single_ipi(int cpu);
 extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
@@ -100,6 +101,7 @@ extern void __cpu_die(unsigned int cpu);
 #ifndef __ASSEMBLY__
 static inline void smp_init_cpus(void) {}
+#define raw_smp_processor_id() 0
 #endif /* __ASSEMBLY__ */
 #endif /* CONFIG_SMP */
diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
index 780560b330d9..d7966e0f7698 100644
--- a/arch/mn10300/include/asm/uaccess.h
+++ b/arch/mn10300/include/asm/uaccess.h
@@ -161,7 +161,7 @@ struct __large_struct { unsigned long buf[100]; };
 #define __get_user_check(x, ptr, size)                                  \
 ({                                                                      \
-        const __typeof__(ptr) __guc_ptr = (ptr);                        \
+        const __typeof__(*(ptr))* __guc_ptr = (ptr);                    \
        int _e;                                                         \
        if (likely(__access_ok((unsigned long) __guc_ptr, (size))))     \
                _e = __get_user_nocheck((x), __guc_ptr, (size));        \
diff --git a/arch/mn10300/kernel/setup.c b/arch/mn10300/kernel/setup.c
index 33c3bd1e5c6d..ebac9c11f796 100644
--- a/arch/mn10300/kernel/setup.c
+++ b/arch/mn10300/kernel/setup.c
@@ -38,6 +38,7 @@ struct mn10300_cpuinfo boot_cpu_data;
 /* For PCI or other memory-mapped resources */
 unsigned long pci_mem_start = 0x18000000;
+static char __initdata cmd_line[COMMAND_LINE_SIZE];
 char redboot_command_line[COMMAND_LINE_SIZE] =
        "console=ttyS0,115200 root=/dev/mtdblock3 rw";
@@ -74,45 +75,19 @@ static const char *const mn10300_cputypes[] = {
 };
 /*
- *
+ * Pick out the memory size.  We look for mem=size,
+ * where size is "size[KkMm]"
 */
-static void __init parse_mem_cmdline(char **cmdline_p)
+static int __init early_mem(char *p)
 {
-        char *from, *to, c;
+        memory_size = memparse(p, &p);
-        /* save unparsed command line copy for /proc/cmdline */
-        strcpy(boot_command_line, redboot_command_line);
-        /* see if there's an explicit memory size option */
-        from = redboot_command_line;
-        to = redboot_command_line;
-        c = ' ';
-        for (;;) {
-                if (c == ' ' && !memcmp(from, "mem=", 4)) {
-                        if (to != redboot_command_line)
-                                to--;
-                        memory_size = memparse(from + 4, &from);
-                }
-                c = *(from++);
-                if (!c)
-                        break;
-                *(to++) = c;
-        }
-        *to = '\0';
-        *cmdline_p = redboot_command_line;
        if (memory_size == 0)
                panic("Memory size not known\n");
-        memory_end = (unsigned long) CONFIG_KERNEL_RAM_BASE_ADDRESS +
+        return 0;
-                memory_size;
-        if (memory_end > phys_memory_end)
-                memory_end = phys_memory_end;
 }
+early_param("mem", early_mem);
 /*
 * architecture specific setup
@@ -125,7 +100,20 @@ void __init setup_arch(char **cmdline_p)
        cpu_init();
        unit_setup();
        smp_init_cpus();
-        parse_mem_cmdline(cmdline_p);
+        /* save unparsed command line copy for /proc/cmdline */
+        strlcpy(boot_command_line, redboot_command_line, COMMAND_LINE_SIZE);
+        /* populate cmd_line too for later use, preserving boot_command_line */
+        strlcpy(cmd_line, boot_command_line, COMMAND_LINE_SIZE);
+        *cmdline_p = cmd_line;
+        parse_early_param();
+        memory_end = (unsigned long) CONFIG_KERNEL_RAM_BASE_ADDRESS +
+                memory_size;
+        if (memory_end > phys_memory_end)
+                memory_end = phys_memory_end;
        init_mm.start_code = (unsigned long)&_text;
        init_mm.end_code = (unsigned long) &_etext;
diff --git a/arch/parisc/include/asm/mmzone.h b/arch/parisc/include/asm/mmzone.h
index cc50d33b7b88..b6b34a0987e7 100644
--- a/arch/parisc/include/asm/mmzone.h
+++ b/arch/parisc/include/asm/mmzone.h
@@ -27,7 +27,7 @@ extern struct node_map_data node_data[];
 #define PFNNID_SHIFT (30 - PAGE_SHIFT)
 #define PFNNID_MAP_MAX  512     /* support 512GB */
-extern unsigned char pfnnid_map[PFNNID_MAP_MAX];
+extern signed char pfnnid_map[PFNNID_MAP_MAX];
 #ifndef CONFIG_64BIT
 #define pfn_is_io(pfn) ((pfn & (0xf0000000UL >> PAGE_SHIFT)) == (0xf0000000UL >> PAGE_SHIFT))
@@ -46,7 +46,7 @@ static inline int pfn_to_nid(unsigned long pfn)
        i = pfn >> PFNNID_SHIFT;
        BUG_ON(i >= ARRAY_SIZE(pfnnid_map));
-        return (int)pfnnid_map[i];
+        return pfnnid_map[i];
 }
 static inline int pfn_valid(int pfn)
diff --git a/arch/parisc/include/asm/pci.h b/arch/parisc/include/asm/pci.h
index 3234f492d575..465154076d23 100644
--- a/arch/parisc/include/asm/pci.h
+++ b/arch/parisc/include/asm/pci.h
@@ -225,4 +225,9 @@ static inline int pci_get_legacy_ide_irq(struct pci_dev *dev, int channel)
        return channel ? 15 : 14;
 }
+#define HAVE_PCI_MMAP
+extern int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
+        enum pci_mmap_state mmap_state, int write_combine);
 #endif /* __ASM_PARISC_PCI_H */
diff --git a/arch/parisc/kernel/hardware.c b/arch/parisc/kernel/hardware.c
index 9e2d2e408529..872275659d98 100644
--- a/arch/parisc/kernel/hardware.c
+++ b/arch/parisc/kernel/hardware.c
@@ -1205,6 +1205,7 @@ static struct hp_hardware hp_hardware_list[] = {
        {HPHW_FIO, 0x004, 0x00320, 0x0, "Metheus Frame Buffer"}, 
        {HPHW_FIO, 0x004, 0x00340, 0x0, "BARCO CX4500 VME Grphx Cnsl"}, 
        {HPHW_FIO, 0x004, 0x00360, 0x0, "Hughes TOG VME FDDI"}, 
+        {HPHW_FIO, 0x076, 0x000AD, 0x00, "Crestone Peak RS-232"},
        {HPHW_IOA, 0x185, 0x0000B, 0x00, "Java BC Summit Port"}, 
        {HPHW_IOA, 0x1FF, 0x0000B, 0x00, "Hitachi Ghostview Summit Port"}, 
        {HPHW_IOA, 0x580, 0x0000B, 0x10, "U2-IOA BC Runway Port"}, 
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 36d7f402e48e..b743a80eaba0 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -860,7 +860,7 @@ ENTRY(flush_dcache_page_asm)
 #endif
        ldil            L%dcache_stride, %r1
-        ldw             R%dcache_stride(%r1), %r1
+        ldw             R%dcache_stride(%r1), r31
 #ifdef CONFIG_64BIT
        depdi,z         1, 63-PAGE_SHIFT,1, %r25
@@ -868,26 +868,26 @@ ENTRY(flush_dcache_page_asm)
        depwi,z         1, 31-PAGE_SHIFT,1, %r25
 #endif
        add             %r28, %r25, %r25
-        sub             %r25, %r1, %r25
+        sub             %r25, r31, %r25
-1:      fdc,m           %r1(%r28)
+1:      fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
        cmpb,COND(<<)           %r28, %r25,1b
-        fdc,m           %r1(%r28)
+        fdc,m           r31(%r28)
        sync
@@ -936,7 +936,7 @@ ENTRY(flush_icache_page_asm)
 #endif
        ldil            L%icache_stride, %r1
-        ldw             R%icache_stride(%r1), %r1
+        ldw             R%icache_stride(%r1), %r31
 #ifdef CONFIG_64BIT
        depdi,z         1, 63-PAGE_SHIFT,1, %r25
@@ -944,28 +944,28 @@ ENTRY(flush_icache_page_asm)
        depwi,z         1, 31-PAGE_SHIFT,1, %r25
 #endif
        add             %r28, %r25, %r25
-        sub             %r25, %r1, %r25
+        sub             %r25, %r31, %r25
        /* fic only has the type 26 form on PA1.1, requiring an
         * explicit space specification, so use %sr4 */
-1:      fic,m           %r1(%sr4,%r28)
+1:      fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
        cmpb,COND(<<)   %r28, %r25,1b
-        fic,m           %r1(%sr4,%r28)
+        fic,m           %r31(%sr4,%r28)
        sync
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index 60309051875e..64f2764a8cef 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -220,6 +220,33 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,
 }
+int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
+                        enum pci_mmap_state mmap_state, int write_combine)
+{
+        unsigned long prot;
+        /*
+         * I/O space can be accessed via normal processor loads and stores on
+         * this platform but for now we elect not to do this and portable
+         * drivers should not do this anyway.
+         */
+        if (mmap_state == pci_mmap_io)
+                return -EINVAL;
+        if (write_combine)
+                return -EINVAL;
+        /*
+         * Ignore write-combine; for now only return uncached mappings.
+         */
+        prot = pgprot_val(vma->vm_page_prot);
+        prot |= _PAGE_NO_CACHE;
+        vma->vm_page_prot = __pgprot(prot);
+        return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+                vma->vm_end - vma->vm_start, vma->vm_page_prot);
+}
 /*
 * A driver is enabling the device.  We make sure that all the appropriate
 * bits are set to allow the device to operate as the driver is expecting.
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 1c965642068b..505b56c6b9b9 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -47,7 +47,7 @@ pte_t pg0[PT_INITIAL * PTRS_PER_PTE] __attribute__ ((__section__ (".data..vm0.pt
 #ifdef CONFIG_DISCONTIGMEM
 struct node_map_data node_data[MAX_NUMNODES] __read_mostly;
-unsigned char pfnnid_map[PFNNID_MAP_MAX] __read_mostly;
+signed char pfnnid_map[PFNNID_MAP_MAX] __read_mostly;
 #endif
 static struct resource data_resource = {
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index eabeec991016..f46914a0f33e 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -994,7 +994,7 @@ void pcibios_setup_bus_self(struct pci_bus *bus)
                ppc_md.pci_dma_bus_setup(bus);
 }
-void pcibios_setup_device(struct pci_dev *dev)
+static void pcibios_setup_device(struct pci_dev *dev)
 {
        /* Fixup NUMA node as it may not be setup yet by the generic
         * code and is needed by the DMA init
@@ -1015,6 +1015,17 @@ void pcibios_setup_device(struct pci_dev *dev)
                ppc_md.pci_irq_fixup(dev);
 }
+int pcibios_add_device(struct pci_dev *dev)
+{
+        /*
+         * We can only call pcibios_setup_device() after bus setup is complete,
+         * since some of the platform specific DMA setup code depends on it.
+         */
+        if (dev->bus->is_added)
+                pcibios_setup_device(dev);
+        return 0;
+}
 void pcibios_setup_bus_devices(struct pci_bus *bus)
 {
        struct pci_dev *dev;
@@ -1469,10 +1480,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
                if (ppc_md.pcibios_enable_device_hook(dev))
                        return -EINVAL;
-        /* avoid pcie irq fix up impact on cardbus */
-        if (dev->hdr_type != PCI_HEADER_TYPE_CARDBUS)
-                pcibios_setup_device(dev);
        return pci_enable_resources(dev, mask);
 }
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index 5cd7ad0c1176..1a1b51189773 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -673,7 +673,6 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
                ret = s;
                goto out;
        }
-        kvmppc_lazy_ee_enable();
        kvm_guest_enter();
@@ -699,6 +698,8 @@ int kvmppc_vcpu_run(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
        kvmppc_load_guest_fp(vcpu);
 #endif
+        kvmppc_lazy_ee_enable();
        ret = __kvmppc_vcpu_run(kvm_run, vcpu);
        /* No need for kvm_guest_exit. It's done in handle_exit.
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 237c8e5f2640..77fdd2cef33b 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -592,8 +592,14 @@ static void hugetlb_free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
        do {
                pmd = pmd_offset(pud, addr);
                next = pmd_addr_end(addr, end);
-                if (pmd_none_or_clear_bad(pmd))
+                if (!is_hugepd(pmd)) {
+                        /*
+                         * if it is not hugepd pointer, we should already find
+                         * it cleared.
+                         */
+                        WARN_ON(!pmd_none_or_clear_bad(pmd));
                        continue;
+                }
 #ifdef CONFIG_PPC_FSL_BOOK3E
                /*
                 * Increment next by the size of the huge mapping since
diff --git a/arch/powerpc/platforms/pseries/eeh_cache.c b/arch/powerpc/platforms/pseries/eeh_cache.c
index 5a4c87903057..5ce3ba7ad137 100644
--- a/arch/powerpc/platforms/pseries/eeh_cache.c
+++ b/arch/powerpc/platforms/pseries/eeh_cache.c
@@ -294,8 +294,6 @@ void __init eeh_addr_cache_build(void)
        spin_lock_init(&pci_io_addr_cache_root.piar_lock);
        for_each_pci_dev(dev) {
-                eeh_addr_cache_insert_dev(dev);
                dn = pci_device_to_OF_node(dev);
                if (!dn)
                        continue;
@@ -308,6 +306,8 @@ void __init eeh_addr_cache_build(void)
                dev->dev.archdata.edev = edev;
                edev->pdev = dev;
+                eeh_addr_cache_insert_dev(dev);
                eeh_sysfs_add_device(dev);
        }
diff --git a/arch/powerpc/platforms/pseries/eeh_pe.c b/arch/powerpc/platforms/pseries/eeh_pe.c
index fe43d1aa2cf1..9d4a9e8562b2 100644
--- a/arch/powerpc/platforms/pseries/eeh_pe.c
+++ b/arch/powerpc/platforms/pseries/eeh_pe.c
@@ -639,7 +639,8 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe)
        if (pe->type & EEH_PE_PHB) {
                bus = pe->phb->bus;
-        } else if (pe->type & EEH_PE_BUS) {
+        } else if (pe->type & EEH_PE_BUS ||
+                   pe->type & EEH_PE_DEVICE) {
                edev = list_first_entry(&pe->edevs, struct eeh_dev, list);
                pdev = eeh_dev_to_pci_dev(edev);
                if (pdev)
diff --git a/arch/powerpc/sysdev/fsl_pci.c b/arch/powerpc/sysdev/fsl_pci.c
index 028ac1f71b51..46ac1ddea683 100644
--- a/arch/powerpc/sysdev/fsl_pci.c
+++ b/arch/powerpc/sysdev/fsl_pci.c
@@ -97,22 +97,14 @@ static int fsl_indirect_read_config(struct pci_bus *bus, unsigned int devfn,
        return indirect_read_config(bus, devfn, offset, len, val);
 }
-static struct pci_ops fsl_indirect_pci_ops =
+#if defined(CONFIG_FSL_SOC_BOOKE) || defined(CONFIG_PPC_86xx)
+static struct pci_ops fsl_indirect_pcie_ops =
 {
        .read = fsl_indirect_read_config,
        .write = indirect_write_config,
 };
-static void __init fsl_setup_indirect_pci(struct pci_controller* hose,
-                                          resource_size_t cfg_addr,
-                                          resource_size_t cfg_data, u32 flags)
-{
-        setup_indirect_pci(hose, cfg_addr, cfg_data, flags);
-        hose->ops = &fsl_indirect_pci_ops;
-}
-#if defined(CONFIG_FSL_SOC_BOOKE) || defined(CONFIG_PPC_86xx)
 #define MAX_PHYS_ADDR_BITS      40
 static u64 pci64_dma_offset = 1ull << MAX_PHYS_ADDR_BITS;
@@ -504,13 +496,15 @@ int __init fsl_add_bridge(struct platform_device *pdev, int is_primary)
        if (!hose->private_data)
                goto no_bridge;
-        fsl_setup_indirect_pci(hose, rsrc.start, rsrc.start + 0x4,
+        setup_indirect_pci(hose, rsrc.start, rsrc.start + 0x4,
-                               PPC_INDIRECT_TYPE_BIG_ENDIAN);
+                           PPC_INDIRECT_TYPE_BIG_ENDIAN);
        if (in_be32(&pci->block_rev1) < PCIE_IP_REV_3_0)
                hose->indirect_type |= PPC_INDIRECT_TYPE_FSL_CFG_REG_LINK;
        if (early_find_capability(hose, 0, 0, PCI_CAP_ID_EXP)) {
+                /* use fsl_indirect_read_config for PCIe */
+                hose->ops = &fsl_indirect_pcie_ops;
                /* For PCIE read HEADER_TYPE to identify controler mode */
                early_read_config_byte(hose, 0, 0, PCI_HEADER_TYPE, &hdr_type);
                if ((hdr_type & 0x7f) != PCI_HEADER_TYPE_BRIDGE)
@@ -814,8 +808,8 @@ int __init mpc83xx_add_bridge(struct device_node *dev)
                if (ret)
                        goto err0;
        } else {
-                fsl_setup_indirect_pci(hose, rsrc_cfg.start,
+                setup_indirect_pci(hose, rsrc_cfg.start,
-                                       rsrc_cfg.start + 4, 0);
+                                   rsrc_cfg.start + 4, 0);
        }
        printk(KERN_INFO "Found FSL PCI host bridge at 0x%016llx. "
diff --git a/arch/s390/include/asm/dma-mapping.h b/arch/s390/include/asm/dma-mapping.h
index 886ac7d4937a..2f8c1abeb086 100644
--- a/arch/s390/include/asm/dma-mapping.h
+++ b/arch/s390/include/asm/dma-mapping.h
@@ -50,9 +50,10 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 {
        struct dma_map_ops *dma_ops = get_dma_ops(dev);
+        debug_dma_mapping_error(dev, dma_addr);
        if (dma_ops->mapping_error)
                return dma_ops->mapping_error(dev, dma_addr);
-        return (dma_addr == 0UL);
+        return (dma_addr == DMA_ERROR_CODE);
 }
 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index d8a6a385d048..feb719d3c851 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -754,9 +754,9 @@ static struct bin_attribute sys_reipl_fcp_scp_data_attr = {
        .write = reipl_fcp_scpdata_write,
 };
-DEFINE_IPL_ATTR_RW(reipl_fcp, wwpn, "0x%016llx\n", "%016llx\n",
+DEFINE_IPL_ATTR_RW(reipl_fcp, wwpn, "0x%016llx\n", "%llx\n",
                   reipl_block_fcp->ipl_info.fcp.wwpn);
-DEFINE_IPL_ATTR_RW(reipl_fcp, lun, "0x%016llx\n", "%016llx\n",
+DEFINE_IPL_ATTR_RW(reipl_fcp, lun, "0x%016llx\n", "%llx\n",
                   reipl_block_fcp->ipl_info.fcp.lun);
 DEFINE_IPL_ATTR_RW(reipl_fcp, bootprog, "%lld\n", "%lld\n",
                   reipl_block_fcp->ipl_info.fcp.bootprog);
@@ -1323,9 +1323,9 @@ static struct shutdown_action __refdata reipl_action = {
 /* FCP dump device attributes */
-DEFINE_IPL_ATTR_RW(dump_fcp, wwpn, "0x%016llx\n", "%016llx\n",
+DEFINE_IPL_ATTR_RW(dump_fcp, wwpn, "0x%016llx\n", "%llx\n",
                   dump_block_fcp->ipl_info.fcp.wwpn);
-DEFINE_IPL_ATTR_RW(dump_fcp, lun, "0x%016llx\n", "%016llx\n",
+DEFINE_IPL_ATTR_RW(dump_fcp, lun, "0x%016llx\n", "%llx\n",
                   dump_block_fcp->ipl_info.fcp.lun);
 DEFINE_IPL_ATTR_RW(dump_fcp, bootprog, "%lld\n", "%lld\n",
                   dump_block_fcp->ipl_info.fcp.bootprog);
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index 408e866ae548..dd3c1994b8bd 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -312,6 +312,7 @@ void measurement_alert_subclass_unregister(void)
 }
 EXPORT_SYMBOL(measurement_alert_subclass_unregister);
+#ifdef CONFIG_SMP
 void synchronize_irq(unsigned int irq)
 {
        /*
@@ -320,6 +321,7 @@ void synchronize_irq(unsigned int irq)
         */
 }
 EXPORT_SYMBOL_GPL(synchronize_irq);
+#endif
 #ifndef CONFIG_PCI
diff --git a/arch/s390/mm/mem_detect.c b/arch/s390/mm/mem_detect.c
index 3cbd3b8bf311..cca388253a39 100644
--- a/arch/s390/mm/mem_detect.c
+++ b/arch/s390/mm/mem_detect.c
@@ -123,7 +123,8 @@ void create_mem_hole(struct mem_chunk mem_chunk[], unsigned long addr,
                        continue;
                } else if ((addr <= chunk->addr) &&
                           (addr + size >= chunk->addr + chunk->size)) {
-                        memset(chunk, 0 , sizeof(*chunk));
+                        memmove(chunk, chunk + 1, (MEMORY_CHUNKS-i-1) * sizeof(*chunk));
+                        memset(&mem_chunk[MEMORY_CHUNKS-1], 0, sizeof(*chunk));
                } else if (addr + size < chunk->addr + chunk->size) {
                        chunk->size =  chunk->addr + chunk->size - addr - size;
                        chunk->addr = addr + size;
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index ff18e3cfb6b1..7e4a97fbded4 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -6,6 +6,7 @@ generic-y += cputime.h
 generic-y += div64.h
 generic-y += emergency-restart.h
 generic-y += exec.h
+generic-y += linkage.h
 generic-y += local64.h
 generic-y += mutex.h
 generic-y += irq_regs.h
diff --git a/arch/sparc/include/asm/leon.h b/arch/sparc/include/asm/leon.h
index 15a716934e4d..b836e9297f2a 100644
--- a/arch/sparc/include/asm/leon.h
+++ b/arch/sparc/include/asm/leon.h
@@ -135,7 +135,7 @@ static inline int sparc_leon3_cpuid(void)
 #ifdef CONFIG_SMP
 # define LEON3_IRQ_IPI_DEFAULT          13
-# define LEON3_IRQ_TICKER               (leon3_ticker_irq)
+# define LEON3_IRQ_TICKER               (leon3_gptimer_irq)
 # define LEON3_IRQ_CROSS_CALL           15
 #endif
diff --git a/arch/sparc/include/asm/leon_amba.h b/arch/sparc/include/asm/leon_amba.h
index f3034eddf468..24ec48c3ff90 100644
--- a/arch/sparc/include/asm/leon_amba.h
+++ b/arch/sparc/include/asm/leon_amba.h
@@ -47,6 +47,7 @@ struct amba_prom_registers {
 #define LEON3_GPTIMER_LD 4
 #define LEON3_GPTIMER_IRQEN 8
 #define LEON3_GPTIMER_SEPIRQ 8
+#define LEON3_GPTIMER_TIMERS 0x7
 #define LEON23_REG_TIMER_CONTROL_EN    0x00000001 /* 1 = enable counting */
 /* 0 = hold scalar and counter */
diff --git a/arch/sparc/include/asm/linkage.h b/arch/sparc/include/asm/linkage.h
deleted file mode 100644
index 291c2d01c44f..000000000000
--- a/arch/sparc/include/asm/linkage.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_LINKAGE_H
-#define __ASM_LINKAGE_H
-/* Nothing to see here... */
-#endif
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 75bb608c423e..5ef48dab5636 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -843,7 +843,8 @@ void ldom_reboot(const char *boot_command)
                unsigned long len;
                strcpy(full_boot_str, "boot ");
-                strcpy(full_boot_str + strlen("boot "), boot_command);
+                strlcpy(full_boot_str + strlen("boot "), boot_command,
+                        sizeof(full_boot_str + strlen("boot ")));
                len = strlen(full_boot_str);
                if (reboot_data_supported) {
diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c
index 7c0231dabe44..b7c68976cbc7 100644
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -38,7 +38,6 @@ static DEFINE_SPINLOCK(leon_irq_lock);
 unsigned long leon3_gptimer_irq; /* interrupt controller irq number */
 unsigned long leon3_gptimer_idx; /* Timer Index (0..6) within Timer Core */
-int leon3_ticker_irq; /* Timer ticker IRQ */
 unsigned int sparc_leon_eirq;
 #define LEON_IMASK(cpu) (&leon3_irqctrl_regs->mask[cpu])
 #define LEON_IACK (&leon3_irqctrl_regs->iclear)
@@ -278,6 +277,9 @@ irqreturn_t leon_percpu_timer_ce_interrupt(int irq, void *unused)
        leon_clear_profile_irq(cpu);
+        if (cpu == boot_cpu_id)
+                timer_interrupt(irq, NULL);
        ce = &per_cpu(sparc32_clockevent, cpu);
        irq_enter();
@@ -299,6 +301,7 @@ void __init leon_init_timers(void)
        int icsel;
        int ampopts;
        int err;
+        u32 config;
        sparc_config.get_cycles_offset = leon_cycles_offset;
        sparc_config.cs_period = 1000000 / HZ;
@@ -377,23 +380,6 @@ void __init leon_init_timers(void)
        LEON3_BYPASS_STORE_PA(
                        &leon3_gptimer_regs->e[leon3_gptimer_idx].ctrl, 0);
-#ifdef CONFIG_SMP
-        leon3_ticker_irq = leon3_gptimer_irq + 1 + leon3_gptimer_idx;
-        if (!(LEON3_BYPASS_LOAD_PA(&leon3_gptimer_regs->config) &
-              (1<<LEON3_GPTIMER_SEPIRQ))) {
-                printk(KERN_ERR "timer not configured with separate irqs\n");
-                BUG();
-        }
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].val,
-                                0);
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].rld,
-                                (((1000000/HZ) - 1)));
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].ctrl,
-                                0);
-#endif
        /*
         * The IRQ controller may (if implemented) consist of multiple
         * IRQ controllers, each mapped on a 4Kb boundary.
@@ -416,13 +402,6 @@ void __init leon_init_timers(void)
        if (eirq != 0)
                leon_eirq_setup(eirq);
-        irq = _leon_build_device_irq(NULL, leon3_gptimer_irq+leon3_gptimer_idx);
-        err = request_irq(irq, timer_interrupt, IRQF_TIMER, "timer", NULL);
-        if (err) {
-                printk(KERN_ERR "unable to attach timer IRQ%d\n", irq);
-                prom_halt();
-        }
 #ifdef CONFIG_SMP
        {
                unsigned long flags;
@@ -439,30 +418,31 @@ void __init leon_init_timers(void)
        }
 #endif
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx].ctrl,
+        config = LEON3_BYPASS_LOAD_PA(&leon3_gptimer_regs->config);
-                              LEON3_GPTIMER_EN |
+        if (config & (1 << LEON3_GPTIMER_SEPIRQ))
-                              LEON3_GPTIMER_RL |
+                leon3_gptimer_irq += leon3_gptimer_idx;
-                              LEON3_GPTIMER_LD |
+        else if ((config & LEON3_GPTIMER_TIMERS) > 1)
-                              LEON3_GPTIMER_IRQEN);
+                pr_warn("GPTIMER uses shared irqs, using other timers of the same core will fail.\n");
 #ifdef CONFIG_SMP
        /* Install per-cpu IRQ handler for broadcasted ticker */
-        irq = leon_build_device_irq(leon3_ticker_irq, handle_percpu_irq,
+        irq = leon_build_device_irq(leon3_gptimer_irq, handle_percpu_irq,
                                    "per-cpu", 0);
        err = request_irq(irq, leon_percpu_timer_ce_interrupt,
-                          IRQF_PERCPU | IRQF_TIMER, "ticker",
+                          IRQF_PERCPU | IRQF_TIMER, "timer", NULL);
-                          NULL);
+#else
+        irq = _leon_build_device_irq(NULL, leon3_gptimer_irq);
+        err = request_irq(irq, timer_interrupt, IRQF_TIMER, "timer", NULL);
+#endif
        if (err) {
-                printk(KERN_ERR "unable to attach ticker IRQ%d\n", irq);
+                pr_err("Unable to attach timer IRQ%d\n", irq);
                prom_halt();
        }
+        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx].ctrl,
-        LEON3_BYPASS_STORE_PA(&leon3_gptimer_regs->e[leon3_gptimer_idx+1].ctrl,
                              LEON3_GPTIMER_EN |
                              LEON3_GPTIMER_RL |
                              LEON3_GPTIMER_LD |
                              LEON3_GPTIMER_IRQEN);
-#endif
        return;
 bad:
        printk(KERN_ERR "No Timer/irqctrl found\n");
diff --git a/arch/sparc/kernel/leon_pci_grpci1.c b/arch/sparc/kernel/leon_pci_grpci1.c
index 7739a54315e2..6df26e37f879 100644
--- a/arch/sparc/kernel/leon_pci_grpci1.c
+++ b/arch/sparc/kernel/leon_pci_grpci1.c
@@ -536,11 +536,9 @@ static int grpci1_of_probe(struct platform_device *ofdev)
        /* find device register base address */
        res = platform_get_resource(ofdev, IORESOURCE_MEM, 0);
-        regs = devm_request_and_ioremap(&ofdev->dev, res);
+        regs = devm_ioremap_resource(&ofdev->dev, res);
-        if (!regs) {
+        if (IS_ERR(regs))
-                dev_err(&ofdev->dev, "io-regs mapping failed\n");
+                return PTR_ERR(regs);
-                return -EADDRNOTAVAIL;
-        }
        /*
         * check that we're in Host Slot and that we can act as a Host Bridge
diff --git a/arch/sparc/kernel/leon_pmc.c b/arch/sparc/kernel/leon_pmc.c
index bdf53d9a8d46..b0b3967a2dd2 100644
--- a/arch/sparc/kernel/leon_pmc.c
+++ b/arch/sparc/kernel/leon_pmc.c
@@ -47,6 +47,10 @@ void pmc_leon_idle_fixup(void)
         * MMU does not get a TLB miss here by using the MMU BYPASS ASI.
         */
        register unsigned int address = (unsigned int)leon3_irqctrl_regs;
+        /* Interrupts need to be enabled to not hang the CPU */
+        local_irq_enable();
        __asm__ __volatile__ (
                "wr     %%g0, %%asr19\n"
                "lda    [%0] %1, %%g0\n"
@@ -60,6 +64,9 @@ void pmc_leon_idle_fixup(void)
 */
 void pmc_leon_idle(void)
 {
+        /* Interrupts need to be enabled to not hang the CPU */
+        local_irq_enable();
        /* For systems without power-down, this will be no-op */
        __asm__ __volatile__ ("wr       %g0, %asr19\n\t");
 }
diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c
index 38bf80a22f02..1434526970a6 100644
--- a/arch/sparc/kernel/setup_32.c
+++ b/arch/sparc/kernel/setup_32.c
@@ -304,7 +304,7 @@ void __init setup_arch(char **cmdline_p)
        /* Initialize PROM console and command line. */
        *cmdline_p = prom_getbootargs();
-        strcpy(boot_command_line, *cmdline_p);
+        strlcpy(boot_command_line, *cmdline_p, COMMAND_LINE_SIZE);
        parse_early_param();
        boot_flags_init(*cmdline_p);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 88a127b9c69e..13785547e435 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -555,7 +555,7 @@ void __init setup_arch(char **cmdline_p)
 {
        /* Initialize PROM console and command line. */
        *cmdline_p = prom_getbootargs();
-        strcpy(boot_command_line, *cmdline_p);
+        strlcpy(boot_command_line, *cmdline_p, COMMAND_LINE_SIZE);
        parse_early_param();
        boot_flags_init(*cmdline_p);
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index a7171997adfd..04fd55a6e461 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -1098,7 +1098,14 @@ static int __init grab_mblocks(struct mdesc_handle *md)
                m->size = *val;
                val = mdesc_get_property(md, node,
                                         "address-congruence-offset", NULL);
-                m->offset = *val;
+                /* The address-congruence-offset property is optional.
+                 * Explicity zero it be identifty this.
+                 */
+                if (val)
+                        m->offset = *val;
+                else
+                        m->offset = 0UL;
                numadbg("MBLOCK[%d]: base[%llx] size[%llx] offset[%llx]\n",
                        count - 1, m->base, m->size, m->offset);
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index 83d89bcb44af..37e7bc4c95b3 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -85,8 +85,8 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
        }
        if (!tb->active) {
-                global_flush_tlb_page(mm, vaddr);
                flush_tsb_user_page(mm, vaddr);
+                global_flush_tlb_page(mm, vaddr);
                goto out;
        }
diff --git a/arch/sparc/prom/bootstr_32.c b/arch/sparc/prom/bootstr_32.c
index f5ec32e0d419..d2b49d2365e7 100644
--- a/arch/sparc/prom/bootstr_32.c
+++ b/arch/sparc/prom/bootstr_32.c
@@ -23,23 +23,25 @@ prom_getbootargs(void)
                return barg_buf;
        }
-        switch(prom_vers) {
+        switch (prom_vers) {
        case PROM_V0:
                cp = barg_buf;
                /* Start from 1 and go over fd(0,0,0)kernel */
-                for(iter = 1; iter < 8; iter++) {
+                for (iter = 1; iter < 8; iter++) {
                        arg = (*(romvec->pv_v0bootargs))->argv[iter];
                        if (arg == NULL)
                                break;
-                        while(*arg != 0) {
+                        while (*arg != 0) {
                                /* Leave place for space and null. */
-                                if(cp >= barg_buf + BARG_LEN-2){
+                                if (cp >= barg_buf + BARG_LEN - 2)
                                        /* We might issue a warning here. */
                                        break;
-                                }
                                *cp++ = *arg++;
                        }
                        *cp++ = ' ';
+                        if (cp >= barg_buf + BARG_LEN - 1)
+                                /* We might issue a warning here. */
+                                break;
                }
                *cp = 0;
                break;
diff --git a/arch/sparc/prom/tree_64.c b/arch/sparc/prom/tree_64.c
index 92204c3800b5..bd1b2a3ac34e 100644
--- a/arch/sparc/prom/tree_64.c
+++ b/arch/sparc/prom/tree_64.c
@@ -39,7 +39,7 @@ inline phandle __prom_getchild(phandle node)
        return prom_node_to_node("child", node);
 }
-inline phandle prom_getchild(phandle node)
+phandle prom_getchild(phandle node)
 {
        phandle cnode;
@@ -72,7 +72,7 @@ inline phandle __prom_getsibling(phandle node)
        return prom_node_to_node(prom_peer_name, node);
 }
-inline phandle prom_getsibling(phandle node)
+phandle prom_getsibling(phandle node)
 {
        phandle sibnode;
@@ -89,7 +89,7 @@ EXPORT_SYMBOL(prom_getsibling);
 /* Return the length in bytes of property 'prop' at node 'node'.
 * Return -1 on error.
 */
-inline int prom_getproplen(phandle node, const char *prop)
+int prom_getproplen(phandle node, const char *prop)
 {
        unsigned long args[6];
@@ -113,8 +113,8 @@ EXPORT_SYMBOL(prom_getproplen);
 * 'buffer' which has a size of 'bufsize'.  If the acquisition
 * was successful the length will be returned, else -1 is returned.
 */
-inline int prom_getproperty(phandle node, const char *prop,
+int prom_getproperty(phandle node, const char *prop,
-                            char *buffer, int bufsize)
+                     char *buffer, int bufsize)
 {
        unsigned long args[8];
        int plen;
@@ -141,7 +141,7 @@ EXPORT_SYMBOL(prom_getproperty);
 /* Acquire an integer property and return its value.  Returns -1
 * on failure.
 */
-inline int prom_getint(phandle node, const char *prop)
+int prom_getint(phandle node, const char *prop)
 {
        int intprop;
@@ -235,7 +235,7 @@ static const char *prom_nextprop_name = "nextprop";
 /* Return the first property type for node 'node'.
 * buffer should be at least 32B in length
 */
-inline char *prom_firstprop(phandle node, char *buffer)
+char *prom_firstprop(phandle node, char *buffer)
 {
        unsigned long args[7];
@@ -261,7 +261,7 @@ EXPORT_SYMBOL(prom_firstprop);
 * at node 'node' .  Returns NULL string if no more
 * property types for this node.
 */
-inline char *prom_nextprop(phandle node, const char *oprop, char *buffer)
+char *prom_nextprop(phandle node, const char *oprop, char *buffer)
 {
        unsigned long args[7];
        char buf[32];
diff --git a/arch/tile/lib/exports.c b/arch/tile/lib/exports.c
index 4385cb6fa00a..a93b02a25222 100644
--- a/arch/tile/lib/exports.c
+++ b/arch/tile/lib/exports.c
@@ -84,4 +84,6 @@ uint64_t __ashrdi3(uint64_t, unsigned int);
 EXPORT_SYMBOL(__ashrdi3);
 uint64_t __ashldi3(uint64_t, unsigned int);
 EXPORT_SYMBOL(__ashldi3);
+int __ffsdi2(uint64_t);
+EXPORT_SYMBOL(__ffsdi2);
 #endif
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index d7d21851e60c..3df3bd544492 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -147,7 +147,7 @@ void mconsole_proc(struct mc_request *req)
        }
        do {
-                loff_t pos;
+                loff_t pos = file->f_pos;
                mm_segment_t old_fs = get_fs();
                set_fs(KERNEL_DS);
                len = vfs_read(file, buf, PAGE_SIZE - 1, &pos);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 685692c94f05..fe120da25625 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2265,6 +2265,7 @@ source "fs/Kconfig.binfmt"
 config IA32_EMULATION
        bool "IA32 Emulation"
        depends on X86_64
+        select BINFMT_ELF
        select COMPAT_BINFMT_ELF
        select HAVE_UID16
        ---help---
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index 62fe22cd4cba..477e9d75149b 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -2681,56 +2681,68 @@ ENTRY(aesni_xts_crypt8)
        addq %rcx, KEYP
        movdqa IV, STATE1
-        pxor 0x00(INP), STATE1
+        movdqu 0x00(INP), INC
+        pxor INC, STATE1
        movdqu IV, 0x00(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE2
-        pxor 0x10(INP), STATE2
+        movdqu 0x10(INP), INC
+        pxor INC, STATE2
        movdqu IV, 0x10(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE3
-        pxor 0x20(INP), STATE3
+        movdqu 0x20(INP), INC
+        pxor INC, STATE3
        movdqu IV, 0x20(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE4
-        pxor 0x30(INP), STATE4
+        movdqu 0x30(INP), INC
+        pxor INC, STATE4
        movdqu IV, 0x30(OUTP)
        call *%r11
-        pxor 0x00(OUTP), STATE1
+        movdqu 0x00(OUTP), INC
+        pxor INC, STATE1
        movdqu STATE1, 0x00(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE1
-        pxor 0x40(INP), STATE1
+        movdqu 0x40(INP), INC
+        pxor INC, STATE1
        movdqu IV, 0x40(OUTP)
-        pxor 0x10(OUTP), STATE2
+        movdqu 0x10(OUTP), INC
+        pxor INC, STATE2
        movdqu STATE2, 0x10(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE2
-        pxor 0x50(INP), STATE2
+        movdqu 0x50(INP), INC
+        pxor INC, STATE2
        movdqu IV, 0x50(OUTP)
-        pxor 0x20(OUTP), STATE3
+        movdqu 0x20(OUTP), INC
+        pxor INC, STATE3
        movdqu STATE3, 0x20(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE3
-        pxor 0x60(INP), STATE3
+        movdqu 0x60(INP), INC
+        pxor INC, STATE3
        movdqu IV, 0x60(OUTP)
-        pxor 0x30(OUTP), STATE4
+        movdqu 0x30(OUTP), INC
+        pxor INC, STATE4
        movdqu STATE4, 0x30(OUTP)
        _aesni_gf128mul_x_ble()
        movdqa IV, STATE4
-        pxor 0x70(INP), STATE4
+        movdqu 0x70(INP), INC
+        pxor INC, STATE4
        movdqu IV, 0x70(OUTP)
        _aesni_gf128mul_x_ble()
@@ -2738,16 +2750,20 @@ ENTRY(aesni_xts_crypt8)
        call *%r11
-        pxor 0x40(OUTP), STATE1
+        movdqu 0x40(OUTP), INC
+        pxor INC, STATE1
        movdqu STATE1, 0x40(OUTP)
-        pxor 0x50(OUTP), STATE2
+        movdqu 0x50(OUTP), INC
+        pxor INC, STATE2
        movdqu STATE2, 0x50(OUTP)
-        pxor 0x60(OUTP), STATE3
+        movdqu 0x60(OUTP), INC
+        pxor INC, STATE3
        movdqu STATE3, 0x60(OUTP)
-        pxor 0x70(OUTP), STATE4
+        movdqu 0x70(OUTP), INC
+        pxor INC, STATE4
        movdqu STATE4, 0x70(OUTP)
        ret
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index 805078e08013..52ff81cce008 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -192,7 +192,7 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
        /* struct user */
        DUMP_WRITE(&dump, sizeof(dump));
        /* Now dump all of the user data.  Include malloced stuff as well */
-        DUMP_SEEK(PAGE_SIZE);
+        DUMP_SEEK(PAGE_SIZE - sizeof(dump));
        /* now we start writing out the user space info */
        set_fs(USER_DS);
        /* Dump the data area */
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index ba870bb6dd8e..57873beb3292 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -41,4 +41,9 @@ extern int vector_used_by_percpu_irq(unsigned int vector);
 extern void init_ISA_irqs(void);
+#ifdef CONFIG_X86_LOCAL_APIC
+void arch_trigger_all_cpu_backtrace(void);
+#define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
+#endif
 #endif /* _ASM_X86_IRQ_H */
diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
index 6825e2efd1b4..6bc3985ee473 100644
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -60,11 +60,11 @@ static inline void __exit exit_amd_microcode(void) {}
 #ifdef CONFIG_MICROCODE_EARLY
 #define MAX_UCODE_COUNT 128
 extern void __init load_ucode_bsp(void);
-extern __init void load_ucode_ap(void);
+extern void __cpuinit load_ucode_ap(void);
 extern int __init save_microcode_in_initrd(void);
 #else
 static inline void __init load_ucode_bsp(void) {}
-static inline __init void load_ucode_ap(void) {}
+static inline void __cpuinit load_ucode_ap(void) {}
 static inline int __init save_microcode_in_initrd(void)
 {
        return 0;
diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
index c0fa356e90de..86f9301903c8 100644
--- a/arch/x86/include/asm/nmi.h
+++ b/arch/x86/include/asm/nmi.h
@@ -18,9 +18,7 @@ extern int proc_nmi_enabled(struct ctl_table *, int ,
                        void __user *, size_t *, loff_t *);
 extern int unknown_nmi_panic;
-void arch_trigger_all_cpu_backtrace(void);
+#endif /* CONFIG_X86_LOCAL_APIC */
-#define arch_trigger_all_cpu_backtrace arch_trigger_all_cpu_backtrace
-#endif
 #define NMI_FLAG_FIRST  1
diff --git a/arch/x86/kernel/apic/hw_nmi.c b/arch/x86/kernel/apic/hw_nmi.c
index 31cb9ae992b7..a698d7165c96 100644
--- a/arch/x86/kernel/apic/hw_nmi.c
+++ b/arch/x86/kernel/apic/hw_nmi.c
@@ -9,6 +9,7 @@
 *
 */
 #include <asm/apic.h>
+#include <asm/nmi.h>
 #include <linux/cpumask.h>
 #include <linux/kdebug.h>
diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index 35ffda5d0727..5f90b85ff22e 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -714,15 +714,15 @@ int __init mtrr_cleanup(unsigned address_bits)
        if (mtrr_tom2)
                x_remove_size = (mtrr_tom2 >> PAGE_SHIFT) - x_remove_base;
-        nr_range = x86_get_mtrr_mem_range(range, 0, x_remove_base, x_remove_size);
        /*
         * [0, 1M) should always be covered by var mtrr with WB
         * and fixed mtrrs should take effect before var mtrr for it:
         */
-        nr_range = add_range_with_merge(range, RANGE_NUM, nr_range, 0,
+        nr_range = add_range_with_merge(range, RANGE_NUM, 0, 0,
                                        1ULL<<(20 - PAGE_SHIFT));
-        /* Sort the ranges: */
+        /* add from var mtrr at last */
-        sort_range(range, nr_range);
+        nr_range = x86_get_mtrr_mem_range(range, nr_range,
+                                          x_remove_base, x_remove_size);
        range_sums = sum_ranges(range, nr_range);
        printk(KERN_INFO "total RAM covered: %ldM\n",
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index f60d41ff9a97..a9e22073bd56 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -165,13 +165,13 @@ static struct extra_reg intel_snb_extra_regs[] __read_mostly = {
        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
        INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x01cd),
-        INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x01cd),
        EVENT_EXTRA_END
 };
 static struct extra_reg intel_snbep_extra_regs[] __read_mostly = {
        INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
        INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
+        INTEL_UEVENT_PEBS_LDLAT_EXTRA_REG(0x01cd),
        EVENT_EXTRA_END
 };
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 9895a9a41380..211bce445522 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -365,10 +365,14 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src)
        return insn.length;
 }
-static void __kprobes arch_copy_kprobe(struct kprobe *p)
+static int __kprobes arch_copy_kprobe(struct kprobe *p)
 {
+        int ret;
        /* Copy an instruction with recovering if other optprobe modifies it.*/
-        __copy_instruction(p->ainsn.insn, p->addr);
+        ret = __copy_instruction(p->ainsn.insn, p->addr);
+        if (!ret)
+                return -EINVAL;
        /*
         * __copy_instruction can modify the displacement of the instruction,
@@ -384,6 +388,8 @@ static void __kprobes arch_copy_kprobe(struct kprobe *p)
        /* Also, displacement change doesn't affect the first byte */
        p->opcode = p->ainsn.insn[0];
+        return 0;
 }
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
@@ -397,8 +403,8 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
        p->ainsn.insn = get_insn_slot();
        if (!p->ainsn.insn)
                return -ENOMEM;
-        arch_copy_kprobe(p);
-        return 0;
+        return arch_copy_kprobe(p);
 }
 void __kprobes arch_arm_kprobe(struct kprobe *p)
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index d2c381280e3c..3dd37ebd591b 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -242,6 +242,7 @@ void __init kvmclock_init(void)
        if (!mem)
                return;
        hv_clock = __va(mem);
+        memset(hv_clock, 0, size);
        if (kvm_register_clock("boot clock")) {
                hv_clock = NULL;
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 4e7a37ff03ab..81a5f5e8f142 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -277,18 +277,6 @@ void exit_idle(void)
 }
 #endif
-void arch_cpu_idle_prepare(void)
-{
-        /*
-         * If we're the non-boot CPU, nothing set the stack canary up
-         * for us.  CPU0 already has it initialized but no harm in
-         * doing it again.  This is a good place for updating it, as
-         * we wont ever return from this function (so the invalid
-         * canaries already on the stack wont ever trigger).
-         */
-        boot_init_stack_canary();
-}
 void arch_cpu_idle_enter(void)
 {
        local_touch_nmi();
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 9c73b51817e4..bfd348e99369 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -372,15 +372,15 @@ static bool __cpuinit match_mc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 void __cpuinit set_cpu_sibling_map(int cpu)
 {
-        bool has_mc = boot_cpu_data.x86_max_cores > 1;
        bool has_smt = smp_num_siblings > 1;
+        bool has_mp = has_smt || boot_cpu_data.x86_max_cores > 1;
        struct cpuinfo_x86 *c = &cpu_data(cpu);
        struct cpuinfo_x86 *o;
        int i;
        cpumask_set_cpu(cpu, cpu_sibling_setup_mask);
-        if (!has_smt && !has_mc) {
+        if (!has_mp) {
                cpumask_set_cpu(cpu, cpu_sibling_mask(cpu));
                cpumask_set_cpu(cpu, cpu_llc_shared_mask(cpu));
                cpumask_set_cpu(cpu, cpu_core_mask(cpu));
@@ -394,7 +394,7 @@ void __cpuinit set_cpu_sibling_map(int cpu)
                if ((i == cpu) || (has_smt && match_smt(c, o)))
                        link_mask(sibling, cpu, i);
-                if ((i == cpu) || (has_mc && match_llc(c, o)))
+                if ((i == cpu) || (has_mp && match_llc(c, o)))
                        link_mask(llc_shared, cpu, i);
        }
@@ -406,7 +406,7 @@ void __cpuinit set_cpu_sibling_map(int cpu)
        for_each_cpu(i, cpu_sibling_setup_mask) {
                o = &cpu_data(i);
-                if ((i == cpu) || (has_mc && match_mc(c, o))) {
+                if ((i == cpu) || (has_mp && match_mc(c, o))) {
                        link_mask(core, cpu, i);
                        /*
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 094b5d96ab14..e8ba99c34180 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -582,8 +582,6 @@ int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
        if (index != XCR_XFEATURE_ENABLED_MASK)
                return 1;
        xcr0 = xcr;
-        if (kvm_x86_ops->get_cpl(vcpu) != 0)
-                return 1;
        if (!(xcr0 & XSTATE_FP))
                return 1;
        if ((xcr0 & XSTATE_YMM) && !(xcr0 & XSTATE_SSE))
@@ -597,7 +595,8 @@ int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
 int kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
 {
-        if (__kvm_set_xcr(vcpu, index, xcr)) {
+        if (kvm_x86_ops->get_cpl(vcpu) != 0 ||
+            __kvm_set_xcr(vcpu, index, xcr)) {
                kvm_inject_gp(vcpu, 0);
                return 1;
        }
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 5ae2eb09419e..d2fbcedcf6ea 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -1069,7 +1069,10 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
                 * that by attempting to use more space than is available.
                 */
                unsigned long dummy_size = remaining_size + 1024;
-                void *dummy = kmalloc(dummy_size, GFP_ATOMIC);
+                void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
+                if (!dummy)
+                        return EFI_OUT_OF_RESOURCES;
                status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
                                          EFI_VARIABLE_NON_VOLATILE |
@@ -1089,6 +1092,8 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
                                         0, dummy);
                }
+                kfree(dummy);
                /*
                 * The runtime code may now have triggered a garbage collection
                 * run, so check the variable info again
diff --git a/crypto/algboss.c b/crypto/algboss.c
index 769219b29309..76fc0b23fc6c 100644
--- a/crypto/algboss.c
+++ b/crypto/algboss.c
@@ -45,10 +45,9 @@ struct cryptomgr_param {
                } nu32;
        } attrs[CRYPTO_MAX_ATTRS];
-        char larval[CRYPTO_MAX_ALG_NAME];
        char template[CRYPTO_MAX_ALG_NAME];
-        struct completion *completion;
+        struct crypto_larval *larval;
        u32 otype;
        u32 omask;
@@ -87,7 +86,8 @@ static int cryptomgr_probe(void *data)
        crypto_tmpl_put(tmpl);
 out:
-        complete_all(param->completion);
+        complete_all(&param->larval->completion);
+        crypto_alg_put(&param->larval->alg);
        kfree(param);
        module_put_and_exit(0);
 }
@@ -187,18 +187,19 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval)
        param->otype = larval->alg.cra_flags;
        param->omask = larval->mask;
-        memcpy(param->larval, larval->alg.cra_name, CRYPTO_MAX_ALG_NAME);
+        crypto_alg_get(&larval->alg);
+        param->larval = larval;
-        param->completion = &larval->completion;
        thread = kthread_run(cryptomgr_probe, param, "cryptomgr_probe");
        if (IS_ERR(thread))
-                goto err_free_param;
+                goto err_put_larval;
        wait_for_completion_interruptible(&larval->completion);
        return NOTIFY_STOP;
+err_put_larval:
+        crypto_alg_put(&larval->alg);
 err_free_param:
        kfree(param);
 err_put_module:
diff --git a/crypto/api.c b/crypto/api.c
index 033a7147e5eb..3b6180336d3d 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -34,12 +34,6 @@ EXPORT_SYMBOL_GPL(crypto_alg_sem);
 BLOCKING_NOTIFIER_HEAD(crypto_chain);
 EXPORT_SYMBOL_GPL(crypto_chain);
-static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
-{
-        atomic_inc(&alg->cra_refcnt);
-        return alg;
-}
 struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
 {
        return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
diff --git a/crypto/internal.h b/crypto/internal.h
index 9ebedae3fb54..bd39bfc92eab 100644
--- a/crypto/internal.h
+++ b/crypto/internal.h
@@ -103,6 +103,12 @@ int crypto_register_notifier(struct notifier_block *nb);
 int crypto_unregister_notifier(struct notifier_block *nb);
 int crypto_probing_notify(unsigned long val, void *v);
+static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
+{
+        atomic_inc(&alg->cra_refcnt);
+        return alg;
+}
 static inline void crypto_alg_put(struct crypto_alg *alg)
 {
        if (atomic_dec_and_test(&alg->cra_refcnt) && alg->cra_destroy)
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 652fd5ce303c..cab13f2fc28e 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -164,15 +164,24 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
        if (dev_desc->clk_required) {
                ret = register_device_clock(adev, pdata);
                if (ret) {
-                        /*
+                        /* Skip the device, but continue the namespace scan. */
-                         * Skip the device, but don't terminate the namespace
+                        ret = 0;
-                         * scan.
+                        goto err_out;
-                         */
-                        kfree(pdata);
-                        return 0;
                }
        }
+        /*
+         * This works around a known issue in ACPI tables where LPSS devices
+         * have _PS0 and _PS3 without _PSC (and no power resources), so
+         * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+         */
+        ret = acpi_device_fix_up_power(adev);
+        if (ret) {
+                /* Skip the device, but continue the namespace scan. */
+                ret = 0;
+                goto err_out;
+        }
        adev->driver_data = pdata;
        ret = acpi_create_platform_device(adev, id);
        if (ret > 0)
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 318fa32a141e..31c217a42839 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -290,6 +290,26 @@ int acpi_bus_init_power(struct acpi_device *device)
        return 0;
 }
+/**
+ * acpi_device_fix_up_power - Force device with missing _PSC into D0.
+ * @device: Device object whose power state is to be fixed up.
+ *
+ * Devices without power resources and _PSC, but having _PS0 and _PS3 defined,
+ * are assumed to be put into D0 by the BIOS.  However, in some cases that may
+ * not be the case and this function should be used then.
+ */
+int acpi_device_fix_up_power(struct acpi_device *device)
+{
+        int ret = 0;
+        if (!device->power.flags.power_resources
+            && !device->power.flags.explicit_get
+            && device->power.state == ACPI_STATE_D0)
+                ret = acpi_dev_pm_explicit_set(device, ACPI_STATE_D0);
+        return ret;
+}
 int acpi_bus_update_power(acpi_handle handle, int *state_p)
 {
        struct acpi_device *device;
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 4fdea381ef21..14de9f46972e 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -66,20 +66,21 @@ struct dock_station {
        spinlock_t dd_lock;
        struct mutex hp_lock;
        struct list_head dependent_devices;
-        struct list_head hotplug_devices;
        struct list_head sibling;
        struct platform_device *dock_device;
 };
 static LIST_HEAD(dock_stations);
 static int dock_station_count;
+static DEFINE_MUTEX(hotplug_lock);
 struct dock_dependent_device {
        struct list_head list;
-        struct list_head hotplug_list;
        acpi_handle handle;
-        const struct acpi_dock_ops *ops;
+        const struct acpi_dock_ops *hp_ops;
-        void *context;
+        void *hp_context;
+        unsigned int hp_refcount;
+        void (*hp_release)(void *);
 };
 #define DOCK_DOCKING    0x00000001
@@ -111,7 +112,6 @@ add_dock_dependent_device(struct dock_station *ds, acpi_handle handle)
        dd->handle = handle;
        INIT_LIST_HEAD(&dd->list);
-        INIT_LIST_HEAD(&dd->hotplug_list);
        spin_lock(&ds->dd_lock);
        list_add_tail(&dd->list, &ds->dependent_devices);
@@ -121,35 +121,90 @@ add_dock_dependent_device(struct dock_station *ds, acpi_handle handle)
 }
 /**
- * dock_add_hotplug_device - associate a hotplug handler with the dock station
+ * dock_init_hotplug - Initialize a hotplug device on a docking station.
- * @ds: The dock station
+ * @dd: Dock-dependent device.
- * @dd: The dependent device struct
+ * @ops: Dock operations to attach to the dependent device.
- *
+ * @context: Data to pass to the @ops callbacks and @release.
- * Add the dependent device to the dock's hotplug device list
+ * @init: Optional initialization routine to run after setting up context.
+ * @release: Optional release routine to run on removal.
 */
-static void
+static int dock_init_hotplug(struct dock_dependent_device *dd,
-dock_add_hotplug_device(struct dock_station *ds,
+                             const struct acpi_dock_ops *ops, void *context,
-                        struct dock_dependent_device *dd)
+                             void (*init)(void *), void (*release)(void *))
 {
-        mutex_lock(&ds->hp_lock);
+        int ret = 0;
-        list_add_tail(&dd->hotplug_list, &ds->hotplug_devices);
-        mutex_unlock(&ds->hp_lock);
+        mutex_lock(&hotplug_lock);
+        if (dd->hp_context) {
+                ret = -EEXIST;
+        } else {
+                dd->hp_refcount = 1;
+                dd->hp_ops = ops;
+                dd->hp_context = context;
+                dd->hp_release = release;
+        }
+        if (!WARN_ON(ret) && init)
+                init(context);
+        mutex_unlock(&hotplug_lock);
+        return ret;
 }
 /**
- * dock_del_hotplug_device - remove a hotplug handler from the dock station
+ * dock_release_hotplug - Decrement hotplug reference counter of dock device.
- * @ds: The dock station
+ * @dd: Dock-dependent device.
- * @dd: the dependent device struct
 *
- * Delete the dependent device from the dock's hotplug device list
+ * Decrement the reference counter of @dd and if 0, detach its hotplug
+ * operations from it, reset its context pointer and run the optional release
+ * routine if present.
 */
-static void
+static void dock_release_hotplug(struct dock_dependent_device *dd)
-dock_del_hotplug_device(struct dock_station *ds,
-                        struct dock_dependent_device *dd)
 {
-        mutex_lock(&ds->hp_lock);
+        void (*release)(void *) = NULL;
-        list_del(&dd->hotplug_list);
+        void *context = NULL;
-        mutex_unlock(&ds->hp_lock);
+        mutex_lock(&hotplug_lock);
+        if (dd->hp_context && !--dd->hp_refcount) {
+                dd->hp_ops = NULL;
+                context = dd->hp_context;
+                dd->hp_context = NULL;
+                release = dd->hp_release;
+                dd->hp_release = NULL;
+        }
+        if (release && context)
+                release(context);
+        mutex_unlock(&hotplug_lock);
+}
+static void dock_hotplug_event(struct dock_dependent_device *dd, u32 event,
+                               bool uevent)
+{
+        acpi_notify_handler cb = NULL;
+        bool run = false;
+        mutex_lock(&hotplug_lock);
+        if (dd->hp_context) {
+                run = true;
+                dd->hp_refcount++;
+                if (dd->hp_ops)
+                        cb = uevent ? dd->hp_ops->uevent : dd->hp_ops->handler;
+        }
+        mutex_unlock(&hotplug_lock);
+        if (!run)
+                return;
+        if (cb)
+                cb(dd->handle, event, dd->hp_context);
+        dock_release_hotplug(dd);
 }
 /**
@@ -360,9 +415,8 @@ static void hotplug_dock_devices(struct dock_station *ds, u32 event)
        /*
         * First call driver specific hotplug functions
         */
-        list_for_each_entry(dd, &ds->hotplug_devices, hotplug_list)
+        list_for_each_entry(dd, &ds->dependent_devices, list)
-                if (dd->ops && dd->ops->handler)
+                dock_hotplug_event(dd, event, false);
-                        dd->ops->handler(dd->handle, event, dd->context);
        /*
         * Now make sure that an acpi_device is created for each
@@ -398,9 +452,8 @@ static void dock_event(struct dock_station *ds, u32 event, int num)
        if (num == DOCK_EVENT)
                kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
-        list_for_each_entry(dd, &ds->hotplug_devices, hotplug_list)
+        list_for_each_entry(dd, &ds->dependent_devices, list)
-                if (dd->ops && dd->ops->uevent)
+                dock_hotplug_event(dd, event, true);
-                        dd->ops->uevent(dd->handle, event, dd->context);
        if (num != DOCK_EVENT)
                kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
@@ -570,19 +623,24 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifier);
 * @handle: the handle of the device
 * @ops: handlers to call after docking
 * @context: device specific data
+ * @init: Optional initialization routine to run after registration
+ * @release: Optional release routine to run on unregistration
 *
 * If a driver would like to perform a hotplug operation after a dock
 * event, they can register an acpi_notifiy_handler to be called by
 * the dock driver after _DCK is executed.
 */
-int
+int register_hotplug_dock_device(acpi_handle handle,
-register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
+                                 const struct acpi_dock_ops *ops, void *context,
-                             void *context)
+                                 void (*init)(void *), void (*release)(void *))
 {
        struct dock_dependent_device *dd;
        struct dock_station *dock_station;
        int ret = -EINVAL;
+        if (WARN_ON(!context))
+                return -EINVAL;
        if (!dock_station_count)
                return -ENODEV;
@@ -597,12 +655,8 @@ register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops
                 * ops
                 */
                dd = find_dock_dependent_device(dock_station, handle);
-                if (dd) {
+                if (dd && !dock_init_hotplug(dd, ops, context, init, release))
-                        dd->ops = ops;
-                        dd->context = context;
-                        dock_add_hotplug_device(dock_station, dd);
                        ret = 0;
-                }
        }
        return ret;
@@ -624,7 +678,7 @@ void unregister_hotplug_dock_device(acpi_handle handle)
        list_for_each_entry(dock_station, &dock_stations, sibling) {
                dd = find_dock_dependent_device(dock_station, handle);
                if (dd)
-                        dock_del_hotplug_device(dock_station, dd);
+                        dock_release_hotplug(dd);
        }
 }
 EXPORT_SYMBOL_GPL(unregister_hotplug_dock_device);
@@ -868,8 +922,10 @@ static ssize_t write_undock(struct device *dev, struct device_attribute *attr,
        if (!count)
                return -EINVAL;
+        acpi_scan_lock_acquire();
        begin_undock(dock_station);
        ret = handle_eject_request(dock_station, ACPI_NOTIFY_EJECT_REQUEST);
+        acpi_scan_lock_release();
        return ret ? ret: count;
 }
 static DEVICE_ATTR(undock, S_IWUSR, NULL, write_undock);
@@ -951,7 +1007,6 @@ static int __init dock_add(acpi_handle handle)
        mutex_init(&dock_station->hp_lock);
        spin_lock_init(&dock_station->dd_lock);
        INIT_LIST_HEAD(&dock_station->sibling);
-        INIT_LIST_HEAD(&dock_station->hotplug_devices);
        ATOMIC_INIT_NOTIFIER_HEAD(&dock_notifier_list);
        INIT_LIST_HEAD(&dock_station->dependent_devices);
@@ -992,30 +1047,6 @@ err_unregister:
 }
 /**
- * dock_remove - free up resources related to the dock station
- */
-static int dock_remove(struct dock_station *ds)
-{
-        struct dock_dependent_device *dd, *tmp;
-        struct platform_device *dock_device = ds->dock_device;
-        if (!dock_station_count)
-                return 0;
-        /* remove dependent devices */
-        list_for_each_entry_safe(dd, tmp, &ds->dependent_devices, list)
-                kfree(dd);
-        list_del(&ds->sibling);
-        /* cleanup sysfs */
-        sysfs_remove_group(&dock_device->dev.kobj, &dock_attribute_group);
-        platform_device_unregister(dock_device);
-        return 0;
-}
-/**
 * find_dock_and_bay - look for dock stations and bays
 * @handle: acpi handle of a device
 * @lvl: unused
@@ -1033,7 +1064,7 @@ find_dock_and_bay(acpi_handle handle, u32 lvl, void *context, void **rv)
        return AE_OK;
 }
-static int __init dock_init(void)
+int __init acpi_dock_init(void)
 {
        if (acpi_disabled)
                return 0;
@@ -1052,19 +1083,3 @@ static int __init dock_init(void)
                ACPI_DOCK_DRIVER_DESCRIPTION, dock_station_count);
        return 0;
 }
-static void __exit dock_exit(void)
-{
-        struct dock_station *tmp, *dock_station;
-        unregister_acpi_bus_notifier(&dock_acpi_notifier);
-        list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibling)
-                dock_remove(dock_station);
-}
-/*
- * Must be called before drivers of devices in dock, otherwise we can't know
- * which devices are in a dock
- */
-subsys_initcall(dock_init);
-module_exit(dock_exit);
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 297cbf456f86..c610a76d92c4 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -40,6 +40,11 @@ void acpi_container_init(void);
 #else
 static inline void acpi_container_init(void) {}
 #endif
+#ifdef CONFIG_ACPI_DOCK
+void acpi_dock_init(void);
+#else
+static inline void acpi_dock_init(void) {}
+#endif
 #ifdef CONFIG_ACPI_HOTPLUG_MEMORY
 void acpi_memory_hotplug_init(void);
 #else
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index f962047c6c85..288bb270f8ed 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -885,6 +885,7 @@ int acpi_add_power_resource(acpi_handle handle)
                                ACPI_STA_DEFAULT);
        mutex_init(&resource->resource_lock);
        INIT_LIST_HEAD(&resource->dependent);
+        INIT_LIST_HEAD(&resource->list_node);
        resource->name = device->pnp.bus_id;
        strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
        strcpy(acpi_device_class(device), ACPI_POWER_CLASS);
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index a3868f6c222a..3322b47ab7ca 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -304,7 +304,8 @@ static void acpi_dev_irqresource_disabled(struct resource *res, u32 gsi)
 }
 static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
-                                     u8 triggering, u8 polarity, u8 shareable)
+                                     u8 triggering, u8 polarity, u8 shareable,
+                                     bool legacy)
 {
        int irq, p, t;
@@ -317,14 +318,19 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
         * In IO-APIC mode, use overrided attribute. Two reasons:
         * 1. BIOS bug in DSDT
         * 2. BIOS uses IO-APIC mode Interrupt Source Override
+         *
+         * We do this only if we are dealing with IRQ() or IRQNoFlags()
+         * resource (the legacy ISA resources). With modern ACPI 5 devices
+         * using extended IRQ descriptors we take the IRQ configuration
+         * from _CRS directly.
         */
-        if (!acpi_get_override_irq(gsi, &t, &p)) {
+        if (legacy && !acpi_get_override_irq(gsi, &t, &p)) {
                u8 trig = t ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
                u8 pol = p ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
                if (triggering != trig || polarity != pol) {
                        pr_warning("ACPI: IRQ %d override to %s, %s\n", gsi,
-                                   t ? "edge" : "level", p ? "low" : "high");
+                                   t ? "level" : "edge", p ? "low" : "high");
                        triggering = trig;
                        polarity = pol;
                }
@@ -373,7 +379,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
                }
                acpi_dev_get_irqresource(res, irq->interrupts[index],
                                         irq->triggering, irq->polarity,
-                                         irq->sharable);
+                                         irq->sharable, true);
                break;
        case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
                ext_irq = &ares->data.extended_irq;
@@ -383,7 +389,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
                }
                acpi_dev_get_irqresource(res, ext_irq->interrupts[index],
                                         ext_irq->triggering, ext_irq->polarity,
-                                         ext_irq->sharable);
+                                         ext_irq->sharable, false);
                break;
        default:
                return false;
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index b14ac46948c9..27da63061e11 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2042,6 +2042,7 @@ int __init acpi_scan_init(void)
        acpi_lpss_init();
        acpi_container_init();
        acpi_memory_hotplug_init();
+        acpi_dock_init();
        mutex_lock(&acpi_scan_lock);
        /*
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 87f2f395d79a..cf4e7020adac 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -156,8 +156,10 @@ static void ata_acpi_handle_hotplug(struct ata_port *ap, struct ata_device *dev,
        spin_unlock_irqrestore(ap->lock, flags);
-        if (wait)
+        if (wait) {
                ata_port_wait_eh(ap);
+                flush_work(&ap->hotplug_task.work);
+        }
 }
 static void ata_acpi_dev_notify_dock(acpi_handle handle, u32 event, void *data)
@@ -214,6 +216,39 @@ static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
        .uevent = ata_acpi_ap_uevent,
 };
+void ata_acpi_hotplug_init(struct ata_host *host)
+{
+        int i;
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
+                acpi_handle handle;
+                struct ata_device *dev;
+                if (!ap)
+                        continue;
+                handle = ata_ap_acpi_handle(ap);
+                if (handle) {
+                        /* we might be on a docking station */
+                        register_hotplug_dock_device(handle,
+                                                     &ata_acpi_ap_dock_ops, ap,
+                                                     NULL, NULL);
+                }
+                ata_for_each_dev(dev, &ap->link, ALL) {
+                        handle = ata_dev_acpi_handle(dev);
+                        if (!handle)
+                                continue;
+                        /* we might be on a docking station */
+                        register_hotplug_dock_device(handle,
+                                                     &ata_acpi_dev_dock_ops,
+                                                     dev, NULL, NULL);
+                }
+        }
+}
 /**
 * ata_acpi_dissociate - dissociate ATA host from ACPI objects
 * @host: target ATA host
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index f2184276539d..adf002a3c584 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6148,6 +6148,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
        if (rc)
                goto err_tadd;
+        ata_acpi_hotplug_init(host);
        /* set cable, sata_spd_limit and report */
        for (i = 0; i < host->n_ports; i++) {
                struct ata_port *ap = host->ports[i];
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index c949dd311b2e..577d902bc4de 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -122,6 +122,7 @@ extern int ata_acpi_register(void);
 extern void ata_acpi_unregister(void);
 extern void ata_acpi_bind(struct ata_device *dev);
 extern void ata_acpi_unbind(struct ata_device *dev);
+extern void ata_acpi_hotplug_init(struct ata_host *host);
 #else
 static inline void ata_acpi_dissociate(struct ata_host *host) { }
 static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; }
@@ -134,6 +135,7 @@ static inline int ata_acpi_register(void) { return 0; }
 static inline void ata_acpi_unregister(void) { }
 static inline void ata_acpi_bind(struct ata_device *dev) { }
 static inline void ata_acpi_unbind(struct ata_device *dev) { }
+static inline void ata_acpi_hotplug_init(struct ata_host *host) {}
 #endif
 /* libata-scsi.c */
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 4b1f9265887f..01e21037d8fe 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -450,8 +450,18 @@ static void fw_load_abort(struct firmware_priv *fw_priv)
 {
        struct firmware_buf *buf = fw_priv->buf;
+        /*
+         * There is a small window in which user can write to 'loading'
+         * between loading done and disappearance of 'loading'
+         */
+        if (test_bit(FW_STATUS_DONE, &buf->status))
+                return;
        set_bit(FW_STATUS_ABORT, &buf->status);
        complete_all(&buf->completion);
+        /* avoid user action after loading abort */
+        fw_priv->buf = NULL;
 }
 #define is_fw_load_aborted(buf) \
@@ -528,7 +538,12 @@ static ssize_t firmware_loading_show(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
        struct firmware_priv *fw_priv = to_firmware_priv(dev);
-        int loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
+        int loading = 0;
+        mutex_lock(&fw_lock);
+        if (fw_priv->buf)
+                loading = test_bit(FW_STATUS_LOADING, &fw_priv->buf->status);
+        mutex_unlock(&fw_lock);
        return sprintf(buf, "%d\n", loading);
 }
@@ -570,12 +585,12 @@ static ssize_t firmware_loading_store(struct device *dev,
                                      const char *buf, size_t count)
 {
        struct firmware_priv *fw_priv = to_firmware_priv(dev);
-        struct firmware_buf *fw_buf = fw_priv->buf;
+        struct firmware_buf *fw_buf;
        int loading = simple_strtol(buf, NULL, 10);
        int i;
        mutex_lock(&fw_lock);
+        fw_buf = fw_priv->buf;
        if (!fw_buf)
                goto out;
@@ -777,10 +792,6 @@ static void firmware_class_timeout_work(struct work_struct *work)
                        struct firmware_priv, timeout_work.work);
        mutex_lock(&fw_lock);
-        if (test_bit(FW_STATUS_DONE, &(fw_priv->buf->status))) {
-                mutex_unlock(&fw_lock);
-                return;
-        }
        fw_load_abort(fw_priv);
        mutex_unlock(&fw_lock);
 }
@@ -861,8 +872,6 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
        cancel_delayed_work_sync(&fw_priv->timeout_work);
-        fw_priv->buf = NULL;
        device_remove_file(f_dev, &dev_attr_loading);
 err_del_bin_attr:
        device_remove_bin_file(f_dev, &firmware_attr_data);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 3063452e55da..aff789d6fccd 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1036,12 +1036,16 @@ static const char *rbd_segment_name(struct rbd_device *rbd_dev, u64 offset)
        char *name;
        u64 segment;
        int ret;
+        char *name_format;
        name = kmem_cache_alloc(rbd_segment_name_cache, GFP_NOIO);
        if (!name)
                return NULL;
        segment = offset >> rbd_dev->header.obj_order;
-        ret = snprintf(name, MAX_OBJ_NAME_SIZE + 1, "%s.%012llx",
+        name_format = "%s.%012llx";
+        if (rbd_dev->image_format == 2)
+                name_format = "%s.%016llx";
+        ret = snprintf(name, MAX_OBJ_NAME_SIZE + 1, name_format,
                        rbd_dev->header.object_prefix, segment);
        if (ret < 0 || ret > MAX_OBJ_NAME_SIZE) {
                pr_err("error formatting segment name for #%llu (%d)\n",
@@ -2248,13 +2252,17 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
                                        obj_request->pages, length,
                                        offset & ~PAGE_MASK, false, false);
+                /*
+                 * set obj_request->img_request before formatting
+                 * the osd_request so that it gets the right snapc
+                 */
+                rbd_img_obj_request_add(img_request, obj_request);
                if (write_request)
                        rbd_osd_req_format_write(obj_request);
                else
                        rbd_osd_req_format_read(obj_request);
                obj_request->img_offset = img_offset;
-                rbd_img_obj_request_add(img_request, obj_request);
                img_offset += length;
                resid -= length;
@@ -4239,6 +4247,10 @@ static int rbd_dev_v2_header_info(struct rbd_device *rbd_dev)
        down_write(&rbd_dev->header_rwsem);
+        ret = rbd_dev_v2_image_size(rbd_dev);
+        if (ret)
+                goto out;
        if (first_time) {
                ret = rbd_dev_v2_header_onetime(rbd_dev);
                if (ret)
@@ -4272,10 +4284,6 @@ static int rbd_dev_v2_header_info(struct rbd_device *rbd_dev)
                                        "is EXPERIMENTAL!");
        }
-        ret = rbd_dev_v2_image_size(rbd_dev);
-        if (ret)
-                goto out;
        if (rbd_dev->spec->snap_id == CEPH_NOSNAP)
                if (rbd_dev->mapping.size != rbd_dev->header.image_size)
                        rbd_dev->mapping.size = rbd_dev->header.image_size;
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 934cfd18f72d..1144e8c7579d 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1955,6 +1955,7 @@ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
                /* XXX the notifier code should handle this better */
                if (!cn->notifier_head.head) {
                        srcu_cleanup_notifier_head(&cn->notifier_head);
+                        list_del(&cn->node);
                        kfree(cn);
                }
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index 5c97e75924a8..22d7699e7ced 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -155,7 +155,7 @@ static __initdata unsigned long exynos5250_clk_regs[] = {
 /* list of all parent clock list */
 PNAME(mout_apll_p)      = { "fin_pll", "fout_apll", };
-PNAME(mout_cpu_p)       = { "mout_apll", "mout_mpll", };
+PNAME(mout_cpu_p)       = { "mout_apll", "sclk_mpll", };
 PNAME(mout_mpll_fout_p) = { "fout_mplldiv2", "fout_mpll" };
 PNAME(mout_mpll_p)      = { "fin_pll", "mout_mpll_fout" };
 PNAME(mout_bpll_fout_p) = { "fout_bplldiv2", "fout_bpll" };
@@ -208,10 +208,10 @@ struct samsung_fixed_factor_clock exynos5250_fixed_factor_clks[] __initdata = {
 };
 struct samsung_mux_clock exynos5250_mux_clks[] __initdata = {
-        MUX(none, "mout_apll", mout_apll_p, SRC_CPU, 0, 1),
+        MUX_A(none, "mout_apll", mout_apll_p, SRC_CPU, 0, 1, "mout_apll"),
-        MUX(none, "mout_cpu", mout_cpu_p, SRC_CPU, 16, 1),
+        MUX_A(none, "mout_cpu", mout_cpu_p, SRC_CPU, 16, 1, "mout_cpu"),
        MUX(none, "mout_mpll_fout", mout_mpll_fout_p, PLL_DIV2_SEL, 4, 1),
-        MUX(none, "sclk_mpll", mout_mpll_p, SRC_CORE1, 8, 1),
+        MUX_A(none, "sclk_mpll", mout_mpll_p, SRC_CORE1, 8, 1, "mout_mpll"),
        MUX(none, "mout_bpll_fout", mout_bpll_fout_p, PLL_DIV2_SEL, 0, 1),
        MUX(none, "sclk_bpll", mout_bpll_p, SRC_CDREX, 0, 1),
        MUX(none, "mout_vpllsrc", mout_vpllsrc_p, SRC_TOP2, 0, 1),
@@ -378,7 +378,7 @@ struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0),
        GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0),
        GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0),
-        GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, 0, 0),
+        GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0),
        GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0),
        GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0),
        GATE(tzpc2, "tzpc2", "aclk66", GATE_IP_PERIS, 8, 0, 0),
diff --git a/drivers/clk/samsung/clk-pll.c b/drivers/clk/samsung/clk-pll.c
index 89135f6be116..362f12dcd944 100644
--- a/drivers/clk/samsung/clk-pll.c
+++ b/drivers/clk/samsung/clk-pll.c
@@ -111,7 +111,8 @@ static unsigned long samsung_pll36xx_recalc_rate(struct clk_hw *hw,
                                unsigned long parent_rate)
 {
        struct samsung_clk_pll36xx *pll = to_clk_pll36xx(hw);
-        u32 mdiv, pdiv, sdiv, kdiv, pll_con0, pll_con1;
+        u32 mdiv, pdiv, sdiv, pll_con0, pll_con1;
+        s16 kdiv;
        u64 fvco = parent_rate;
        pll_con0 = __raw_readl(pll->con_reg);
@@ -119,7 +120,7 @@ static unsigned long samsung_pll36xx_recalc_rate(struct clk_hw *hw,
        mdiv = (pll_con0 >> PLL36XX_MDIV_SHIFT) & PLL36XX_MDIV_MASK;
        pdiv = (pll_con0 >> PLL36XX_PDIV_SHIFT) & PLL36XX_PDIV_MASK;
        sdiv = (pll_con0 >> PLL36XX_SDIV_SHIFT) & PLL36XX_SDIV_MASK;
-        kdiv = pll_con1 & PLL36XX_KDIV_MASK;
+        kdiv = (s16)(pll_con1 & PLL36XX_KDIV_MASK);
        fvco *= (mdiv << 16) + kdiv;
        do_div(fvco, (pdiv << sdiv));
diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c
index f9ec43fd1320..080c3c5e33f6 100644
--- a/drivers/clk/spear/spear3xx_clock.c
+++ b/drivers/clk/spear/spear3xx_clock.c
@@ -369,7 +369,7 @@ static void __init spear320_clk_init(void __iomem *soc_config_base)
        clk_register_clkdev(clk, NULL, "60100000.serial");
 }
 #else
-static inline void spear320_clk_init(void) { }
+static inline void spear320_clk_init(void __iomem *soc_config_base) { }
 #endif
 void __init spear3xx_clk_init(void __iomem *misc_base, void __iomem *soc_config_base)
diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
index c6921f538e28..ba99e3844106 100644
--- a/drivers/clk/tegra/clk-tegra30.c
+++ b/drivers/clk/tegra/clk-tegra30.c
@@ -1598,6 +1598,12 @@ static void __init tegra30_periph_clk_init(void)
        clk_register_clkdev(clk, "afi", "tegra-pcie");
        clks[afi] = clk;
+        /* pciex */
+        clk = tegra_clk_register_periph_gate("pciex", "pll_e", 0, clk_base, 0,
+                                    74, &periph_u_regs, periph_clk_enb_refcnt);
+        clk_register_clkdev(clk, "pciex", "tegra-pcie");
+        clks[pciex] = clk;
        /* kfuse */
        clk = tegra_clk_register_periph_gate("kfuse", "clk_m",
                                    TEGRA_PERIPH_ON_APB,
@@ -1716,11 +1722,6 @@ static void __init tegra30_fixed_clk_init(void)
                                1, 0, &cml_lock);
        clk_register_clkdev(clk, "cml1", NULL);
        clks[cml1] = clk;
-        /* pciex */
-        clk = clk_register_fixed_rate(NULL, "pciex", "pll_e", 0, 100000000);
-        clk_register_clkdev(clk, "pciex", NULL);
-        clks[pciex] = clk;
 }
 static void __init tegra30_osc_clk_init(void)
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 4b9bb5def6f1..93eb5cbcc1f6 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -47,6 +47,8 @@ static struct od_ops od_ops;
 static struct cpufreq_governor cpufreq_gov_ondemand;
 #endif
+static unsigned int default_powersave_bias;
 static void ondemand_powersave_bias_init_cpu(int cpu)
 {
        struct od_cpu_dbs_info_s *dbs_info = &per_cpu(od_cpu_dbs_info, cpu);
@@ -543,7 +545,7 @@ static int od_init(struct dbs_data *dbs_data)
        tuners->sampling_down_factor = DEF_SAMPLING_DOWN_FACTOR;
        tuners->ignore_nice = 0;
-        tuners->powersave_bias = 0;
+        tuners->powersave_bias = default_powersave_bias;
        tuners->io_is_busy = should_io_be_busy();
        dbs_data->tuners = tuners;
@@ -585,6 +587,7 @@ static void od_set_powersave_bias(unsigned int powersave_bias)
        unsigned int cpu;
        cpumask_t done;
+        default_powersave_bias = powersave_bias;
        cpumask_clear(&done);
        get_online_cpus();
@@ -593,11 +596,17 @@ static void od_set_powersave_bias(unsigned int powersave_bias)
                        continue;
                policy = per_cpu(od_cpu_dbs_info, cpu).cdbs.cur_policy;
-                dbs_data = policy->governor_data;
+                if (!policy)
-                od_tuners = dbs_data->tuners;
+                        continue;
-                od_tuners->powersave_bias = powersave_bias;
                cpumask_or(&done, &done, policy->cpus);
+                if (policy->governor != &cpufreq_gov_ondemand)
+                        continue;
+                dbs_data = policy->governor_data;
+                od_tuners = dbs_data->tuners;
+                od_tuners->powersave_bias = default_powersave_bias;
        }
        put_online_cpus();
 }
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index d3f7d2db870f..4a430360af5a 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -1094,6 +1094,9 @@ static int omap_gpio_probe(struct platform_device *pdev)
        const struct omap_gpio_platform_data *pdata;
        struct resource *res;
        struct gpio_bank *bank;
+#ifdef CONFIG_ARCH_OMAP1
+        int irq_base;
+#endif
        match = of_match_device(of_match_ptr(omap_gpio_match), dev);
@@ -1135,11 +1138,28 @@ static int omap_gpio_probe(struct platform_device *pdev)
                                pdata->get_context_loss_count;
        }
+#ifdef CONFIG_ARCH_OMAP1
+        /*
+         * REVISIT: Once we have OMAP1 supporting SPARSE_IRQ, we can drop
+         * irq_alloc_descs() and irq_domain_add_legacy() and just use a
+         * linear IRQ domain mapping for all OMAP platforms.
+         */
+        irq_base = irq_alloc_descs(-1, 0, bank->width, 0);
+        if (irq_base < 0) {
+                dev_err(dev, "Couldn't allocate IRQ numbers\n");
+                return -ENODEV;
+        }
+        bank->domain = irq_domain_add_legacy(node, bank->width, irq_base,
+                                             0, &irq_domain_simple_ops, NULL);
+#else
        bank->domain = irq_domain_add_linear(node, bank->width,
                                             &irq_domain_simple_ops, NULL);
-        if (!bank->domain)
+#endif
+        if (!bank->domain) {
+                dev_err(dev, "Couldn't register an IRQ domain\n");
                return -ENODEV;
+        }
        if (bank->regs->set_dataout && bank->regs->clr_dataout)
                bank->set_dataout = _set_gpio_dataout_reg;
diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index dcde35231e25..5b7b9110254b 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -190,8 +190,7 @@ struct dma_buf *drm_gem_prime_export(struct drm_device *dev,
                if (ret)
                        return ERR_PTR(ret);
        }
-        return dma_buf_export(obj, &drm_gem_prime_dmabuf_ops, obj->size,
+        return dma_buf_export(obj, &drm_gem_prime_dmabuf_ops, obj->size, flags);
-                              0600);
 }
 EXPORT_SYMBOL(drm_gem_prime_export);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index b9d00dcf9a2d..9669a0b8b440 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1697,6 +1697,8 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,
 struct dma_buf *i915_gem_prime_export(struct drm_device *dev,
                                struct drm_gem_object *gem_obj, int flags);
+void i915_gem_restore_fences(struct drm_device *dev);
 /* i915_gem_context.c */
 void i915_gem_context_init(struct drm_device *dev);
 void i915_gem_context_fini(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 970ad17c99ab..9e35dafc5807 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1801,7 +1801,14 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                        gfp |= __GFP_NORETRY | __GFP_NOWARN | __GFP_NO_KSWAPD;
                        gfp &= ~(__GFP_IO | __GFP_WAIT);
                }
+#ifdef CONFIG_SWIOTLB
+                if (swiotlb_nr_tbl()) {
+                        st->nents++;
+                        sg_set_page(sg, page, PAGE_SIZE, 0);
+                        sg = sg_next(sg);
+                        continue;
+                }
+#endif
                if (!i || page_to_pfn(page) != last_pfn + 1) {
                        if (i)
                                sg = sg_next(sg);
@@ -1812,8 +1819,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                }
                last_pfn = page_to_pfn(page);
        }
+#ifdef CONFIG_SWIOTLB
-        sg_mark_end(sg);
+        if (!swiotlb_nr_tbl())
+#endif
+                sg_mark_end(sg);
        obj->pages = st;
        if (i915_gem_object_needs_bit17_swizzle(obj))
@@ -2117,25 +2126,15 @@ static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
        }
 }
-static void i915_gem_reset_fences(struct drm_device *dev)
+void i915_gem_restore_fences(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
        int i;
        for (i = 0; i < dev_priv->num_fence_regs; i++) {
                struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
+                i915_gem_write_fence(dev, i, reg->obj);
-                if (reg->obj)
-                        i915_gem_object_fence_lost(reg->obj);
-                i915_gem_write_fence(dev, i, NULL);
-                reg->pin_count = 0;
-                reg->obj = NULL;
-                INIT_LIST_HEAD(&reg->lru_list);
        }
-        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
 }
 void i915_gem_reset(struct drm_device *dev)
@@ -2158,8 +2157,7 @@ void i915_gem_reset(struct drm_device *dev)
                obj->base.read_domains &= ~I915_GEM_GPU_DOMAINS;
        }
-        /* The fence registers are invalidated so clear them out */
+        i915_gem_restore_fences(dev);
-        i915_gem_reset_fences(dev);
 }
 /**
@@ -3865,8 +3863,6 @@ i915_gem_idle(struct drm_device *dev)
        if (!drm_core_check_feature(dev, DRIVER_MODESET))
                i915_gem_evict_everything(dev);
-        i915_gem_reset_fences(dev);
        /* Hack!  Don't let anybody do execbuf while we don't control the chip.
         * We need to replace this with a semaphore, or something.
         * And not confound mm.suspended!
@@ -4193,7 +4189,8 @@ i915_gem_load(struct drm_device *dev)
                dev_priv->num_fence_regs = 8;
        /* Initialize fence registers to zero */
-        i915_gem_reset_fences(dev);
+        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
+        i915_gem_restore_fences(dev);
        i915_gem_detect_bit_6_swizzle(dev);
        init_waitqueue_head(&dev_priv->pending_flip_queue);
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 41f0fdecfbdc..369b3d8776ab 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -384,6 +384,7 @@ int i915_restore_state(struct drm_device *dev)
        mutex_lock(&dev->struct_mutex);
+        i915_gem_restore_fences(dev);
        i915_restore_display(dev);
        if (!drm_core_check_feature(dev, DRIVER_MODESET)) {
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index a4b71b25fa53..a30f29425c21 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
                if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
                        return -EINVAL;
+                if (!access_ok(VERIFY_READ,
+                               (void *)(unsigned long)user_cmd.command,
+                               user_cmd.command_size))
+                        return -EFAULT;
                ret = qxl_alloc_release_reserved(qdev,
                                                 sizeof(union qxl_release_info) +
                                                 user_cmd.command_size,
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 0e5341695922..6948eb88c2b7 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2687,6 +2687,9 @@ void r600_uvd_rbc_stop(struct radeon_device *rdev)
 int r600_uvd_init(struct radeon_device *rdev)
 {
        int i, j, r;
+        /* disable byte swapping */
+        u32 lmi_swap_cntl = 0;
+        u32 mp_swap_cntl = 0;
        /* raise clocks while booting up the VCPU */
        radeon_set_uvd_clocks(rdev, 53300, 40000);
@@ -2711,9 +2714,13 @@ int r600_uvd_init(struct radeon_device *rdev)
        WREG32(UVD_LMI_CTRL, 0x40 | (1 << 8) | (1 << 13) |
                             (1 << 21) | (1 << 9) | (1 << 20));
-        /* disable byte swapping */
+#ifdef __BIG_ENDIAN
-        WREG32(UVD_LMI_SWAP_CNTL, 0);
+        /* swap (8 in 32) RB and IB */
-        WREG32(UVD_MP_SWAP_CNTL, 0);
+        lmi_swap_cntl = 0xa;
+        mp_swap_cntl = 0;
+#endif
+        WREG32(UVD_LMI_SWAP_CNTL, lmi_swap_cntl);
+        WREG32(UVD_MP_SWAP_CNTL, mp_swap_cntl);
        WREG32(UVD_MPC_SET_MUXA0, 0x40c2040);
        WREG32(UVD_MPC_SET_MUXA1, 0x0);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 189973836cff..b0dc0b6cb4e0 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -244,16 +244,6 @@ void radeon_scratch_free(struct radeon_device *rdev, uint32_t reg)
 */
 void radeon_wb_disable(struct radeon_device *rdev)
 {
-        int r;
-        if (rdev->wb.wb_obj) {
-                r = radeon_bo_reserve(rdev->wb.wb_obj, false);
-                if (unlikely(r != 0))
-                        return;
-                radeon_bo_kunmap(rdev->wb.wb_obj);
-                radeon_bo_unpin(rdev->wb.wb_obj);
-                radeon_bo_unreserve(rdev->wb.wb_obj);
-        }
        rdev->wb.enabled = false;
 }
@@ -269,6 +259,11 @@ void radeon_wb_fini(struct radeon_device *rdev)
 {
        radeon_wb_disable(rdev);
        if (rdev->wb.wb_obj) {
+                if (!radeon_bo_reserve(rdev->wb.wb_obj, false)) {
+                        radeon_bo_kunmap(rdev->wb.wb_obj);
+                        radeon_bo_unpin(rdev->wb.wb_obj);
+                        radeon_bo_unreserve(rdev->wb.wb_obj);
+                }
                radeon_bo_unref(&rdev->wb.wb_obj);
                rdev->wb.wb = NULL;
                rdev->wb.wb_obj = NULL;
@@ -295,26 +290,26 @@ int radeon_wb_init(struct radeon_device *rdev)
                        dev_warn(rdev->dev, "(%d) create WB bo failed\n", r);
                        return r;
                }
-        }
+                r = radeon_bo_reserve(rdev->wb.wb_obj, false);
-        r = radeon_bo_reserve(rdev->wb.wb_obj, false);
+                if (unlikely(r != 0)) {
-        if (unlikely(r != 0)) {
+                        radeon_wb_fini(rdev);
-                radeon_wb_fini(rdev);
+                        return r;
-                return r;
+                }
-        }
+                r = radeon_bo_pin(rdev->wb.wb_obj, RADEON_GEM_DOMAIN_GTT,
-        r = radeon_bo_pin(rdev->wb.wb_obj, RADEON_GEM_DOMAIN_GTT,
+                                &rdev->wb.gpu_addr);
-                          &rdev->wb.gpu_addr);
+                if (r) {
-        if (r) {
+                        radeon_bo_unreserve(rdev->wb.wb_obj);
+                        dev_warn(rdev->dev, "(%d) pin WB bo failed\n", r);
+                        radeon_wb_fini(rdev);
+                        return r;
+                }
+                r = radeon_bo_kmap(rdev->wb.wb_obj, (void **)&rdev->wb.wb);
                radeon_bo_unreserve(rdev->wb.wb_obj);
-                dev_warn(rdev->dev, "(%d) pin WB bo failed\n", r);
+                if (r) {
-                radeon_wb_fini(rdev);
+                        dev_warn(rdev->dev, "(%d) map WB bo failed\n", r);
-                return r;
+                        radeon_wb_fini(rdev);
-        }
+                        return r;
-        r = radeon_bo_kmap(rdev->wb.wb_obj, (void **)&rdev->wb.wb);
+                }
-        radeon_bo_unreserve(rdev->wb.wb_obj);
-        if (r) {
-                dev_warn(rdev->dev, "(%d) map WB bo failed\n", r);
-                radeon_wb_fini(rdev);
-                return r;
        }
        /* clear wb memory */
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 5b937dfe6f65..ddb8f8e04eb5 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -63,7 +63,9 @@ static void radeon_fence_write(struct radeon_device *rdev, u32 seq, int ring)
 {
        struct radeon_fence_driver *drv = &rdev->fence_drv[ring];
        if (likely(rdev->wb.enabled || !drv->scratch_reg)) {
-                *drv->cpu_addr = cpu_to_le32(seq);
+                if (drv->cpu_addr) {
+                        *drv->cpu_addr = cpu_to_le32(seq);
+                }
        } else {
                WREG32(drv->scratch_reg, seq);
        }
@@ -84,7 +86,11 @@ static u32 radeon_fence_read(struct radeon_device *rdev, int ring)
        u32 seq = 0;
        if (likely(rdev->wb.enabled || !drv->scratch_reg)) {
-                seq = le32_to_cpu(*drv->cpu_addr);
+                if (drv->cpu_addr) {
+                        seq = le32_to_cpu(*drv->cpu_addr);
+                } else {
+                        seq = lower_32_bits(atomic64_read(&drv->last_seq));
+                }
        } else {
                seq = RREG32(drv->scratch_reg);
        }
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 2c1341f63dc5..43ec4a401f07 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -1197,11 +1197,13 @@ int radeon_vm_bo_update_pte(struct radeon_device *rdev,
 int radeon_vm_bo_rmv(struct radeon_device *rdev,
                     struct radeon_bo_va *bo_va)
 {
-        int r;
+        int r = 0;
        mutex_lock(&rdev->vm_manager.lock);
        mutex_lock(&bo_va->vm->mutex);
-        r = radeon_vm_bo_update_pte(rdev, bo_va->vm, bo_va->bo, NULL);
+        if (bo_va->soffset) {
+                r = radeon_vm_bo_update_pte(rdev, bo_va->vm, bo_va->bo, NULL);
+        }
        mutex_unlock(&rdev->vm_manager.lock);
        list_del(&bo_va->vm_list);
        mutex_unlock(&bo_va->vm->mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index e17faa7cf732..82434018cbe8 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -402,6 +402,13 @@ int radeon_ring_alloc(struct radeon_device *rdev, struct radeon_ring *ring, unsi
                return -ENOMEM;
        /* Align requested size with padding so unlock_commit can
         * pad safely */
+        radeon_ring_free_size(rdev, ring);
+        if (ring->ring_free_dw == (ring->ring_size / 4)) {
+                /* This is an empty ring update lockup info to avoid
+                 * false positive.
+                 */
+                radeon_ring_lockup_update(ring);
+        }
        ndw = (ndw + ring->align_mask) & ~ring->align_mask;
        while (ndw > (ring->ring_free_dw - 1)) {
                radeon_ring_free_size(rdev, ring);
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 906e5c0ca3b9..cad735dd02c6 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -159,7 +159,17 @@ int radeon_uvd_suspend(struct radeon_device *rdev)
        if (!r) {
                radeon_bo_kunmap(rdev->uvd.vcpu_bo);
                radeon_bo_unpin(rdev->uvd.vcpu_bo);
+                rdev->uvd.cpu_addr = NULL;
+                if (!radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_CPU, NULL)) {
+                        radeon_bo_kmap(rdev->uvd.vcpu_bo, &rdev->uvd.cpu_addr);
+                }
                radeon_bo_unreserve(rdev->uvd.vcpu_bo);
+                if (rdev->uvd.cpu_addr) {
+                        radeon_fence_driver_start_ring(rdev, R600_RING_TYPE_UVD_INDEX);
+                } else {
+                        rdev->fence_drv[R600_RING_TYPE_UVD_INDEX].cpu_addr = NULL;
+                }
        }
        return r;
 }
@@ -178,6 +188,10 @@ int radeon_uvd_resume(struct radeon_device *rdev)
                return r;
        }
+        /* Have been pin in cpu unmap unpin */
+        radeon_bo_kunmap(rdev->uvd.vcpu_bo);
+        radeon_bo_unpin(rdev->uvd.vcpu_bo);
        r = radeon_bo_pin(rdev->uvd.vcpu_bo, RADEON_GEM_DOMAIN_VRAM,
                          &rdev->uvd.gpu_addr);
        if (r) {
@@ -613,19 +627,19 @@ int radeon_uvd_get_create_msg(struct radeon_device *rdev, int ring,
        }
        /* stitch together an UVD create msg */
-        msg[0] = 0x00000de4;
+        msg[0] = cpu_to_le32(0x00000de4);
-        msg[1] = 0x00000000;
+        msg[1] = cpu_to_le32(0x00000000);
-        msg[2] = handle;
+        msg[2] = cpu_to_le32(handle);
-        msg[3] = 0x00000000;
+        msg[3] = cpu_to_le32(0x00000000);
-        msg[4] = 0x00000000;
+        msg[4] = cpu_to_le32(0x00000000);
-        msg[5] = 0x00000000;
+        msg[5] = cpu_to_le32(0x00000000);
-        msg[6] = 0x00000000;
+        msg[6] = cpu_to_le32(0x00000000);
-        msg[7] = 0x00000780;
+        msg[7] = cpu_to_le32(0x00000780);
-        msg[8] = 0x00000440;
+        msg[8] = cpu_to_le32(0x00000440);
-        msg[9] = 0x00000000;
+        msg[9] = cpu_to_le32(0x00000000);
-        msg[10] = 0x01b37000;
+        msg[10] = cpu_to_le32(0x01b37000);
        for (i = 11; i < 1024; ++i)
-                msg[i] = 0x0;
+                msg[i] = cpu_to_le32(0x0);
        radeon_bo_kunmap(bo);
        radeon_bo_unreserve(bo);
@@ -659,12 +673,12 @@ int radeon_uvd_get_destroy_msg(struct radeon_device *rdev, int ring,
        }
        /* stitch together an UVD destroy msg */
-        msg[0] = 0x00000de4;
+        msg[0] = cpu_to_le32(0x00000de4);
-        msg[1] = 0x00000002;
+        msg[1] = cpu_to_le32(0x00000002);
-        msg[2] = handle;
+        msg[2] = cpu_to_le32(handle);
-        msg[3] = 0x00000000;
+        msg[3] = cpu_to_le32(0x00000000);
        for (i = 4; i < 1024; ++i)
-                msg[i] = 0x0;
+                msg[i] = cpu_to_le32(0x0);
        radeon_bo_kunmap(bo);
        radeon_bo_unreserve(bo);
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index d6cbfe9df218..fa061d46527f 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -137,7 +137,7 @@ static const struct xpad_device {
        { 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
        { 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", 0, XTYPE_XBOX },
        { 0x0738, 0x4716, "Mad Catz Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
-        { 0x0738, 0x4728, "Mad Catz Street Fighter IV FightPad", XTYPE_XBOX360 },
+        { 0x0738, 0x4728, "Mad Catz Street Fighter IV FightPad", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
        { 0x0738, 0xbeef, "Mad Catz JOYTECH NEO SE Advanced GamePad", XTYPE_XBOX360 },
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 62a2c0e4cc99..7ac9c9818d55 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -431,6 +431,7 @@ config KEYBOARD_TEGRA
 config KEYBOARD_OPENCORES
        tristate "OpenCores Keyboard Controller"
+        depends on HAS_IOMEM
        help
          Say Y here if you want to use the OpenCores Keyboard Controller
          http://www.opencores.org/project,keyboardcontroller
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index aebfe3ecb945..1bda828f4b55 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -205,6 +205,7 @@ config SERIO_XILINX_XPS_PS2
 config SERIO_ALTERA_PS2
        tristate "Altera UP PS/2 controller"
+        depends on HAS_IOMEM
        help
          Say Y here if you have Altera University Program PS/2 ports.
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 518282da6d85..384fbcd0cee0 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -363,6 +363,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
                case 0x140802: /* Intuos4/5 13HD/24HD Classic Pen */
                case 0x160802: /* Cintiq 13HD Pro Pen */
                case 0x180802: /* DTH2242 Pen */
+                case 0x100802: /* Intuos4/5 13HD/24HD General Pen */
                        wacom->tool[idx] = BTN_TOOL_PEN;
                        break;
@@ -401,6 +402,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
                case 0x10080c: /* Intuos4/5 13HD/24HD Art Pen Eraser */
                case 0x16080a: /* Cintiq 13HD Pro Pen Eraser */
                case 0x18080a: /* DTH2242 Eraser */
+                case 0x10080a: /* Intuos4/5 13HD/24HD General Pen Eraser */
                        wacom->tool[idx] = BTN_TOOL_RUBBER;
                        break;
diff --git a/drivers/input/touchscreen/cyttsp_core.c b/drivers/input/touchscreen/cyttsp_core.c
index 8e60437ac85b..ae89d2609ab0 100644
--- a/drivers/input/touchscreen/cyttsp_core.c
+++ b/drivers/input/touchscreen/cyttsp_core.c
@@ -116,6 +116,15 @@ static int ttsp_send_command(struct cyttsp *ts, u8 cmd)
        return ttsp_write_block_data(ts, CY_REG_BASE, sizeof(cmd), &cmd);
 }
+static int cyttsp_handshake(struct cyttsp *ts)
+{
+        if (ts->pdata->use_hndshk)
+                return ttsp_send_command(ts,
+                                ts->xy_data.hst_mode ^ CY_HNDSHK_BIT);
+        return 0;
+}
 static int cyttsp_load_bl_regs(struct cyttsp *ts)
 {
        memset(&ts->bl_data, 0, sizeof(ts->bl_data));
@@ -133,7 +142,7 @@ static int cyttsp_exit_bl_mode(struct cyttsp *ts)
        memcpy(bl_cmd, bl_command, sizeof(bl_command));
        if (ts->pdata->bl_keys)
                memcpy(&bl_cmd[sizeof(bl_command) - CY_NUM_BL_KEYS],
-                        ts->pdata->bl_keys, sizeof(bl_command));
+                        ts->pdata->bl_keys, CY_NUM_BL_KEYS);
        error = ttsp_write_block_data(ts, CY_REG_BASE,
                                      sizeof(bl_cmd), bl_cmd);
@@ -167,6 +176,10 @@ static int cyttsp_set_operational_mode(struct cyttsp *ts)
        if (error)
                return error;
+        error = cyttsp_handshake(ts);
+        if (error)
+                return error;
        return ts->xy_data.act_dist == CY_ACT_DIST_DFLT ? -EIO : 0;
 }
@@ -188,6 +201,10 @@ static int cyttsp_set_sysinfo_mode(struct cyttsp *ts)
        if (error)
                return error;
+        error = cyttsp_handshake(ts);
+        if (error)
+                return error;
        if (!ts->sysinfo_data.tts_verh && !ts->sysinfo_data.tts_verl)
                return -EIO;
@@ -344,12 +361,9 @@ static irqreturn_t cyttsp_irq(int irq, void *handle)
                goto out;
        /* provide flow control handshake */
-        if (ts->pdata->use_hndshk) {
+        error = cyttsp_handshake(ts);
-                error = ttsp_send_command(ts,
+        if (error)
-                                ts->xy_data.hst_mode ^ CY_HNDSHK_BIT);
+                goto out;
-                if (error)
-                        goto out;
-        }
        if (unlikely(ts->state == CY_IDLE_STATE))
                goto out;
diff --git a/drivers/input/touchscreen/cyttsp_core.h b/drivers/input/touchscreen/cyttsp_core.h
index 1aa3c6967e70..f1ebde369f86 100644
--- a/drivers/input/touchscreen/cyttsp_core.h
+++ b/drivers/input/touchscreen/cyttsp_core.h
@@ -67,8 +67,8 @@ struct cyttsp_xydata {
 /* TTSP System Information interface definition */
 struct cyttsp_sysinfo_data {
        u8 hst_mode;
-        u8 mfg_cmd;
        u8 mfg_stat;
+        u8 mfg_cmd;
        u8 cid[3];
        u8 tt_undef1;
        u8 uid[8];
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1760ceb68b7b..19ceaa60e0f4 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -705,7 +705,7 @@ static int gic_irq_domain_xlate(struct irq_domain *d,
 static int __cpuinit gic_secondary_init(struct notifier_block *nfb,
                                        unsigned long action, void *hcpu)
 {
-        if (action == CPU_STARTING)
+        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
                gic_cpu_init(&gic_data[0]);
        return NOTIFY_OK;
 }
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index 7f5a7cac6dc7..8270388e2a0d 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -136,9 +136,9 @@ config DVB_NET
 # This Kconfig option is used by both PCI and USB drivers
 config TTPCI_EEPROM
-        tristate
+        tristate
-        depends on I2C
+        depends on I2C
-        default n
+        default n
 source "drivers/media/dvb-core/Kconfig"
@@ -189,6 +189,12 @@ config MEDIA_SUBDRV_AUTOSELECT
          If unsure say Y.
+config MEDIA_ATTACH
+        bool
+        depends on MEDIA_ANALOG_TV_SUPPORT || MEDIA_DIGITAL_TV_SUPPORT || MEDIA_RADIO_SUPPORT
+        depends on MODULES
+        default MODULES
 source "drivers/media/i2c/Kconfig"
 source "drivers/media/tuners/Kconfig"
 source "drivers/media/dvb-frontends/Kconfig"
diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
index cb52438e53ac..9eac5310942f 100644
--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c
+++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c
@@ -956,7 +956,7 @@ static int s5c73m3_oif_enum_frame_interval(struct v4l2_subdev *sd,
        if (fie->pad != OIF_SOURCE_PAD)
                return -EINVAL;
-        if (fie->index > ARRAY_SIZE(s5c73m3_intervals))
+        if (fie->index >= ARRAY_SIZE(s5c73m3_intervals))
                return -EINVAL;
        mutex_lock(&state->lock);
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 27d62623274b..aba5b1c649e6 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -615,7 +615,7 @@ static int snd_cx88_volume_put(struct snd_kcontrol *kcontrol,
        int changed = 0;
        u32 old;
-        if (core->board.audio_chip == V4L2_IDENT_WM8775)
+        if (core->sd_wm8775)
                snd_cx88_wm8775_volume_put(kcontrol, value);
        left = value->value.integer.value[0] & 0x3f;
@@ -682,8 +682,7 @@ static int snd_cx88_switch_put(struct snd_kcontrol *kcontrol,
                vol ^= bit;
                cx_swrite(SHADOW_AUD_VOL_CTL, AUD_VOL_CTL, vol);
                /* Pass mute onto any WM8775 */
-                if ((core->board.audio_chip == V4L2_IDENT_WM8775) &&
+                if (core->sd_wm8775 && ((1<<6) == bit))
-                    ((1<<6) == bit))
                        wm8775_s_ctrl(core, V4L2_CID_AUDIO_MUTE, 0 != (vol & bit));
                ret = 1;
        }
@@ -903,7 +902,7 @@ static int cx88_audio_initdev(struct pci_dev *pci,
                goto error;
        /* If there's a wm8775 then add a Line-In ALC switch */
-        if (core->board.audio_chip == V4L2_IDENT_WM8775)
+        if (core->sd_wm8775)
                snd_ctl_add(card, snd_ctl_new1(&snd_cx88_alc_switch, chip));
        strcpy (card->driver, "CX88x");
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 1b00615fd395..c7a9be1065c0 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -385,8 +385,7 @@ int cx88_video_mux(struct cx88_core *core, unsigned int input)
                /* The wm8775 module has the "2" route hardwired into
                   the initialization. Some boards may use different
                   routes for different inputs. HVR-1300 surely does */
-                if (core->board.audio_chip &&
+                if (core->sd_wm8775) {
-                    core->board.audio_chip == V4L2_IDENT_WM8775) {
                        call_all(core, audio, s_routing,
                                 INPUT(input).audioroute, 0, 0);
                }
@@ -771,8 +770,7 @@ static int video_open(struct file *file)
                cx_write(MO_GP1_IO, core->board.radio.gpio1);
                cx_write(MO_GP2_IO, core->board.radio.gpio2);
                if (core->board.radio.audioroute) {
-                        if(core->board.audio_chip &&
+                        if (core->sd_wm8775) {
-                                core->board.audio_chip == V4L2_IDENT_WM8775) {
                                call_all(core, audio, s_routing,
                                        core->board.radio.audioroute, 0, 0);
                        }
@@ -959,7 +957,7 @@ static int cx8800_s_aud_ctrl(struct v4l2_ctrl *ctrl)
        u32 value,mask;
        /* Pass changes onto any WM8775 */
-        if (core->board.audio_chip == V4L2_IDENT_WM8775) {
+        if (core->sd_wm8775) {
                switch (ctrl->id) {
                case V4L2_CID_AUDIO_MUTE:
                        wm8775_s_ctrl(core, ctrl->id, ctrl->val);
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index 48b8d7af386d..9d1481a60bd9 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -576,6 +576,14 @@ static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
        return v4l2_m2m_dqbuf(file, ctx->m2m_ctx, buf);
 }
+static int vidioc_create_bufs(struct file *file, void *priv,
+                              struct v4l2_create_buffers *create)
+{
+        struct coda_ctx *ctx = fh_to_ctx(priv);
+        return v4l2_m2m_create_bufs(file, ctx->m2m_ctx, create);
+}
 static int vidioc_streamon(struct file *file, void *priv,
                           enum v4l2_buf_type type)
 {
@@ -610,6 +618,7 @@ static const struct v4l2_ioctl_ops coda_ioctl_ops = {
        .vidioc_qbuf            = vidioc_qbuf,
        .vidioc_dqbuf           = vidioc_dqbuf,
+        .vidioc_create_bufs     = vidioc_create_bufs,
        .vidioc_streamon        = vidioc_streamon,
        .vidioc_streamoff       = vidioc_streamoff,
diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
index 1802f11e939f..d0b375cf565f 100644
--- a/drivers/media/platform/davinci/vpbe_display.c
+++ b/drivers/media/platform/davinci/vpbe_display.c
@@ -916,6 +916,21 @@ static int vpbe_display_s_fmt(struct file *file, void *priv,
        other video window */
        layer->pix_fmt = *pixfmt;
+        if (pixfmt->pixelformat == V4L2_PIX_FMT_NV12) {
+                struct vpbe_layer *otherlayer;
+                otherlayer = _vpbe_display_get_other_win_layer(disp_dev, layer);
+                /* if other layer is available, only
+                 * claim it, do not configure it
+                 */
+                ret = osd_device->ops.request_layer(osd_device,
+                                                    otherlayer->layer_info.id);
+                if (ret < 0) {
+                        v4l2_err(&vpbe_dev->v4l2_dev,
+                                 "Display Manager failed to allocate layer\n");
+                        return -EBUSY;
+                }
+        }
        /* Get osd layer config */
        osd_device->ops.get_layer_config(osd_device,
diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
index 8c50d3074866..93609091cb23 100644
--- a/drivers/media/platform/davinci/vpfe_capture.c
+++ b/drivers/media/platform/davinci/vpfe_capture.c
@@ -1837,7 +1837,7 @@ static int vpfe_probe(struct platform_device *pdev)
        if (NULL == ccdc_cfg) {
                v4l2_err(pdev->dev.driver,
                         "Memory allocation failed for ccdc_cfg\n");
-                goto probe_free_lock;
+                goto probe_free_dev_mem;
        }
        mutex_lock(&ccdc_lock);
@@ -1991,7 +1991,6 @@ probe_out_release_irq:
        free_irq(vpfe_dev->ccdc_irq0, vpfe_dev);
 probe_free_ccdc_cfg_mem:
        kfree(ccdc_cfg);
-probe_free_lock:
        mutex_unlock(&ccdc_lock);
 probe_free_dev_mem:
        kfree(vpfe_dev);
diff --git a/drivers/media/platform/exynos4-is/fimc-is-regs.c b/drivers/media/platform/exynos4-is/fimc-is-regs.c
index b0ff67bc1b05..d05eaa2c8490 100644
--- a/drivers/media/platform/exynos4-is/fimc-is-regs.c
+++ b/drivers/media/platform/exynos4-is/fimc-is-regs.c
@@ -174,7 +174,7 @@ int fimc_is_hw_change_mode(struct fimc_is *is)
                HIC_CAPTURE_STILL, HIC_CAPTURE_VIDEO,
        };
-        if (WARN_ON(is->config_index > ARRAY_SIZE(cmd)))
+        if (WARN_ON(is->config_index >= ARRAY_SIZE(cmd)))
                return -EINVAL;
        mcuctl_write(cmd[is->config_index], is, MCUCTL_REG_ISSR(0));
diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c
index 47c6363d04e2..0741945b79ed 100644
--- a/drivers/media/platform/exynos4-is/fimc-is.c
+++ b/drivers/media/platform/exynos4-is/fimc-is.c
@@ -48,7 +48,6 @@ static char *fimc_is_clocks[ISS_CLKS_MAX] = {
        [ISS_CLK_LITE0]                 = "lite0",
        [ISS_CLK_LITE1]                 = "lite1",
        [ISS_CLK_MPLL]                  = "mpll",
-        [ISS_CLK_SYSREG]                = "sysreg",
        [ISS_CLK_ISP]                   = "isp",
        [ISS_CLK_DRC]                   = "drc",
        [ISS_CLK_FD]                    = "fd",
@@ -71,7 +70,6 @@ static void fimc_is_put_clocks(struct fimc_is *is)
        for (i = 0; i < ISS_CLKS_MAX; i++) {
                if (IS_ERR(is->clocks[i]))
                        continue;
-                clk_unprepare(is->clocks[i]);
                clk_put(is->clocks[i]);
                is->clocks[i] = ERR_PTR(-EINVAL);
        }
@@ -90,12 +88,6 @@ static int fimc_is_get_clocks(struct fimc_is *is)
                        ret = PTR_ERR(is->clocks[i]);
                        goto err;
                }
-                ret = clk_prepare(is->clocks[i]);
-                if (ret < 0) {
-                        clk_put(is->clocks[i]);
-                        is->clocks[i] = ERR_PTR(-EINVAL);
-                        goto err;
-                }
        }
        return 0;
@@ -103,7 +95,7 @@ err:
        fimc_is_put_clocks(is);
        dev_err(&is->pdev->dev, "failed to get clock: %s\n",
                fimc_is_clocks[i]);
-        return -ENXIO;
+        return ret;
 }
 static int fimc_is_setup_clocks(struct fimc_is *is)
@@ -144,7 +136,7 @@ int fimc_is_enable_clocks(struct fimc_is *is)
        for (i = 0; i < ISS_GATE_CLKS_MAX; i++) {
                if (IS_ERR(is->clocks[i]))
                        continue;
-                ret = clk_enable(is->clocks[i]);
+                ret = clk_prepare_enable(is->clocks[i]);
                if (ret < 0) {
                        dev_err(&is->pdev->dev, "clock %s enable failed\n",
                                fimc_is_clocks[i]);
@@ -163,7 +155,7 @@ void fimc_is_disable_clocks(struct fimc_is *is)
        for (i = 0; i < ISS_GATE_CLKS_MAX; i++) {
                if (!IS_ERR(is->clocks[i])) {
-                        clk_disable(is->clocks[i]);
+                        clk_disable_unprepare(is->clocks[i]);
                        pr_debug("disabled clock: %s\n", fimc_is_clocks[i]);
                }
        }
@@ -326,6 +318,11 @@ int fimc_is_start_firmware(struct fimc_is *is)
        struct device *dev = &is->pdev->dev;
        int ret;
+        if (is->fw.f_w == NULL) {
+                dev_err(dev, "firmware is not loaded\n");
+                return -EINVAL;
+        }
        memcpy(is->memory.vaddr, is->fw.f_w->data, is->fw.f_w->size);
        wmb();
@@ -837,23 +834,11 @@ static int fimc_is_probe(struct platform_device *pdev)
                goto err_clk;
        }
        pm_runtime_enable(dev);
-        /*
-         * Enable only the ISP power domain, keep FIMC-IS clocks off until
-         * the whole clock tree is configured. The ISP power domain needs
-         * be active in order to acces any CMU_ISP clock registers.
-         */
-        ret = pm_runtime_get_sync(dev);
-        if (ret < 0)
-                goto err_irq;
-        ret = fimc_is_setup_clocks(is);
-        pm_runtime_put_sync(dev);
+        ret = pm_runtime_get_sync(dev);
        if (ret < 0)
                goto err_irq;
-        is->clk_init = true;
        is->alloc_ctx = vb2_dma_contig_init_ctx(dev);
        if (IS_ERR(is->alloc_ctx)) {
                ret = PTR_ERR(is->alloc_ctx);
@@ -875,6 +860,8 @@ static int fimc_is_probe(struct platform_device *pdev)
        if (ret < 0)
                goto err_dfs;
+        pm_runtime_put_sync(dev);
        dev_dbg(dev, "FIMC-IS registered successfully\n");
        return 0;
@@ -894,9 +881,11 @@ err_clk:
 static int fimc_is_runtime_resume(struct device *dev)
 {
        struct fimc_is *is = dev_get_drvdata(dev);
+        int ret;
-        if (!is->clk_init)
+        ret = fimc_is_setup_clocks(is);
-                return 0;
+        if (ret)
+                return ret;
        return fimc_is_enable_clocks(is);
 }
@@ -905,9 +894,7 @@ static int fimc_is_runtime_suspend(struct device *dev)
 {
        struct fimc_is *is = dev_get_drvdata(dev);
-        if (is->clk_init)
+        fimc_is_disable_clocks(is);
-                fimc_is_disable_clocks(is);
        return 0;
 }
@@ -941,7 +928,8 @@ static int fimc_is_remove(struct platform_device *pdev)
        vb2_dma_contig_cleanup_ctx(is->alloc_ctx);
        fimc_is_put_clocks(is);
        fimc_is_debugfs_remove(is);
-        release_firmware(is->fw.f_w);
+        if (is->fw.f_w)
+                release_firmware(is->fw.f_w);
        fimc_is_free_cpu_memory(is);
        return 0;
diff --git a/drivers/media/platform/exynos4-is/fimc-is.h b/drivers/media/platform/exynos4-is/fimc-is.h
index f5275a5b0156..d7db133b493f 100644
--- a/drivers/media/platform/exynos4-is/fimc-is.h
+++ b/drivers/media/platform/exynos4-is/fimc-is.h
@@ -73,7 +73,6 @@ enum {
        ISS_CLK_LITE0,
        ISS_CLK_LITE1,
        ISS_CLK_MPLL,
-        ISS_CLK_SYSREG,
        ISS_CLK_ISP,
        ISS_CLK_DRC,
        ISS_CLK_FD,
@@ -265,7 +264,6 @@ struct fimc_is {
        spinlock_t                      slock;
        struct clk                      *clocks[ISS_CLKS_MAX];
-        bool                            clk_init;
        void __iomem                    *regs;
        void __iomem                    *pmu_regs;
        int                             irq;
diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c
index d63947f7b302..7ede30b5910f 100644
--- a/drivers/media/platform/exynos4-is/fimc-isp.c
+++ b/drivers/media/platform/exynos4-is/fimc-isp.c
@@ -138,7 +138,7 @@ static int fimc_isp_subdev_get_fmt(struct v4l2_subdev *sd,
                return 0;
        }
-        mf->colorspace = V4L2_COLORSPACE_JPEG;
+        mf->colorspace = V4L2_COLORSPACE_SRGB;
        mutex_lock(&isp->subdev_lock);
        __is_get_frame_size(is, &cur_fmt);
@@ -194,7 +194,7 @@ static int fimc_isp_subdev_set_fmt(struct v4l2_subdev *sd,
        v4l2_dbg(1, debug, sd, "%s: pad%d: code: 0x%x, %dx%d\n",
                 __func__, fmt->pad, mf->code, mf->width, mf->height);
-        mf->colorspace = V4L2_COLORSPACE_JPEG;
+        mf->colorspace = V4L2_COLORSPACE_SRGB;
        mutex_lock(&isp->subdev_lock);
        __isp_subdev_try_format(isp, fmt);
diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
index a2eda9d5ac87..254d70fe762a 100644
--- a/drivers/media/platform/exynos4-is/mipi-csis.c
+++ b/drivers/media/platform/exynos4-is/mipi-csis.c
@@ -746,7 +746,7 @@ static int s5pcsis_parse_dt(struct platform_device *pdev,
        node = v4l2_of_get_next_endpoint(node, NULL);
        if (!node) {
                dev_err(&pdev->dev, "No port node at %s\n",
-                                        node->full_name);
+                                pdev->dev.of_node->full_name);
                return -EINVAL;
        }
        /* Get port node and validate MIPI-CSI channel id. */
diff --git a/drivers/media/platform/s3c-camif/camif-core.h b/drivers/media/platform/s3c-camif/camif-core.h
index 261134baa655..35d2fcdc0036 100644
--- a/drivers/media/platform/s3c-camif/camif-core.h
+++ b/drivers/media/platform/s3c-camif/camif-core.h
@@ -229,7 +229,7 @@ struct camif_vp {
        unsigned int            state;
        u16                     fmt_flags;
        u8                      id;
-        u8                      rotation;
+        u16                     rotation;
        u8                      hflip;
        u8                      vflip;
        unsigned int            offset;
diff --git a/drivers/media/platform/s5p-jpeg/Makefile b/drivers/media/platform/s5p-jpeg/Makefile
index ddc2900d88a2..d18cb5edd2d5 100644
--- a/drivers/media/platform/s5p-jpeg/Makefile
+++ b/drivers/media/platform/s5p-jpeg/Makefile
@@ -1,2 +1,2 @@
 s5p-jpeg-objs := jpeg-core.o
-obj-$(CONFIG_VIDEO_SAMSUNG_S5P_JPEG) := s5p-jpeg.o
+obj-$(CONFIG_VIDEO_SAMSUNG_S5P_JPEG) += s5p-jpeg.o
diff --git a/drivers/media/platform/s5p-mfc/Makefile b/drivers/media/platform/s5p-mfc/Makefile
index 379008c6d09a..15f59b324fef 100644
--- a/drivers/media/platform/s5p-mfc/Makefile
+++ b/drivers/media/platform/s5p-mfc/Makefile
@@ -1,4 +1,4 @@
-obj-$(CONFIG_VIDEO_SAMSUNG_S5P_MFC) := s5p-mfc.o
+obj-$(CONFIG_VIDEO_SAMSUNG_S5P_MFC) += s5p-mfc.o
 s5p-mfc-y += s5p_mfc.o s5p_mfc_intr.o
 s5p-mfc-y += s5p_mfc_dec.o s5p_mfc_enc.o
 s5p-mfc-y += s5p_mfc_ctrl.o s5p_mfc_pm.o
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 01f9ae0dadb0..d12faa691af8 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -397,7 +397,7 @@ static void s5p_mfc_handle_frame(struct s5p_mfc_ctx *ctx,
 leave_handle_frame:
        spin_unlock_irqrestore(&dev->irqlock, flags);
        if ((ctx->src_queue_cnt == 0 && ctx->state != MFCINST_FINISHING)
-                                    || ctx->dst_queue_cnt < ctx->dpb_count)
+                                    || ctx->dst_queue_cnt < ctx->pb_count)
                clear_work_bit(ctx);
        s5p_mfc_hw_call(dev->mfc_ops, clear_int_flags, dev);
        wake_up_ctx(ctx, reason, err);
@@ -473,7 +473,7 @@ static void s5p_mfc_handle_seq_done(struct s5p_mfc_ctx *ctx,
                s5p_mfc_hw_call(dev->mfc_ops, dec_calc_dpb_size, ctx);
-                ctx->dpb_count = s5p_mfc_hw_call(dev->mfc_ops, get_dpb_count,
+                ctx->pb_count = s5p_mfc_hw_call(dev->mfc_ops, get_dpb_count,
                                dev);
                ctx->mv_count = s5p_mfc_hw_call(dev->mfc_ops, get_mv_count,
                                dev);
@@ -562,7 +562,7 @@ static void s5p_mfc_handle_stream_complete(struct s5p_mfc_ctx *ctx,
        struct s5p_mfc_dev *dev = ctx->dev;
        struct s5p_mfc_buf *mb_entry;
-        mfc_debug(2, "Stream completed");
+        mfc_debug(2, "Stream completed\n");
        s5p_mfc_clear_int_flags(dev);
        ctx->int_type = reason;
@@ -1362,7 +1362,6 @@ static struct s5p_mfc_variant mfc_drvdata_v5 = {
        .port_num       = MFC_NUM_PORTS,
        .buf_size       = &buf_size_v5,
        .buf_align      = &mfc_buf_align_v5,
-        .mclk_name      = "sclk_mfc",
        .fw_name        = "s5p-mfc.fw",
 };
@@ -1389,7 +1388,6 @@ static struct s5p_mfc_variant mfc_drvdata_v6 = {
        .port_num       = MFC_NUM_PORTS_V6,
        .buf_size       = &buf_size_v6,
        .buf_align      = &mfc_buf_align_v6,
-        .mclk_name      = "aclk_333",
        .fw_name        = "s5p-mfc-v6.fw",
 };
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
index 202d1d7a37a8..ef4074cd5316 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
@@ -138,6 +138,7 @@ enum s5p_mfc_inst_state {
        MFCINST_INIT = 100,
        MFCINST_GOT_INST,
        MFCINST_HEAD_PARSED,
+        MFCINST_HEAD_PRODUCED,
        MFCINST_BUFS_SET,
        MFCINST_RUNNING,
        MFCINST_FINISHING,
@@ -231,7 +232,6 @@ struct s5p_mfc_variant {
        unsigned int port_num;
        struct s5p_mfc_buf_size *buf_size;
        struct s5p_mfc_buf_align *buf_align;
-        char    *mclk_name;
        char    *fw_name;
 };
@@ -438,7 +438,7 @@ struct s5p_mfc_enc_params {
        u32 rc_framerate_num;
        u32 rc_framerate_denom;
-        union {
+        struct {
                struct s5p_mfc_h264_enc_params h264;
                struct s5p_mfc_mpeg4_enc_params mpeg4;
        } codec;
@@ -602,7 +602,7 @@ struct s5p_mfc_ctx {
        int after_packed_pb;
        int sei_fp_parse;
-        int dpb_count;
+        int pb_count;
        int total_dpb_count;
        int mv_count;
        /* Buffers */
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
index 2e5f30b40dea..dc1fc94a488d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c
@@ -38,7 +38,7 @@ int s5p_mfc_alloc_firmware(struct s5p_mfc_dev *dev)
        dev->fw_virt_addr = dma_alloc_coherent(dev->mem_dev_l, dev->fw_size,
                                        &dev->bank1, GFP_KERNEL);
-        if (IS_ERR(dev->fw_virt_addr)) {
+        if (IS_ERR_OR_NULL(dev->fw_virt_addr)) {
                dev->fw_virt_addr = NULL;
                mfc_err("Allocating bitprocessor buffer failed\n");
                return -ENOMEM;
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h b/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h
index bd5cd4ae993c..8e608f5aa0d7 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_debug.h
@@ -30,8 +30,8 @@ extern int debug;
 #define mfc_debug(level, fmt, args...)
 #endif
-#define mfc_debug_enter() mfc_debug(5, "enter")
+#define mfc_debug_enter() mfc_debug(5, "enter\n")
-#define mfc_debug_leave() mfc_debug(5, "leave")
+#define mfc_debug_leave() mfc_debug(5, "leave\n")
 #define mfc_err(fmt, args...)                           \
        do {                                            \
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
index 4af53bd2f182..00b07032f4f0 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_dec.c
@@ -210,11 +210,11 @@ static int s5p_mfc_ctx_ready(struct s5p_mfc_ctx *ctx)
        /* Context is to decode a frame */
        if (ctx->src_queue_cnt >= 1 &&
            ctx->state == MFCINST_RUNNING &&
-            ctx->dst_queue_cnt >= ctx->dpb_count)
+            ctx->dst_queue_cnt >= ctx->pb_count)
                return 1;
        /* Context is to return last frame */
        if (ctx->state == MFCINST_FINISHING &&
-            ctx->dst_queue_cnt >= ctx->dpb_count)
+            ctx->dst_queue_cnt >= ctx->pb_count)
                return 1;
        /* Context is to set buffers */
        if (ctx->src_queue_cnt >= 1 &&
@@ -224,7 +224,7 @@ static int s5p_mfc_ctx_ready(struct s5p_mfc_ctx *ctx)
        /* Resolution change */
        if ((ctx->state == MFCINST_RES_CHANGE_INIT ||
                ctx->state == MFCINST_RES_CHANGE_FLUSH) &&
-                ctx->dst_queue_cnt >= ctx->dpb_count)
+                ctx->dst_queue_cnt >= ctx->pb_count)
                return 1;
        if (ctx->state == MFCINST_RES_CHANGE_END &&
                ctx->src_queue_cnt >= 1)
@@ -537,7 +537,7 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                        mfc_err("vb2_reqbufs on capture failed\n");
                        return ret;
                }
-                if (reqbufs->count < ctx->dpb_count) {
+                if (reqbufs->count < ctx->pb_count) {
                        mfc_err("Not enough buffers allocated\n");
                        reqbufs->count = 0;
                        s5p_mfc_clock_on();
@@ -751,7 +751,7 @@ static int s5p_mfc_dec_g_v_ctrl(struct v4l2_ctrl *ctrl)
        case V4L2_CID_MIN_BUFFERS_FOR_CAPTURE:
                if (ctx->state >= MFCINST_HEAD_PARSED &&
                    ctx->state < MFCINST_ABORT) {
-                        ctrl->val = ctx->dpb_count;
+                        ctrl->val = ctx->pb_count;
                        break;
                } else if (ctx->state != MFCINST_INIT) {
                        v4l2_err(&dev->v4l2_dev, "Decoding not initialised\n");
@@ -763,7 +763,7 @@ static int s5p_mfc_dec_g_v_ctrl(struct v4l2_ctrl *ctrl)
                                S5P_MFC_R2H_CMD_SEQ_DONE_RET, 0);
                if (ctx->state >= MFCINST_HEAD_PARSED &&
                    ctx->state < MFCINST_ABORT) {
-                        ctrl->val = ctx->dpb_count;
+                        ctrl->val = ctx->pb_count;
                } else {
                        v4l2_err(&dev->v4l2_dev, "Decoding not initialised\n");
                        return -EINVAL;
@@ -924,10 +924,10 @@ static int s5p_mfc_queue_setup(struct vb2_queue *vq,
                /* Output plane count is 2 - one for Y and one for CbCr */
                *plane_count = 2;
                /* Setup buffer count */
-                if (*buf_count < ctx->dpb_count)
+                if (*buf_count < ctx->pb_count)
-                        *buf_count = ctx->dpb_count;
+                        *buf_count = ctx->pb_count;
-                if (*buf_count > ctx->dpb_count + MFC_MAX_EXTRA_DPB)
+                if (*buf_count > ctx->pb_count + MFC_MAX_EXTRA_DPB)
-                        *buf_count = ctx->dpb_count + MFC_MAX_EXTRA_DPB;
+                        *buf_count = ctx->pb_count + MFC_MAX_EXTRA_DPB;
                if (*buf_count > MFC_MAX_BUFFERS)
                        *buf_count = MFC_MAX_BUFFERS;
        } else {
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
index 4f6b553c4b2d..2549967b2f85 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_enc.c
@@ -592,7 +592,7 @@ static int s5p_mfc_ctx_ready(struct s5p_mfc_ctx *ctx)
                return 1;
        /* context is ready to encode a frame */
        if ((ctx->state == MFCINST_RUNNING ||
-                ctx->state == MFCINST_HEAD_PARSED) &&
+                ctx->state == MFCINST_HEAD_PRODUCED) &&
                ctx->src_queue_cnt >= 1 && ctx->dst_queue_cnt >= 1)
                return 1;
        /* context is ready to encode remaining frames */
@@ -649,6 +649,7 @@ static int enc_post_seq_start(struct s5p_mfc_ctx *ctx)
        struct s5p_mfc_enc_params *p = &ctx->enc_params;
        struct s5p_mfc_buf *dst_mb;
        unsigned long flags;
+        unsigned int enc_pb_count;
        if (p->seq_hdr_mode == V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE) {
                spin_lock_irqsave(&dev->irqlock, flags);
@@ -661,18 +662,19 @@ static int enc_post_seq_start(struct s5p_mfc_ctx *ctx)
                vb2_buffer_done(dst_mb->b, VB2_BUF_STATE_DONE);
                spin_unlock_irqrestore(&dev->irqlock, flags);
        }
-        if (IS_MFCV6(dev)) {
-                ctx->state = MFCINST_HEAD_PARSED; /* for INIT_BUFFER cmd */
+        if (!IS_MFCV6(dev)) {
-        } else {
                ctx->state = MFCINST_RUNNING;
                if (s5p_mfc_ctx_ready(ctx))
                        set_work_bit_irqsave(ctx);
                s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
-        }
+        } else {
+                enc_pb_count = s5p_mfc_hw_call(dev->mfc_ops,
-        if (IS_MFCV6(dev))
-                ctx->dpb_count = s5p_mfc_hw_call(dev->mfc_ops,
                                get_enc_dpb_count, dev);
+                if (ctx->pb_count < enc_pb_count)
+                        ctx->pb_count = enc_pb_count;
+                ctx->state = MFCINST_HEAD_PRODUCED;
+        }
        return 0;
 }
@@ -717,9 +719,9 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx)
        slice_type = s5p_mfc_hw_call(dev->mfc_ops, get_enc_slice_type, dev);
        strm_size = s5p_mfc_hw_call(dev->mfc_ops, get_enc_strm_size, dev);
-        mfc_debug(2, "Encoded slice type: %d", slice_type);
+        mfc_debug(2, "Encoded slice type: %d\n", slice_type);
-        mfc_debug(2, "Encoded stream size: %d", strm_size);
+        mfc_debug(2, "Encoded stream size: %d\n", strm_size);
-        mfc_debug(2, "Display order: %d",
+        mfc_debug(2, "Display order: %d\n",
                  mfc_read(dev, S5P_FIMV_ENC_SI_PIC_CNT));
        spin_lock_irqsave(&dev->irqlock, flags);
        if (slice_type >= 0) {
@@ -1055,15 +1057,13 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                }
                ctx->capture_state = QUEUE_BUFS_REQUESTED;
-                if (!IS_MFCV6(dev)) {
+                ret = s5p_mfc_hw_call(ctx->dev->mfc_ops,
-                        ret = s5p_mfc_hw_call(ctx->dev->mfc_ops,
+                                alloc_codec_buffers, ctx);
-                                        alloc_codec_buffers, ctx);
+                if (ret) {
-                        if (ret) {
+                        mfc_err("Failed to allocate encoding buffers\n");
-                                mfc_err("Failed to allocate encoding buffers\n");
+                        reqbufs->count = 0;
-                                reqbufs->count = 0;
+                        ret = vb2_reqbufs(&ctx->vq_dst, reqbufs);
-                                ret = vb2_reqbufs(&ctx->vq_dst, reqbufs);
+                        return -ENOMEM;
-                                return -ENOMEM;
-                        }
                }
        } else if (reqbufs->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
                if (ctx->output_state != QUEUE_FREE) {
@@ -1071,6 +1071,19 @@ static int vidioc_reqbufs(struct file *file, void *priv,
                                                        ctx->output_state);
                        return -EINVAL;
                }
+                if (IS_MFCV6(dev)) {
+                        /* Check for min encoder buffers */
+                        if (ctx->pb_count &&
+                                (reqbufs->count < ctx->pb_count)) {
+                                reqbufs->count = ctx->pb_count;
+                                mfc_debug(2, "Minimum %d output buffers needed\n",
+                                                ctx->pb_count);
+                        } else {
+                                ctx->pb_count = reqbufs->count;
+                        }
+                }
                ret = vb2_reqbufs(&ctx->vq_src, reqbufs);
                if (ret != 0) {
                        mfc_err("error in vb2_reqbufs() for E(S)\n");
@@ -1533,14 +1546,14 @@ int vidioc_encoder_cmd(struct file *file, void *priv,
                spin_lock_irqsave(&dev->irqlock, flags);
                if (list_empty(&ctx->src_queue)) {
-                        mfc_debug(2, "EOS: empty src queue, entering finishing state");
+                        mfc_debug(2, "EOS: empty src queue, entering finishing state\n");
                        ctx->state = MFCINST_FINISHING;
                        if (s5p_mfc_ctx_ready(ctx))
                                set_work_bit_irqsave(ctx);
                        spin_unlock_irqrestore(&dev->irqlock, flags);
                        s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
                } else {
-                        mfc_debug(2, "EOS: marking last buffer of stream");
+                        mfc_debug(2, "EOS: marking last buffer of stream\n");
                        buf = list_entry(ctx->src_queue.prev,
                                                struct s5p_mfc_buf, list);
                        if (buf->flags & MFC_BUF_FLAG_USED)
@@ -1609,9 +1622,9 @@ static int check_vb_with_fmt(struct s5p_mfc_fmt *fmt, struct vb2_buffer *vb)
                        mfc_err("failed to get plane cookie\n");
                        return -EINVAL;
                }
-                mfc_debug(2, "index: %d, plane[%d] cookie: 0x%08zx",
+                mfc_debug(2, "index: %d, plane[%d] cookie: 0x%08zx\n",
-                                vb->v4l2_buf.index, i,
+                          vb->v4l2_buf.index, i,
-                                vb2_dma_contig_plane_dma_addr(vb, i));
+                          vb2_dma_contig_plane_dma_addr(vb, i));
        }
        return 0;
 }
@@ -1760,11 +1773,27 @@ static int s5p_mfc_start_streaming(struct vb2_queue *q, unsigned int count)
        struct s5p_mfc_ctx *ctx = fh_to_ctx(q->drv_priv);
        struct s5p_mfc_dev *dev = ctx->dev;
-        v4l2_ctrl_handler_setup(&ctx->ctrl_handler);
+        if (IS_MFCV6(dev) && (q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
+                if ((ctx->state == MFCINST_GOT_INST) &&
+                        (dev->curr_ctx == ctx->num) && dev->hw_lock) {
+                        s5p_mfc_wait_for_done_ctx(ctx,
+                                                S5P_MFC_R2H_CMD_SEQ_DONE_RET,
+                                                0);
+                }
+                if (ctx->src_bufs_cnt < ctx->pb_count) {
+                        mfc_err("Need minimum %d OUTPUT buffers\n",
+                                        ctx->pb_count);
+                        return -EINVAL;
+                }
+        }
        /* If context is ready then dev = work->data;schedule it to run */
        if (s5p_mfc_ctx_ready(ctx))
                set_work_bit_irqsave(ctx);
        s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
        return 0;
 }
@@ -1920,6 +1949,7 @@ int s5p_mfc_enc_ctrls_setup(struct s5p_mfc_ctx *ctx)
                if (controls[i].is_volatile && ctx->ctrls[i])
                        ctx->ctrls[i]->flags |= V4L2_CTRL_FLAG_VOLATILE;
        }
+        v4l2_ctrl_handler_setup(&ctx->ctrl_handler);
        return 0;
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
index 0af05a2d1cd4..368582b091bf 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v5.c
@@ -1275,8 +1275,8 @@ static int s5p_mfc_run_enc_frame(struct s5p_mfc_ctx *ctx)
        spin_unlock_irqrestore(&dev->irqlock, flags);
        dev->curr_ctx = ctx->num;
        s5p_mfc_clean_ctx_int_flags(ctx);
-        mfc_debug(2, "encoding buffer with index=%d state=%d",
+        mfc_debug(2, "encoding buffer with index=%d state=%d\n",
-                        src_mb ? src_mb->b->v4l2_buf.index : -1, ctx->state);
+                  src_mb ? src_mb->b->v4l2_buf.index : -1, ctx->state);
        s5p_mfc_encode_one_frame_v5(ctx);
        return 0;
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
index 7e76fce2e524..66f0d042357f 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_opr_v6.c
@@ -62,12 +62,6 @@ static void s5p_mfc_release_dec_desc_buffer_v6(struct s5p_mfc_ctx *ctx)
        /* NOP */
 }
-static int s5p_mfc_get_dec_status_v6(struct s5p_mfc_dev *dev)
-{
-        /* NOP */
-        return -1;
-}
 /* Allocate codec buffers */
 static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
 {
@@ -167,7 +161,7 @@ static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
                                S5P_FIMV_SCRATCH_BUFFER_ALIGN_V6);
                ctx->bank1.size =
                        ctx->scratch_buf_size + ctx->tmv_buffer_size +
-                        (ctx->dpb_count * (ctx->luma_dpb_size +
+                        (ctx->pb_count * (ctx->luma_dpb_size +
                        ctx->chroma_dpb_size + ctx->me_buffer_size));
                ctx->bank2.size = 0;
                break;
@@ -181,7 +175,7 @@ static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
                                S5P_FIMV_SCRATCH_BUFFER_ALIGN_V6);
                ctx->bank1.size =
                        ctx->scratch_buf_size + ctx->tmv_buffer_size +
-                        (ctx->dpb_count * (ctx->luma_dpb_size +
+                        (ctx->pb_count * (ctx->luma_dpb_size +
                        ctx->chroma_dpb_size + ctx->me_buffer_size));
                ctx->bank2.size = 0;
                break;
@@ -198,7 +192,6 @@ static int s5p_mfc_alloc_codec_buffers_v6(struct s5p_mfc_ctx *ctx)
                }
                BUG_ON(ctx->bank1.dma & ((1 << MFC_BANK1_ALIGN_ORDER) - 1));
        }
        return 0;
 }
@@ -449,8 +442,8 @@ static int s5p_mfc_set_enc_stream_buffer_v6(struct s5p_mfc_ctx *ctx,
        WRITEL(addr, S5P_FIMV_E_STREAM_BUFFER_ADDR_V6); /* 16B align */
        WRITEL(size, S5P_FIMV_E_STREAM_BUFFER_SIZE_V6);
-        mfc_debug(2, "stream buf addr: 0x%08lx, size: 0x%d",
+        mfc_debug(2, "stream buf addr: 0x%08lx, size: 0x%d\n",
-                addr, size);
+                  addr, size);
        return 0;
 }
@@ -463,8 +456,8 @@ static void s5p_mfc_set_enc_frame_buffer_v6(struct s5p_mfc_ctx *ctx,
        WRITEL(y_addr, S5P_FIMV_E_SOURCE_LUMA_ADDR_V6); /* 256B align */
        WRITEL(c_addr, S5P_FIMV_E_SOURCE_CHROMA_ADDR_V6);
-        mfc_debug(2, "enc src y buf addr: 0x%08lx", y_addr);
+        mfc_debug(2, "enc src y buf addr: 0x%08lx\n", y_addr);
-        mfc_debug(2, "enc src c buf addr: 0x%08lx", c_addr);
+        mfc_debug(2, "enc src c buf addr: 0x%08lx\n", c_addr);
 }
 static void s5p_mfc_get_enc_frame_buffer_v6(struct s5p_mfc_ctx *ctx,
@@ -479,8 +472,8 @@ static void s5p_mfc_get_enc_frame_buffer_v6(struct s5p_mfc_ctx *ctx,
        enc_recon_y_addr = READL(S5P_FIMV_E_RECON_LUMA_DPB_ADDR_V6);
        enc_recon_c_addr = READL(S5P_FIMV_E_RECON_CHROMA_DPB_ADDR_V6);
-        mfc_debug(2, "recon y addr: 0x%08lx", enc_recon_y_addr);
+        mfc_debug(2, "recon y addr: 0x%08lx\n", enc_recon_y_addr);
-        mfc_debug(2, "recon c addr: 0x%08lx", enc_recon_c_addr);
+        mfc_debug(2, "recon c addr: 0x%08lx\n", enc_recon_c_addr);
 }
 /* Set encoding ref & codec buffer */
@@ -497,7 +490,7 @@ static int s5p_mfc_set_enc_ref_buffer_v6(struct s5p_mfc_ctx *ctx)
        mfc_debug(2, "Buf1: %p (%d)\n", (void *)buf_addr1, buf_size1);
-        for (i = 0; i < ctx->dpb_count; i++) {
+        for (i = 0; i < ctx->pb_count; i++) {
                WRITEL(buf_addr1, S5P_FIMV_E_LUMA_DPB_V6 + (4 * i));
                buf_addr1 += ctx->luma_dpb_size;
                WRITEL(buf_addr1, S5P_FIMV_E_CHROMA_DPB_V6 + (4 * i));
@@ -520,7 +513,7 @@ static int s5p_mfc_set_enc_ref_buffer_v6(struct s5p_mfc_ctx *ctx)
        buf_size1 -= ctx->tmv_buffer_size;
        mfc_debug(2, "Buf1: %u, buf_size1: %d (ref frames %d)\n",
-                        buf_addr1, buf_size1, ctx->dpb_count);
+                        buf_addr1, buf_size1, ctx->pb_count);
        if (buf_size1 < 0) {
                mfc_debug(2, "Not enough memory has been allocated.\n");
                return -ENOMEM;
@@ -1431,8 +1424,8 @@ static inline int s5p_mfc_run_enc_frame(struct s5p_mfc_ctx *ctx)
        src_y_addr = vb2_dma_contig_plane_dma_addr(src_mb->b, 0);
        src_c_addr = vb2_dma_contig_plane_dma_addr(src_mb->b, 1);
-        mfc_debug(2, "enc src y addr: 0x%08lx", src_y_addr);
+        mfc_debug(2, "enc src y addr: 0x%08lx\n", src_y_addr);
-        mfc_debug(2, "enc src c addr: 0x%08lx", src_c_addr);
+        mfc_debug(2, "enc src c addr: 0x%08lx\n", src_c_addr);
        s5p_mfc_set_enc_frame_buffer_v6(ctx, src_y_addr, src_c_addr);
@@ -1522,22 +1515,6 @@ static inline int s5p_mfc_run_init_enc_buffers(struct s5p_mfc_ctx *ctx)
        struct s5p_mfc_dev *dev = ctx->dev;
        int ret;
-        ret = s5p_mfc_alloc_codec_buffers_v6(ctx);
-        if (ret) {
-                mfc_err("Failed to allocate encoding buffers.\n");
-                return -ENOMEM;
-        }
-        /* Header was generated now starting processing
-         * First set the reference frame buffers
-         */
-        if (ctx->capture_state != QUEUE_BUFS_REQUESTED) {
-                mfc_err("It seems that destionation buffers were not\n"
-                        "requested.MFC requires that header should be generated\n"
-                        "before allocating codec buffer.\n");
-                return -EAGAIN;
-        }
        dev->curr_ctx = ctx->num;
        s5p_mfc_clean_ctx_int_flags(ctx);
        ret = s5p_mfc_set_enc_ref_buffer_v6(ctx);
@@ -1582,7 +1559,7 @@ static void s5p_mfc_try_run_v6(struct s5p_mfc_dev *dev)
        mfc_debug(1, "Seting new context to %p\n", ctx);
        /* Got context to run in ctx */
        mfc_debug(1, "ctx->dst_queue_cnt=%d ctx->dpb_count=%d ctx->src_queue_cnt=%d\n",
-                ctx->dst_queue_cnt, ctx->dpb_count, ctx->src_queue_cnt);
+                ctx->dst_queue_cnt, ctx->pb_count, ctx->src_queue_cnt);
        mfc_debug(1, "ctx->state=%d\n", ctx->state);
        /* Last frame has already been sent to MFC
         * Now obtaining frames from MFC buffer */
@@ -1647,7 +1624,7 @@ static void s5p_mfc_try_run_v6(struct s5p_mfc_dev *dev)
                case MFCINST_GOT_INST:
                        s5p_mfc_run_init_enc(ctx);
                        break;
-                case MFCINST_HEAD_PARSED: /* Only for MFC6.x */
+                case MFCINST_HEAD_PRODUCED:
                        ret = s5p_mfc_run_init_enc_buffers(ctx);
                        break;
                default:
@@ -1730,7 +1707,7 @@ static int s5p_mfc_get_dspl_status_v6(struct s5p_mfc_dev *dev)
        return mfc_read(dev, S5P_FIMV_D_DISPLAY_STATUS_V6);
 }
-static int s5p_mfc_get_decoded_status_v6(struct s5p_mfc_dev *dev)
+static int s5p_mfc_get_dec_status_v6(struct s5p_mfc_dev *dev)
 {
        return mfc_read(dev, S5P_FIMV_D_DECODED_STATUS_V6);
 }
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
index 6aa38a56aaf2..11d5f1dada32 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
@@ -50,19 +50,6 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
                goto err_p_ip_clk;
        }
-        pm->clock = clk_get(&dev->plat_dev->dev, dev->variant->mclk_name);
-        if (IS_ERR(pm->clock)) {
-                mfc_err("Failed to get MFC clock\n");
-                ret = PTR_ERR(pm->clock);
-                goto err_g_ip_clk_2;
-        }
-        ret = clk_prepare(pm->clock);
-        if (ret) {
-                mfc_err("Failed to prepare MFC clock\n");
-                goto err_p_ip_clk_2;
-        }
        atomic_set(&pm->power, 0);
 #ifdef CONFIG_PM_RUNTIME
        pm->device = &dev->plat_dev->dev;
@@ -72,10 +59,6 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
        atomic_set(&clk_ref, 0);
 #endif
        return 0;
-err_p_ip_clk_2:
-        clk_put(pm->clock);
-err_g_ip_clk_2:
-        clk_unprepare(pm->clock_gate);
 err_p_ip_clk:
        clk_put(pm->clock_gate);
 err_g_ip_clk:
@@ -86,8 +69,6 @@ void s5p_mfc_final_pm(struct s5p_mfc_dev *dev)
 {
        clk_unprepare(pm->clock_gate);
        clk_put(pm->clock_gate);
-        clk_unprepare(pm->clock);
-        clk_put(pm->clock);
 #ifdef CONFIG_PM_RUNTIME
        pm_runtime_disable(pm->device);
 #endif
@@ -98,7 +79,7 @@ int s5p_mfc_clock_on(void)
        int ret;
 #ifdef CLK_DEBUG
        atomic_inc(&clk_ref);
-        mfc_debug(3, "+ %d", atomic_read(&clk_ref));
+        mfc_debug(3, "+ %d\n", atomic_read(&clk_ref));
 #endif
        ret = clk_enable(pm->clock_gate);
        return ret;
@@ -108,7 +89,7 @@ void s5p_mfc_clock_off(void)
 {
 #ifdef CLK_DEBUG
        atomic_dec(&clk_ref);
-        mfc_debug(3, "- %d", atomic_read(&clk_ref));
+        mfc_debug(3, "- %d\n", atomic_read(&clk_ref));
 #endif
        clk_disable(pm->clock_gate);
 }
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index 0b32cc3f6a47..59a9deefb242 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -905,11 +905,11 @@ static int sh_veu_queue_setup(struct vb2_queue *vq,
                if (ftmp.fmt.pix.width != pix->width ||
                    ftmp.fmt.pix.height != pix->height)
                        return -EINVAL;
-                size = pix->bytesperline ? pix->bytesperline * pix->height :
+                size = pix->bytesperline ? pix->bytesperline * pix->height * fmt->depth / fmt->ydepth :
-                        pix->width * pix->height * fmt->depth >> 3;
+                        pix->width * pix->height * fmt->depth / fmt->ydepth;
        } else {
                vfmt = sh_veu_get_vfmt(veu, vq->type);
-                size = vfmt->bytesperline * vfmt->frame.height;
+                size = vfmt->bytesperline * vfmt->frame.height * vfmt->fmt->depth / vfmt->fmt->ydepth;
        }
        if (count < 2)
@@ -1033,8 +1033,6 @@ static int sh_veu_release(struct file *file)
        dev_dbg(veu->dev, "Releasing instance %p\n", veu_file);
-        pm_runtime_put(veu->dev);
        if (veu_file == veu->capture) {
                veu->capture = NULL;
                vb2_queue_release(v4l2_m2m_get_vq(veu->m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE));
@@ -1050,6 +1048,8 @@ static int sh_veu_release(struct file *file)
                veu->m2m_ctx = NULL;
        }
+        pm_runtime_put(veu->dev);
        kfree(veu_file);
        return 0;
@@ -1138,10 +1138,7 @@ static irqreturn_t sh_veu_isr(int irq, void *dev_id)
        veu->xaction++;
-        if (!veu->aborting)
+        return IRQ_WAKE_THREAD;
-                return IRQ_WAKE_THREAD;
-        return IRQ_HANDLED;
 }
 static int sh_veu_probe(struct platform_device *pdev)
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c
index eea832c5fd01..3a4efbdc7668 100644
--- a/drivers/media/platform/soc_camera/soc_camera.c
+++ b/drivers/media/platform/soc_camera/soc_camera.c
@@ -643,9 +643,9 @@ static int soc_camera_close(struct file *file)
                if (ici->ops->init_videobuf2)
                        vb2_queue_release(&icd->vb2_vidq);
-                ici->ops->remove(icd);
                __soc_camera_power_off(icd);
+                ici->ops->remove(icd);
        }
        if (icd->streamer == file)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index c0beee2fa37c..d529ba788f41 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -22,6 +22,7 @@ config RADIO_SI476X
        tristate "Silicon Laboratories Si476x I2C FM Radio"
        depends on I2C && VIDEO_V4L2
        depends on MFD_SI476X_CORE
+        depends on SND_SOC
        select SND_SOC_SI476X
        ---help---
          Choose Y here if you have this FM radio chip.
diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index 9430c6a29937..9dc8bafe6486 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -44,7 +44,7 @@
 #define FREQ_MUL (10000000 / 625)
-#define SI476X_PHDIV_STATUS_LINK_LOCKED(status) (0b10000000 & (status))
+#define SI476X_PHDIV_STATUS_LINK_LOCKED(status) (0x80 & (status))
 #define DRIVER_NAME "si476x-radio"
 #define DRIVER_CARD "SI476x AM/FM Receiver"
diff --git a/drivers/media/tuners/Kconfig b/drivers/media/tuners/Kconfig
index f6768cad001a..15665debc572 100644
--- a/drivers/media/tuners/Kconfig
+++ b/drivers/media/tuners/Kconfig
@@ -1,23 +1,3 @@
-config MEDIA_ATTACH
-        bool "Load and attach frontend and tuner driver modules as needed"
-        depends on MEDIA_ANALOG_TV_SUPPORT || MEDIA_DIGITAL_TV_SUPPORT || MEDIA_RADIO_SUPPORT
-        depends on MODULES
-        default y if !EXPERT
-        help
-          Remove the static dependency of DVB card drivers on all
-          frontend modules for all possible card variants. Instead,
-          allow the card drivers to only load the frontend modules
-          they require.
-          Also, tuner module will automatically load a tuner driver
-          when needed, for analog mode.
-          This saves several KBytes of memory.
-          Note: You will need module-init-tools v3.2 or later for this feature.
-          If unsure say Y.
 # Analog TV tuners, auto-loaded via tuner.ko
 config MEDIA_TUNER
        tristate
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 22015fe1a0f3..2cc8ec70e3b6 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -376,7 +376,7 @@ static int rtl2832u_read_config(struct dvb_usb_device *d)
        struct rtl28xxu_req req_mxl5007t = {0xd9c0, CMD_I2C_RD, 1, buf};
        struct rtl28xxu_req req_e4000 = {0x02c8, CMD_I2C_RD, 1, buf};
        struct rtl28xxu_req req_tda18272 = {0x00c0, CMD_I2C_RD, 2, buf};
-        struct rtl28xxu_req req_r820t = {0x0034, CMD_I2C_RD, 5, buf};
+        struct rtl28xxu_req req_r820t = {0x0034, CMD_I2C_RD, 1, buf};
        dev_dbg(&d->udev->dev, "%s:\n", __func__);
@@ -481,9 +481,9 @@ static int rtl2832u_read_config(struct dvb_usb_device *d)
                goto found;
        }
-        /* check R820T by reading tuner stats at I2C addr 0x1a */
+        /* check R820T ID register; reg=00 val=69 */
        ret = rtl28xxu_ctrl_msg(d, &req_r820t);
-        if (ret == 0) {
+        if (ret == 0 && buf[0] == 0x69) {
                priv->tuner = TUNER_RTL2832_R820T;
                priv->tuner_name = "R820T";
                goto found;
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 3fe207e038c7..d7ff3b9687c5 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -1159,6 +1159,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
                        regs[0x01] = 0x44; /* Select 24 Mhz clock */
                        regs[0x12] = 0x02; /* Set hstart to 2 */
                }
+                break;
+        case SENSOR_PAS202:
+                /* For some unknown reason we need to increase hstart by 1 on
+                   the sn9c103, otherwise we get wrong colors (bayer shift). */
+                if (sd->bridge == BRIDGE_103)
+                        regs[0x12] += 1;
+                break;
        }
        /* Disable compression when the raw bayer format has been selected */
        if (cam->cam_mode[gspca_dev->curr_mode].priv & MODE_RAW)
diff --git a/drivers/media/usb/pwc/pwc.h b/drivers/media/usb/pwc/pwc.h
index 7a6a0d39c2c6..81b017a554bc 100644
--- a/drivers/media/usb/pwc/pwc.h
+++ b/drivers/media/usb/pwc/pwc.h
@@ -226,7 +226,7 @@ struct pwc_device
        struct list_head queued_bufs;
        spinlock_t queued_bufs_lock; /* Protects queued_bufs */
-        /* Note if taking both locks v4l2_lock must always be locked first! */
+        /* If taking both locks vb_queue_lock must always be locked first! */
        struct mutex v4l2_lock;      /* Protects everything else */
        struct mutex vb_queue_lock;  /* Protects vb_queue and capt_file */
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index ebb8e48619a2..fccd08b66d1a 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -1835,6 +1835,8 @@ bool v4l2_ctrl_radio_filter(const struct v4l2_ctrl *ctrl)
 {
        if (V4L2_CTRL_ID2CLASS(ctrl->id) == V4L2_CTRL_CLASS_FM_TX)
                return true;
+        if (V4L2_CTRL_ID2CLASS(ctrl->id) == V4L2_CTRL_CLASS_FM_RX)
+                return true;
        switch (ctrl->id) {
        case V4L2_CID_AUDIO_MUTE:
        case V4L2_CID_AUDIO_VOLUME:
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index f81bda1a48ec..7658586fe5f4 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -243,7 +243,6 @@ static void v4l_print_format(const void *arg, bool write_only)
        const struct v4l2_vbi_format *vbi;
        const struct v4l2_sliced_vbi_format *sliced;
        const struct v4l2_window *win;
-        const struct v4l2_clip *clip;
        unsigned i;
        pr_cont("type=%s", prt_names(p->type, v4l2_type_names));
@@ -253,7 +252,7 @@ static void v4l_print_format(const void *arg, bool write_only)
                pix = &p->fmt.pix;
                pr_cont(", width=%u, height=%u, "
                        "pixelformat=%c%c%c%c, field=%s, "
-                        "bytesperline=%u sizeimage=%u, colorspace=%d\n",
+                        "bytesperline=%u, sizeimage=%u, colorspace=%d\n",
                        pix->width, pix->height,
                        (pix->pixelformat & 0xff),
                        (pix->pixelformat >>  8) & 0xff,
@@ -284,20 +283,14 @@ static void v4l_print_format(const void *arg, bool write_only)
        case V4L2_BUF_TYPE_VIDEO_OVERLAY:
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
                win = &p->fmt.win;
-                pr_cont(", wxh=%dx%d, x,y=%d,%d, field=%s, "
+                /* Note: we can't print the clip list here since the clips
-                        "chromakey=0x%08x, bitmap=%p, "
+                 * pointer is a userspace pointer, not a kernelspace
-                        "global_alpha=0x%02x\n",
+                 * pointer. */
-                        win->w.width, win->w.height,
+                pr_cont(", wxh=%dx%d, x,y=%d,%d, field=%s, chromakey=0x%08x, clipcount=%u, clips=%p, bitmap=%p, global_alpha=0x%02x\n",
-                        win->w.left, win->w.top,
+                        win->w.width, win->w.height, win->w.left, win->w.top,
                        prt_names(win->field, v4l2_field_names),
-                        win->chromakey, win->bitmap, win->global_alpha);
+                        win->chromakey, win->clipcount, win->clips,
-                clip = win->clips;
+                        win->bitmap, win->global_alpha);
-                for (i = 0; i < win->clipcount; i++) {
-                        printk(KERN_DEBUG "clip %u: wxh=%dx%d, x,y=%d,%d\n",
-                                        i, clip->c.width, clip->c.height,
-                                        clip->c.left, clip->c.top);
-                        clip = clip->next;
-                }
                break;
        case V4L2_BUF_TYPE_VBI_CAPTURE:
        case V4L2_BUF_TYPE_VBI_OUTPUT:
@@ -332,7 +325,7 @@ static void v4l_print_framebuffer(const void *arg, bool write_only)
        pr_cont("capability=0x%x, flags=0x%x, base=0x%p, width=%u, "
                "height=%u, pixelformat=%c%c%c%c, "
-                "bytesperline=%u sizeimage=%u, colorspace=%d\n",
+                "bytesperline=%u, sizeimage=%u, colorspace=%d\n",
                        p->capability, p->flags, p->base,
                        p->fmt.width, p->fmt.height,
                        (p->fmt.pixelformat & 0xff),
@@ -353,7 +346,7 @@ static void v4l_print_modulator(const void *arg, bool write_only)
        const struct v4l2_modulator *p = arg;
        if (write_only)
-                pr_cont("index=%u, txsubchans=0x%x", p->index, p->txsubchans);
+                pr_cont("index=%u, txsubchans=0x%x\n", p->index, p->txsubchans);
        else
                pr_cont("index=%u, name=%.*s, capability=0x%x, "
                        "rangelow=%u, rangehigh=%u, txsubchans=0x%x\n",
@@ -445,13 +438,13 @@ static void v4l_print_buffer(const void *arg, bool write_only)
                for (i = 0; i < p->length; ++i) {
                        plane = &p->m.planes[i];
                        printk(KERN_DEBUG
-                                "plane %d: bytesused=%d, data_offset=0x%08x "
+                                "plane %d: bytesused=%d, data_offset=0x%08x, "
                                "offset/userptr=0x%lx, length=%d\n",
                                i, plane->bytesused, plane->data_offset,
                                plane->m.userptr, plane->length);
                }
        } else {
-                pr_cont("bytesused=%d, offset/userptr=0x%lx, length=%d\n",
+                pr_cont(", bytesused=%d, offset/userptr=0x%lx, length=%d\n",
                        p->bytesused, p->m.userptr, p->length);
        }
@@ -504,6 +497,8 @@ static void v4l_print_streamparm(const void *arg, bool write_only)
                        c->capability, c->outputmode,
                        c->timeperframe.numerator, c->timeperframe.denominator,
                        c->extendedmode, c->writebuffers);
+        } else {
+                pr_cont("\n");
        }
 }
@@ -734,11 +729,11 @@ static void v4l_print_frmsizeenum(const void *arg, bool write_only)
                        p->type);
        switch (p->type) {
        case V4L2_FRMSIZE_TYPE_DISCRETE:
-                pr_cont(" wxh=%ux%u\n",
+                pr_cont(", wxh=%ux%u\n",
                        p->discrete.width, p->discrete.height);
                break;
        case V4L2_FRMSIZE_TYPE_STEPWISE:
-                pr_cont(" min=%ux%u, max=%ux%u, step=%ux%u\n",
+                pr_cont(", min=%ux%u, max=%ux%u, step=%ux%u\n",
                                p->stepwise.min_width,  p->stepwise.min_height,
                                p->stepwise.step_width, p->stepwise.step_height,
                                p->stepwise.max_width,  p->stepwise.max_height);
@@ -764,12 +759,12 @@ static void v4l_print_frmivalenum(const void *arg, bool write_only)
                        p->width, p->height, p->type);
        switch (p->type) {
        case V4L2_FRMIVAL_TYPE_DISCRETE:
-                pr_cont(" fps=%d/%d\n",
+                pr_cont(", fps=%d/%d\n",
                                p->discrete.numerator,
                                p->discrete.denominator);
                break;
        case V4L2_FRMIVAL_TYPE_STEPWISE:
-                pr_cont(" min=%d/%d, max=%d/%d, step=%d/%d\n",
+                pr_cont(", min=%d/%d, max=%d/%d, step=%d/%d\n",
                                p->stepwise.min.numerator,
                                p->stepwise.min.denominator,
                                p->stepwise.max.numerator,
@@ -807,8 +802,8 @@ static void v4l_print_event(const void *arg, bool write_only)
                        pr_cont("value64=%lld, ", c->value64);
                else
                        pr_cont("value=%d, ", c->value);
-                pr_cont("flags=0x%x, minimum=%d, maximum=%d, step=%d,"
+                pr_cont("flags=0x%x, minimum=%d, maximum=%d, step=%d, "
-                                " default_value=%d\n",
+                        "default_value=%d\n",
                        c->flags, c->minimum, c->maximum,
                        c->step, c->default_value);
                break;
@@ -845,7 +840,7 @@ static void v4l_print_freq_band(const void *arg, bool write_only)
        const struct v4l2_frequency_band *p = arg;
        pr_cont("tuner=%u, type=%u, index=%u, capability=0x%x, "
-                        "rangelow=%u, rangehigh=%u, modulation=0x%x\n",
+                "rangelow=%u, rangehigh=%u, modulation=0x%x\n",
                        p->tuner, p->type, p->index,
                        p->capability, p->rangelow,
                        p->rangehigh, p->modulation);
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index 66f599fcb829..e96497f7c3ed 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -205,7 +205,7 @@ static void v4l2_m2m_try_run(struct v4l2_m2m_dev *m2m_dev)
 static void v4l2_m2m_try_schedule(struct v4l2_m2m_ctx *m2m_ctx)
 {
        struct v4l2_m2m_dev *m2m_dev;
-        unsigned long flags_job, flags;
+        unsigned long flags_job, flags_out, flags_cap;
        m2m_dev = m2m_ctx->m2m_dev;
        dprintk("Trying to schedule a job for m2m_ctx: %p\n", m2m_ctx);
@@ -223,23 +223,26 @@ static void v4l2_m2m_try_schedule(struct v4l2_m2m_ctx *m2m_ctx)
                return;
        }
-        spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+        spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags_out);
        if (list_empty(&m2m_ctx->out_q_ctx.rdy_queue)) {
-                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock,
+                                        flags_out);
                spin_unlock_irqrestore(&m2m_dev->job_spinlock, flags_job);
                dprintk("No input buffers available\n");
                return;
        }
-        spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+        spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags_cap);
        if (list_empty(&m2m_ctx->cap_q_ctx.rdy_queue)) {
-                spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+                spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock,
-                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+                                        flags_cap);
+                spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock,
+                                        flags_out);
                spin_unlock_irqrestore(&m2m_dev->job_spinlock, flags_job);
                dprintk("No output buffers available\n");
                return;
        }
-        spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
+        spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags_cap);
-        spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
+        spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags_out);
        if (m2m_dev->m2m_ops->job_ready
                && (!m2m_dev->m2m_ops->job_ready(m2m_ctx->priv))) {
@@ -372,6 +375,20 @@ int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
 EXPORT_SYMBOL_GPL(v4l2_m2m_dqbuf);
 /**
+ * v4l2_m2m_create_bufs() - create a source or destination buffer, depending
+ * on the type
+ */
+int v4l2_m2m_create_bufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+                         struct v4l2_create_buffers *create)
+{
+        struct vb2_queue *vq;
+        vq = v4l2_m2m_get_vq(m2m_ctx, create->format.type);
+        return vb2_create_bufs(vq, create);
+}
+EXPORT_SYMBOL_GPL(v4l2_m2m_create_bufs);
+/**
 * v4l2_m2m_expbuf() - export a source or destination buffer, depending on
 * the type
 */
@@ -486,8 +503,10 @@ unsigned int v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
        if (m2m_ctx->m2m_dev->m2m_ops->unlock)
                m2m_ctx->m2m_dev->m2m_ops->unlock(m2m_ctx->priv);
-        poll_wait(file, &src_q->done_wq, wait);
+        if (list_empty(&src_q->done_list))
-        poll_wait(file, &dst_q->done_wq, wait);
+                poll_wait(file, &src_q->done_wq, wait);
+        if (list_empty(&dst_q->done_list))
+                poll_wait(file, &dst_q->done_wq, wait);
        if (m2m_ctx->m2m_dev->m2m_ops->lock)
                m2m_ctx->m2m_dev->m2m_ops->lock(m2m_ctx->priv);
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 7d833eefaf4e..e3bdc3be91e1 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -2014,7 +2014,8 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
        if (list_empty(&q->queued_list))
                return res | POLLERR;
-        poll_wait(file, &q->done_wq, wait);
+        if (list_empty(&q->done_list))
+                poll_wait(file, &q->done_wq, wait);
        /*
         * Take first buffer available for dequeuing.
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index 721b9186a5d1..4b93ed4d5cd6 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -107,7 +107,7 @@ static struct mfd_cell tps6586x_cell[] = {
                .name = "tps6586x-gpio",
        },
        {
-                .name = "tps6586x-pmic",
+                .name = "tps6586x-regulator",
        },
        {
                .name = "tps6586x-rtc",
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 742c193881fa..07f257d44a1e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2364,7 +2364,8 @@ static void bond_miimon_commit(struct bonding *bond)
                        pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
                                bond->dev->name, slave->dev->name,
-                                slave->speed, slave->duplex ? "full" : "half");
+                                slave->speed == SPEED_UNKNOWN ? 0 : slave->speed,
+                                slave->duplex ? "full" : "half");
                        /* notify ad that the link status has changed */
                        if (bond->params.mode == BOND_MODE_8023AD)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 986df04fdcb3..d964f302ac94 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -744,6 +744,9 @@ static int tg3_ape_lock(struct tg3 *tp, int locknum)
                status = tg3_ape_read32(tp, gnt + off);
                if (status == bit)
                        break;
+                if (pci_channel_offline(tp->pdev))
+                        break;
                udelay(10);
        }
@@ -1632,6 +1635,9 @@ static void tg3_wait_for_event_ack(struct tg3 *tp)
        for (i = 0; i < delay_cnt; i++) {
                if (!(tr32(GRC_RX_CPU_EVENT) & GRC_RX_CPU_DRIVER_EVENT))
                        break;
+                if (pci_channel_offline(tp->pdev))
+                        break;
                udelay(8);
        }
 }
@@ -1803,6 +1809,9 @@ static int tg3_poll_fw(struct tg3 *tp)
                for (i = 0; i < 200; i++) {
                        if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE)
                                return 0;
+                        if (pci_channel_offline(tp->pdev))
+                                return -ENODEV;
                        udelay(100);
                }
                return -ENODEV;
@@ -1813,6 +1822,15 @@ static int tg3_poll_fw(struct tg3 *tp)
                tg3_read_mem(tp, NIC_SRAM_FIRMWARE_MBOX, &val);
                if (val == ~NIC_SRAM_FIRMWARE_MBOX_MAGIC1)
                        break;
+                if (pci_channel_offline(tp->pdev)) {
+                        if (!tg3_flag(tp, NO_FWARE_REPORTED)) {
+                                tg3_flag_set(tp, NO_FWARE_REPORTED);
+                                netdev_info(tp->dev, "No firmware running\n");
+                        }
+                        break;
+                }
                udelay(10);
        }
@@ -3547,6 +3565,8 @@ static int tg3_pause_cpu(struct tg3 *tp, u32 cpu_base)
                tw32(cpu_base + CPU_MODE,  CPU_MODE_HALT);
                if (tr32(cpu_base + CPU_MODE) & CPU_MODE_HALT)
                        break;
+                if (pci_channel_offline(tp->pdev))
+                        return -EBUSY;
        }
        return (i == iters) ? -EBUSY : 0;
@@ -8661,6 +8681,14 @@ static int tg3_stop_block(struct tg3 *tp, unsigned long ofs, u32 enable_bit, boo
        tw32_f(ofs, val);
        for (i = 0; i < MAX_WAIT_CNT; i++) {
+                if (pci_channel_offline(tp->pdev)) {
+                        dev_err(&tp->pdev->dev,
+                                "tg3_stop_block device offline, "
+                                "ofs=%lx enable_bit=%x\n",
+                                ofs, enable_bit);
+                        return -ENODEV;
+                }
                udelay(100);
                val = tr32(ofs);
                if ((val & enable_bit) == 0)
@@ -8684,6 +8712,13 @@ static int tg3_abort_hw(struct tg3 *tp, bool silent)
        tg3_disable_ints(tp);
+        if (pci_channel_offline(tp->pdev)) {
+                tp->rx_mode &= ~(RX_MODE_ENABLE | TX_MODE_ENABLE);
+                tp->mac_mode &= ~MAC_MODE_TDE_ENABLE;
+                err = -ENODEV;
+                goto err_no_dev;
+        }
        tp->rx_mode &= ~RX_MODE_ENABLE;
        tw32_f(MAC_RX_MODE, tp->rx_mode);
        udelay(10);
@@ -8732,6 +8767,7 @@ static int tg3_abort_hw(struct tg3 *tp, bool silent)
        err |= tg3_stop_block(tp, BUFMGR_MODE, BUFMGR_MODE_ENABLE, silent);
        err |= tg3_stop_block(tp, MEMARB_MODE, MEMARB_MODE_ENABLE, silent);
+err_no_dev:
        for (i = 0; i < tp->irq_cnt; i++) {
                struct tg3_napi *tnapi = &tp->napi[i];
                if (tnapi->hw_status)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index b6768821757b..1f7ff2268bd0 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -516,6 +516,7 @@ fec_restart(struct net_device *ndev, int duplex)
        /* Set MII speed */
        writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
+#if !defined(CONFIG_M5272)
        /* set RX checksum */
        val = readl(fep->hwp + FEC_RACC);
        if (fep->csum_flags & FLAG_RX_CSUM_ENABLED)
@@ -523,6 +524,7 @@ fec_restart(struct net_device *ndev, int duplex)
        else
                val &= ~FEC_RACC_OPTIONS;
        writel(val, fep->hwp + FEC_RACC);
+#endif
        /*
         * The phy interface and speed need to get configured
@@ -575,6 +577,7 @@ fec_restart(struct net_device *ndev, int duplex)
 #endif
        }
+#if !defined(CONFIG_M5272)
        /* enable pause frame*/
        if ((fep->pause_flag & FEC_PAUSE_FLAG_ENABLE) ||
            ((fep->pause_flag & FEC_PAUSE_FLAG_AUTONEG) &&
@@ -592,6 +595,7 @@ fec_restart(struct net_device *ndev, int duplex)
        } else {
                rcntl &= ~FEC_ENET_FCE;
        }
+#endif /* !defined(CONFIG_M5272) */
        writel(rcntl, fep->hwp + FEC_R_CNTRL);
@@ -1211,7 +1215,9 @@ static int fec_enet_mii_probe(struct net_device *ndev)
        /* mask with MAC supported features */
        if (id_entry->driver_data & FEC_QUIRK_HAS_GBIT) {
                phy_dev->supported &= PHY_GBIT_FEATURES;
+#if !defined(CONFIG_M5272)
                phy_dev->supported |= SUPPORTED_Pause;
+#endif
        }
        else
                phy_dev->supported &= PHY_BASIC_FEATURES;
@@ -1396,6 +1402,8 @@ static int fec_enet_get_ts_info(struct net_device *ndev,
        }
 }
+#if !defined(CONFIG_M5272)
 static void fec_enet_get_pauseparam(struct net_device *ndev,
                                    struct ethtool_pauseparam *pause)
 {
@@ -1442,7 +1450,6 @@ static int fec_enet_set_pauseparam(struct net_device *ndev,
        return 0;
 }
-#ifndef CONFIG_M5272
 static const struct fec_stat {
        char name[ETH_GSTRING_LEN];
        u16 offset;
@@ -1541,7 +1548,7 @@ static int fec_enet_get_sset_count(struct net_device *dev, int sset)
                return -EOPNOTSUPP;
        }
 }
-#endif
+#endif /* !defined(CONFIG_M5272) */
 static int fec_enet_nway_reset(struct net_device *dev)
 {
@@ -1555,8 +1562,10 @@ static int fec_enet_nway_reset(struct net_device *dev)
 }
 static const struct ethtool_ops fec_enet_ethtool_ops = {
+#if !defined(CONFIG_M5272)
        .get_pauseparam         = fec_enet_get_pauseparam,
        .set_pauseparam         = fec_enet_set_pauseparam,
+#endif
        .get_settings           = fec_enet_get_settings,
        .set_settings           = fec_enet_set_settings,
        .get_drvinfo            = fec_enet_get_drvinfo,
@@ -1996,10 +2005,12 @@ fec_probe(struct platform_device *pdev)
        /* setup board info structure */
        fep = netdev_priv(ndev);
+#if !defined(CONFIG_M5272)
        /* default enable pause frame auto negotiation */
        if (pdev->id_entry &&
            (pdev->id_entry->driver_data & FEC_QUIRK_HAS_GBIT))
                fep->pause_flag |= FEC_PAUSE_FLAG_AUTONEG;
+#endif
        fep->hwp = devm_ioremap_resource(&pdev->dev, r);
        if (IS_ERR(fep->hwp)) {
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 510d50603a02..6495bea56ec8 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1763,7 +1763,7 @@ static int rxq_init(struct mv643xx_eth_private *mp, int index)
        memset(rxq->rx_desc_area, 0, size);
        rxq->rx_desc_area_size = size;
-        rxq->rx_skb = kmalloc_array(rxq->rx_ring_size, sizeof(*rxq->rx_skb),
+        rxq->rx_skb = kcalloc(rxq->rx_ring_size, sizeof(*rxq->rx_skb),
                                    GFP_KERNEL);
        if (rxq->rx_skb == NULL)
                goto out_free;
diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index ec20508f0d6b..db481477bcc5 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1015,7 +1015,7 @@ static int rxq_init(struct net_device *dev)
        int rx_desc_num = pep->rx_ring_size;
        /* Allocate RX skb rings */
-        pep->rx_skb = kmalloc(sizeof(*pep->rx_skb) * pep->rx_ring_size,
+        pep->rx_skb = kzalloc(sizeof(*pep->rx_skb) * pep->rx_ring_size,
                             GFP_KERNEL);
        if (!pep->rx_skb)
                return -ENOMEM;
@@ -1076,7 +1076,7 @@ static int txq_init(struct net_device *dev)
        int size = 0, i = 0;
        int tx_desc_num = pep->tx_ring_size;
-        pep->tx_skb = kmalloc(sizeof(*pep->tx_skb) * pep->tx_ring_size,
+        pep->tx_skb = kzalloc(sizeof(*pep->tx_skb) * pep->tx_ring_size,
                             GFP_KERNEL);
        if (!pep->tx_skb)
                return -ENOMEM;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 56160a2bb57b..f390785417f0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -632,6 +632,9 @@ static int mlx4_slave_cap(struct mlx4_dev *dev)
                dev->caps.cqe_size   = 32;
        }
+        dev->caps.flags2 &= ~MLX4_DEV_CAP_FLAG2_TS;
+        mlx4_warn(dev, "Timestamping is not supported in slave mode.\n");
        slave_adjust_steering_mode(dev, &dev_cap, &hca_param);
        return 0;
diff --git a/drivers/net/ethernet/octeon/octeon_mgmt.c b/drivers/net/ethernet/octeon/octeon_mgmt.c
index e6e029237a63..622aa75904c4 100644
--- a/drivers/net/ethernet/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/octeon/octeon_mgmt.c
@@ -46,17 +46,25 @@
 union mgmt_port_ring_entry {
        u64 d64;
        struct {
-                u64    reserved_62_63:2;
+#define RING_ENTRY_CODE_DONE 0xf
+#define RING_ENTRY_CODE_MORE 0x10
+#ifdef __BIG_ENDIAN_BITFIELD
+                u64 reserved_62_63:2;
                /* Length of the buffer/packet in bytes */
-                u64    len:14;
+                u64 len:14;
                /* For TX, signals that the packet should be timestamped */
-                u64    tstamp:1;
+                u64 tstamp:1;
                /* The RX error code */
-                u64    code:7;
+                u64 code:7;
-#define RING_ENTRY_CODE_DONE 0xf
-#define RING_ENTRY_CODE_MORE 0x10
                /* Physical address of the buffer */
-                u64    addr:40;
+                u64 addr:40;
+#else
+                u64 addr:40;
+                u64 code:7;
+                u64 tstamp:1;
+                u64 len:14;
+                u64 reserved_62_63:2;
+#endif
        } s;
 };
@@ -1141,10 +1149,13 @@ static int octeon_mgmt_open(struct net_device *netdev)
                /* For compensation state to lock. */
                ndelay(1040 * NS_PER_PHY_CLK);
-                /* Some Ethernet switches cannot handle standard
+                /* Default Interframe Gaps are too small.  Recommended
-                 * Interframe Gap, increase to 16 bytes.
+                 * workaround is.
+                 *
+                 * AGL_GMX_TX_IFG[IFG1]=14
+                 * AGL_GMX_TX_IFG[IFG2]=10
                 */
-                cvmx_write_csr(CVMX_AGL_GMX_TX_IFG, 0x88);
+                cvmx_write_csr(CVMX_AGL_GMX_TX_IFG, 0xae);
        }
        octeon_mgmt_rx_fill_ring(netdev);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
index 0d54fceda960..0581a484ceb5 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c
@@ -665,7 +665,7 @@ void qlcnic_fw_destroy_ctx(struct qlcnic_adapter *adapter)
                                qlcnic_83xx_config_intrpt(adapter, 0);
                }
                /* Allow dma queues to drain after context reset */
-                msleep(20);
+                mdelay(20);
        }
 }
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 7732f11f14ad..a753928bab9c 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -382,8 +382,9 @@ static struct sh_eth_cpu_data r8a777x_data = {
        .eesipr_value   = 0x01ff009f,
        .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
-        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RDE |
+        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
-                          EESR_RFRMER | EESR_TFE | EESR_TDE | EESR_ECI,
+                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE |
+                          EESR_ECI,
        .apr            = 1,
        .mpr            = 1,
@@ -417,8 +418,9 @@ static struct sh_eth_cpu_data sh7724_data = {
        .eesipr_value   = 0x01ff009f,
        .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
-        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RDE |
+        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
-                          EESR_RFRMER | EESR_TFE | EESR_TDE | EESR_ECI,
+                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE |
+                          EESR_ECI,
        .apr            = 1,
        .mpr            = 1,
@@ -453,8 +455,9 @@ static struct sh_eth_cpu_data sh7757_data = {
        .rmcr_value     = 0x00000001,
        .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
-        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RDE |
+        .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
-                          EESR_RFRMER | EESR_TFE | EESR_TDE | EESR_ECI,
+                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE |
+                          EESR_ECI,
        .irq_flags      = IRQF_SHARED,
        .apr            = 1,
@@ -521,9 +524,9 @@ static struct sh_eth_cpu_data sh7757_data_giga = {
        .eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
        .tx_check       = EESR_TC1 | EESR_FTC,
-        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT | \
+        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
-                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE | \
+                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
-                          EESR_ECI,
+                          EESR_TDE | EESR_ECI,
        .fdr_value      = 0x0000072f,
        .rmcr_value     = 0x00000001,
@@ -579,9 +582,9 @@ static struct sh_eth_cpu_data sh7734_data = {
        .eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
        .tx_check       = EESR_TC1 | EESR_FTC,
-        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT | \
+        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
-                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE | \
+                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
-                          EESR_ECI,
+                          EESR_TDE | EESR_ECI,
        .apr            = 1,
        .mpr            = 1,
@@ -643,9 +646,9 @@ static struct sh_eth_cpu_data r8a7740_data = {
        .eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
        .tx_check       = EESR_TC1 | EESR_FTC,
-        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT | \
+        .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
-                          EESR_RDE | EESR_RFRMER | EESR_TFE | EESR_TDE | \
+                          EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
-                          EESR_ECI,
+                          EESR_TDE | EESR_ECI,
        .apr            = 1,
        .mpr            = 1,
@@ -1401,11 +1404,12 @@ static void sh_eth_error(struct net_device *ndev, int intr_status)
 ignore_link:
        if (intr_status & EESR_TWB) {
-                /* Write buck end. unused write back interrupt */
+                /* Unused write back interrupt */
-                if (intr_status & EESR_TABT)    /* Transmit Abort int */
+                if (intr_status & EESR_TABT) {  /* Transmit Abort int */
                        ndev->stats.tx_aborted_errors++;
                        if (netif_msg_tx_err(mdp))
                                dev_err(&ndev->dev, "Transmit Abort\n");
+                }
        }
        if (intr_status & EESR_RABT) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index a78fb0c424f8..99995bf38c40 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -258,7 +258,7 @@ enum EESR_BIT {
 #define DEFAULT_TX_CHECK        (EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | \
                                 EESR_RTO)
-#define DEFAULT_EESR_ERR_CHECK  (EESR_TWB | EESR_TABT | EESR_RABT | \
+#define DEFAULT_EESR_ERR_CHECK  (EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE | \
                                 EESR_RDE | EESR_RFRMER | EESR_ADE | \
                                 EESR_TFE | EESR_TDE | EESR_ECI)
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index e7284a2caffa..c72968840f1a 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -2115,7 +2115,7 @@ show_phy_type(struct device *dev, struct device_attribute *attr, char *buf)
        struct efx_nic *efx = pci_get_drvdata(to_pci_dev(dev));
        return sprintf(buf, "%d\n", efx->phy_type);
 }
-static DEVICE_ATTR(phy_type, 0644, show_phy_type, NULL);
+static DEVICE_ATTR(phy_type, 0444, show_phy_type, NULL);
 static int efx_register_netdev(struct efx_nic *efx)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 9911b9323f00..7eb8babed2cb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -287,8 +287,8 @@ struct dma_features {
 #define MAC_RNABLE_RX           0x00000004      /* Receiver Enable */
 /* Default LPI timers */
-#define STMMAC_DEFAULT_LIT_LS_TIMER     0x3E8
+#define STMMAC_DEFAULT_LIT_LS   0x3E8
-#define STMMAC_DEFAULT_TWT_LS_TIMER     0x0
+#define STMMAC_DEFAULT_TWT_LS   0x0
 #define STMMAC_CHAIN_MODE       0x1
 #define STMMAC_RING_MODE        0x2
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 62e31054bd24..f2d283d2528f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -104,7 +104,7 @@ static const u32 default_msg_level = (NETIF_MSG_DRV | NETIF_MSG_PROBE |
 static int eee_timer = STMMAC_DEFAULT_LPI_TIMER;
 module_param(eee_timer, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(eee_timer, "LPI tx expiration time in msec");
-#define STMMAC_LPI_TIMER(x) (jiffies + msecs_to_jiffies(x))
+#define STMMAC_LPI_T(x) (jiffies + msecs_to_jiffies(x))
 /* By default the driver will use the ring mode to manage tx and rx descriptors
 * but passing this value so user can force to use the chain instead of the ring
@@ -260,7 +260,7 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
        struct stmmac_priv *priv = (struct stmmac_priv *)arg;
        stmmac_enable_eee_mode(priv);
-        mod_timer(&priv->eee_ctrl_timer, STMMAC_LPI_TIMER(eee_timer));
+        mod_timer(&priv->eee_ctrl_timer, STMMAC_LPI_T(eee_timer));
 }
 /**
@@ -276,22 +276,34 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
 {
        bool ret = false;
+        /* Using PCS we cannot dial with the phy registers at this stage
+         * so we do not support extra feature like EEE.
+         */
+        if ((priv->pcs == STMMAC_PCS_RGMII) || (priv->pcs == STMMAC_PCS_TBI) ||
+            (priv->pcs == STMMAC_PCS_RTBI))
+                goto out;
        /* MAC core supports the EEE feature. */
        if (priv->dma_cap.eee) {
                /* Check if the PHY supports EEE */
                if (phy_init_eee(priv->phydev, 1))
                        goto out;
-                priv->eee_active = 1;
+                if (!priv->eee_active) {
-                init_timer(&priv->eee_ctrl_timer);
+                        priv->eee_active = 1;
-                priv->eee_ctrl_timer.function = stmmac_eee_ctrl_timer;
+                        init_timer(&priv->eee_ctrl_timer);
-                priv->eee_ctrl_timer.data = (unsigned long)priv;
+                        priv->eee_ctrl_timer.function = stmmac_eee_ctrl_timer;
-                priv->eee_ctrl_timer.expires = STMMAC_LPI_TIMER(eee_timer);
+                        priv->eee_ctrl_timer.data = (unsigned long)priv;
-                add_timer(&priv->eee_ctrl_timer);
+                        priv->eee_ctrl_timer.expires = STMMAC_LPI_T(eee_timer);
+                        add_timer(&priv->eee_ctrl_timer);
-                priv->hw->mac->set_eee_timer(priv->ioaddr,
-                                             STMMAC_DEFAULT_LIT_LS_TIMER,
+                        priv->hw->mac->set_eee_timer(priv->ioaddr,
-                                             priv->tx_lpi_timer);
+                                                     STMMAC_DEFAULT_LIT_LS,
+                                                     priv->tx_lpi_timer);
+                } else
+                        /* Set HW EEE according to the speed */
+                        priv->hw->mac->set_eee_pls(priv->ioaddr,
+                                                   priv->phydev->link);
                pr_info("stmmac: Energy-Efficient Ethernet initialized\n");
@@ -301,20 +313,6 @@ out:
        return ret;
 }
-/**
- * stmmac_eee_adjust: adjust HW EEE according to the speed
- * @priv: driver private structure
- * Description:
- *      When the EEE has been already initialised we have to
- *      modify the PLS bit in the LPI ctrl & status reg according
- *      to the PHY link status. For this reason.
- */
-static void stmmac_eee_adjust(struct stmmac_priv *priv)
-{
-        if (priv->eee_enabled)
-                priv->hw->mac->set_eee_pls(priv->ioaddr, priv->phydev->link);
-}
 /* stmmac_get_tx_hwtstamp: get HW TX timestamps
 * @priv: driver private structure
 * @entry : descriptor index to be used.
@@ -738,7 +736,10 @@ static void stmmac_adjust_link(struct net_device *dev)
        if (new_state && netif_msg_link(priv))
                phy_print_status(phydev);
-        stmmac_eee_adjust(priv);
+        /* At this stage, it could be needed to setup the EEE or adjust some
+         * MAC related HW registers.
+         */
+        priv->eee_enabled = stmmac_eee_init(priv);
        spin_unlock_irqrestore(&priv->lock, flags);
 }
@@ -1250,7 +1251,7 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
        if ((priv->eee_enabled) && (!priv->tx_path_in_lpi_mode)) {
                stmmac_enable_eee_mode(priv);
-                mod_timer(&priv->eee_ctrl_timer, STMMAC_LPI_TIMER(eee_timer));
+                mod_timer(&priv->eee_ctrl_timer, STMMAC_LPI_T(eee_timer));
        }
        spin_unlock(&priv->tx_lock);
 }
@@ -1644,14 +1645,9 @@ static int stmmac_open(struct net_device *dev)
        if (priv->phydev)
                phy_start(priv->phydev);
-        priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS_TIMER;
+        priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
-        /* Using PCS we cannot dial with the phy registers at this stage
+        priv->eee_enabled = stmmac_eee_init(priv);
-         * so we do not support extra feature like EEE.
-         */
-        if (priv->pcs != STMMAC_PCS_RGMII && priv->pcs != STMMAC_PCS_TBI &&
-            priv->pcs != STMMAC_PCS_RTBI)
-                priv->eee_enabled = stmmac_eee_init(priv);
        stmmac_init_tx_coalesce(priv);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 2c3657adc7cb..ab48cef9e5a9 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1974,9 +1974,12 @@ static int cpsw_suspend(struct device *dev)
 {
        struct platform_device  *pdev = to_platform_device(dev);
        struct net_device       *ndev = platform_get_drvdata(pdev);
+        struct cpsw_priv        *priv = netdev_priv(ndev);
        if (netif_running(ndev))
                cpsw_ndo_stop(ndev);
+        soft_reset("sliver 0", &priv->slaves[0].sliver->soft_reset);
+        soft_reset("sliver 1", &priv->slaves[1].sliver->soft_reset);
        pm_runtime_put_sync(&pdev->dev);
        return 0;
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index a377bc727740..031ebc81b50c 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -706,6 +706,13 @@ int cpdma_chan_submit(struct cpdma_chan *chan, void *token, void *data,
        }
        buffer = dma_map_single(ctlr->dev, data, len, chan->dir);
+        ret = dma_mapping_error(ctlr->dev, buffer);
+        if (ret) {
+                cpdma_desc_free(ctlr->pool, desc, 1);
+                ret = -EINVAL;
+                goto unlock_ret;
+        }
        mode = CPDMA_DESC_OWNER | CPDMA_DESC_SOP | CPDMA_DESC_EOP;
        cpdma_desc_to_port(chan, mode, directed);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 5bfaecdd2354..f2c4a3b218fc 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -589,8 +589,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
                        return -EMSGSIZE;
                num_pages = get_user_pages_fast(base, size, 0, &page[i]);
                if (num_pages != size) {
-                        for (i = 0; i < num_pages; i++)
+                        int j;
-                                put_page(page[i]);
+                        for (j = 0; j < num_pages; j++)
+                                put_page(page[i + j]);
                        return -EFAULT;
                }
                truesize = size * PAGE_SIZE;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index cea2fe4e9812..7eab5fcd064f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1008,8 +1008,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
                        return -EMSGSIZE;
                num_pages = get_user_pages_fast(base, size, 0, &page[i]);
                if (num_pages != size) {
-                        for (i = 0; i < num_pages; i++)
+                        int j;
-                                put_page(page[i]);
+                        for (j = 0; j < num_pages; j++)
+                                put_page(page[i + j]);
                        return -EFAULT;
                }
                truesize = size * PAGE_SIZE;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index cdddb396e4f8..606eba2872bd 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -592,7 +592,13 @@ static const struct usb_device_id products[] = {
        {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)},    /* HP un2400 Gobi Modem Device */
        {QMI_GOBI1K_DEVICE(0x04da, 0x250d)},    /* Panasonic Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x413c, 0x8172)},    /* Dell Gobi Modem device */
-        {QMI_GOBI1K_DEVICE(0x1410, 0xa001)},    /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa001)},    /* Novatel/Verizon USB-1000 */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa002)},    /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa003)},    /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa004)},    /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa005)},    /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa006)},    /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa007)},    /* Novatel Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x0b05, 0x1776)},    /* Asus Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x19d2, 0xfff3)},    /* ONDA Gobi Modem device */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9001)},    /* Generic Gobi Modem device */
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 70ac59929f80..0d1c7592efa0 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -384,21 +384,37 @@ static int dlci_del(struct dlci_add *dlci)
        struct frad_local       *flp;
        struct net_device       *master, *slave;
        int                     err;
+        bool                    found = false;
+        rtnl_lock();
        /* validate slave device */
        master = __dev_get_by_name(&init_net, dlci->devname);
-        if (!master)
+        if (!master) {
-                return -ENODEV;
+                err = -ENODEV;
+                goto out;
+        }
+        list_for_each_entry(dlp, &dlci_devs, list) {
+                if (dlp->master == master) {
+                        found = true;
+                        break;
+                }
+        }
+        if (!found) {
+                err = -ENODEV;
+                goto out;
+        }
        if (netif_running(master)) {
-                return -EBUSY;
+                err = -EBUSY;
+                goto out;
        }
        dlp = netdev_priv(master);
        slave = dlp->slave;
        flp = netdev_priv(slave);
-        rtnl_lock();
        err = (*flp->deassoc)(slave, master);
        if (!err) {
                list_del(&dlp->list);
@@ -407,8 +423,8 @@ static int dlci_del(struct dlci_add *dlci)
                dev_put(slave);
        }
+out:
        rtnl_unlock();
        return err;
 }
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 9544cdc0d1af..e79e006eb9ab 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -811,6 +811,70 @@ int iosapic_fixup_irq(void *isi_obj, struct pci_dev *pcidev)
        return pcidev->irq;
 }
+static struct iosapic_info *first_isi = NULL;
+#ifdef CONFIG_64BIT
+int iosapic_serial_irq(int num)
+{
+        struct iosapic_info *isi = first_isi;
+        struct irt_entry *irte = NULL;  /* only used if PAT PDC */
+        struct vector_info *vi;
+        int isi_line;   /* line used by device */
+        /* lookup IRT entry for isi/slot/pin set */
+        irte = &irt_cell[num];
+        DBG_IRT("iosapic_serial_irq(): irte %p %x %x %x %x %x %x %x %x\n",
+                irte,
+                irte->entry_type,
+                irte->entry_length,
+                irte->polarity_trigger,
+                irte->src_bus_irq_devno,
+                irte->src_bus_id,
+                irte->src_seg_id,
+                irte->dest_iosapic_intin,
+                (u32) irte->dest_iosapic_addr);
+        isi_line = irte->dest_iosapic_intin;
+        /* get vector info for this input line */
+        vi = isi->isi_vector + isi_line;
+        DBG_IRT("iosapic_serial_irq:  line %d vi 0x%p\n", isi_line, vi);
+        /* If this IRQ line has already been setup, skip it */
+        if (vi->irte)
+                goto out;
+        vi->irte = irte;
+        /*
+         * Allocate processor IRQ
+         *
+         * XXX/FIXME The txn_alloc_irq() code and related code should be
+         * moved to enable_irq(). That way we only allocate processor IRQ
+         * bits for devices that actually have drivers claiming them.
+         * Right now we assign an IRQ to every PCI device present,
+         * regardless of whether it's used or not.
+         */
+        vi->txn_irq = txn_alloc_irq(8);
+        if (vi->txn_irq < 0)
+                panic("I/O sapic: couldn't get TXN IRQ\n");
+        /* enable_irq() will use txn_* to program IRdT */
+        vi->txn_addr = txn_alloc_addr(vi->txn_irq);
+        vi->txn_data = txn_alloc_data(vi->txn_irq);
+        vi->eoi_addr = isi->addr + IOSAPIC_REG_EOI;
+        vi->eoi_data = cpu_to_le32(vi->txn_data);
+        cpu_claim_irq(vi->txn_irq, &iosapic_interrupt_type, vi);
+ out:
+        return vi->txn_irq;
+}
+#endif
 /*
 ** squirrel away the I/O Sapic Version
@@ -877,6 +941,8 @@ void *iosapic_register(unsigned long hpa)
                vip->irqline = (unsigned char) cnt;
                vip->iosapic = isi;
        }
+        if (!first_isi)
+                first_isi = isi;
        return isi;
 }
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 716aa93fff76..59df8575a48c 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -61,6 +61,7 @@ static DEFINE_MUTEX(bridge_mutex);
 static void handle_hotplug_event_bridge (acpi_handle, u32, void *);
 static void acpiphp_sanitize_bus(struct pci_bus *bus);
 static void acpiphp_set_hpp_values(struct pci_bus *bus);
+static void hotplug_event_func(acpi_handle handle, u32 type, void *context);
 static void handle_hotplug_event_func(acpi_handle handle, u32 type, void *context);
 static void free_bridge(struct kref *kref);
@@ -147,7 +148,7 @@ static int post_dock_fixups(struct notifier_block *nb, unsigned long val,
 static const struct acpi_dock_ops acpiphp_dock_ops = {
-        .handler = handle_hotplug_event_func,
+        .handler = hotplug_event_func,
 };
 /* Check whether the PCI device is managed by native PCIe hotplug driver */
@@ -179,6 +180,20 @@ static bool device_is_managed_by_native_pciehp(struct pci_dev *pdev)
        return true;
 }
+static void acpiphp_dock_init(void *data)
+{
+        struct acpiphp_func *func = data;
+        get_bridge(func->slot->bridge);
+}
+static void acpiphp_dock_release(void *data)
+{
+        struct acpiphp_func *func = data;
+        put_bridge(func->slot->bridge);
+}
 /* callback routine to register each ACPI PCI slot object */
 static acpi_status
 register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
@@ -298,7 +313,8 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
                 */
                newfunc->flags &= ~FUNC_HAS_EJ0;
                if (register_hotplug_dock_device(handle,
-                        &acpiphp_dock_ops, newfunc))
+                        &acpiphp_dock_ops, newfunc,
+                        acpiphp_dock_init, acpiphp_dock_release))
                        dbg("failed to register dock device\n");
                /* we need to be notified when dock events happen
@@ -670,6 +686,7 @@ static int __ref enable_device(struct acpiphp_slot *slot)
        struct pci_bus *bus = slot->bridge->pci_bus;
        struct acpiphp_func *func;
        int num, max, pass;
+        LIST_HEAD(add_list);
        if (slot->flags & SLOT_ENABLED)
                goto err_exit;
@@ -694,13 +711,15 @@ static int __ref enable_device(struct acpiphp_slot *slot)
                                max = pci_scan_bridge(bus, dev, max, pass);
                                if (pass && dev->subordinate) {
                                        check_hotplug_bridge(slot, dev);
-                                        pci_bus_size_bridges(dev->subordinate);
+                                        pcibios_resource_survey_bus(dev->subordinate);
+                                        __pci_bus_size_bridges(dev->subordinate,
+                                                               &add_list);
                                }
                        }
                }
        }
-        pci_bus_assign_resources(bus);
+        __pci_bus_assign_resources(bus, &add_list, NULL);
        acpiphp_sanitize_bus(bus);
        acpiphp_set_hpp_values(bus);
        acpiphp_set_acpi_region(slot);
@@ -1065,22 +1084,12 @@ static void handle_hotplug_event_bridge(acpi_handle handle, u32 type,
        alloc_acpi_hp_work(handle, type, context, _handle_hotplug_event_bridge);
 }
-static void _handle_hotplug_event_func(struct work_struct *work)
+static void hotplug_event_func(acpi_handle handle, u32 type, void *context)
 {
-        struct acpiphp_func *func;
+        struct acpiphp_func *func = context;
        char objname[64];
        struct acpi_buffer buffer = { .length = sizeof(objname),
                                      .pointer = objname };
-        struct acpi_hp_work *hp_work;
-        acpi_handle handle;
-        u32 type;
-        hp_work = container_of(work, struct acpi_hp_work, work);
-        handle = hp_work->handle;
-        type = hp_work->type;
-        func = (struct acpiphp_func *)hp_work->context;
-        acpi_scan_lock_acquire();
        acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
@@ -1113,6 +1122,18 @@ static void _handle_hotplug_event_func(struct work_struct *work)
                warn("notify_handler: unknown event type 0x%x for %s\n", type, objname);
                break;
        }
+}
+static void _handle_hotplug_event_func(struct work_struct *work)
+{
+        struct acpi_hp_work *hp_work;
+        struct acpiphp_func *func;
+        hp_work = container_of(work, struct acpi_hp_work, work);
+        func = hp_work->context;
+        acpi_scan_lock_acquire();
+        hotplug_event_func(hp_work->handle, hp_work->type, func);
        acpi_scan_lock_release();
        kfree(hp_work); /* allocated in handle_hotplug_event_func */
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 68678ed76b0d..d1182c4a754e 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -202,6 +202,11 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                    struct resource *res, unsigned int reg);
 int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type);
 void pci_configure_ari(struct pci_dev *dev);
+void __ref __pci_bus_size_bridges(struct pci_bus *bus,
+                        struct list_head *realloc_head);
+void __ref __pci_bus_assign_resources(const struct pci_bus *bus,
+                                      struct list_head *realloc_head,
+                                      struct list_head *fail_head);
 /**
 * pci_ari_enabled - query ARI forwarding status
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 16abaaa1f83c..d254e2379533 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -1044,7 +1044,7 @@ handle_done:
        ;
 }
-static void __ref __pci_bus_size_bridges(struct pci_bus *bus,
+void __ref __pci_bus_size_bridges(struct pci_bus *bus,
                        struct list_head *realloc_head)
 {
        struct pci_dev *dev;
@@ -1115,9 +1115,9 @@ void __ref pci_bus_size_bridges(struct pci_bus *bus)
 }
 EXPORT_SYMBOL(pci_bus_size_bridges);
-static void __ref __pci_bus_assign_resources(const struct pci_bus *bus,
+void __ref __pci_bus_assign_resources(const struct pci_bus *bus,
-                                         struct list_head *realloc_head,
+                                      struct list_head *realloc_head,
-                                         struct list_head *fail_head)
+                                      struct list_head *fail_head)
 {
        struct pci_bus *b;
        struct pci_dev *dev;
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index d8fa37d5c734..2c9155b66f09 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -439,7 +439,7 @@ static int tps6586x_regulator_remove(struct platform_device *pdev)
 static struct platform_driver tps6586x_regulator_driver = {
        .driver = {
-                .name   = "tps6586x-pmic",
+                .name   = "tps6586x-regulator",
                .owner  = THIS_MODULE,
        },
        .probe          = tps6586x_regulator_probe,
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index ee721b6cbcdf..4a05d0427a9c 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -1656,9 +1656,12 @@ static int fcoe_xmit(struct fc_lport *lport, struct fc_frame *fp)
        if (fcoe->netdev->priv_flags & IFF_802_1Q_VLAN &&
            fcoe->realdev->features & NETIF_F_HW_VLAN_CTAG_TX) {
-                skb->vlan_tci = VLAN_TAG_PRESENT |
+                /* must set skb->dev before calling vlan_put_tag */
-                                vlan_dev_vlan_id(fcoe->netdev);
                skb->dev = fcoe->realdev;
+                skb = __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+                                             vlan_dev_vlan_id(fcoe->netdev));
+                if (!skb)
+                        return -ENOMEM;
        } else
                skb->dev = fcoe->netdev;
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index cd743c545ce9..795843dde8ec 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -1548,9 +1548,6 @@ static struct fcoe_fcf *fcoe_ctlr_select(struct fcoe_ctlr *fip)
 {
        struct fcoe_fcf *fcf;
        struct fcoe_fcf *best = fip->sel_fcf;
-        struct fcoe_fcf *first;
-        first = list_first_entry(&fip->fcfs, struct fcoe_fcf, list);
        list_for_each_entry(fcf, &fip->fcfs, list) {
                LIBFCOE_FIP_DBG(fip, "consider FCF fab %16.16llx "
@@ -1568,17 +1565,15 @@ static struct fcoe_fcf *fcoe_ctlr_select(struct fcoe_ctlr *fip)
                                        "" : "un");
                        continue;
                }
-                if (fcf->fabric_name != first->fabric_name ||
+                if (!best || fcf->pri < best->pri || best->flogi_sent)
-                    fcf->vfid != first->vfid ||
+                        best = fcf;
-                    fcf->fc_map != first->fc_map) {
+                if (fcf->fabric_name != best->fabric_name ||
+                    fcf->vfid != best->vfid ||
+                    fcf->fc_map != best->fc_map) {
                        LIBFCOE_FIP_DBG(fip, "Conflicting fabric, VFID, "
                                        "or FC-MAP\n");
                        return NULL;
                }
-                if (fcf->flogi_sent)
-                        continue;
-                if (!best || fcf->pri < best->pri || best->flogi_sent)
-                        best = fcf;
        }
        fip->sel_fcf = best;
        if (best) {
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 82a3c1ec8706..6c4cedb44c07 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -8980,19 +8980,6 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
        if (!ioa_cfg->res_entries)
                goto out;
-        if (ioa_cfg->sis64) {
-                ioa_cfg->target_ids = kzalloc(sizeof(unsigned long) *
-                                              BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
-                ioa_cfg->array_ids = kzalloc(sizeof(unsigned long) *
-                                             BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
-                ioa_cfg->vset_ids = kzalloc(sizeof(unsigned long) *
-                                            BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
-                if (!ioa_cfg->target_ids || !ioa_cfg->array_ids
-                        || !ioa_cfg->vset_ids)
-                        goto out_free_res_entries;
-        }
        for (i = 0; i < ioa_cfg->max_devs_supported; i++) {
                list_add_tail(&ioa_cfg->res_entries[i].queue, &ioa_cfg->free_res_q);
                ioa_cfg->res_entries[i].ioa_cfg = ioa_cfg;
@@ -9089,9 +9076,6 @@ out_free_vpd_cbs:
                            ioa_cfg->vpd_cbs, ioa_cfg->vpd_cbs_dma);
 out_free_res_entries:
        kfree(ioa_cfg->res_entries);
-        kfree(ioa_cfg->target_ids);
-        kfree(ioa_cfg->array_ids);
-        kfree(ioa_cfg->vset_ids);
        goto out;
 }
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index a1fb840596ef..07a85ce41782 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1440,9 +1440,9 @@ struct ipr_ioa_cfg {
        /*
         * Bitmaps for SIS64 generated target values
         */
-        unsigned long *target_ids;
+        unsigned long target_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
-        unsigned long *array_ids;
+        unsigned long array_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
-        unsigned long *vset_ids;
+        unsigned long vset_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
        u16 type; /* CCIN of the card */
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index c772d8d27159..8b928c67e4b9 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -463,13 +463,7 @@ static void fc_exch_delete(struct fc_exch *ep)
        fc_exch_release(ep);    /* drop hold for exch in mp */
 }
-/**
+static int fc_seq_send_locked(struct fc_lport *lport, struct fc_seq *sp,
- * fc_seq_send() - Send a frame using existing sequence/exchange pair
- * @lport: The local port that the exchange will be sent on
- * @sp:    The sequence to be sent
- * @fp:    The frame to be sent on the exchange
- */
-static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
                       struct fc_frame *fp)
 {
        struct fc_exch *ep;
@@ -479,7 +473,7 @@ static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
        u8 fh_type = fh->fh_type;
        ep = fc_seq_exch(sp);
-        WARN_ON((ep->esb_stat & ESB_ST_SEQ_INIT) != ESB_ST_SEQ_INIT);
+        WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT));
        f_ctl = ntoh24(fh->fh_f_ctl);
        fc_exch_setup_hdr(ep, fp, f_ctl);
@@ -502,17 +496,34 @@ static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
        error = lport->tt.frame_send(lport, fp);
        if (fh_type == FC_TYPE_BLS)
-                return error;
+                goto out;
        /*
         * Update the exchange and sequence flags,
         * assuming all frames for the sequence have been sent.
         * We can only be called to send once for each sequence.
         */
-        spin_lock_bh(&ep->ex_lock);
        ep->f_ctl = f_ctl & ~FC_FC_FIRST_SEQ;   /* not first seq */
        if (f_ctl & FC_FC_SEQ_INIT)
                ep->esb_stat &= ~ESB_ST_SEQ_INIT;
+out:
+        return error;
+}
+/**
+ * fc_seq_send() - Send a frame using existing sequence/exchange pair
+ * @lport: The local port that the exchange will be sent on
+ * @sp:    The sequence to be sent
+ * @fp:    The frame to be sent on the exchange
+ */
+static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
+                       struct fc_frame *fp)
+{
+        struct fc_exch *ep;
+        int error;
+        ep = fc_seq_exch(sp);
+        spin_lock_bh(&ep->ex_lock);
+        error = fc_seq_send_locked(lport, sp, fp);
        spin_unlock_bh(&ep->ex_lock);
        return error;
 }
@@ -629,7 +640,7 @@ static int fc_exch_abort_locked(struct fc_exch *ep,
        if (fp) {
                fc_fill_fc_hdr(fp, FC_RCTL_BA_ABTS, ep->did, ep->sid,
                               FC_TYPE_BLS, FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
-                error = fc_seq_send(ep->lp, sp, fp);
+                error = fc_seq_send_locked(ep->lp, sp, fp);
        } else
                error = -ENOBUFS;
        return error;
@@ -1132,7 +1143,7 @@ static void fc_seq_send_last(struct fc_seq *sp, struct fc_frame *fp,
        f_ctl = FC_FC_LAST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT;
        f_ctl |= ep->f_ctl;
        fc_fill_fc_hdr(fp, rctl, ep->did, ep->sid, fh_type, f_ctl, 0);
-        fc_seq_send(ep->lp, sp, fp);
+        fc_seq_send_locked(ep->lp, sp, fp);
 }
 /**
@@ -1307,8 +1318,8 @@ static void fc_exch_recv_abts(struct fc_exch *ep, struct fc_frame *rx_fp)
                ap->ba_low_seq_cnt = htons(sp->cnt);
        }
        sp = fc_seq_start_next_locked(sp);
-        spin_unlock_bh(&ep->ex_lock);
        fc_seq_send_last(sp, fp, FC_RCTL_BA_ACC, FC_TYPE_BLS);
+        spin_unlock_bh(&ep->ex_lock);
        fc_frame_free(rx_fp);
        return;
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index d518d17e940f..6bbb9447b75d 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -1962,7 +1962,7 @@ static int fc_rport_fcp_prli(struct fc_rport_priv *rdata, u32 spp_len,
                rdata->flags |= FC_RP_FLAGS_RETRY;
        rdata->supported_classes = FC_COS_CLASS3;
-        if (!(lport->service_params & FC_RPORT_ROLE_FCP_INITIATOR))
+        if (!(lport->service_params & FCP_SPPF_INIT_FCN))
                return 0;
        spp->spp_flags |= rspp->spp_flags & FC_SPP_EST_IMG_PAIR;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 98ab921070d2..0a5c8951cebb 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -278,3 +278,14 @@ qla2x00_do_host_ramp_up(scsi_qla_host_t *vha)
        set_bit(HOST_RAMP_UP_QUEUE_DEPTH, &vha->dpc_flags);
 }
+static inline void
+qla2x00_handle_mbx_completion(struct qla_hw_data *ha, int status)
+{
+        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
+            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
+                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
+                clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
+                complete(&ha->mbx_intr_comp);
+        }
+}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 259d9205d876..d2a4c75e5b8f 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -104,14 +104,9 @@ qla2100_intr_handler(int irq, void *dev_id)
                        RD_REG_WORD(&reg->hccr);
                }
        }
+        qla2x00_handle_mbx_completion(ha, status);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
-            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
-                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                complete(&ha->mbx_intr_comp);
-        }
        return (IRQ_HANDLED);
 }
@@ -221,14 +216,9 @@ qla2300_intr_handler(int irq, void *dev_id)
                WRT_REG_WORD(&reg->hccr, HCCR_CLR_RISC_INT);
                RD_REG_WORD_RELAXED(&reg->hccr);
        }
+        qla2x00_handle_mbx_completion(ha, status);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
-            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
-                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                complete(&ha->mbx_intr_comp);
-        }
        return (IRQ_HANDLED);
 }
@@ -2613,14 +2603,9 @@ qla24xx_intr_handler(int irq, void *dev_id)
                if (unlikely(IS_QLA83XX(ha) && (ha->pdev->revision == 1)))
                        ndelay(3500);
        }
+        qla2x00_handle_mbx_completion(ha, status);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
-            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
-                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                complete(&ha->mbx_intr_comp);
-        }
        return IRQ_HANDLED;
 }
@@ -2763,13 +2748,9 @@ qla24xx_msix_default(int irq, void *dev_id)
                }
                WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
        } while (0);
+        qla2x00_handle_mbx_completion(ha, status);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
-            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
-                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                complete(&ha->mbx_intr_comp);
-        }
        return IRQ_HANDLED;
 }
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 9e5d89db7272..3587ec267fa6 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -179,8 +179,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                wait_for_completion_timeout(&ha->mbx_intr_comp, mcp->tov * HZ);
-                clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
        } else {
                ql_dbg(ql_dbg_mbx, vha, 0x1011,
                    "Cmd=%x Polling Mode.\n", command);
diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
index 937fed8cb038..a6df55838365 100644
--- a/drivers/scsi/qla2xxx/qla_mr.c
+++ b/drivers/scsi/qla2xxx/qla_mr.c
@@ -148,9 +148,6 @@ qlafx00_mailbox_command(scsi_qla_host_t *vha, struct mbx_cmd_32 *mcp)
                spin_unlock_irqrestore(&ha->hardware_lock, flags);
                wait_for_completion_timeout(&ha->mbx_intr_comp, mcp->tov * HZ);
-                clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
        } else {
                ql_dbg(ql_dbg_mbx, vha, 0x112c,
                    "Cmd=%x Polling Mode.\n", command);
@@ -2934,13 +2931,10 @@ qlafx00_intr_handler(int irq, void *dev_id)
                QLAFX00_CLR_INTR_REG(ha, clr_intr);
                QLAFX00_RD_INTR_REG(ha);
        }
+        qla2x00_handle_mbx_completion(ha, status);
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
-            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
-                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                complete(&ha->mbx_intr_comp);
-        }
        return IRQ_HANDLED;
 }
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 10754f518303..cce0cd0d7ec4 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -2074,9 +2074,6 @@ qla82xx_intr_handler(int irq, void *dev_id)
                }
                WRT_REG_DWORD(&reg->host_int, 0);
        }
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (!ha->flags.msi_enabled)
-                qla82xx_wr_32(ha, ha->nx_legacy_intr.tgt_mask_reg, 0xfbff);
 #ifdef QL_DEBUG_LEVEL_17
        if (!irq && ha->flags.eeh_busy)
@@ -2085,11 +2082,12 @@ qla82xx_intr_handler(int irq, void *dev_id)
                    status, ha->mbx_cmd_flags, ha->flags.mbox_int, stat);
 #endif
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
+        qla2x00_handle_mbx_completion(ha, status);
-            (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-                set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                complete(&ha->mbx_intr_comp);
+        if (!ha->flags.msi_enabled)
-        }
+                qla82xx_wr_32(ha, ha->nx_legacy_intr.tgt_mask_reg, 0xfbff);
        return IRQ_HANDLED;
 }
@@ -2149,8 +2147,6 @@ qla82xx_msix_default(int irq, void *dev_id)
                WRT_REG_DWORD(&reg->host_int, 0);
        } while (0);
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 #ifdef QL_DEBUG_LEVEL_17
        if (!irq && ha->flags.eeh_busy)
                ql_log(ql_log_warn, vha, 0x5044,
@@ -2158,11 +2154,9 @@ qla82xx_msix_default(int irq, void *dev_id)
                    status, ha->mbx_cmd_flags, ha->flags.mbox_int, stat);
 #endif
-        if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
+        qla2x00_handle_mbx_completion(ha, status);
-                (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-                        set_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
-                        complete(&ha->mbx_intr_comp);
-        }
        return IRQ_HANDLED;
 }
@@ -3345,7 +3339,7 @@ void qla82xx_clear_pending_mbx(scsi_qla_host_t *vha)
                ha->flags.mbox_busy = 0;
                ql_log(ql_log_warn, vha, 0x6010,
                    "Doing premature completion of mbx command.\n");
-                if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags))
+                if (test_and_clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags))
                        complete(&ha->mbx_intr_comp);
        }
 }
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 7a3870f385f6..66b0b26a1381 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -688,8 +688,12 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
                 * For FCP_READ with CHECK_CONDITION status, clear cmd->bufflen
                 * for qla_tgt_xmit_response LLD code
                 */
+                if (se_cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
+                        se_cmd->se_cmd_flags &= ~SCF_OVERFLOW_BIT;
+                        se_cmd->residual_count = 0;
+                }
                se_cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
-                se_cmd->residual_count = se_cmd->data_length;
+                se_cmd->residual_count += se_cmd->data_length;
                cmd->bufflen = 0;
        }
diff --git a/drivers/spi/spi-pxa2xx-dma.c b/drivers/spi/spi-pxa2xx-dma.c
index c735c5a008a2..6427600b5bbe 100644
--- a/drivers/spi/spi-pxa2xx-dma.c
+++ b/drivers/spi/spi-pxa2xx-dma.c
@@ -59,7 +59,7 @@ static int pxa2xx_spi_map_dma_buffer(struct driver_data *drv_data,
                int ret;
                sg_free_table(sgt);
-                ret = sg_alloc_table(sgt, nents, GFP_KERNEL);
+                ret = sg_alloc_table(sgt, nents, GFP_ATOMIC);
                if (ret)
                        return ret;
        }
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index f5d84d6f8222..48b396fced0a 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1075,7 +1075,7 @@ pxa2xx_spi_acpi_get_pdata(struct platform_device *pdev)
            acpi_bus_get_device(ACPI_HANDLE(&pdev->dev), &adev))
                return NULL;
-        pdata = devm_kzalloc(&pdev->dev, sizeof(*ssp), GFP_KERNEL);
+        pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
        if (!pdata) {
                dev_err(&pdev->dev,
                        "failed to allocate memory for platform data\n");
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 5000586cb98d..71cc3e6ef47c 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -444,7 +444,7 @@ static int s3c64xx_spi_prepare_transfer(struct spi_master *spi)
        }
        ret = pm_runtime_get_sync(&sdd->pdev->dev);
-        if (ret != 0) {
+        if (ret < 0) {
                dev_err(dev, "Failed to enable device: %d\n", ret);
                goto out_tx;
        }
diff --git a/drivers/staging/media/davinci_vpfe/Kconfig b/drivers/staging/media/davinci_vpfe/Kconfig
index 2e4a28b018e8..12f321dd2399 100644
--- a/drivers/staging/media/davinci_vpfe/Kconfig
+++ b/drivers/staging/media/davinci_vpfe/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_DM365_VPFE
        tristate "DM365 VPFE Media Controller Capture Driver"
-        depends on VIDEO_V4L2 && ARCH_DAVINCI_DM365 && !VIDEO_VPFE_CAPTURE
+        depends on VIDEO_V4L2 && ARCH_DAVINCI_DM365 && !VIDEO_DM365_ISIF
        select VIDEOBUF2_DMA_CONTIG
        help
          Support for DM365 VPFE based Media Controller Capture driver.
diff --git a/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c b/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c
index b88e1ddce229..d8ce20d2fbda 100644
--- a/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c
+++ b/drivers/staging/media/davinci_vpfe/vpfe_mc_capture.c
@@ -639,7 +639,8 @@ static int vpfe_probe(struct platform_device *pdev)
        if (ret)
                goto probe_free_dev_mem;
-        if (vpfe_initialize_modules(vpfe_dev, pdev))
+        ret = vpfe_initialize_modules(vpfe_dev, pdev);
+        if (ret)
                goto probe_disable_clock;
        vpfe_dev->media_dev.dev = vpfe_dev->pdev;
@@ -663,7 +664,8 @@ static int vpfe_probe(struct platform_device *pdev)
        /* set the driver data in platform device */
        platform_set_drvdata(pdev, vpfe_dev);
        /* register subdevs/entities */
-        if (vpfe_register_entities(vpfe_dev))
+        ret = vpfe_register_entities(vpfe_dev);
+        if (ret)
                goto probe_out_v4l2_unregister;
        ret = vpfe_attach_irq(vpfe_dev);
diff --git a/drivers/staging/media/solo6x10/Kconfig b/drivers/staging/media/solo6x10/Kconfig
index df6569b997b8..34f3b6d02d2a 100644
--- a/drivers/staging/media/solo6x10/Kconfig
+++ b/drivers/staging/media/solo6x10/Kconfig
@@ -5,6 +5,7 @@ config SOLO6X10
        select VIDEOBUF2_DMA_SG
        select VIDEOBUF2_DMA_CONTIG
        select SND_PCM
+        select FONT_8x16
        ---help---
          This driver supports the Softlogic based MPEG-4 and h.264 codec
          cards.
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index 13e9e715ad2e..8d8b3ff68490 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -155,7 +155,7 @@ static ssize_t lio_target_np_store_iser(
        struct iscsi_tpg_np *tpg_np_iser = NULL;
        char *endptr;
        u32 op;
-        int rc;
+        int rc = 0;
        op = simple_strtoul(page, &endptr, 0);
        if ((op != 1) && (op != 0)) {
@@ -174,31 +174,32 @@ static ssize_t lio_target_np_store_iser(
                return -EINVAL;
        if (op) {
-                int rc = request_module("ib_isert");
+                rc = request_module("ib_isert");
-                if (rc != 0)
+                if (rc != 0) {
                        pr_warn("Unable to request_module for ib_isert\n");
+                        rc = 0;
+                }
                tpg_np_iser = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
                                np->np_ip, tpg_np, ISCSI_INFINIBAND);
-                if (!tpg_np_iser || IS_ERR(tpg_np_iser))
+                if (IS_ERR(tpg_np_iser)) {
+                        rc = PTR_ERR(tpg_np_iser);
                        goto out;
+                }
        } else {
                tpg_np_iser = iscsit_tpg_locate_child_np(tpg_np, ISCSI_INFINIBAND);
-                if (!tpg_np_iser)
+                if (tpg_np_iser) {
-                        goto out;
+                        rc = iscsit_tpg_del_network_portal(tpg, tpg_np_iser);
+                        if (rc < 0)
-                rc = iscsit_tpg_del_network_portal(tpg, tpg_np_iser);
+                                goto out;
-                if (rc < 0)
+                }
-                        goto out;
        }
-        printk("lio_target_np_store_iser() done, op: %d\n", op);
        iscsit_put_tpg(tpg);
        return count;
 out:
        iscsit_put_tpg(tpg);
-        return -EINVAL;
+        return rc;
 }
 TF_NP_BASE_ATTR(lio_target, iser, S_IRUGO | S_IWUSR);
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 8e6298cc8839..dcb199da06b9 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -842,11 +842,11 @@ int iscsit_stop_time2retain_timer(struct iscsi_session *sess)
                return 0;
        sess->time2retain_timer_flags |= ISCSI_TF_STOP;
-        spin_unlock_bh(&se_tpg->session_lock);
+        spin_unlock(&se_tpg->session_lock);
        del_timer_sync(&sess->time2retain_timer);
-        spin_lock_bh(&se_tpg->session_lock);
+        spin_lock(&se_tpg->session_lock);
        sess->time2retain_timer_flags &= ~ISCSI_TF_RUNNING;
        pr_debug("Stopped Time2Retain Timer for SID: %u\n",
                        sess->sid);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index bb5d5c5bce65..3402241be87c 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -984,8 +984,6 @@ int iscsi_target_setup_login_socket(
        }
        np->np_transport = t;
-        printk("Set np->np_transport to %p -> %s\n", np->np_transport,
-                                np->np_transport->name);
        return 0;
 }
@@ -1002,7 +1000,6 @@ int iscsit_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
        conn->sock = new_sock;
        conn->login_family = np->np_sockaddr.ss_family;
-        printk("iSCSI/TCP: Setup conn->sock from new_sock: %p\n", new_sock);
        if (np->np_sockaddr.ss_family == AF_INET6) {
                memset(&sock_in6, 0, sizeof(struct sockaddr_in6));
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 7ad912060e21..cd5018ff9cd7 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -721,9 +721,6 @@ int iscsi_target_locate_portal(
                start += strlen(key) + strlen(value) + 2;
        }
-        printk("i_buf: %s, s_buf: %s, t_buf: %s\n", i_buf, s_buf, t_buf);
        /*
         * See 5.3.  Login Phase.
         */
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 59bfaecc4e14..abfd99089781 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -244,14 +244,9 @@ static void pty_flush_buffer(struct tty_struct *tty)
 static int pty_open(struct tty_struct *tty, struct file *filp)
 {
-        int     retval = -ENODEV;
        if (!tty || !tty->link)
-                goto out;
+                return -ENODEV;
-        set_bit(TTY_IO_ERROR, &tty->flags);
-        retval = -EIO;
        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
                goto out;
        if (test_bit(TTY_PTY_LOCK, &tty->link->flags))
@@ -262,9 +257,11 @@ static int pty_open(struct tty_struct *tty, struct file *filp)
        clear_bit(TTY_IO_ERROR, &tty->flags);
        clear_bit(TTY_OTHER_CLOSED, &tty->link->flags);
        set_bit(TTY_THROTTLED, &tty->flags);
-        retval = 0;
+        return 0;
 out:
-        return retval;
+        set_bit(TTY_IO_ERROR, &tty->flags);
+        return -EIO;
 }
 static void pty_set_termios(struct tty_struct *tty,
diff --git a/drivers/tty/serial/8250/8250_gsc.c b/drivers/tty/serial/8250/8250_gsc.c
index 097dff9c08ad..bb91b4713ebd 100644
--- a/drivers/tty/serial/8250/8250_gsc.c
+++ b/drivers/tty/serial/8250/8250_gsc.c
@@ -30,6 +30,12 @@ static int __init serial_init_chip(struct parisc_device *dev)
        unsigned long address;
        int err;
+#ifdef CONFIG_64BIT
+        extern int iosapic_serial_irq(int cellnum);
+        if (!dev->irq && (dev->id.sversion == 0xad))
+                dev->irq = iosapic_serial_irq(dev->mod_index-1);
+#endif
        if (!dev->irq) {
                /* We find some unattached serial ports by walking native
                 * busses.  These should be silently ignored.  Otherwise,
@@ -51,7 +57,8 @@ static int __init serial_init_chip(struct parisc_device *dev)
        memset(&uart, 0, sizeof(uart));
        uart.port.iotype        = UPIO_MEM;
        /* 7.272727MHz on Lasi.  Assumed the same for Dino, Wax and Timi. */
-        uart.port.uartclk       = 7272727;
+        uart.port.uartclk       = (dev->id.sversion != 0xad) ?
+                                        7272727 : 1843200;
        uart.port.mapbase       = address;
        uart.port.membase       = ioremap_nocache(address, 16);
        uart.port.irq   = dev->irq;
@@ -73,6 +80,7 @@ static struct parisc_device_id serial_tbl[] = {
        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x00075 },
        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x0008c },
        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x0008d },
+        { HPHW_FIO, HVERSION_REV_ANY_ID, HVERSION_ANY_ID, 0x000ad },
        { 0 }
 };
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index fc2c06c66e89..2bd78e2ac8ec 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -289,13 +289,10 @@ static int vt_disallocate(unsigned int vc_num)
        struct vc_data *vc = NULL;
        int ret = 0;
-        if (!vc_num)
-                return 0;
        console_lock();
        if (VT_BUSY(vc_num))
                ret = -EBUSY;
-        else
+        else if (vc_num)
                vc = vc_deallocate(vc_num);
        console_unlock();
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 7ef3eb8617a6..2311b1e4e43c 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -4,11 +4,17 @@
 menuconfig USB_PHY
        bool "USB Physical Layer drivers"
        help
-          USB controllers (those which are host, device or DRD) need a
+          Most USB controllers have the physical layer signalling part
-          device to handle the physical layer signalling, commonly called
+          (commonly called a PHY) built in.  However, dual-role devices
-          a PHY.
+          (a.k.a. USB on-the-go) which support being USB master or slave
+          with the same connector often use an external PHY.
-          The following drivers add support for such PHY devices.
+          The drivers in this submenu add support for such PHY devices.
+          They are not needed for standard master-only (or the vast
+          majority of slave-only) USB interfaces.
+          If you're not sure if this applies to you, it probably doesn't;
+          say N here.
 if USB_PHY
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index c92c5ed4e580..e581c2549a57 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -172,7 +172,8 @@ static struct usb_device_id ti_id_table_3410[15+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
-        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STEREO_PLUG_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
 };
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index b353e7e3d480..4a2423e84d55 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -52,7 +52,9 @@
 /* Abbott Diabetics vendor and product ids */
 #define ABBOTT_VENDOR_ID                0x1a61
-#define ABBOTT_PRODUCT_ID               0x3410
+#define ABBOTT_STEREO_PLUG_ID           0x3410
+#define ABBOTT_PRODUCT_ID               ABBOTT_STEREO_PLUG_ID
+#define ABBOTT_STRIP_PORT_ID            0x3420
 /* Commands */
 #define TI_GET_VERSION                  0x01
diff --git a/fs/exec.c b/fs/exec.c
index 643019585574..ffd7a813ad3d 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1135,13 +1135,6 @@ void setup_new_exec(struct linux_binprm * bprm)
                        set_dumpable(current->mm, suid_dumpable);
        }
-        /*
-         * Flush performance counters when crossing a
-         * security domain:
-         */
-        if (!get_dumpable(current->mm))
-                perf_event_exit_task(current);
        /* An exec changes our domain. We are no longer part of the thread
           group */
@@ -1205,6 +1198,15 @@ void install_exec_creds(struct linux_binprm *bprm)
        commit_creds(bprm->cred);
        bprm->cred = NULL;
+        /*
+         * Disable monitoring for regular users
+         * when executing setuid binaries. Must
+         * wait until new credentials are committed
+         * by commit_creds() above
+         */
+        if (get_dumpable(current->mm) != SUID_DUMP_USER)
+                perf_event_exit_task(current);
        /*
         * cred_guard_mutex must be held at least to this point to prevent
         * ptrace_attach() from altering our determination of the task's
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index e570081f9f76..35f281033142 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2470,13 +2470,16 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
                .mode = mode
        };
        int err;
+        bool lock_inode = !(mode & FALLOC_FL_KEEP_SIZE) ||
+                           (mode & FALLOC_FL_PUNCH_HOLE);
        if (fc->no_fallocate)
                return -EOPNOTSUPP;
-        if (mode & FALLOC_FL_PUNCH_HOLE) {
+        if (lock_inode) {
                mutex_lock(&inode->i_mutex);
-                fuse_set_nowrite(inode);
+                if (mode & FALLOC_FL_PUNCH_HOLE)
+                        fuse_set_nowrite(inode);
        }
        req = fuse_get_req_nopages(fc);
@@ -2511,8 +2514,9 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
        fuse_invalidate_attr(inode);
 out:
-        if (mode & FALLOC_FL_PUNCH_HOLE) {
+        if (lock_inode) {
-                fuse_release_nowrite(inode);
+                if (mode & FALLOC_FL_PUNCH_HOLE)
+                        fuse_release_nowrite(inode);
                mutex_unlock(&inode->i_mutex);
        }
diff --git a/fs/internal.h b/fs/internal.h
index eaa75f75b625..68121584ae37 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -132,6 +132,12 @@ extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
 extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
 /*
+ * splice.c
+ */
+extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
+                loff_t *opos, size_t len, unsigned int flags);
+/*
 * pipe.c
 */
 extern const struct file_operations pipefifo_fops;
diff --git a/fs/read_write.c b/fs/read_write.c
index 03430008704e..2cefa417be34 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1064,6 +1064,7 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
        struct fd in, out;
        struct inode *in_inode, *out_inode;
        loff_t pos;
+        loff_t out_pos;
        ssize_t retval;
        int fl;
@@ -1077,12 +1078,14 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
        if (!(in.file->f_mode & FMODE_READ))
                goto fput_in;
        retval = -ESPIPE;
-        if (!ppos)
+        if (!ppos) {
-                ppos = &in.file->f_pos;
+                pos = in.file->f_pos;
-        else
+        } else {
+                pos = *ppos;
                if (!(in.file->f_mode & FMODE_PREAD))
                        goto fput_in;
-        retval = rw_verify_area(READ, in.file, ppos, count);
+        }
+        retval = rw_verify_area(READ, in.file, &pos, count);
        if (retval < 0)
                goto fput_in;
        count = retval;
@@ -1099,7 +1102,8 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
        retval = -EINVAL;
        in_inode = file_inode(in.file);
        out_inode = file_inode(out.file);
-        retval = rw_verify_area(WRITE, out.file, &out.file->f_pos, count);
+        out_pos = out.file->f_pos;
+        retval = rw_verify_area(WRITE, out.file, &out_pos, count);
        if (retval < 0)
                goto fput_out;
        count = retval;
@@ -1107,7 +1111,6 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
        if (!max)
                max = min(in_inode->i_sb->s_maxbytes, out_inode->i_sb->s_maxbytes);
-        pos = *ppos;
        if (unlikely(pos + count > max)) {
                retval = -EOVERFLOW;
                if (pos >= max)
@@ -1126,18 +1129,23 @@ static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos,
        if (in.file->f_flags & O_NONBLOCK)
                fl = SPLICE_F_NONBLOCK;
 #endif
-        retval = do_splice_direct(in.file, ppos, out.file, count, fl);
+        retval = do_splice_direct(in.file, &pos, out.file, &out_pos, count, fl);
        if (retval > 0) {
                add_rchar(current, retval);
                add_wchar(current, retval);
                fsnotify_access(in.file);
                fsnotify_modify(out.file);
+                out.file->f_pos = out_pos;
+                if (ppos)
+                        *ppos = pos;
+                else
+                        in.file->f_pos = pos;
        }
        inc_syscr(current);
        inc_syscw(current);
-        if (*ppos > max)
+        if (pos > max)
                retval = -EOVERFLOW;
 fput_out:
diff --git a/fs/splice.c b/fs/splice.c
index e6b25598c8c4..d37431dd60a1 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1274,7 +1274,7 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
 {
        struct file *file = sd->u.file;
-        return do_splice_from(pipe, file, &file->f_pos, sd->total_len,
+        return do_splice_from(pipe, file, sd->opos, sd->total_len,
                              sd->flags);
 }
@@ -1283,6 +1283,7 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
 * @in:         file to splice from
 * @ppos:       input file offset
 * @out:        file to splice to
+ * @opos:       output file offset
 * @len:        number of bytes to splice
 * @flags:      splice modifier flags
 *
@@ -1294,7 +1295,7 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
 *
 */
 long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
-                      size_t len, unsigned int flags)
+                      loff_t *opos, size_t len, unsigned int flags)
 {
        struct splice_desc sd = {
                .len            = len,
@@ -1302,6 +1303,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
                .flags          = flags,
                .pos            = *ppos,
                .u.file         = out,
+                .opos           = opos,
        };
        long ret;
@@ -1325,7 +1327,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
 {
        struct pipe_inode_info *ipipe;
        struct pipe_inode_info *opipe;
-        loff_t offset, *off;
+        loff_t offset;
        long ret;
        ipipe = get_pipe_info(in);
@@ -1356,13 +1358,15 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                                return -EINVAL;
                        if (copy_from_user(&offset, off_out, sizeof(loff_t)))
                                return -EFAULT;
-                        off = &offset;
+                } else {
-                } else
+                        offset = out->f_pos;
-                        off = &out->f_pos;
+                }
-                ret = do_splice_from(ipipe, out, off, len, flags);
+                ret = do_splice_from(ipipe, out, &offset, len, flags);
-                if (off_out && copy_to_user(off_out, off, sizeof(loff_t)))
+                if (!off_out)
+                        out->f_pos = offset;
+                else if (copy_to_user(off_out, &offset, sizeof(loff_t)))
                        ret = -EFAULT;
                return ret;
@@ -1376,13 +1380,15 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                                return -EINVAL;
                        if (copy_from_user(&offset, off_in, sizeof(loff_t)))
                                return -EFAULT;
-                        off = &offset;
+                } else {
-                } else
+                        offset = in->f_pos;
-                        off = &in->f_pos;
+                }
-                ret = do_splice_to(in, off, opipe, len, flags);
+                ret = do_splice_to(in, &offset, opipe, len, flags);
-                if (off_in && copy_to_user(off_in, off, sizeof(loff_t)))
+                if (!off_in)
+                        in->f_pos = offset;
+                else if (copy_to_user(off_in, &offset, sizeof(loff_t)))
                        ret = -EFAULT;
                return ret;
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index de08c92f2e23..605af512aec2 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -349,31 +349,50 @@ static unsigned int vfs_dent_type(uint8_t type)
 static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
 {
        int err, over = 0;
+        loff_t pos = file->f_pos;
        struct qstr nm;
        union ubifs_key key;
        struct ubifs_dent_node *dent;
        struct inode *dir = file_inode(file);
        struct ubifs_info *c = dir->i_sb->s_fs_info;
-        dbg_gen("dir ino %lu, f_pos %#llx", dir->i_ino, file->f_pos);
+        dbg_gen("dir ino %lu, f_pos %#llx", dir->i_ino, pos);
-        if (file->f_pos > UBIFS_S_KEY_HASH_MASK || file->f_pos == 2)
+        if (pos > UBIFS_S_KEY_HASH_MASK || pos == 2)
                /*
                 * The directory was seek'ed to a senseless position or there
                 * are no more entries.
                 */
                return 0;
+        if (file->f_version == 0) {
+                /*
+                 * The file was seek'ed, which means that @file->private_data
+                 * is now invalid. This may also be just the first
+                 * 'ubifs_readdir()' invocation, in which case
+                 * @file->private_data is NULL, and the below code is
+                 * basically a no-op.
+                 */
+                kfree(file->private_data);
+                file->private_data = NULL;
+        }
+        /*
+         * 'generic_file_llseek()' unconditionally sets @file->f_version to
+         * zero, and we use this for detecting whether the file was seek'ed.
+         */
+        file->f_version = 1;
        /* File positions 0 and 1 correspond to "." and ".." */
-        if (file->f_pos == 0) {
+        if (pos == 0) {
                ubifs_assert(!file->private_data);
                over = filldir(dirent, ".", 1, 0, dir->i_ino, DT_DIR);
                if (over)
                        return 0;
-                file->f_pos = 1;
+                file->f_pos = pos = 1;
        }
-        if (file->f_pos == 1) {
+        if (pos == 1) {
                ubifs_assert(!file->private_data);
                over = filldir(dirent, "..", 2, 1,
                               parent_ino(file->f_path.dentry), DT_DIR);
@@ -389,7 +408,7 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
                        goto out;
                }
-                file->f_pos = key_hash_flash(c, &dent->key);
+                file->f_pos = pos = key_hash_flash(c, &dent->key);
                file->private_data = dent;
        }
@@ -397,17 +416,16 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
        if (!dent) {
                /*
                 * The directory was seek'ed to and is now readdir'ed.
-                 * Find the entry corresponding to @file->f_pos or the
+                 * Find the entry corresponding to @pos or the closest one.
-                 * closest one.
                 */
-                dent_key_init_hash(c, &key, dir->i_ino, file->f_pos);
+                dent_key_init_hash(c, &key, dir->i_ino, pos);
                nm.name = NULL;
                dent = ubifs_tnc_next_ent(c, &key, &nm);
                if (IS_ERR(dent)) {
                        err = PTR_ERR(dent);
                        goto out;
                }
-                file->f_pos = key_hash_flash(c, &dent->key);
+                file->f_pos = pos = key_hash_flash(c, &dent->key);
                file->private_data = dent;
        }
@@ -419,7 +437,7 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
                             ubifs_inode(dir)->creat_sqnum);
                nm.len = le16_to_cpu(dent->nlen);
-                over = filldir(dirent, dent->name, nm.len, file->f_pos,
+                over = filldir(dirent, dent->name, nm.len, pos,
                               le64_to_cpu(dent->inum),
                               vfs_dent_type(dent->type));
                if (over)
@@ -435,9 +453,17 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
                }
                kfree(file->private_data);
-                file->f_pos = key_hash_flash(c, &dent->key);
+                file->f_pos = pos = key_hash_flash(c, &dent->key);
                file->private_data = dent;
                cond_resched();
+                if (file->f_version == 0)
+                        /*
+                         * The file was seek'ed meanwhile, lets return and start
+                         * reading direntries from the new position on the next
+                         * invocation.
+                         */
+                        return 0;
        }
 out:
@@ -448,15 +474,13 @@ out:
        kfree(file->private_data);
        file->private_data = NULL;
+        /* 2 is a special value indicating that there are no more direntries */
        file->f_pos = 2;
        return 0;
 }
-/* If a directory is seeked, we have to free saved readdir() state */
 static loff_t ubifs_dir_llseek(struct file *file, loff_t offset, int whence)
 {
-        kfree(file->private_data);
-        file->private_data = NULL;
        return generic_file_llseek(file, offset, whence);
 }
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 636c59f2003a..c13c919ab99e 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -382,6 +382,7 @@ const char *acpi_power_state_string(int state);
 int acpi_device_get_power(struct acpi_device *device, int *state);
 int acpi_device_set_power(struct acpi_device *device, int state);
 int acpi_bus_init_power(struct acpi_device *device);
+int acpi_device_fix_up_power(struct acpi_device *device);
 int acpi_bus_update_power(acpi_handle handle, int *state_p);
 bool acpi_bus_power_manageable(acpi_handle handle);
diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
index e6168a24b9f0..b420939f5eb5 100644
--- a/include/acpi/acpi_drivers.h
+++ b/include/acpi/acpi_drivers.h
@@ -123,7 +123,9 @@ extern int register_dock_notifier(struct notifier_block *nb);
 extern void unregister_dock_notifier(struct notifier_block *nb);
 extern int register_hotplug_dock_device(acpi_handle handle,
                                        const struct acpi_dock_ops *ops,
-                                        void *context);
+                                        void *context,
+                                        void (*init)(void *),
+                                        void (*release)(void *));
 extern void unregister_hotplug_dock_device(acpi_handle handle);
 #else
 static inline int is_dock_device(acpi_handle handle)
@@ -139,7 +141,9 @@ static inline void unregister_dock_notifier(struct notifier_block *nb)
 }
 static inline int register_hotplug_dock_device(acpi_handle handle,
                                               const struct acpi_dock_ops *ops,
-                                               void *context)
+                                               void *context,
+                                               void (*init)(void *),
+                                               void (*release)(void *))
 {
        return -ENODEV;
 }
diff --git a/include/linux/context_tracking.h b/include/linux/context_tracking.h
index 365f4a61bf04..fc09d7b0dacf 100644
--- a/include/linux/context_tracking.h
+++ b/include/linux/context_tracking.h
@@ -3,6 +3,7 @@
 #include <linux/sched.h>
 #include <linux/percpu.h>
+#include <linux/vtime.h>
 #include <asm/ptrace.h>
 struct context_tracking {
@@ -19,6 +20,26 @@ struct context_tracking {
        } state;
 };
+static inline void __guest_enter(void)
+{
+        /*
+         * This is running in ioctl context so we can avoid
+         * the call to vtime_account() with its unnecessary idle check.
+         */
+        vtime_account_system(current);
+        current->flags |= PF_VCPU;
+}
+static inline void __guest_exit(void)
+{
+        /*
+         * This is running in ioctl context so we can avoid
+         * the call to vtime_account() with its unnecessary idle check.
+         */
+        vtime_account_system(current);
+        current->flags &= ~PF_VCPU;
+}
 #ifdef CONFIG_CONTEXT_TRACKING
 DECLARE_PER_CPU(struct context_tracking, context_tracking);
@@ -35,6 +56,9 @@ static inline bool context_tracking_active(void)
 extern void user_enter(void);
 extern void user_exit(void);
+extern void guest_enter(void);
+extern void guest_exit(void);
 static inline enum ctx_state exception_enter(void)
 {
        enum ctx_state prev_ctx;
@@ -57,6 +81,17 @@ extern void context_tracking_task_switch(struct task_struct *prev,
 static inline bool context_tracking_in_user(void) { return false; }
 static inline void user_enter(void) { }
 static inline void user_exit(void) { }
+static inline void guest_enter(void)
+{
+        __guest_enter();
+}
+static inline void guest_exit(void)
+{
+        __guest_exit();
+}
 static inline enum ctx_state exception_enter(void) { return 0; }
 static inline void exception_exit(enum ctx_state prev_ctx) { }
 static inline void context_tracking_task_switch(struct task_struct *prev,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 43db02e9c9fa..65c2be22b601 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2414,8 +2414,6 @@ extern ssize_t generic_file_splice_write(struct pipe_inode_info *,
                struct file *, loff_t *, size_t, unsigned int);
 extern ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe,
                struct file *out, loff_t *, size_t len, unsigned int flags);
-extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
-                size_t len, unsigned int flags);
 extern void
 file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping);
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 7a9c8cf31659..cdcbafa9b39a 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -44,7 +44,7 @@ struct vlan_hdr {
 *      struct vlan_ethhdr - vlan ethernet header (ethhdr + vlan_hdr)
 *      @h_dest: destination ethernet address
 *      @h_source: source ethernet address
- *      @h_vlan_proto: ethernet protocol (always 0x8100)
+ *      @h_vlan_proto: ethernet protocol
 *      @h_vlan_TCI: priority and VLAN ID
 *      @h_vlan_encapsulated_proto: packet type ID or len
 */
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index f0eea07d2c2b..8db53cfaccdb 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -23,6 +23,7 @@
 #include <linux/ratelimit.h>
 #include <linux/err.h>
 #include <linux/irqflags.h>
+#include <linux/context_tracking.h>
 #include <asm/signal.h>
 #include <linux/kvm.h>
@@ -760,42 +761,6 @@ static inline int kvm_iommu_unmap_guest(struct kvm *kvm)
 }
 #endif
-static inline void __guest_enter(void)
-{
-        /*
-         * This is running in ioctl context so we can avoid
-         * the call to vtime_account() with its unnecessary idle check.
-         */
-        vtime_account_system(current);
-        current->flags |= PF_VCPU;
-}
-static inline void __guest_exit(void)
-{
-        /*
-         * This is running in ioctl context so we can avoid
-         * the call to vtime_account() with its unnecessary idle check.
-         */
-        vtime_account_system(current);
-        current->flags &= ~PF_VCPU;
-}
-#ifdef CONFIG_CONTEXT_TRACKING
-extern void guest_enter(void);
-extern void guest_exit(void);
-#else /* !CONFIG_CONTEXT_TRACKING */
-static inline void guest_enter(void)
-{
-        __guest_enter();
-}
-static inline void guest_exit(void)
-{
-        __guest_exit();
-}
-#endif /* !CONFIG_CONTEXT_TRACKING */
 static inline void kvm_guest_enter(void)
 {
        unsigned long flags;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 09b4188c1ea7..bb82871b8494 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1759,6 +1759,7 @@ extern int		init_dummy_netdev(struct net_device *dev);
 extern struct net_device        *dev_get_by_index(struct net *net, int ifindex);
 extern struct net_device        *__dev_get_by_index(struct net *net, int ifindex);
 extern struct net_device        *dev_get_by_index_rcu(struct net *net, int ifindex);
+extern int              netdev_get_name(struct net *net, char *name, int ifindex);
 extern int              dev_restart(struct net_device *dev);
 #ifdef CONFIG_NETPOLL_TRAP
 extern int              netpoll_trap(void);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index f463a46424e2..c5b6dbf9c2fc 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -389,8 +389,7 @@ struct perf_event {
        /* mmap bits */
        struct mutex                    mmap_mutex;
        atomic_t                        mmap_count;
-        int                             mmap_locked;
-        struct user_struct              *mmap_user;
        struct ring_buffer              *rb;
        struct list_head                rb_entry;
diff --git a/include/linux/preempt.h b/include/linux/preempt.h
index 87a03c746f17..f5d4723cdb3d 100644
--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -33,9 +33,25 @@ do { \
                preempt_schedule(); \
 } while (0)
+#ifdef CONFIG_CONTEXT_TRACKING
+void preempt_schedule_context(void);
+#define preempt_check_resched_context() \
+do { \
+        if (unlikely(test_thread_flag(TIF_NEED_RESCHED))) \
+                preempt_schedule_context(); \
+} while (0)
+#else
+#define preempt_check_resched_context() preempt_check_resched()
+#endif /* CONFIG_CONTEXT_TRACKING */
 #else /* !CONFIG_PREEMPT */
 #define preempt_check_resched()         do { } while (0)
+#define preempt_check_resched_context() do { } while (0)
 #endif /* CONFIG_PREEMPT */
@@ -88,7 +104,7 @@ do { \
 do { \
        preempt_enable_no_resched_notrace(); \
        barrier(); \
-        preempt_check_resched(); \
+        preempt_check_resched_context(); \
 } while (0)
 #else /* !CONFIG_PREEMPT_COUNT */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6b06023e8a08..5afefa01a13c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -635,6 +635,7 @@ static inline struct rtable *skb_rtable(const struct sk_buff *skb)
 }
 extern void kfree_skb(struct sk_buff *skb);
+extern void kfree_skb_list(struct sk_buff *segs);
 extern void skb_tx_error(struct sk_buff *skb);
 extern void consume_skb(struct sk_buff *skb);
 extern void            __kfree_skb(struct sk_buff *skb);
diff --git a/include/linux/splice.h b/include/linux/splice.h
index 09a545a7dfa3..74575cbf2d6f 100644
--- a/include/linux/splice.h
+++ b/include/linux/splice.h
@@ -35,6 +35,7 @@ struct splice_desc {
                void *data;             /* cookie */
        } u;
        loff_t pos;                     /* file position */
+        loff_t *opos;                   /* sendfile: output position */
        size_t num_spliced;             /* number of bytes already spliced */
        bool need_wakeup;               /* need to wake up writer */
 };
diff --git a/include/linux/vtime.h b/include/linux/vtime.h
index 71a5782d8c59..b1dd2db80076 100644
--- a/include/linux/vtime.h
+++ b/include/linux/vtime.h
@@ -34,7 +34,7 @@ static inline void vtime_user_exit(struct task_struct *tsk)
 }
 extern void vtime_guest_enter(struct task_struct *tsk);
 extern void vtime_guest_exit(struct task_struct *tsk);
-extern void vtime_init_idle(struct task_struct *tsk);
+extern void vtime_init_idle(struct task_struct *tsk, int cpu);
 #else
 static inline void vtime_account_irq_exit(struct task_struct *tsk)
 {
@@ -45,7 +45,7 @@ static inline void vtime_user_enter(struct task_struct *tsk) { }
 static inline void vtime_user_exit(struct task_struct *tsk) { }
 static inline void vtime_guest_enter(struct task_struct *tsk) { }
 static inline void vtime_guest_exit(struct task_struct *tsk) { }
-static inline void vtime_init_idle(struct task_struct *tsk) { }
+static inline void vtime_init_idle(struct task_struct *tsk, int cpu) { }
 #endif
 #ifdef CONFIG_IRQ_TIME_ACCOUNTING
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index d3eef01da648..0f4555b2a31b 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -110,6 +110,8 @@ int v4l2_m2m_qbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
                  struct v4l2_buffer *buf);
 int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
                   struct v4l2_buffer *buf);
+int v4l2_m2m_create_bufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+                         struct v4l2_create_buffers *create);
 int v4l2_m2m_expbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
                   struct v4l2_exportbuffer *eb);
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index ab5d4992e568..bdc6e87ff3eb 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -261,6 +261,7 @@ header-y += net_dropmon.h
 header-y += net_tstamp.h
 header-y += netconf.h
 header-y += netdevice.h
+header-y += netlink_diag.h
 header-y += netfilter.h
 header-y += netfilter_arp.h
 header-y += netfilter_bridge.h
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
index 65349f07b878..383f8231e436 100644
--- a/kernel/context_tracking.c
+++ b/kernel/context_tracking.c
@@ -15,7 +15,6 @@
 */
 #include <linux/context_tracking.h>
-#include <linux/kvm_host.h>
 #include <linux/rcupdate.h>
 #include <linux/sched.h>
 #include <linux/hardirq.h>
@@ -71,6 +70,46 @@ void user_enter(void)
        local_irq_restore(flags);
 }
+#ifdef CONFIG_PREEMPT
+/**
+ * preempt_schedule_context - preempt_schedule called by tracing
+ *
+ * The tracing infrastructure uses preempt_enable_notrace to prevent
+ * recursion and tracing preempt enabling caused by the tracing
+ * infrastructure itself. But as tracing can happen in areas coming
+ * from userspace or just about to enter userspace, a preempt enable
+ * can occur before user_exit() is called. This will cause the scheduler
+ * to be called when the system is still in usermode.
+ *
+ * To prevent this, the preempt_enable_notrace will use this function
+ * instead of preempt_schedule() to exit user context if needed before
+ * calling the scheduler.
+ */
+void __sched notrace preempt_schedule_context(void)
+{
+        struct thread_info *ti = current_thread_info();
+        enum ctx_state prev_ctx;
+        if (likely(ti->preempt_count || irqs_disabled()))
+                return;
+        /*
+         * Need to disable preemption in case user_exit() is traced
+         * and the tracer calls preempt_enable_notrace() causing
+         * an infinite recursion.
+         */
+        preempt_disable_notrace();
+        prev_ctx = exception_enter();
+        preempt_enable_no_resched_notrace();
+        preempt_schedule();
+        preempt_disable_notrace();
+        exception_exit(prev_ctx);
+        preempt_enable_notrace();
+}
+EXPORT_SYMBOL_GPL(preempt_schedule_context);
+#endif /* CONFIG_PREEMPT */
 /**
 * user_exit - Inform the context tracking that the CPU is
diff --git a/kernel/cpu/idle.c b/kernel/cpu/idle.c
index d5585f5e038e..e695c0a0bcb5 100644
--- a/kernel/cpu/idle.c
+++ b/kernel/cpu/idle.c
@@ -5,6 +5,7 @@
 #include <linux/cpu.h>
 #include <linux/tick.h>
 #include <linux/mm.h>
+#include <linux/stackprotector.h>
 #include <asm/tlb.h>
@@ -58,6 +59,7 @@ void __weak arch_cpu_idle_dead(void) { }
 void __weak arch_cpu_idle(void)
 {
        cpu_idle_force_poll = 1;
+        local_irq_enable();
 }
 /*
@@ -112,6 +114,21 @@ static void cpu_idle_loop(void)
 void cpu_startup_entry(enum cpuhp_state state)
 {
+        /*
+         * This #ifdef needs to die, but it's too late in the cycle to
+         * make this generic (arm and sh have never invoked the canary
+         * init for the non boot cpus!). Will be fixed in 3.11
+         */
+#ifdef CONFIG_X86
+        /*
+         * If we're the non-boot CPU, nothing set the stack canary up
+         * for us. The boot CPU already has it initialized but no harm
+         * in doing it again. This is a good place for updating it, as
+         * we wont ever return from this function (so the invalid
+         * canaries already on the stack wont ever trigger).
+         */
+        boot_init_stack_canary();
+#endif
        current_set_polling();
        arch_cpu_idle_prepare();
        cpu_idle_loop();
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 9dc297faf7c0..b391907d5352 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -196,9 +196,6 @@ static void cpu_ctx_sched_in(struct perf_cpu_context *cpuctx,
 static void update_context_time(struct perf_event_context *ctx);
 static u64 perf_event_time(struct perf_event *event);
-static void ring_buffer_attach(struct perf_event *event,
-                               struct ring_buffer *rb);
 void __weak perf_event_print_debug(void)        { }
 extern __weak const char *perf_pmu_name(void)
@@ -2918,6 +2915,7 @@ static void free_event_rcu(struct rcu_head *head)
 }
 static void ring_buffer_put(struct ring_buffer *rb);
+static void ring_buffer_detach(struct perf_event *event, struct ring_buffer *rb);
 static void free_event(struct perf_event *event)
 {
@@ -2942,15 +2940,30 @@ static void free_event(struct perf_event *event)
                if (has_branch_stack(event)) {
                        static_key_slow_dec_deferred(&perf_sched_events);
                        /* is system-wide event */
-                        if (!(event->attach_state & PERF_ATTACH_TASK))
+                        if (!(event->attach_state & PERF_ATTACH_TASK)) {
                                atomic_dec(&per_cpu(perf_branch_stack_events,
                                                    event->cpu));
+                        }
                }
        }
        if (event->rb) {
-                ring_buffer_put(event->rb);
+                struct ring_buffer *rb;
-                event->rb = NULL;
+                /*
+                 * Can happen when we close an event with re-directed output.
+                 *
+                 * Since we have a 0 refcount, perf_mmap_close() will skip
+                 * over us; possibly making our ring_buffer_put() the last.
+                 */
+                mutex_lock(&event->mmap_mutex);
+                rb = event->rb;
+                if (rb) {
+                        rcu_assign_pointer(event->rb, NULL);
+                        ring_buffer_detach(event, rb);
+                        ring_buffer_put(rb); /* could be last */
+                }
+                mutex_unlock(&event->mmap_mutex);
        }
        if (is_cgroup_event(event))
@@ -3188,30 +3201,13 @@ static unsigned int perf_poll(struct file *file, poll_table *wait)
        unsigned int events = POLL_HUP;
        /*
-         * Race between perf_event_set_output() and perf_poll(): perf_poll()
+         * Pin the event->rb by taking event->mmap_mutex; otherwise
-         * grabs the rb reference but perf_event_set_output() overrides it.
+         * perf_event_set_output() can swizzle our rb and make us miss wakeups.
-         * Here is the timeline for two threads T1, T2:
-         * t0: T1, rb = rcu_dereference(event->rb)
-         * t1: T2, old_rb = event->rb
-         * t2: T2, event->rb = new rb
-         * t3: T2, ring_buffer_detach(old_rb)
-         * t4: T1, ring_buffer_attach(rb1)
-         * t5: T1, poll_wait(event->waitq)
-         *
-         * To avoid this problem, we grab mmap_mutex in perf_poll()
-         * thereby ensuring that the assignment of the new ring buffer
-         * and the detachment of the old buffer appear atomic to perf_poll()
         */
        mutex_lock(&event->mmap_mutex);
+        rb = event->rb;
-        rcu_read_lock();
+        if (rb)
-        rb = rcu_dereference(event->rb);
-        if (rb) {
-                ring_buffer_attach(event, rb);
                events = atomic_xchg(&rb->poll, 0);
-        }
-        rcu_read_unlock();
        mutex_unlock(&event->mmap_mutex);
        poll_wait(file, &event->waitq, wait);
@@ -3521,16 +3517,12 @@ static void ring_buffer_attach(struct perf_event *event,
                return;
        spin_lock_irqsave(&rb->event_lock, flags);
-        if (!list_empty(&event->rb_entry))
+        if (list_empty(&event->rb_entry))
-                goto unlock;
+                list_add(&event->rb_entry, &rb->event_list);
-        list_add(&event->rb_entry, &rb->event_list);
-unlock:
        spin_unlock_irqrestore(&rb->event_lock, flags);
 }
-static void ring_buffer_detach(struct perf_event *event,
+static void ring_buffer_detach(struct perf_event *event, struct ring_buffer *rb)
-                               struct ring_buffer *rb)
 {
        unsigned long flags;
@@ -3549,13 +3541,10 @@ static void ring_buffer_wakeup(struct perf_event *event)
        rcu_read_lock();
        rb = rcu_dereference(event->rb);
-        if (!rb)
+        if (rb) {
-                goto unlock;
+                list_for_each_entry_rcu(event, &rb->event_list, rb_entry)
+                        wake_up_all(&event->waitq);
-        list_for_each_entry_rcu(event, &rb->event_list, rb_entry)
+        }
-                wake_up_all(&event->waitq);
-unlock:
        rcu_read_unlock();
 }
@@ -3584,18 +3573,10 @@ static struct ring_buffer *ring_buffer_get(struct perf_event *event)
 static void ring_buffer_put(struct ring_buffer *rb)
 {
-        struct perf_event *event, *n;
-        unsigned long flags;
        if (!atomic_dec_and_test(&rb->refcount))
                return;
-        spin_lock_irqsave(&rb->event_lock, flags);
+        WARN_ON_ONCE(!list_empty(&rb->event_list));
-        list_for_each_entry_safe(event, n, &rb->event_list, rb_entry) {
-                list_del_init(&event->rb_entry);
-                wake_up_all(&event->waitq);
-        }
-        spin_unlock_irqrestore(&rb->event_lock, flags);
        call_rcu(&rb->rcu_head, rb_free_rcu);
 }
@@ -3605,26 +3586,100 @@ static void perf_mmap_open(struct vm_area_struct *vma)
        struct perf_event *event = vma->vm_file->private_data;
        atomic_inc(&event->mmap_count);
+        atomic_inc(&event->rb->mmap_count);
 }
+/*
+ * A buffer can be mmap()ed multiple times; either directly through the same
+ * event, or through other events by use of perf_event_set_output().
+ *
+ * In order to undo the VM accounting done by perf_mmap() we need to destroy
+ * the buffer here, where we still have a VM context. This means we need
+ * to detach all events redirecting to us.
+ */
 static void perf_mmap_close(struct vm_area_struct *vma)
 {
        struct perf_event *event = vma->vm_file->private_data;
-        if (atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) {
+        struct ring_buffer *rb = event->rb;
-                unsigned long size = perf_data_size(event->rb);
+        struct user_struct *mmap_user = rb->mmap_user;
-                struct user_struct *user = event->mmap_user;
+        int mmap_locked = rb->mmap_locked;
-                struct ring_buffer *rb = event->rb;
+        unsigned long size = perf_data_size(rb);
+        atomic_dec(&rb->mmap_count);
+        if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex))
+                return;
-                atomic_long_sub((size >> PAGE_SHIFT) + 1, &user->locked_vm);
+        /* Detach current event from the buffer. */
-                vma->vm_mm->pinned_vm -= event->mmap_locked;
+        rcu_assign_pointer(event->rb, NULL);
-                rcu_assign_pointer(event->rb, NULL);
+        ring_buffer_detach(event, rb);
-                ring_buffer_detach(event, rb);
+        mutex_unlock(&event->mmap_mutex);
+        /* If there's still other mmap()s of this buffer, we're done. */
+        if (atomic_read(&rb->mmap_count)) {
+                ring_buffer_put(rb); /* can't be last */
+                return;
+        }
+        /*
+         * No other mmap()s, detach from all other events that might redirect
+         * into the now unreachable buffer. Somewhat complicated by the
+         * fact that rb::event_lock otherwise nests inside mmap_mutex.
+         */
+again:
+        rcu_read_lock();
+        list_for_each_entry_rcu(event, &rb->event_list, rb_entry) {
+                if (!atomic_long_inc_not_zero(&event->refcount)) {
+                        /*
+                         * This event is en-route to free_event() which will
+                         * detach it and remove it from the list.
+                         */
+                        continue;
+                }
+                rcu_read_unlock();
+                mutex_lock(&event->mmap_mutex);
+                /*
+                 * Check we didn't race with perf_event_set_output() which can
+                 * swizzle the rb from under us while we were waiting to
+                 * acquire mmap_mutex.
+                 *
+                 * If we find a different rb; ignore this event, a next
+                 * iteration will no longer find it on the list. We have to
+                 * still restart the iteration to make sure we're not now
+                 * iterating the wrong list.
+                 */
+                if (event->rb == rb) {
+                        rcu_assign_pointer(event->rb, NULL);
+                        ring_buffer_detach(event, rb);
+                        ring_buffer_put(rb); /* can't be last, we still have one */
+                }
                mutex_unlock(&event->mmap_mutex);
+                put_event(event);
-                ring_buffer_put(rb);
+                /*
-                free_uid(user);
+                 * Restart the iteration; either we're on the wrong list or
+                 * destroyed its integrity by doing a deletion.
+                 */
+                goto again;
        }
+        rcu_read_unlock();
+        /*
+         * It could be there's still a few 0-ref events on the list; they'll
+         * get cleaned up by free_event() -- they'll also still have their
+         * ref on the rb and will free it whenever they are done with it.
+         *
+         * Aside from that, this buffer is 'fully' detached and unmapped,
+         * undo the VM accounting.
+         */
+        atomic_long_sub((size >> PAGE_SHIFT) + 1, &mmap_user->locked_vm);
+        vma->vm_mm->pinned_vm -= mmap_locked;
+        free_uid(mmap_user);
+        ring_buffer_put(rb); /* could be last */
 }
 static const struct vm_operations_struct perf_mmap_vmops = {
@@ -3674,12 +3729,24 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
                return -EINVAL;
        WARN_ON_ONCE(event->ctx->parent_ctx);
+again:
        mutex_lock(&event->mmap_mutex);
        if (event->rb) {
-                if (event->rb->nr_pages == nr_pages)
+                if (event->rb->nr_pages != nr_pages) {
-                        atomic_inc(&event->rb->refcount);
-                else
                        ret = -EINVAL;
+                        goto unlock;
+                }
+                if (!atomic_inc_not_zero(&event->rb->mmap_count)) {
+                        /*
+                         * Raced against perf_mmap_close() through
+                         * perf_event_set_output(). Try again, hope for better
+                         * luck.
+                         */
+                        mutex_unlock(&event->mmap_mutex);
+                        goto again;
+                }
                goto unlock;
        }
@@ -3720,12 +3787,16 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
                ret = -ENOMEM;
                goto unlock;
        }
-        rcu_assign_pointer(event->rb, rb);
+        atomic_set(&rb->mmap_count, 1);
+        rb->mmap_locked = extra;
+        rb->mmap_user = get_current_user();
        atomic_long_add(user_extra, &user->locked_vm);
-        event->mmap_locked = extra;
+        vma->vm_mm->pinned_vm += extra;
-        event->mmap_user = get_current_user();
-        vma->vm_mm->pinned_vm += event->mmap_locked;
+        ring_buffer_attach(event, rb);
+        rcu_assign_pointer(event->rb, rb);
        perf_event_update_userpage(event);
@@ -3734,7 +3805,11 @@ unlock:
                atomic_inc(&event->mmap_count);
        mutex_unlock(&event->mmap_mutex);
-        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+        /*
+         * Since pinned accounting is per vm we cannot allow fork() to copy our
+         * vma.
+         */
+        vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND | VM_DONTDUMP;
        vma->vm_ops = &perf_mmap_vmops;
        return ret;
@@ -6412,6 +6487,8 @@ set:
        if (atomic_read(&event->mmap_count))
                goto unlock;
+        old_rb = event->rb;
        if (output_event) {
                /* get the rb we want to redirect to */
                rb = ring_buffer_get(output_event);
@@ -6419,16 +6496,28 @@ set:
                        goto unlock;
        }
-        old_rb = event->rb;
-        rcu_assign_pointer(event->rb, rb);
        if (old_rb)
                ring_buffer_detach(event, old_rb);
+        if (rb)
+                ring_buffer_attach(event, rb);
+        rcu_assign_pointer(event->rb, rb);
+        if (old_rb) {
+                ring_buffer_put(old_rb);
+                /*
+                 * Since we detached before setting the new rb, so that we
+                 * could attach the new rb, we could have missed a wakeup.
+                 * Provide it now.
+                 */
+                wake_up_all(&event->waitq);
+        }
        ret = 0;
 unlock:
        mutex_unlock(&event->mmap_mutex);
-        if (old_rb)
-                ring_buffer_put(old_rb);
 out:
        return ret;
 }
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index a64f8aeb5c1f..20185ea64aa6 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -120,7 +120,7 @@ static int task_bp_pinned(int cpu, struct perf_event *bp, enum bp_type_idx type)
        list_for_each_entry(iter, &bp_task_head, hw.bp_list) {
                if (iter->hw.bp_target == tsk &&
                    find_slot_idx(iter) == type &&
-                    cpu == iter->cpu)
+                    (iter->cpu < 0 || cpu == iter->cpu))
                        count += hw_breakpoint_weight(iter);
        }
@@ -149,7 +149,7 @@ fetch_bp_busy_slots(struct bp_busy_slots *slots, struct perf_event *bp,
                return;
        }
-        for_each_online_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                unsigned int nr;
                nr = per_cpu(nr_cpu_bp_pinned[type], cpu);
@@ -235,7 +235,7 @@ toggle_bp_slot(struct perf_event *bp, bool enable, enum bp_type_idx type,
        if (cpu >= 0) {
                toggle_bp_task_slot(bp, cpu, enable, type, weight);
        } else {
-                for_each_online_cpu(cpu)
+                for_each_possible_cpu(cpu)
                        toggle_bp_task_slot(bp, cpu, enable, type, weight);
        }
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index eb675c4d59df..ca6599723be5 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -31,6 +31,10 @@ struct ring_buffer {
        spinlock_t                      event_lock;
        struct list_head                event_list;
+        atomic_t                        mmap_count;
+        unsigned long                   mmap_locked;
+        struct user_struct              *mmap_user;
        struct perf_event_mmap_page     *user_page;
        void                            *data_pages[0];
 };
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 3fed7f0cbcdf..bddf3b201a48 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -467,6 +467,7 @@ static struct kprobe *__kprobes get_optimized_kprobe(unsigned long addr)
 /* Optimization staging list, protected by kprobe_mutex */
 static LIST_HEAD(optimizing_list);
 static LIST_HEAD(unoptimizing_list);
+static LIST_HEAD(freeing_list);
 static void kprobe_optimizer(struct work_struct *work);
 static DECLARE_DELAYED_WORK(optimizing_work, kprobe_optimizer);
@@ -504,7 +505,7 @@ static __kprobes void do_optimize_kprobes(void)
 * Unoptimize (replace a jump with a breakpoint and remove the breakpoint
 * if need) kprobes listed on unoptimizing_list.
 */
-static __kprobes void do_unoptimize_kprobes(struct list_head *free_list)
+static __kprobes void do_unoptimize_kprobes(void)
 {
        struct optimized_kprobe *op, *tmp;
@@ -515,9 +516,9 @@ static __kprobes void do_unoptimize_kprobes(struct list_head *free_list)
        /* Ditto to do_optimize_kprobes */
        get_online_cpus();
        mutex_lock(&text_mutex);
-        arch_unoptimize_kprobes(&unoptimizing_list, free_list);
+        arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
        /* Loop free_list for disarming */
-        list_for_each_entry_safe(op, tmp, free_list, list) {
+        list_for_each_entry_safe(op, tmp, &freeing_list, list) {
                /* Disarm probes if marked disabled */
                if (kprobe_disabled(&op->kp))
                        arch_disarm_kprobe(&op->kp);
@@ -536,11 +537,11 @@ static __kprobes void do_unoptimize_kprobes(struct list_head *free_list)
 }
 /* Reclaim all kprobes on the free_list */
-static __kprobes void do_free_cleaned_kprobes(struct list_head *free_list)
+static __kprobes void do_free_cleaned_kprobes(void)
 {
        struct optimized_kprobe *op, *tmp;
-        list_for_each_entry_safe(op, tmp, free_list, list) {
+        list_for_each_entry_safe(op, tmp, &freeing_list, list) {
                BUG_ON(!kprobe_unused(&op->kp));
                list_del_init(&op->list);
                free_aggr_kprobe(&op->kp);
@@ -556,8 +557,6 @@ static __kprobes void kick_kprobe_optimizer(void)
 /* Kprobe jump optimizer */
 static __kprobes void kprobe_optimizer(struct work_struct *work)
 {
-        LIST_HEAD(free_list);
        mutex_lock(&kprobe_mutex);
        /* Lock modules while optimizing kprobes */
        mutex_lock(&module_mutex);
@@ -566,7 +565,7 @@ static __kprobes void kprobe_optimizer(struct work_struct *work)
         * Step 1: Unoptimize kprobes and collect cleaned (unused and disarmed)
         * kprobes before waiting for quiesence period.
         */
-        do_unoptimize_kprobes(&free_list);
+        do_unoptimize_kprobes();
        /*
         * Step 2: Wait for quiesence period to ensure all running interrupts
@@ -581,7 +580,7 @@ static __kprobes void kprobe_optimizer(struct work_struct *work)
        do_optimize_kprobes();
        /* Step 4: Free cleaned kprobes after quiesence period */
-        do_free_cleaned_kprobes(&free_list);
+        do_free_cleaned_kprobes();
        mutex_unlock(&module_mutex);
        mutex_unlock(&kprobe_mutex);
@@ -723,8 +722,19 @@ static void __kprobes kill_optimized_kprobe(struct kprobe *p)
        if (!list_empty(&op->list))
                /* Dequeue from the (un)optimization queue */
                list_del_init(&op->list);
        op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+        if (kprobe_unused(p)) {
+                /* Enqueue if it is unused */
+                list_add(&op->list, &freeing_list);
+                /*
+                 * Remove unused probes from the hash list. After waiting
+                 * for synchronization, this probe is reclaimed.
+                 * (reclaiming is done by do_free_cleaned_kprobes().)
+                 */
+                hlist_del_rcu(&op->kp.hlist);
+        }
        /* Don't touch the code, because it is already freed. */
        arch_remove_optimized_kprobe(op);
 }
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index aed981a3f69c..335a7ae697f5 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -665,20 +665,22 @@ static int ptrace_peek_siginfo(struct task_struct *child,
                if (unlikely(is_compat_task())) {
                        compat_siginfo_t __user *uinfo = compat_ptr(data);
-                        ret = copy_siginfo_to_user32(uinfo, &info);
+                        if (copy_siginfo_to_user32(uinfo, &info) ||
-                        ret |= __put_user(info.si_code, &uinfo->si_code);
+                            __put_user(info.si_code, &uinfo->si_code)) {
+                                ret = -EFAULT;
+                                break;
+                        }
                } else
 #endif
                {
                        siginfo_t __user *uinfo = (siginfo_t __user *) data;
-                        ret = copy_siginfo_to_user(uinfo, &info);
+                        if (copy_siginfo_to_user(uinfo, &info) ||
-                        ret |= __put_user(info.si_code, &uinfo->si_code);
+                            __put_user(info.si_code, &uinfo->si_code)) {
-                }
+                                ret = -EFAULT;
+                                break;
-                if (ret) {
+                        }
-                        ret = -EFAULT;
-                        break;
                }
                data += sizeof(siginfo_t);
diff --git a/kernel/range.c b/kernel/range.c
index eb911dbce267..322ea8e93e4b 100644
--- a/kernel/range.c
+++ b/kernel/range.c
@@ -4,7 +4,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/sort.h>
+#include <linux/string.h>
 #include <linux/range.h>
 int add_range(struct range *range, int az, int nr_range, u64 start, u64 end)
@@ -32,9 +32,8 @@ int add_range_with_merge(struct range *range, int az, int nr_range,
        if (start >= end)
                return nr_range;
-        /* Try to merge it with old one: */
+        /* get new start/end: */
        for (i = 0; i < nr_range; i++) {
-                u64 final_start, final_end;
                u64 common_start, common_end;
                if (!range[i].end)
@@ -45,14 +44,16 @@ int add_range_with_merge(struct range *range, int az, int nr_range,
                if (common_start > common_end)
                        continue;
-                final_start = min(range[i].start, start);
+                /* new start/end, will add it back at last */
-                final_end = max(range[i].end, end);
+                start = min(range[i].start, start);
+                end = max(range[i].end, end);
-                /* clear it and add it back for further merge */
+                memmove(&range[i], &range[i + 1],
-                range[i].start = 0;
+                        (nr_range - (i + 1)) * sizeof(range[i]));
-                range[i].end =  0;
+                range[nr_range - 1].start = 0;
-                return add_range_with_merge(range, az, nr_range,
+                range[nr_range - 1].end   = 0;
-                        final_start, final_end);
+                nr_range--;
+                i--;
        }
        /* Need to add it: */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 58453b8272fd..e8b335016c52 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -633,7 +633,19 @@ void wake_up_nohz_cpu(int cpu)
 static inline bool got_nohz_idle_kick(void)
 {
        int cpu = smp_processor_id();
-        return idle_cpu(cpu) && test_bit(NOHZ_BALANCE_KICK, nohz_flags(cpu));
+        if (!test_bit(NOHZ_BALANCE_KICK, nohz_flags(cpu)))
+                return false;
+        if (idle_cpu(cpu) && !need_resched())
+                return true;
+        /*
+         * We can't run Idle Load Balance on this CPU for this time so we
+         * cancel it and clear NOHZ_BALANCE_KICK
+         */
+        clear_bit(NOHZ_BALANCE_KICK, nohz_flags(cpu));
+        return false;
 }
 #else /* CONFIG_NO_HZ_COMMON */
@@ -1393,8 +1405,9 @@ static void sched_ttwu_pending(void)
 void scheduler_ipi(void)
 {
-        if (llist_empty(&this_rq()->wake_list) && !got_nohz_idle_kick()
+        if (llist_empty(&this_rq()->wake_list)
-            && !tick_nohz_full_cpu(smp_processor_id()))
+                        && !tick_nohz_full_cpu(smp_processor_id())
+                        && !got_nohz_idle_kick())
                return;
        /*
@@ -1417,7 +1430,7 @@ void scheduler_ipi(void)
        /*
         * Check if someone kicked us for doing the nohz idle load balance.
         */
-        if (unlikely(got_nohz_idle_kick() && !need_resched())) {
+        if (unlikely(got_nohz_idle_kick())) {
                this_rq()->idle_balance = 1;
                raise_softirq_irqoff(SCHED_SOFTIRQ);
        }
@@ -4745,7 +4758,7 @@ void __cpuinit init_idle(struct task_struct *idle, int cpu)
         */
        idle->sched_class = &idle_sched_class;
        ftrace_graph_init_idle_task(idle, cpu);
-        vtime_init_idle(idle);
+        vtime_init_idle(idle, cpu);
 #if defined(CONFIG_SMP)
        sprintf(idle->comm, "%s/%d", INIT_TASK_COMM, cpu);
 #endif
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index cc2dc3eea8a3..b5ccba22603b 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -747,17 +747,17 @@ void arch_vtime_task_switch(struct task_struct *prev)
        write_seqlock(&current->vtime_seqlock);
        current->vtime_snap_whence = VTIME_SYS;
-        current->vtime_snap = sched_clock();
+        current->vtime_snap = sched_clock_cpu(smp_processor_id());
        write_sequnlock(&current->vtime_seqlock);
 }
-void vtime_init_idle(struct task_struct *t)
+void vtime_init_idle(struct task_struct *t, int cpu)
 {
        unsigned long flags;
        write_seqlock_irqsave(&t->vtime_seqlock, flags);
        t->vtime_snap_whence = VTIME_SYS;
-        t->vtime_snap = sched_clock();
+        t->vtime_snap = sched_clock_cpu(cpu);
        write_sequnlock_irqrestore(&t->vtime_seqlock, flags);
 }
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 0c739423b0f9..20d6fba70652 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -599,8 +599,6 @@ void tick_broadcast_oneshot_control(unsigned long reason)
        } else {
                if (cpumask_test_and_clear_cpu(cpu, tick_broadcast_oneshot_mask)) {
                        clockevents_set_mode(dev, CLOCK_EVT_MODE_ONESHOT);
-                        if (dev->next_event.tv64 == KTIME_MAX)
-                                goto out;
                        /*
                         * The cpu which was handling the broadcast
                         * timer marked this cpu in the broadcast
@@ -615,6 +613,11 @@ void tick_broadcast_oneshot_control(unsigned long reason)
                                goto out;
                        /*
+                         * Bail out if there is no next event.
+                         */
+                        if (dev->next_event.tv64 == KTIME_MAX)
+                                goto out;
+                        /*
                         * If the pending bit is not set, then we are
                         * either the CPU handling the broadcast
                         * interrupt or we got woken by something else.
@@ -698,10 +701,6 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
                bc->event_handler = tick_handle_oneshot_broadcast;
-                /* Take the do_timer update */
-                if (!tick_nohz_full_cpu(cpu))
-                        tick_do_timer_cpu = cpu;
                /*
                 * We must be careful here. There might be other CPUs
                 * waiting for periodic broadcast. We need to set the
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index f4208138fbf4..0cf1c1453181 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -306,7 +306,7 @@ static int __cpuinit tick_nohz_cpu_down_callback(struct notifier_block *nfb,
                 * we can't safely shutdown that CPU.
                 */
                if (have_nohz_full_mask && tick_do_timer_cpu == cpu)
-                        return -EINVAL;
+                        return NOTIFY_BAD;
                break;
        }
        return NOTIFY_OK;
diff --git a/mm/slab_common.c b/mm/slab_common.c
index ff3218a0f5e1..2d414508e9ec 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -373,8 +373,10 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags)
 {
        int index;
-        if (WARN_ON_ONCE(size > KMALLOC_MAX_SIZE))
+        if (size > KMALLOC_MAX_SIZE) {
+                WARN_ON_ONCE(!(flags & __GFP_NOWARN));
                return NULL;
+        }
        if (size <= 192) {
                if (!size)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6a93cd8cd264..560dafd83adf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -800,6 +800,40 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex)
 EXPORT_SYMBOL(dev_get_by_index);
 /**
+ *      netdev_get_name - get a netdevice name, knowing its ifindex.
+ *      @net: network namespace
+ *      @name: a pointer to the buffer where the name will be stored.
+ *      @ifindex: the ifindex of the interface to get the name from.
+ *
+ *      The use of raw_seqcount_begin() and cond_resched() before
+ *      retrying is required as we want to give the writers a chance
+ *      to complete when CONFIG_PREEMPT is not set.
+ */
+int netdev_get_name(struct net *net, char *name, int ifindex)
+{
+        struct net_device *dev;
+        unsigned int seq;
+retry:
+        seq = raw_seqcount_begin(&devnet_rename_seq);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                return -ENODEV;
+        }
+        strcpy(name, dev->name);
+        rcu_read_unlock();
+        if (read_seqcount_retry(&devnet_rename_seq, seq)) {
+                cond_resched();
+                goto retry;
+        }
+        return 0;
+}
+/**
 *      dev_getbyhwaddr_rcu - find a device by its hardware address
 *      @net: the applicable net namespace
 *      @type: media type of device
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 6cc0481faade..5b7d0e1d0664 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -19,9 +19,8 @@
 static int dev_ifname(struct net *net, struct ifreq __user *arg)
 {
-        struct net_device *dev;
        struct ifreq ifr;
-        unsigned seq;
+        int error;
        /*
         *      Fetch the caller's info block.
@@ -30,19 +29,9 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                return -EFAULT;
-retry:
+        error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
-        seq = read_seqcount_begin(&devnet_rename_seq);
+        if (error)
-        rcu_read_lock();
+                return error;
-        dev = dev_get_by_index_rcu(net, ifr.ifr_ifindex);
-        if (!dev) {
-                rcu_read_unlock();
-                return -ENODEV;
-        }
-        strcpy(ifr.ifr_name, dev->name);
-        rcu_read_unlock();
-        if (read_seqcount_retry(&devnet_rename_seq, seq))
-                goto retry;
        if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
                return -EFAULT;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index b1fcb8727e56..77971a35d6e1 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -477,15 +477,8 @@ EXPORT_SYMBOL(skb_add_rx_frag);
 static void skb_drop_list(struct sk_buff **listp)
 {
-        struct sk_buff *list = *listp;
+        kfree_skb_list(*listp);
        *listp = NULL;
-        do {
-                struct sk_buff *this = list;
-                list = list->next;
-                kfree_skb(this);
-        } while (list);
 }
 static inline void skb_drop_fraglist(struct sk_buff *skb)
@@ -645,6 +638,17 @@ void kfree_skb(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(kfree_skb);
+void kfree_skb_list(struct sk_buff *segs)
+{
+        while (segs) {
+                struct sk_buff *next = segs->next;
+                kfree_skb(segs);
+                segs = next;
+        }
+}
+EXPORT_SYMBOL(kfree_skb_list);
 /**
 *      skb_tx_error - report an sk_buff xmit error
 *      @skb: buffer that triggered an error
diff --git a/net/core/sock.c b/net/core/sock.c
index b6c619f4d47b..ab06b719f5b1 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -573,9 +573,7 @@ static int sock_getbindtodevice(struct sock *sk, char __user *optval,
        int ret = -ENOPROTOOPT;
 #ifdef CONFIG_NETDEVICES
        struct net *net = sock_net(sk);
-        struct net_device *dev;
        char devname[IFNAMSIZ];
-        unsigned seq;
        if (sk->sk_bound_dev_if == 0) {
                len = 0;
@@ -586,20 +584,9 @@ static int sock_getbindtodevice(struct sock *sk, char __user *optval,
        if (len < IFNAMSIZ)
                goto out;
-retry:
+        ret = netdev_get_name(net, devname, sk->sk_bound_dev_if);
-        seq = read_seqcount_begin(&devnet_rename_seq);
+        if (ret)
-        rcu_read_lock();
-        dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
-        ret = -ENODEV;
-        if (!dev) {
-                rcu_read_unlock();
                goto out;
-        }
-        strcpy(devname, dev->name);
-        rcu_read_unlock();
-        if (read_seqcount_retry(&devnet_rename_seq, seq))
-                goto retry;
        len = strlen(devname) + 1;
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index a9d8cd2bff4b..775d5b532ece 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -87,7 +87,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
                                err = __skb_linearize(skb);
                                if (err) {
-                                        kfree_skb(segs);
+                                        kfree_skb_list(segs);
                                        segs = ERR_PTR(err);
                                        goto out;
                                }
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 57c671152c42..cbc22158af49 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -125,15 +125,16 @@ static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum)
 /* timer function to flush queue in flushtimeout time */
 static void ulog_timer(unsigned long data)
 {
+        unsigned int groupnum = *((unsigned int *)data);
        struct ulog_net *ulog = container_of((void *)data,
                                             struct ulog_net,
-                                             nlgroup[*(unsigned int *)data]);
+                                             nlgroup[groupnum]);
        pr_debug("timer function called, calling ulog_send\n");
        /* lock to protect against somebody modifying our structure
         * from ipt_ulog_target at the same time */
        spin_lock_bh(&ulog->lock);
-        ulog_send(ulog, data);
+        ulog_send(ulog, groupnum);
        spin_unlock_bh(&ulog->lock);
 }
@@ -413,8 +414,11 @@ static int __net_init ulog_tg_net_init(struct net *net)
        spin_lock_init(&ulog->lock);
        /* initialize ulog_buffers */
-        for (i = 0; i < ULOG_MAXNLGROUPS; i++)
+        for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
-                setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer, i);
+                ulog->nlgroup[i] = i;
+                setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,
+                            (unsigned long)&ulog->nlgroup[i]);
+        }
        ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
        if (!ulog->nflognl)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1063bb83e342..35675e46aff8 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -986,7 +986,7 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
        struct tcp_sock *tp = tcp_sk(sk);
        struct tcp_md5sig_info *md5sig;
-        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
+        key = tcp_md5_do_lookup(sk, addr, family);
        if (key) {
                /* Pre-existing entry - just update that one. */
                memcpy(key->key, newkey, newkeylen);
@@ -1029,7 +1029,7 @@ int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family)
 {
        struct tcp_md5sig_key *key;
-        key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&addr, AF_INET);
+        key = tcp_md5_do_lookup(sk, addr, family);
        if (!key)
                return -ENOENT;
        hlist_del_rcu(&key->node);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 75fd93bdd0d3..cfdcf7b2daf6 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2656,6 +2656,9 @@ static void init_loopback(struct net_device *dev)
                        if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
                                continue;
+                        if (sp_ifa->rt)
+                                continue;
                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
                        /* Failure cases are ignored */
@@ -4340,6 +4343,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        struct inet6_ifaddr *ifp;
        struct net_device *dev = idev->dev;
        bool update_rs = false;
+        struct in6_addr ll_addr;
        if (token == NULL)
                return -EINVAL;
@@ -4359,11 +4363,9 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        write_unlock_bh(&idev->lock);
-        if (!idev->dead && (idev->if_flags & IF_READY)) {
+        if (!idev->dead && (idev->if_flags & IF_READY) &&
-                struct in6_addr ll_addr;
+            !ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
+                             IFA_F_OPTIMISTIC)) {
-                ipv6_get_lladdr(dev, &ll_addr, IFA_F_TENTATIVE |
-                                IFA_F_OPTIMISTIC);
                /* If we're not ready, then normal ifup will take care
                 * of this. Otherwise, we need to request our rs here.
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index be7589ef5cf9..6e3ddf806ec2 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -381,9 +381,8 @@ int ip6_forward(struct sk_buff *skb)
         *      cannot be fragmented, because there is no warranty
         *      that different fragments will go along one path. --ANK
         */
-        if (opt->ra) {
+        if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
-                u8 *ptr = skb_network_header(skb) + opt->ra;
+                if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
-                if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
                        return 0;
        }
@@ -822,11 +821,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
                                          const struct flowi6 *fl6)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct rt6_info *rt = (struct rt6_info *)dst;
+        struct rt6_info *rt;
        if (!dst)
                goto out;
+        if (dst->ops->family != AF_INET6) {
+                dst_release(dst);
+                return NULL;
+        }
+        rt = (struct rt6_info *)dst;
        /* Yes, checking route validity in not connected
         * case is not very simple. Take into account,
         * that we do not support routing by source, TOS,
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 97bcf2bae857..c9b6a6e6a1e8 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -204,7 +204,7 @@ static unsigned int __ipv6_conntrack_in(struct net *net,
                if (ct != NULL && !nf_ct_is_untracked(ct)) {
                        help = nfct_help(ct);
                        if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
-                                nf_conntrack_get_reasm(skb);
+                                nf_conntrack_get_reasm(reasm);
                                NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
                                               (struct net_device *)in,
                                               (struct net_device *)out,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c5fbd7589681..9da862070dd8 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c)
        hdr->sadb_msg_version = PF_KEY_V2;
        hdr->sadb_msg_errno = (uint8_t) 0;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+        hdr->sadb_msg_reserved = 0;
        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
@@ -2699,6 +2700,7 @@ static int key_notify_policy_flush(const struct km_event *c)
        hdr->sadb_msg_errno = (uint8_t) 0;
        hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+        hdr->sadb_msg_reserved = 0;
        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
        return 0;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index e9b0330f220d..4f69e83ff836 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1442,7 +1442,8 @@ ignore_ipip:
        /* do the statistics and put it back */
        ip_vs_in_stats(cp, skb);
-        if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
+        if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol ||
+            IPPROTO_SCTP == cih->protocol)
                offset += 2 * sizeof(__u16);
        verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum, &ciph);
diff --git a/net/netfilter/nf_conntrack_labels.c b/net/netfilter/nf_conntrack_labels.c
index 8fe2e99428b7..355d2ef08094 100644
--- a/net/netfilter/nf_conntrack_labels.c
+++ b/net/netfilter/nf_conntrack_labels.c
@@ -45,7 +45,7 @@ int nf_connlabel_set(struct nf_conn *ct, u16 bit)
        if (test_bit(bit, labels->bits))
                return 0;
-        if (test_and_set_bit(bit, labels->bits))
+        if (!test_and_set_bit(bit, labels->bits))
                nf_conntrack_event_cache(IPCT_LABEL, ct);
        return 0;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index f83a52298efe..edc410e778f7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1837,6 +1837,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                        nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                      (1 << IPCT_ASSURED) |
                                                      (1 << IPCT_HELPER) |
+                                                      (1 << IPCT_LABEL) |
                                                      (1 << IPCT_PROTOINFO) |
                                                      (1 << IPCT_NATSEQADJ) |
                                                      (1 << IPCT_MARK),
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index 96ccdf78a29f..dac11f73868e 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -230,9 +230,10 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
                                        &ct->tuplehash[!dir].tuple.src.u3,
                                        false);
                        if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
-                                           poff, plen, buffer, buflen))
+                                           poff, plen, buffer, buflen)) {
                                nf_ct_helper_log(skb, ct, "cannot mangle received");
                                return NF_DROP;
+                        }
                }
                /* The rport= parameter (RFC 3581) contains the port number
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index bd8d46cca2b3..cccaf9c7a7bb 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -58,6 +58,7 @@ enum {
        CS420X_GPIO_23,
        CS420X_MBP101,
        CS420X_MBP81,
+        CS420X_MBA42,
        CS420X_AUTO,
        /* aliases */
        CS420X_IMAC27_122 = CS420X_GPIO_23,
@@ -346,6 +347,7 @@ static const struct hda_model_fixup cs420x_models[] = {
        { .id = CS420X_APPLE, .name = "apple" },
        { .id = CS420X_MBP101, .name = "mbp101" },
        { .id = CS420X_MBP81, .name = "mbp81" },
+        { .id = CS420X_MBA42, .name = "mba42" },
        {}
 };
@@ -361,6 +363,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
        SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
        SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
        SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+        SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
        SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
        {} /* terminator */
 };
@@ -414,6 +417,20 @@ static const struct hda_pintbl mbp101_pincfgs[] = {
        {} /* terminator */
 };
+static const struct hda_pintbl mba42_pincfgs[] = {
+        { 0x09, 0x012b4030 }, /* HP */
+        { 0x0a, 0x400000f0 },
+        { 0x0b, 0x90100120 }, /* speaker */
+        { 0x0c, 0x400000f0 },
+        { 0x0d, 0x90a00110 }, /* mic */
+        { 0x0e, 0x400000f0 },
+        { 0x0f, 0x400000f0 },
+        { 0x10, 0x400000f0 },
+        { 0x12, 0x400000f0 },
+        { 0x15, 0x400000f0 },
+        {} /* terminator */
+};
 static void cs420x_fixup_gpio_13(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action)
 {
@@ -482,6 +499,12 @@ static const struct hda_fixup cs420x_fixups[] = {
                .chained = true,
                .chain_id = CS420X_GPIO_13,
        },
+        [CS420X_MBA42] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = mba42_pincfgs,
+                .chained = true,
+                .chain_id = CS420X_GPIO_13,
+        },
 };
 static struct cs_spec *cs_alloc_spec(struct hda_codec *codec, int vendor_nid)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 02e22b4458d2..403010c9e82e 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3483,6 +3483,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05ca, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05cb, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05de, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x05e0, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05e9, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05ea, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05eb, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
@@ -3494,6 +3495,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x05f8, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0606, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
        SND_PCI_QUIRK(0x103c, 0x18e6, "HP", ALC269_FIXUP_HP_GPIO_LED),
@@ -3596,6 +3599,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
        {.id = ALC269_FIXUP_INV_DMIC, .name = "inv-dmic"},
        {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
        {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+        {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
+        {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
        {}
 };
@@ -4275,6 +4280,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
        {.id = ALC662_FIXUP_ASUS_MODE7, .name = "asus-mode7"},
        {.id = ALC662_FIXUP_ASUS_MODE8, .name = "asus-mode8"},
        {.id = ALC662_FIXUP_INV_DMIC, .name = "inv-dmic"},
+        {.id = ALC668_FIXUP_DELL_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
        {}
 };
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 1a033177b83f..64952e2d3ed1 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -147,14 +147,32 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
                return -EINVAL;
        }
+        alts = &iface->altsetting[0];
+        altsd = get_iface_desc(alts);
+        /*
+         * Android with both accessory and audio interfaces enabled gets the
+         * interface numbers wrong.
+         */
+        if ((chip->usb_id == USB_ID(0x18d1, 0x2d04) ||
+             chip->usb_id == USB_ID(0x18d1, 0x2d05)) &&
+            interface == 0 &&
+            altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC &&
+            altsd->bInterfaceSubClass == USB_SUBCLASS_VENDOR_SPEC) {
+                interface = 2;
+                iface = usb_ifnum_to_if(dev, interface);
+                if (!iface)
+                        return -EINVAL;
+                alts = &iface->altsetting[0];
+                altsd = get_iface_desc(alts);
+        }
        if (usb_interface_claimed(iface)) {
                snd_printdd(KERN_INFO "%d:%d:%d: skipping, already claimed\n",
                                                dev->devnum, ctrlif, interface);
                return -EINVAL;
        }
-        alts = &iface->altsetting[0];
-        altsd = get_iface_desc(alts);
        if ((altsd->bInterfaceClass == USB_CLASS_AUDIO ||
             altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC) &&
            altsd->bInterfaceSubClass == USB_SUBCLASS_MIDISTREAMING) {
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index e5c7f9f20fdd..d5438083fd6a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -885,6 +885,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
        case USB_ID(0x046d, 0x0808):
        case USB_ID(0x046d, 0x0809):
+        case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
        case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
        case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
        case USB_ID(0x046d, 0x0991):