348 files changed, 3792 insertions, 1868 deletions

diff --git a/Documentation/devicetree/bindings/arm/exynos/power_domain.txt b/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
index f4445e5a2bbb..1e097037349c 100644
--- a/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
+++ b/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
@@ -22,6 +22,8 @@ Optional Properties:
         - pclkN, clkN: Pairs of parent of input clock and input clock to the
                 devices in this power domain. Maximum of 4 pairs (N = 0 to 3)
                 are supported currently.
+- power-domains: phandle pointing to the parent power domain, for more details
+                 see Documentation/devicetree/bindings/power/power_domain.txt
 
 Node of a device using power domains must have a power-domains property
 defined with a phandle to respective power domain.
diff --git a/Documentation/devicetree/bindings/arm/sti.txt b/Documentation/devicetree/bindings/arm/sti.txt
index d70ec358736c..8d27f6b084c7 100644
--- a/Documentation/devicetree/bindings/arm/sti.txt
+++ b/Documentation/devicetree/bindings/arm/sti.txt
@@ -13,6 +13,10 @@ Boards with the ST STiH407 SoC shall have the following properties:
 Required root node property:
 compatible = "st,stih407";
 
+Boards with the ST STiH410 SoC shall have the following properties:
+Required root node property:
+compatible = "st,stih410";
+
 Boards with the ST STiH418 SoC shall have the following properties:
 Required root node property:
 compatible = "st,stih418";
diff --git a/Documentation/devicetree/bindings/power/power_domain.txt b/Documentation/devicetree/bindings/power/power_domain.txt
index 98c16672ab5f..0f8ed3710c66 100644
--- a/Documentation/devicetree/bindings/power/power_domain.txt
+++ b/Documentation/devicetree/bindings/power/power_domain.txt
@@ -19,6 +19,16 @@ Required properties:
    providing multiple PM domains (e.g. power controllers), but can be any value
    as specified by device tree binding documentation of particular provider.
 
+Optional properties:
+ - power-domains : A phandle and PM domain specifier as defined by bindings of
+                   the power controller specified by phandle.
+   Some power domains might be powered from another power domain (or have
+   other hardware specific dependencies). For representing such dependency
+   a standard PM domain consumer binding is used. When provided, all domains
+   created by the given provider should be subdomains of the domain
+   specified by this binding. More details about power domain specifier are
+   available in the next section.
+
 Example:
 
         power: power-controller@12340000 {
@@ -30,6 +40,25 @@ Example:
 The node above defines a power controller that is a PM domain provider and
 expects one cell as its phandle argument.
 
+Example 2:
+
+        parent: power-controller@12340000 {
+                compatible = "foo,power-controller";
+                reg = <0x12340000 0x1000>;
+                #power-domain-cells = <1>;
+        };
+
+        child: power-controller@12340000 {
+                compatible = "foo,power-controller";
+                reg = <0x12341000 0x1000>;
+                power-domains = <&parent 0>;
+                #power-domain-cells = <1>;
+        };
+
+The nodes above define two power controllers: 'parent' and 'child'.
+Domains created by the 'child' power controller are subdomains of '0' power
+domain provided by the 'parent' power controller.
+
 ==PM domain consumers==
 
 Required properties:
diff --git a/Documentation/devicetree/bindings/serial/of-serial.txt b/Documentation/devicetree/bindings/serial/8250.txt
index 91d5ab0e60fc..91d5ab0e60fc 100644
--- a/Documentation/devicetree/bindings/serial/of-serial.txt
+++ b/Documentation/devicetree/bindings/serial/8250.txt
diff --git a/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt b/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt
new file mode 100644
index 000000000000..ebcbb62c0a76
--- /dev/null
+++ b/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt
@@ -0,0 +1,19 @@
+ETRAX FS UART
+
+Required properties:
+- compatible : "axis,etraxfs-uart"
+- reg: offset and length of the register set for the device.
+- interrupts: device interrupt
+
+Optional properties:
+- {dtr,dsr,ri,cd}-gpios: specify a GPIO for DTR/DSR/RI/CD
+  line respectively.
+
+Example:
+
+serial@b00260000 {
+        compatible = "axis,etraxfs-uart";
+        reg = <0xb0026000 0x1000>;
+        interrupts = <68>;
+        status = "disabled";
+};
diff --git a/Documentation/devicetree/bindings/submitting-patches.txt b/Documentation/devicetree/bindings/submitting-patches.txt
index 56742bc70218..7d44eae7ab0b 100644
--- a/Documentation/devicetree/bindings/submitting-patches.txt
+++ b/Documentation/devicetree/bindings/submitting-patches.txt
@@ -12,6 +12,9 @@ I. For patch submitters
 
        devicetree@vger.kernel.org
 
+     and Cc: the DT maintainers. Use scripts/get_maintainer.pl to identify
+     all of the DT maintainers.
+
   3) The Documentation/ portion of the patch should come in the series before
      the code implementing the binding.
 
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 389ca1347a77..fae26d014aaf 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -20,6 +20,7 @@ amlogic	Amlogic, Inc.
 ams     AMS AG
 amstaos AMS-Taos Inc.
 apm     Applied Micro Circuits Corporation (APM)
+arasan  Arasan Chip Systems
 arm     ARM Ltd.
 armadeus        ARMadeus Systems SARL
 asahi-kasei     Asahi Kasei Corp.
@@ -27,6 +28,7 @@ atmel	Atmel Corporation
 auo     AU Optronics Corporation
 avago   Avago Technologies
 avic    Shanghai AVIC Optoelectronics Co., Ltd.
+axis    Axis Communications AB
 bosch   Bosch Sensortec GmbH
 brcm    Broadcom Corporation
 buffalo Buffalo, Inc.
diff --git a/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt b/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
index f90e294d7631..a4d869744f59 100644
--- a/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
+++ b/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
@@ -26,6 +26,11 @@ Optional properties:
 - atmel,disable : Should be present if you want to disable the watchdog.
 - atmel,idle-halt : Should be present if you want to stop the watchdog when
         entering idle state.
+        CAUTION: This property should be used with care, it actually makes the
+        watchdog not counting when the CPU is in idle state, therefore the
+        watchdog reset time depends on mean CPU usage and will not reset at all
+        if the CPU stop working while it is in idle state, which is probably
+        not what you want.
 - atmel,dbg-halt : Should be present if you want to stop the watchdog when
         entering debug state.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 42e221c48776..66ab548ee469 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1030,6 +1030,16 @@ F:	arch/arm/mach-mxs/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
 
+ARM/FREESCALE VYBRID ARM ARCHITECTURE
+M:      Shawn Guo <shawn.guo@linaro.org>
+M:      Sascha Hauer <kernel@pengutronix.de>
+R:      Stefan Agner <stefan@agner.ch>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
+F:      arch/arm/mach-imx/*vf610*
+F:      arch/arm/boot/dts/vf*
+
 ARM/GLOMATION GESBC9312SX MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1188,6 +1198,7 @@ ARM/Marvell Dove/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+M:      Gregory Clement <gregory.clement@free-electrons.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-dove/
@@ -1730,7 +1741,7 @@ S:	Maintained
 F:      drivers/net/ethernet/atheros/
 
 ATM
-M:      Chas Williams <chas@cmf.nrl.navy.mil>
+M:      Chas Williams <3chas3@gmail.com>
 L:      linux-atm-general@lists.sourceforge.net (moderated for non-subscribers)
 L:      netdev@vger.kernel.org
 W:      http://linux-atm.sourceforge.net
@@ -2107,7 +2118,6 @@ F:	drivers/net/ethernet/broadcom/bnx2x/
 
 BROADCOM BCM281XX/BCM11XXX/BCM216XX ARM ARCHITECTURE
 M:      Christian Daudt <bcm@fixthebug.org>
-M:      Matt Porter <mporter@linaro.org>
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      bcm-kernel-feedback-list@broadcom.com
 T:      git git://github.com/broadcom/mach-bcm
diff --git a/Makefile b/Makefile
index 1100ff3c77e3..e734965b1604 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 7f99cd652203..eb7bb511f853 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -150,6 +150,7 @@ machine-$(CONFIG_ARCH_BERLIN)		+= berlin
 machine-$(CONFIG_ARCH_CLPS711X)         += clps711x
 machine-$(CONFIG_ARCH_CNS3XXX)          += cns3xxx
 machine-$(CONFIG_ARCH_DAVINCI)          += davinci
+machine-$(CONFIG_ARCH_DIGICOLOR)        += digicolor
 machine-$(CONFIG_ARCH_DOVE)             += dove
 machine-$(CONFIG_ARCH_EBSA110)          += ebsa110
 machine-$(CONFIG_ARCH_EFM32)            += efm32
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index 2c6248d9a9ef..c3255e0c90aa 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -301,3 +301,11 @@
         cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
         cd-inverted;
 };
+
+&aes {
+        status = "okay";
+};
+
+&sham {
+        status = "okay";
+};
diff --git a/arch/arm/boot/dts/am335x-bone.dts b/arch/arm/boot/dts/am335x-bone.dts
index 83d40f7655e5..6b8493720424 100644
--- a/arch/arm/boot/dts/am335x-bone.dts
+++ b/arch/arm/boot/dts/am335x-bone.dts
@@ -24,11 +24,3 @@
 &mmc1 {
         vmmc-supply = <&ldo3_reg>;
 };
-
-&sham {
-        status = "okay";
-};
-
-&aes {
-        status = "okay";
-};
diff --git a/arch/arm/boot/dts/am335x-lxm.dts b/arch/arm/boot/dts/am335x-lxm.dts
index 7266a00aab2e..5c5667a3624d 100644
--- a/arch/arm/boot/dts/am335x-lxm.dts
+++ b/arch/arm/boot/dts/am335x-lxm.dts
@@ -328,6 +328,10 @@
         dual_emac_res_vlan = <3>;
 };
 
+&phy_sel {
+        rmii-clock-ext;
+};
+
 &mac {
         pinctrl-names = "default", "sleep";
         pinctrl-0 = <&cpsw_default>;
diff --git a/arch/arm/boot/dts/am33xx-clocks.dtsi b/arch/arm/boot/dts/am33xx-clocks.dtsi
index 712edce7d6fb..071b56aa0c7e 100644
--- a/arch/arm/boot/dts/am33xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am33xx-clocks.dtsi
@@ -99,7 +99,7 @@
         ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <0>;
                 reg = <0x0664>;
         };
@@ -107,7 +107,7 @@
         ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <1>;
                 reg = <0x0664>;
         };
@@ -115,7 +115,7 @@
         ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <2>;
                 reg = <0x0664>;
         };
diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
index c7dc9dab93a4..cfb49686ab6a 100644
--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
@@ -107,7 +107,7 @@
         ehrpwm0_tbclk: ehrpwm0_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <0>;
                 reg = <0x0664>;
         };
@@ -115,7 +115,7 @@
         ehrpwm1_tbclk: ehrpwm1_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <1>;
                 reg = <0x0664>;
         };
@@ -123,7 +123,7 @@
         ehrpwm2_tbclk: ehrpwm2_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <2>;
                 reg = <0x0664>;
         };
@@ -131,7 +131,7 @@
         ehrpwm3_tbclk: ehrpwm3_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <4>;
                 reg = <0x0664>;
         };
@@ -139,7 +139,7 @@
         ehrpwm4_tbclk: ehrpwm4_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <5>;
                 reg = <0x0664>;
         };
@@ -147,7 +147,7 @@
         ehrpwm5_tbclk: ehrpwm5_tbclk {
                 #clock-cells = <0>;
                 compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                 ti,bit-shift = <6>;
                 reg = <0x0664>;
         };
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index 9f7c7376f2cf..62d25b14deb8 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -494,12 +494,12 @@
 
                                         pinctrl_usart3_rts: usart3_rts-0 {
                                                 atmel,pins =
-                                                        <AT91_PIOB 8 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PC8 periph B */
+                                                        <AT91_PIOC 8 AT91_PERIPH_B AT91_PINCTRL_NONE>;
                                         };
 
                                         pinctrl_usart3_cts: usart3_cts-0 {
                                                 atmel,pins =
-                                                        <AT91_PIOB 10 AT91_PERIPH_B AT91_PINCTRL_NONE>; /* PC10 periph B */
+                                                        <AT91_PIOC 10 AT91_PERIPH_B AT91_PINCTRL_NONE>;
                                         };
                                 };
 
@@ -853,7 +853,7 @@
                         };
 
                         usb1: gadget@fffa4000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9260-udc";
                                 reg = <0xfffa4000 0x4000>;
                                 interrupts = <10 IRQ_TYPE_LEVEL_HIGH 2>;
                                 clocks = <&udc_clk>, <&udpck>;
@@ -976,7 +976,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
index e247b0b5fdab..d55fdf2487ef 100644
--- a/arch/arm/boot/dts/at91sam9261.dtsi
+++ b/arch/arm/boot/dts/at91sam9261.dtsi
@@ -124,11 +124,12 @@
                         };
 
                         usb1: gadget@fffa4000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9261-udc";
                                 reg = <0xfffa4000 0x4000>;
                                 interrupts = <10 IRQ_TYPE_LEVEL_HIGH 2>;
-                                clocks = <&usb>, <&udc_clk>, <&udpck>;
-                                clock-names = "usb_clk", "udc_clk", "udpck";
+                                clocks = <&udc_clk>, <&udpck>;
+                                clock-names = "pclk", "hclk";
+                                atmel,matrix = <&matrix>;
                                 status = "disabled";
                         };
 
@@ -262,7 +263,7 @@
                         };
 
                         matrix: matrix@ffffee00 {
-                                compatible = "atmel,at91sam9260-bus-matrix";
+                                compatible = "atmel,at91sam9260-bus-matrix", "syscon";
                                 reg = <0xffffee00 0x200>;
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index 340179ef6ba0..e4f61a979a57 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -69,7 +69,7 @@
 
         sram1: sram@00500000 {
                 compatible = "mmio-sram";
-                reg = <0x00300000 0x4000>;
+                reg = <0x00500000 0x4000>;
         };
 
         ahb {
@@ -856,7 +856,7 @@
                         };
 
                         usb1: gadget@fff78000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9263-udc";
                                 reg = <0xfff78000 0x4000>;
                                 interrupts = <24 IRQ_TYPE_LEVEL_HIGH 2>;
                                 clocks = <&udc_clk>, <&udpck>;
@@ -905,7 +905,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index 586eab7b653d..8ec05b11298a 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -1116,7 +1116,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
@@ -1301,7 +1300,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00800000 0x100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "hclk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index c2666a7cb5b1..0c53a375ba99 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -894,7 +894,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 818dabdd8c0e..d221179d0f1a 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -1066,7 +1066,7 @@
                                 reg = <0x00500000 0x80000
                                        0xf803c000 0x400>;
                                 interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-                                clocks = <&usb>, <&udphs_clk>;
+                                clocks = <&utmi>, <&udphs_clk>;
                                 clock-names = "hclk", "pclk";
                                 status = "disabled";
 
@@ -1130,7 +1130,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
@@ -1186,7 +1185,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00700000 0x100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 3290a96ba586..7563d7ce01bb 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -263,17 +263,15 @@
 
         dcan1_pins_default: dcan1_pins_default {
                 pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT | MUX_MODE0) /* dcan1_tx */
-                        0x3d4   (MUX_MODE15)            /* dcan1_rx.off */
-                        0x418   (PULL_DIS | MUX_MODE1) /* wakeup0.dcan1_rx */
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
+                        0x418   (PULL_UP | MUX_MODE1) /* wakeup0.dcan1_rx */
                 >;
         };
 
         dcan1_pins_sleep: dcan1_pins_sleep {
                 pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15)    /* dcan1_tx.off */
-                        0x3d4   (MUX_MODE15)    /* dcan1_rx.off */
-                        0x418   (MUX_MODE15)    /* wakeup0.off */
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
                 >;
         };
 };
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index e0264d0bf7b9..40ed539ce474 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -119,17 +119,15 @@
 
         dcan1_pins_default: dcan1_pins_default {
                 pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT | MUX_MODE0) /* dcan1_tx */
-                        0x3d4   (MUX_MODE15)            /* dcan1_rx.off */
-                        0x418   (PULL_DIS | MUX_MODE1) /* wakeup0.dcan1_rx */
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
+                        0x418   (PULL_UP | MUX_MODE1)   /* wakeup0.dcan1_rx */
                 >;
         };
 
         dcan1_pins_sleep: dcan1_pins_sleep {
                 pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15)    /* dcan1_tx.off */
-                        0x3d4   (MUX_MODE15)    /* dcan1_rx.off */
-                        0x418   (MUX_MODE15)    /* wakeup0.off */
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
                 >;
         };
 
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index 4bdcbd61ce47..99b09a44e269 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -243,10 +243,18 @@
                 ti,invert-autoidle-bit;
         };
 
+        dpll_core_byp_mux: dpll_core_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x012c>;
+        };
+
         dpll_core_ck: dpll_core_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-core-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
                 reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
         };
 
@@ -309,10 +317,18 @@
                 clock-div = <1>;
         };
 
+        dpll_dsp_byp_mux: dpll_dsp_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x0240>;
+        };
+
         dpll_dsp_ck: dpll_dsp_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
                 reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
         };
 
@@ -335,10 +351,18 @@
                 clock-div = <1>;
         };
 
+        dpll_iva_byp_mux: dpll_iva_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x01ac>;
+        };
+
         dpll_iva_ck: dpll_iva_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
                 reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
         };
 
@@ -361,10 +385,18 @@
                 clock-div = <1>;
         };
 
+        dpll_gpu_byp_mux: dpll_gpu_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x02e4>;
+        };
+
         dpll_gpu_ck: dpll_gpu_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
                 reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
         };
 
@@ -398,10 +430,18 @@
                 clock-div = <1>;
         };
 
+        dpll_ddr_byp_mux: dpll_ddr_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x021c>;
+        };
+
         dpll_ddr_ck: dpll_ddr_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
                 reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
         };
 
@@ -416,10 +456,18 @@
                 ti,invert-autoidle-bit;
         };
 
+        dpll_gmac_byp_mux: dpll_gmac_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x02b4>;
+        };
+
         dpll_gmac_ck: dpll_gmac_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
                 reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
         };
 
@@ -482,10 +530,18 @@
                 clock-div = <1>;
         };
 
+        dpll_eve_byp_mux: dpll_eve_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x0290>;
+        };
+
         dpll_eve_ck: dpll_eve_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
                 reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
         };
 
@@ -1249,10 +1305,18 @@
                 clock-div = <1>;
         };
 
+        dpll_per_byp_mux: dpll_per_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x014c>;
+        };
+
         dpll_per_ck: dpll_per_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
                 reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
         };
 
@@ -1275,10 +1339,18 @@
                 clock-div = <1>;
         };
 
+        dpll_usb_byp_mux: dpll_usb_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x018c>;
+        };
+
         dpll_usb_ck: dpll_usb_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-j-type-clock";
-                clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
                 reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
         };
 
diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
index 277b48b0b6f9..ac6b0ae42caf 100644
--- a/arch/arm/boot/dts/exynos3250.dtsi
+++ b/arch/arm/boot/dts/exynos3250.dtsi
@@ -18,6 +18,7 @@
  */
 
 #include "skeleton.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 #include <dt-bindings/clock/exynos3250.h>
 
 / {
@@ -193,6 +194,7 @@
                         interrupts = <0 216 0>;
                         clocks = <&cmu CLK_TMU_APBIF>;
                         clock-names = "tmu_apbif";
+                        #include "exynos4412-tmu-sensor-conf.dtsi"
                         status = "disabled";
                 };
 
diff --git a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
new file mode 100644
index 000000000000..735cb2f10817
--- /dev/null
+++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
@@ -0,0 +1,52 @@
+/*
+ * Device tree sources for Exynos4 thermal zone
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <dt-bindings/thermal/thermal.h>
+
+/ {
+thermal-zones {
+        cpu_thermal: cpu-thermal {
+                thermal-sensors = <&tmu 0>;
+                polling-delay-passive = <0>;
+                polling-delay = <0>;
+                trips {
+                        cpu_alert0: cpu-alert-0 {
+                                temperature = <70000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_alert1: cpu-alert-1 {
+                                temperature = <95000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_alert2: cpu-alert-2 {
+                                temperature = <110000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_crit0: cpu-crit-0 {
+                                temperature = <120000>; /* millicelsius */
+                                hysteresis = <0>; /* millicelsius */
+                                type = "critical";
+                        };
+                };
+                cooling-maps {
+                        map0 {
+                                trip = <&cpu_alert0>;
+                        };
+                        map1 {
+                                trip = <&cpu_alert1>;
+                        };
+                };
+        };
+};
+};
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index 76173cacd450..77ea547768f4 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -38,6 +38,7 @@
                 i2c5 = &i2c_5;
                 i2c6 = &i2c_6;
                 i2c7 = &i2c_7;
+                i2c8 = &i2c_8;
                 csis0 = &csis_0;
                 csis1 = &csis_1;
                 fimc0 = &fimc_0;
@@ -104,6 +105,7 @@
                 compatible = "samsung,exynos4210-pd";
                 reg = <0x10023C20 0x20>;
                 #power-domain-cells = <0>;
+                power-domains = <&pd_lcd0>;
         };
 
         pd_cam: cam-power-domain@10023C00 {
@@ -554,6 +556,22 @@
                 status = "disabled";
         };
 
+        i2c_8: i2c@138E0000 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "samsung,s3c2440-hdmiphy-i2c";
+                reg = <0x138E0000 0x100>;
+                interrupts = <0 93 0>;
+                clocks = <&clock CLK_I2C_HDMI>;
+                clock-names = "i2c";
+                status = "disabled";
+
+                hdmi_i2c_phy: hdmiphy@38 {
+                        compatible = "exynos4210-hdmiphy";
+                        reg = <0x38>;
+                };
+        };
+
         spi_0: spi@13920000 {
                 compatible = "samsung,exynos4210-spi";
                 reg = <0x13920000 0x100>;
@@ -663,6 +681,33 @@
                 status = "disabled";
         };
 
+        tmu: tmu@100C0000 {
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+
+        hdmi: hdmi@12D00000 {
+                compatible = "samsung,exynos4210-hdmi";
+                reg = <0x12D00000 0x70000>;
+                interrupts = <0 92 0>;
+                clock-names = "hdmi", "sclk_hdmi", "sclk_pixel", "sclk_hdmiphy",
+                        "mout_hdmi";
+                clocks = <&clock CLK_HDMI>, <&clock CLK_SCLK_HDMI>,
+                        <&clock CLK_SCLK_PIXEL>, <&clock CLK_SCLK_HDMIPHY>,
+                        <&clock CLK_MOUT_HDMI>;
+                phy = <&hdmi_i2c_phy>;
+                power-domains = <&pd_tv>;
+                samsung,syscon-phandle = <&pmu_system_controller>;
+                status = "disabled";
+        };
+
+        mixer: mixer@12C10000 {
+                compatible = "samsung,exynos4210-mixer";
+                interrupts = <0 91 0>;
+                reg = <0x12C10000 0x2100>, <0x12c00000 0x300>;
+                power-domains = <&pd_tv>;
+                status = "disabled";
+        };
+
         ppmu_dmc0: ppmu_dmc0@106a0000 {
                 compatible = "samsung,exynos-ppmu";
                 reg = <0x106a0000 0x2000>;
diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts
index 3d6652a4b6cb..32c5fd8f6269 100644
--- a/arch/arm/boot/dts/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/exynos4210-trats.dts
@@ -426,6 +426,25 @@
                 status = "okay";
         };
 
+        tmu@100C0000 {
+                status = "okay";
+        };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 2 2>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 4 4>;
+                               };
+                       };
+                };
+        };
+
         camera {
                 pinctrl-names = "default";
                 pinctrl-0 = <>;
diff --git a/arch/arm/boot/dts/exynos4210-universal_c210.dts b/arch/arm/boot/dts/exynos4210-universal_c210.dts
index b57e6b82ea20..d4f2b11319dd 100644
--- a/arch/arm/boot/dts/exynos4210-universal_c210.dts
+++ b/arch/arm/boot/dts/exynos4210-universal_c210.dts
@@ -505,6 +505,63 @@
                         assigned-clock-rates = <0>, <160000000>;
                 };
         };
+
+        hdmi_en: voltage-regulator-hdmi-5v {
+                compatible = "regulator-fixed";
+                regulator-name = "HDMI_5V";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                gpio = <&gpe0 1 0>;
+                enable-active-high;
+        };
+
+        hdmi_ddc: i2c-ddc {
+                compatible = "i2c-gpio";
+                gpios = <&gpe4 2 0 &gpe4 3 0>;
+                i2c-gpio,delay-us = <100>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                pinctrl-0 = <&i2c_ddc_bus>;
+                pinctrl-names = "default";
+                status = "okay";
+        };
+
+        mixer@12C10000 {
+                status = "okay";
+        };
+
+        hdmi@12D00000 {
+                hpd-gpio = <&gpx3 7 0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&hdmi_hpd>;
+                hdmi-en-supply = <&hdmi_en>;
+                vdd-supply = <&ldo3_reg>;
+                vdd_osc-supply = <&ldo4_reg>;
+                vdd_pll-supply = <&ldo3_reg>;
+                ddc = <&hdmi_ddc>;
+                status = "okay";
+        };
+
+        i2c@138E0000 {
+                status = "okay";
+        };
+};
+
+&pinctrl_1 {
+        hdmi_hpd: hdmi-hpd {
+                samsung,pins = "gpx3-7";
+                samsung,pin-pud = <0>;
+        };
+};
+
+&pinctrl_0 {
+        i2c_ddc_bus: i2c-ddc-bus {
+                samsung,pins = "gpe4-2", "gpe4-3";
+                samsung,pin-function = <2>;
+                samsung,pin-pud = <3>;
+                samsung,pin-drv = <0>;
+        };
 };
 
 &mdma1 {
diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
index 67c832c9dcf1..be89f83f70e7 100644
--- a/arch/arm/boot/dts/exynos4210.dtsi
+++ b/arch/arm/boot/dts/exynos4210.dtsi
@@ -21,6 +21,7 @@
 
 #include "exynos4.dtsi"
 #include "exynos4210-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 
 / {
         compatible = "samsung,exynos4210", "samsung,exynos4";
@@ -35,10 +36,13 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@900 {
+                cpu0: cpu@900 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0x900>;
+                        cooling-min-level = <4>;
+                        cooling-max-level = <2>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
 
                 cpu@901 {
@@ -153,16 +157,38 @@
                 reg = <0x03860000 0x1000>;
         };
 
-        tmu@100C0000 {
+        tmu: tmu@100C0000 {
                 compatible = "samsung,exynos4210-tmu";
                 interrupt-parent = <&combiner>;
                 reg = <0x100C0000 0x100>;
                 interrupts = <2 4>;
                 clocks = <&clock CLK_TMU_APBIF>;
                 clock-names = "tmu_apbif";
+                samsung,tmu_gain = <15>;
+                samsung,tmu_reference_voltage = <7>;
                 status = "disabled";
         };
 
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        polling-delay-passive = <0>;
+                        polling-delay = <0>;
+                        thermal-sensors = <&tmu 0>;
+
+                        trips {
+                              cpu_alert0: cpu-alert-0 {
+                                      temperature = <85000>; /* millicelsius */
+                              };
+                              cpu_alert1: cpu-alert-1 {
+                                      temperature = <100000>; /* millicelsius */
+                              };
+                              cpu_alert2: cpu-alert-2 {
+                                      temperature = <110000>; /* millicelsius */
+                              };
+                        };
+                };
+        };
+
         g2d@12800000 {
                 compatible = "samsung,s5pv210-g2d";
                 reg = <0x12800000 0x1000>;
@@ -203,6 +229,14 @@
                 };
         };
 
+        mixer: mixer@12C10000 {
+                clock-names = "mixer", "hdmi", "sclk_hdmi", "vp", "mout_mixer",
+                        "sclk_mixer";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                        <&clock CLK_SCLK_HDMI>, <&clock CLK_VP>,
+                        <&clock CLK_MOUT_MIXER>, <&clock CLK_SCLK_MIXER>;
+        };
+
         ppmu_lcd1: ppmu_lcd1@12240000 {
                 compatible = "samsung,exynos-ppmu";
                 reg = <0x12240000 0x2000>;
diff --git a/arch/arm/boot/dts/exynos4212.dtsi b/arch/arm/boot/dts/exynos4212.dtsi
index dd0a43ec56da..5be03288f1ee 100644
--- a/arch/arm/boot/dts/exynos4212.dtsi
+++ b/arch/arm/boot/dts/exynos4212.dtsi
@@ -26,10 +26,13 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@A00 {
+                cpu0: cpu@A00 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0xA00>;
+                        cooling-min-level = <13>;
+                        cooling-max-level = <7>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
 
                 cpu@A01 {
diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
index de80b5bba204..adb4f6a97a1d 100644
--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
@@ -249,6 +249,20 @@
                                         regulator-always-on;
                                 };
 
+                                ldo8_reg: ldo@8 {
+                                        regulator-compatible = "LDO8";
+                                        regulator-name = "VDD10_HDMI_1.0V";
+                                        regulator-min-microvolt = <1000000>;
+                                        regulator-max-microvolt = <1000000>;
+                                };
+
+                                ldo10_reg: ldo@10 {
+                                        regulator-compatible = "LDO10";
+                                        regulator-name = "VDDQ_MIPIHSI_1.8V";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                };
+
                                 ldo11_reg: LDO11 {
                                         regulator-name = "VDD18_ABB1_1.8V";
                                         regulator-min-microvolt = <1800000>;
@@ -411,6 +425,51 @@
         ehci: ehci@12580000 {
                 status = "okay";
         };
+
+        tmu@100C0000 {
+                vtmu-supply = <&ldo10_reg>;
+                status = "okay";
+        };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 7 7>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 13 13>;
+                               };
+                       };
+                };
+        };
+
+        mixer: mixer@12C10000 {
+                status = "okay";
+        };
+
+        hdmi@12D00000 {
+                hpd-gpio = <&gpx3 7 0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&hdmi_hpd>;
+                vdd-supply = <&ldo8_reg>;
+                vdd_osc-supply = <&ldo10_reg>;
+                vdd_pll-supply = <&ldo8_reg>;
+                ddc = <&hdmi_ddc>;
+                status = "okay";
+        };
+
+        hdmi_ddc: i2c@13880000 {
+                status = "okay";
+                pinctrl-names = "default";
+                pinctrl-0 = <&i2c2_bus>;
+        };
+
+        i2c@138E0000 {
+                status = "okay";
+        };
 };
 
 &pinctrl_1 {
@@ -425,4 +484,9 @@
                 samsung,pin-pud = <0>;
                 samsung,pin-drv = <0>;
         };
+
+        hdmi_hpd: hdmi-hpd {
+                samsung,pins = "gpx3-7";
+                samsung,pin-pud = <1>;
+        };
 };
diff --git a/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi
new file mode 100644
index 000000000000..e3f7934d19d0
--- /dev/null
+++ b/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi
@@ -0,0 +1,24 @@
+/*
+ * Device tree sources for Exynos4412 TMU sensor configuration
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <dt-bindings/thermal/thermal_exynos.h>
+
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <8>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <55>;
+samsung,tmu_min_efuse_value = <40>;
+samsung,tmu_max_efuse_value = <100>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <85>;
+samsung,tmu_default_temp_offset = <50>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts
index 21f748083586..173ffa479ad3 100644
--- a/arch/arm/boot/dts/exynos4412-trats2.dts
+++ b/arch/arm/boot/dts/exynos4412-trats2.dts
@@ -927,6 +927,21 @@
                 pulldown-ohm = <100000>; /* 100K */
                 io-channels = <&adc 2>;  /* Battery temperature */
         };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 7 7>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 13 13>;
+                               };
+                       };
+                };
+        };
 };
 
 &pmu_system_controller {
diff --git a/arch/arm/boot/dts/exynos4412.dtsi b/arch/arm/boot/dts/exynos4412.dtsi
index 0f6ec93bb1d8..68ad43b391ae 100644
--- a/arch/arm/boot/dts/exynos4412.dtsi
+++ b/arch/arm/boot/dts/exynos4412.dtsi
@@ -26,10 +26,13 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@A00 {
+                cpu0: cpu@A00 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a9";
                         reg = <0xA00>;
+                        cooling-min-level = <13>;
+                        cooling-max-level = <7>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
 
                 cpu@A01 {
diff --git a/arch/arm/boot/dts/exynos4x12.dtsi b/arch/arm/boot/dts/exynos4x12.dtsi
index f5e0ae780d6c..6a6abe14fd9b 100644
--- a/arch/arm/boot/dts/exynos4x12.dtsi
+++ b/arch/arm/boot/dts/exynos4x12.dtsi
@@ -19,6 +19,7 @@
 
 #include "exynos4.dtsi"
 #include "exynos4x12-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 
 / {
         aliases {
@@ -297,4 +298,15 @@
                 clock-names = "tmu_apbif";
                 status = "disabled";
         };
+
+        hdmi: hdmi@12D00000 {
+                compatible = "samsung,exynos4212-hdmi";
+        };
+
+        mixer: mixer@12C10000 {
+                compatible = "samsung,exynos4212-mixer";
+                clock-names = "mixer", "hdmi", "sclk_hdmi", "vp";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>, <&clock CLK_VP>;
+        };
 };
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 9bb1b0b738f5..adbde1adad95 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -20,7 +20,7 @@
 #include <dt-bindings/clock/exynos5250.h>
 #include "exynos5.dtsi"
 #include "exynos5250-pinctrl.dtsi"
-
+#include "exynos4-cpu-thermal.dtsi"
 #include <dt-bindings/clock/exynos-audss-clk.h>
 
 / {
@@ -58,11 +58,14 @@
                 #address-cells = <1>;
                 #size-cells = <0>;
 
-                cpu@0 {
+                cpu0: cpu@0 {
                         device_type = "cpu";
                         compatible = "arm,cortex-a15";
                         reg = <0>;
                         clock-frequency = <1700000000>;
+                        cooling-min-level = <15>;
+                        cooling-max-level = <9>;
+                        #cooling-cells = <2>; /* min followed by max */
                 };
                 cpu@1 {
                         device_type = "cpu";
@@ -102,6 +105,12 @@
                 #power-domain-cells = <0>;
         };
 
+        pd_disp1: disp1-power-domain@100440A0 {
+                compatible = "samsung,exynos4210-pd";
+                reg = <0x100440A0 0x20>;
+                #power-domain-cells = <0>;
+        };
+
         clock: clock-controller@10010000 {
                 compatible = "samsung,exynos5250-clock";
                 reg = <0x10010000 0x30000>;
@@ -235,12 +244,32 @@
                 status = "disabled";
         };
 
-        tmu@10060000 {
+        tmu: tmu@10060000 {
                 compatible = "samsung,exynos5250-tmu";
                 reg = <0x10060000 0x100>;
                 interrupts = <0 65 0>;
                 clocks = <&clock CLK_TMU>;
                 clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        polling-delay-passive = <0>;
+                        polling-delay = <0>;
+                        thermal-sensors = <&tmu 0>;
+
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 9 9>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 15 15>;
+                               };
+                       };
+                };
         };
 
         serial@12C00000 {
@@ -719,6 +748,7 @@
         hdmi: hdmi {
                 compatible = "samsung,exynos4212-hdmi";
                 reg = <0x14530000 0x70000>;
+                power-domains = <&pd_disp1>;
                 interrupts = <0 95 0>;
                 clocks = <&clock CLK_HDMI>, <&clock CLK_SCLK_HDMI>,
                          <&clock CLK_SCLK_PIXEL>, <&clock CLK_SCLK_HDMIPHY>,
@@ -731,9 +761,11 @@
         mixer {
                 compatible = "samsung,exynos5250-mixer";
                 reg = <0x14450000 0x10000>;
+                power-domains = <&pd_disp1>;
                 interrupts = <0 94 0>;
-                clocks = <&clock CLK_MIXER>, <&clock CLK_SCLK_HDMI>;
-                clock-names = "mixer", "sclk_hdmi";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>;
+                clock-names = "mixer", "hdmi", "sclk_hdmi";
         };
 
         dp_phy: video-phy@10040720 {
@@ -743,6 +775,7 @@
         };
 
         dp: dp-controller@145B0000 {
+                power-domains = <&pd_disp1>;
                 clocks = <&clock CLK_DP>;
                 clock-names = "dp";
                 phys = <&dp_phy>;
@@ -750,6 +783,7 @@
         };
 
         fimd: fimd@14400000 {
+                power-domains = <&pd_disp1>;
                 clocks = <&clock CLK_SCLK_FIMD1>, <&clock CLK_FIMD1>;
                 clock-names = "sclk_fimd", "fimd";
         };
diff --git a/arch/arm/boot/dts/exynos5420-trip-points.dtsi b/arch/arm/boot/dts/exynos5420-trip-points.dtsi
new file mode 100644
index 000000000000..5d31fc140823
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5420-trip-points.dtsi
@@ -0,0 +1,35 @@
+/*
+ * Device tree sources for default Exynos5420 thermal zone definition
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+polling-delay-passive = <0>;
+polling-delay = <0>;
+trips {
+        cpu-alert-0 {
+                temperature = <85000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-alert-1 {
+                temperature = <103000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-alert-2 {
+                temperature = <110000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-crit-0 {
+                temperature = <1200000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "critical";
+        };
+};
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index 9dc2e9773b30..c0e98cf3514f 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -740,8 +740,9 @@
                 compatible = "samsung,exynos5420-mixer";
                 reg = <0x14450000 0x10000>;
                 interrupts = <0 94 0>;
-                clocks = <&clock CLK_MIXER>, <&clock CLK_SCLK_HDMI>;
-                clock-names = "mixer", "sclk_hdmi";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>;
+                clock-names = "mixer", "hdmi", "sclk_hdmi";
                 power-domains = <&disp_pd>;
         };
 
@@ -782,6 +783,7 @@
                 interrupts = <0 65 0>;
                 clocks = <&clock CLK_TMU>;
                 clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_cpu1: tmu@10064000 {
@@ -790,6 +792,7 @@
                 interrupts = <0 183 0>;
                 clocks = <&clock CLK_TMU>;
                 clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_cpu2: tmu@10068000 {
@@ -798,6 +801,7 @@
                 interrupts = <0 184 0>;
                 clocks = <&clock CLK_TMU>, <&clock CLK_TMU>;
                 clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_cpu3: tmu@1006c000 {
@@ -806,6 +810,7 @@
                 interrupts = <0 185 0>;
                 clocks = <&clock CLK_TMU>, <&clock CLK_TMU_GPU>;
                 clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
         };
 
         tmu_gpu: tmu@100a0000 {
@@ -814,6 +819,30 @@
                 interrupts = <0 215 0>;
                 clocks = <&clock CLK_TMU_GPU>, <&clock CLK_TMU>;
                 clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+
+        thermal-zones {
+                cpu0_thermal: cpu0-thermal {
+                        thermal-sensors = <&tmu_cpu0>;
+                        #include "exynos5420-trip-points.dtsi"
+                };
+                cpu1_thermal: cpu1-thermal {
+                       thermal-sensors = <&tmu_cpu1>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                cpu2_thermal: cpu2-thermal {
+                       thermal-sensors = <&tmu_cpu2>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                cpu3_thermal: cpu3-thermal {
+                       thermal-sensors = <&tmu_cpu3>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                gpu_thermal: gpu-thermal {
+                       thermal-sensors = <&tmu_gpu>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
         };
 
         watchdog: watchdog@101D0000 {
diff --git a/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi
new file mode 100644
index 000000000000..7b2fba0ae92b
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi
@@ -0,0 +1,24 @@
+/*
+ * Device tree sources for Exynos5440 TMU sensor configuration
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <dt-bindings/thermal/thermal_exynos.h>
+
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <5>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <0x5d2d>;
+samsung,tmu_min_efuse_value = <16>;
+samsung,tmu_max_efuse_value = <76>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <70>;
+samsung,tmu_default_temp_offset = <25>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff --git a/arch/arm/boot/dts/exynos5440-trip-points.dtsi b/arch/arm/boot/dts/exynos5440-trip-points.dtsi
new file mode 100644
index 000000000000..48adfa8f4300
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5440-trip-points.dtsi
@@ -0,0 +1,25 @@
+/*
+ * Device tree sources for default Exynos5440 thermal zone definition
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+polling-delay-passive = <0>;
+polling-delay = <0>;
+trips {
+        cpu-alert-0 {
+                temperature = <100000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "active";
+        };
+        cpu-crit-0 {
+                temperature = <1050000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "critical";
+        };
+};
diff --git a/arch/arm/boot/dts/exynos5440.dtsi b/arch/arm/boot/dts/exynos5440.dtsi
index 8f3373cd7b87..59d9416b3b03 100644
--- a/arch/arm/boot/dts/exynos5440.dtsi
+++ b/arch/arm/boot/dts/exynos5440.dtsi
@@ -219,6 +219,7 @@
                 interrupts = <0 58 0>;
                 clocks = <&clock CLK_B_125>;
                 clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
         };
 
         tmuctrl_1: tmuctrl@16011C {
@@ -227,6 +228,7 @@
                 interrupts = <0 58 0>;
                 clocks = <&clock CLK_B_125>;
                 clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
         };
 
         tmuctrl_2: tmuctrl@160120 {
@@ -235,6 +237,22 @@
                 interrupts = <0 58 0>;
                 clocks = <&clock CLK_B_125>;
                 clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
+        };
+
+        thermal-zones {
+                cpu0_thermal: cpu0-thermal {
+                        thermal-sensors = <&tmuctrl_0>;
+                        #include "exynos5440-trip-points.dtsi"
+                };
+                cpu1_thermal: cpu1-thermal {
+                       thermal-sensors = <&tmuctrl_1>;
+                       #include "exynos5440-trip-points.dtsi"
+                };
+                cpu2_thermal: cpu2-thermal {
+                       thermal-sensors = <&tmuctrl_2>;
+                       #include "exynos5440-trip-points.dtsi"
+                };
         };
 
         sata@210000 {
diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
index f1cd2147421d..a626e6dd8022 100644
--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@@ -35,6 +35,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio3 22 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_usb_h1_vbus: regulator@1 {
@@ -45,6 +46,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio1 29 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_audio: regulator@2 {
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index fda4932faefd..945887d3fdb3 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -52,6 +52,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio4 0 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_usb_otg2_vbus: regulator@1 {
@@ -62,6 +63,7 @@
                         regulator-max-microvolt = <5000000>;
                         gpio = <&gpio4 2 0>;
                         enable-active-high;
+                        vin-supply = <&swbst_reg>;
                 };
 
                 reg_aud3v: regulator@2 {
diff --git a/arch/arm/boot/dts/omap5-core-thermal.dtsi b/arch/arm/boot/dts/omap5-core-thermal.dtsi
index 19212ac6eef0..de8a3d456cf7 100644
--- a/arch/arm/boot/dts/omap5-core-thermal.dtsi
+++ b/arch/arm/boot/dts/omap5-core-thermal.dtsi
@@ -13,7 +13,7 @@
 
 core_thermal: core_thermal {
         polling-delay-passive = <250>; /* milliseconds */
-        polling-delay = <1000>; /* milliseconds */
+        polling-delay = <500>; /* milliseconds */
 
                         /* sensor       ID */
         thermal-sensors = <&bandgap     2>;
diff --git a/arch/arm/boot/dts/omap5-gpu-thermal.dtsi b/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
index 1b87aca88b77..bc3090f2e84b 100644
--- a/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
+++ b/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
@@ -13,7 +13,7 @@
 
 gpu_thermal: gpu_thermal {
         polling-delay-passive = <250>; /* milliseconds */
-        polling-delay = <1000>; /* milliseconds */
+        polling-delay = <500>; /* milliseconds */
 
                         /* sensor       ID */
         thermal-sensors = <&bandgap     1>;
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index ddff674bd05e..4a485b63a141 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -1079,4 +1079,8 @@
         };
 };
 
+&cpu_thermal {
+        polling-delay = <500>; /* milliseconds */
+};
+
 /include/ "omap54xx-clocks.dtsi"
diff --git a/arch/arm/boot/dts/omap54xx-clocks.dtsi b/arch/arm/boot/dts/omap54xx-clocks.dtsi
index 58c27466f012..83b425fb3ac2 100644
--- a/arch/arm/boot/dts/omap54xx-clocks.dtsi
+++ b/arch/arm/boot/dts/omap54xx-clocks.dtsi
@@ -167,10 +167,18 @@
                 ti,index-starts-at-one;
         };
 
+        dpll_core_byp_mux: dpll_core_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x012c>;
+        };
+
         dpll_core_ck: dpll_core_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-core-clock";
-                clocks = <&sys_clkin>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin>, <&dpll_core_byp_mux>;
                 reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
         };
 
@@ -294,10 +302,18 @@
                 clock-div = <1>;
         };
 
+        dpll_iva_byp_mux: dpll_iva_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&iva_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x01ac>;
+        };
+
         dpll_iva_ck: dpll_iva_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin>, <&iva_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_iva_byp_mux>;
                 reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
         };
 
@@ -599,10 +615,19 @@
         };
 };
 &cm_core_clocks {
+
+        dpll_per_byp_mux: dpll_per_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&per_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x014c>;
+        };
+
         dpll_per_ck: dpll_per_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin>, <&per_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_per_byp_mux>;
                 reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
         };
 
@@ -714,10 +739,18 @@
                 ti,index-starts-at-one;
         };
 
+        dpll_usb_byp_mux: dpll_usb_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&usb_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x018c>;
+        };
+
         dpll_usb_ck: dpll_usb_ck {
                 #clock-cells = <0>;
                 compatible = "ti,omap4-dpll-j-type-clock";
-                clocks = <&sys_clkin>, <&usb_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_usb_byp_mux>;
                 reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
         };
 
diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
index 261311bdf65b..367af53c1b84 100644
--- a/arch/arm/boot/dts/sama5d3.dtsi
+++ b/arch/arm/boot/dts/sama5d3.dtsi
@@ -1248,7 +1248,6 @@
                                 atmel,watchdog-type = "hardware";
                                 atmel,reset-type = "all";
                                 atmel,dbg-halt;
-                                atmel,idle-halt;
                                 status = "disabled";
                         };
 
@@ -1416,7 +1415,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00700000 0x100000>;
                         interrupts = <32 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index d986b41b9654..4303874889c6 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -66,6 +66,7 @@
                 gpio4 = &pioE;
                 tcb0 = &tcb0;
                 tcb1 = &tcb1;
+                i2c0 = &i2c0;
                 i2c2 = &i2c2;
         };
         cpus {
@@ -259,7 +260,7 @@
                         compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                         reg = <0x00600000 0x100000>;
                         interrupts = <46 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ehci_clk", "uhpck";
                         status = "disabled";
                 };
@@ -461,8 +462,8 @@
 
                                         lcdck: lcdck {
                                                 #clock-cells = <0>;
-                                                reg = <4>;
-                                                clocks = <&smd>;
+                                                reg = <3>;
+                                                clocks = <&mck>;
                                         };
 
                                         smdck: smdck {
@@ -770,7 +771,7 @@
                                                 reg = <50>;
                                         };
 
-                                        lcd_clk: lcd_clk {
+                                        lcdc_clk: lcdc_clk {
                                                 #clock-cells = <0>;
                                                 reg = <51>;
                                         };
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 252c3d1bda50..9d8760956752 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -713,6 +713,9 @@
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&l4_sp_clk>;
+                        dmas = <&pdma 28>,
+                               <&pdma 29>;
+                        dma-names = "tx", "rx";
                 };
 
                 uart1: serial1@ffc03000 {
@@ -722,6 +725,9 @@
                         reg-shift = <2>;
                         reg-io-width = <4>;
                         clocks = <&l4_sp_clk>;
+                        dmas = <&pdma 30>,
+                               <&pdma 31>;
+                        dma-names = "tx", "rx";
                 };
 
                 rst: rstmgr@ffd05000 {
diff --git a/arch/arm/configs/at91_dt_defconfig b/arch/arm/configs/at91_dt_defconfig
index f2670f638e97..811e72bbe642 100644
--- a/arch/arm/configs/at91_dt_defconfig
+++ b/arch/arm/configs/at91_dt_defconfig
@@ -70,6 +70,7 @@ CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
+CONFIG_ARM_AT91_ETHER=y
 CONFIG_MACB=y
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_DM9000=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index b7e6b6fba5e0..06075b6d2463 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -99,7 +99,7 @@ CONFIG_PCI_RCAR_GEN2=y
 CONFIG_PCI_RCAR_GEN2_PCIE=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=8
+CONFIG_NR_CPUS=16
 CONFIG_HIGHPTE=y
 CONFIG_CMA=y
 CONFIG_ARM_APPENDED_DTB=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index a097cffa1231..8e108599e1af 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -377,6 +377,7 @@ CONFIG_PWM_TWL=m
 CONFIG_PWM_TWL_LED=m
 CONFIG_OMAP_USB2=m
 CONFIG_TI_PIPE3=y
+CONFIG_TWL4030_USB=m
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/configs/sama5_defconfig b/arch/arm/configs/sama5_defconfig
index 41d856effe6c..510c747c65b4 100644
--- a/arch/arm/configs/sama5_defconfig
+++ b/arch/arm/configs/sama5_defconfig
@@ -3,8 +3,6 @@
 CONFIG_SYSVIPC=y
 CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EMBEDDED=y
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index 38840a812924..8f6a5702b696 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -4,6 +4,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_PERF_EVENTS=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=8
 CONFIG_AEABI=y
 CONFIG_HIGHMEM=y
 CONFIG_HIGHPTE=y
diff --git a/arch/arm/configs/vexpress_defconfig b/arch/arm/configs/vexpress_defconfig
index f489fdaa19b8..37fe607a4ede 100644
--- a/arch/arm/configs/vexpress_defconfig
+++ b/arch/arm/configs/vexpress_defconfig
@@ -118,8 +118,8 @@ CONFIG_HID_ZEROPLUS=y
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=y
-CONFIG_USB_ISP1760_HCD=y
 CONFIG_USB_STORAGE=y
+CONFIG_USB_ISP1760=y
 CONFIG_MMC=y
 CONFIG_MMC_ARMMMCI=y
 CONFIG_NEW_LEDS=y
diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
index 71e5fc7cfb18..1d1800f71c5b 100644
--- a/arch/arm/crypto/aesbs-core.S_shipped
+++ b/arch/arm/crypto/aesbs-core.S_shipped
@@ -58,14 +58,18 @@
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
+
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -74,8 +78,6 @@
 .code   32
 #endif
 
-.fpu    neon
-
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
         vld1.8  {q8}, [r0]                      @ initial tweak
         adr     r2, .Lxts_magic
 
+#ifndef XTS_CHAIN_TWEAK
         tst     r9, #0xf                        @ if not multiple of 16
         it      ne                              @ Thumb2 thing, sanity check in ARM
         subne   r9, #0x10                       @ subtract another 16 bytes
+#endif
         subs    r9, #0x80
 
         blo     .Lxts_dec_short
diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
index be068db960ee..a4d3856e7d24 100644
--- a/arch/arm/crypto/bsaes-armv7.pl
+++ b/arch/arm/crypto/bsaes-armv7.pl
@@ -701,14 +701,18 @@ $code.=<<___;
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
+
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -717,8 +721,6 @@ $code.=<<___;
 .code   32
 #endif
 
-.fpu    neon
-
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
         vld1.8  {@XMM[8]}, [r0]                 @ initial tweak
         adr     $magic, .Lxts_magic
 
+#ifndef XTS_CHAIN_TWEAK
         tst     $len, #0xf                      @ if not multiple of 16
         it      ne                              @ Thumb2 thing, sanity check in ARM
         subne   $len, #0x10                     @ subtract another 16 bytes
+#endif
         subs    $len, #0x80
 
         blo     .Lxts_dec_short
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index bf0fe99e8ca9..4cf48c3aca13 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -149,29 +149,28 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
         (__boundary - 1 < (end) - 1)? __boundary: (end);                \
 })
 
+#define kvm_pgd_index(addr)                     pgd_index(addr)
+
 static inline bool kvm_page_empty(void *ptr)
 {
         struct page *ptr_page = virt_to_page(ptr);
         return page_count(ptr_page) == 1;
 }
 
-
 #define kvm_pte_table_empty(kvm, ptep) kvm_page_empty(ptep)
 #define kvm_pmd_table_empty(kvm, pmdp) kvm_page_empty(pmdp)
 #define kvm_pud_table_empty(kvm, pudp) (0)
 
 #define KVM_PREALLOC_LEVEL      0
 
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
+static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
-        return 0;
+        return kvm->arch.pgd;
 }
 
-static inline void kvm_free_hwpgd(struct kvm *kvm) { }
-
-static inline void *kvm_get_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        return kvm->arch.pgd;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 
 struct kvm;
diff --git a/arch/arm/include/debug/at91.S b/arch/arm/include/debug/at91.S
index 80a6501b4d50..c3c45e628e33 100644
--- a/arch/arm/include/debug/at91.S
+++ b/arch/arm/include/debug/at91.S
@@ -18,8 +18,11 @@
 #define AT91_DBGU 0xfc00c000 /* SAMA5D4_BASE_USART3 */
 #endif
 
-/* Keep in sync with mach-at91/include/mach/hardware.h */
+#ifdef CONFIG_MMU
 #define AT91_IO_P2V(x) ((x) - 0x01000000)
+#else
+#define AT91_IO_P2V(x) (x)
+#endif
 
 #define AT91_DBGU_SR            (0x14)  /* Status Register */
 #define AT91_DBGU_THR           (0x1c)  /* Transmitter Holding Register */
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 3e6859bc3e11..5656d79c5a44 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -290,7 +290,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
         phys_addr_t addr = start, end = start + size;
         phys_addr_t next;
 
-        pgd = pgdp + pgd_index(addr);
+        pgd = pgdp + kvm_pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
                 if (!pgd_none(*pgd))
@@ -355,7 +355,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
         phys_addr_t next;
         pgd_t *pgd;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
                 stage2_flush_puds(kvm, pgd, addr, next);
@@ -632,6 +632,20 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
                                      __phys_to_pfn(phys_addr), PAGE_HYP_DEVICE);
 }
 
+/* Free the HW pgd, one page at a time */
+static void kvm_free_hwpgd(void *hwpgd)
+{
+        free_pages_exact(hwpgd, kvm_get_hwpgd_size());
+}
+
+/* Allocate the HW PGD, making sure that each page gets its own refcount */
+static void *kvm_alloc_hwpgd(void)
+{
+        unsigned int size = kvm_get_hwpgd_size();
+
+        return alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO);
+}
+
 /**
  * kvm_alloc_stage2_pgd - allocate level-1 table for stage-2 translation.
  * @kvm:        The KVM struct pointer for the VM.
@@ -645,15 +659,31 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
  */
 int kvm_alloc_stage2_pgd(struct kvm *kvm)
 {
-        int ret;
         pgd_t *pgd;
+        void *hwpgd;
 
         if (kvm->arch.pgd != NULL) {
                 kvm_err("kvm_arch already initialized?\n");
                 return -EINVAL;
         }
 
+        hwpgd = kvm_alloc_hwpgd();
+        if (!hwpgd)
+                return -ENOMEM;
+
+        /* When the kernel uses more levels of page tables than the
+         * guest, we allocate a fake PGD and pre-populate it to point
+         * to the next-level page table, which will be the real
+         * initial page table pointed to by the VTTBR.
+         *
+         * When KVM_PREALLOC_LEVEL==2, we allocate a single page for
+         * the PMD and the kernel will use folded pud.
+         * When KVM_PREALLOC_LEVEL==1, we allocate 2 consecutive PUD
+         * pages.
+         */
         if (KVM_PREALLOC_LEVEL > 0) {
+                int i;
+
                 /*
                  * Allocate fake pgd for the page table manipulation macros to
                  * work.  This is not used by the hardware and we have no
@@ -661,30 +691,32 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
                  */
                 pgd = (pgd_t *)kmalloc(PTRS_PER_S2_PGD * sizeof(pgd_t),
                                        GFP_KERNEL | __GFP_ZERO);
+
+                if (!pgd) {
+                        kvm_free_hwpgd(hwpgd);
+                        return -ENOMEM;
+                }
+
+                /* Plug the HW PGD into the fake one. */
+                for (i = 0; i < PTRS_PER_S2_PGD; i++) {
+                        if (KVM_PREALLOC_LEVEL == 1)
+                                pgd_populate(NULL, pgd + i,
+                                             (pud_t *)hwpgd + i * PTRS_PER_PUD);
+                        else if (KVM_PREALLOC_LEVEL == 2)
+                                pud_populate(NULL, pud_offset(pgd, 0) + i,
+                                             (pmd_t *)hwpgd + i * PTRS_PER_PMD);
+                }
         } else {
                 /*
                  * Allocate actual first-level Stage-2 page table used by the
                  * hardware for Stage-2 page table walks.
                  */
-                pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, S2_PGD_ORDER);
+                pgd = (pgd_t *)hwpgd;
         }
 
-        if (!pgd)
-                return -ENOMEM;
-
-        ret = kvm_prealloc_hwpgd(kvm, pgd);
-        if (ret)
-                goto out_err;
-
         kvm_clean_pgd(pgd);
         kvm->arch.pgd = pgd;
         return 0;
-out_err:
-        if (KVM_PREALLOC_LEVEL > 0)
-                kfree(pgd);
-        else
-                free_pages((unsigned long)pgd, S2_PGD_ORDER);
-        return ret;
 }
 
 /**
@@ -785,11 +817,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
                 return;
 
         unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
-        kvm_free_hwpgd(kvm);
+        kvm_free_hwpgd(kvm_get_hwpgd(kvm));
         if (KVM_PREALLOC_LEVEL > 0)
                 kfree(kvm->arch.pgd);
-        else
-                free_pages((unsigned long)kvm->arch.pgd, S2_PGD_ORDER);
+
         kvm->arch.pgd = NULL;
 }
 
@@ -799,7 +830,7 @@ static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pgd_t *pgd;
         pud_t *pud;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         if (WARN_ON(pgd_none(*pgd))) {
                 if (!cache)
                         return NULL;
@@ -1089,7 +1120,7 @@ static void stage2_wp_range(struct kvm *kvm, phys_addr_t addr, phys_addr_t end)
         pgd_t *pgd;
         phys_addr_t next;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         do {
                 /*
                  * Release kvm_mmu_lock periodically if the memory region is
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 5e34fb143309..aa4116e9452f 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -270,37 +270,35 @@ static void __init at91_pm_sram_init(void)
         phys_addr_t sram_pbase;
         unsigned long sram_base;
         struct device_node *node;
-        struct platform_device *pdev;
+        struct platform_device *pdev = NULL;
 
-        node = of_find_compatible_node(NULL, NULL, "mmio-sram");
-        if (!node) {
-                pr_warn("%s: failed to find sram node!\n", __func__);
-                return;
+        for_each_compatible_node(node, NULL, "mmio-sram") {
+                pdev = of_find_device_by_node(node);
+                if (pdev) {
+                        of_node_put(node);
+                        break;
+                }
         }
 
-        pdev = of_find_device_by_node(node);
         if (!pdev) {
                 pr_warn("%s: failed to find sram device!\n", __func__);
-                goto put_node;
+                return;
         }
 
         sram_pool = dev_get_gen_pool(&pdev->dev);
         if (!sram_pool) {
                 pr_warn("%s: sram pool unavailable!\n", __func__);
-                goto put_node;
+                return;
         }
 
         sram_base = gen_pool_alloc(sram_pool, at91_slow_clock_sz);
         if (!sram_base) {
                 pr_warn("%s: unable to alloc ocram!\n", __func__);
-                goto put_node;
+                return;
         }
 
         sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base);
         slow_clock = __arm_ioremap_exec(sram_pbase, at91_slow_clock_sz, false);
-
-put_node:
-        of_node_put(node);
 }
 #endif
 
diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
index d2c89963af2d..86c0aa819d25 100644
--- a/arch/arm/mach-at91/pm.h
+++ b/arch/arm/mach-at91/pm.h
@@ -44,7 +44,7 @@ static inline void at91rm9200_standby(void)
                 "    mcr    p15, 0, %0, c7, c0, 4\n\t"
                 "    str    %5, [%1, %2]"
                 :
-                : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
+                : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
                   "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
                   "r" (lpr));
 }
diff --git a/arch/arm/mach-at91/pm_slowclock.S b/arch/arm/mach-at91/pm_slowclock.S
index 556151e85ec4..931f0e302c03 100644
--- a/arch/arm/mach-at91/pm_slowclock.S
+++ b/arch/arm/mach-at91/pm_slowclock.S
@@ -25,11 +25,6 @@
  */
 #undef SLOWDOWN_MASTER_CLOCK
 
-#define MCKRDY_TIMEOUT          1000
-#define MOSCRDY_TIMEOUT         1000
-#define PLLALOCK_TIMEOUT        1000
-#define PLLBLOCK_TIMEOUT        1000
-
 pmc     .req    r0
 sdramc  .req    r1
 ramc1   .req    r2
@@ -41,60 +36,42 @@ tmp2	.req	r5
  * Wait until master clock is ready (after switching master clock source)
  */
         .macro wait_mckrdy
-        mov     tmp2, #MCKRDY_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_MCKRDY
         beq     1b
-2:
         .endm
 
 /*
  * Wait until master oscillator has stabilized.
  */
         .macro wait_moscrdy
-        mov     tmp2, #MOSCRDY_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_MOSCS
         beq     1b
-2:
         .endm
 
 /*
  * Wait until PLLA has locked.
  */
         .macro wait_pllalock
-        mov     tmp2, #PLLALOCK_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_LOCKA
         beq     1b
-2:
         .endm
 
 /*
  * Wait until PLLB has locked.
  */
         .macro wait_pllblock
-        mov     tmp2, #PLLBLOCK_TIMEOUT
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
         tst     tmp1, #AT91_PMC_LOCKB
         beq     1b
-2:
         .endm
 
         .text
 
+        .arm
+
 /* void at91_slow_clock(void __iomem *pmc, void __iomem *sdramc,
  *                      void __iomem *ramc1, int memctrl)
  */
@@ -134,6 +111,16 @@ ddr_sr_enable:
         cmp     memctrl, #AT91_MEMCTRL_DDRSDR
         bne     sdr_sr_enable
 
+        /* LPDDR1 --> force DDR2 mode during self-refresh */
+        ldr     tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+        str     tmp1, .saved_sam9_mdr
+        bic     tmp1, tmp1, #~AT91_DDRSDRC_MD
+        cmp     tmp1, #AT91_DDRSDRC_MD_LOW_POWER_DDR
+        ldreq   tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+        biceq   tmp1, tmp1, #AT91_DDRSDRC_MD
+        orreq   tmp1, tmp1, #AT91_DDRSDRC_MD_DDR2
+        streq   tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+
         /* prepare for DDRAM self-refresh mode */
         ldr     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
         str     tmp1, .saved_sam9_lpr
@@ -142,14 +129,26 @@ ddr_sr_enable:
 
         /* figure out if we use the second ram controller */
         cmp     ramc1, #0
-        ldrne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
-        strne   tmp2, .saved_sam9_lpr1
-        bicne   tmp2, #AT91_DDRSDRC_LPCB
-        orrne   tmp2, #AT91_DDRSDRC_LPCB_SELF_REFRESH
+        beq     ddr_no_2nd_ctrl
+
+        ldr     tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+        str     tmp2, .saved_sam9_mdr1
+        bic     tmp2, tmp2, #~AT91_DDRSDRC_MD
+        cmp     tmp2, #AT91_DDRSDRC_MD_LOW_POWER_DDR
+        ldreq   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+        biceq   tmp2, tmp2, #AT91_DDRSDRC_MD
+        orreq   tmp2, tmp2, #AT91_DDRSDRC_MD_DDR2
+        streq   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+
+        ldr     tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+        str     tmp2, .saved_sam9_lpr1
+        bic     tmp2, #AT91_DDRSDRC_LPCB
+        orr     tmp2, #AT91_DDRSDRC_LPCB_SELF_REFRESH
 
         /* Enable DDRAM self-refresh mode */
+        str     tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+ddr_no_2nd_ctrl:
         str     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
-        strne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
 
         b       sdr_sr_done
 
@@ -208,6 +207,7 @@ sdr_sr_done:
         /* Turn off the main oscillator */
         ldr     tmp1, [pmc, #AT91_CKGR_MOR]
         bic     tmp1, tmp1, #AT91_PMC_MOSCEN
+        orr     tmp1, tmp1, #AT91_PMC_KEY
         str     tmp1, [pmc, #AT91_CKGR_MOR]
 
         /* Wait for interrupt */
@@ -216,6 +216,7 @@ sdr_sr_done:
         /* Turn on the main oscillator */
         ldr     tmp1, [pmc, #AT91_CKGR_MOR]
         orr     tmp1, tmp1, #AT91_PMC_MOSCEN
+        orr     tmp1, tmp1, #AT91_PMC_KEY
         str     tmp1, [pmc, #AT91_CKGR_MOR]
 
         wait_moscrdy
@@ -280,12 +281,17 @@ sdr_sr_done:
          */
         cmp     memctrl, #AT91_MEMCTRL_DDRSDR
         bne     sdr_en_restore
+        /* Restore MDR in case of LPDDR1 */
+        ldr     tmp1, .saved_sam9_mdr
+        str     tmp1, [sdramc, #AT91_DDRSDRC_MDR]
         /* Restore LPR on AT91 with DDRAM */
         ldr     tmp1, .saved_sam9_lpr
         str     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
 
         /* if we use the second ram controller */
         cmp     ramc1, #0
+        ldrne   tmp2, .saved_sam9_mdr1
+        strne   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
         ldrne   tmp2, .saved_sam9_lpr1
         strne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
 
@@ -319,5 +325,11 @@ ram_restored:
 .saved_sam9_lpr1:
         .word 0
 
+.saved_sam9_mdr:
+        .word 0
+
+.saved_sam9_mdr1:
+        .word 0
+
 ENTRY(at91_slow_clock_sz)
         .word .-at91_slow_clock
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 3f32c47a6d74..d2e9f12d12f1 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -126,8 +126,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
  */
 void exynos_cpu_power_down(int cpu)
 {
-        if (cpu == 0 && (of_machine_is_compatible("samsung,exynos5420") ||
-                of_machine_is_compatible("samsung,exynos5800"))) {
+        if (cpu == 0 && (soc_is_exynos5420() || soc_is_exynos5800())) {
                 /*
                  * Bypass power down for CPU0 during suspend. Check for
                  * the SYS_PWR_REG value to decide if we are suspending
diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c
index 20f267121b3e..37266a826437 100644
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -161,6 +161,34 @@ no_clk:
                 of_genpd_add_provider_simple(np, &pd->pd);
         }
 
+        /* Assign the child power domains to their parents */
+        for_each_compatible_node(np, NULL, "samsung,exynos4210-pd") {
+                struct generic_pm_domain *child_domain, *parent_domain;
+                struct of_phandle_args args;
+
+                args.np = np;
+                args.args_count = 0;
+                child_domain = of_genpd_get_from_provider(&args);
+                if (!child_domain)
+                        continue;
+
+                if (of_parse_phandle_with_args(np, "power-domains",
+                                         "#power-domain-cells", 0, &args) != 0)
+                        continue;
+
+                parent_domain = of_genpd_get_from_provider(&args);
+                if (!parent_domain)
+                        continue;
+
+                if (pm_genpd_add_subdomain(parent_domain, child_domain))
+                        pr_warn("%s failed to add subdomain: %s\n",
+                                parent_domain->name, child_domain->name);
+                else
+                        pr_info("%s has as child subdomain: %s.\n",
+                                parent_domain->name, child_domain->name);
+                of_node_put(np);
+        }
+
         return 0;
 }
 arch_initcall(exynos4_pm_init_power_domain);
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
index 52e2b1a2fddb..318d127df147 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
@@ -87,8 +87,8 @@ static unsigned int exynos_pmu_spare3;
 static u32 exynos_irqwake_intmask = 0xffffffff;
 
 static const struct exynos_wkup_irq exynos3250_wkup_irq[] = {
-        { 73, BIT(1) }, /* RTC alarm */
-        { 74, BIT(2) }, /* RTC tick */
+        { 105, BIT(1) }, /* RTC alarm */
+        { 106, BIT(2) }, /* RTC tick */
         { /* sentinel */ },
 };
 
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 4ad6e473cf83..9de3412af406 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -211,8 +211,9 @@ static void __init imx6q_1588_init(void)
          * set bit IOMUXC_GPR1[21].  Or the PTP clock must be from pad
          * (external OSC), and we need to clear the bit.
          */
-        clksel = ptp_clk == enet_ref ? IMX6Q_GPR1_ENET_CLK_SEL_ANATOP :
-                                       IMX6Q_GPR1_ENET_CLK_SEL_PAD;
+        clksel = clk_is_match(ptp_clk, enet_ref) ?
+                                IMX6Q_GPR1_ENET_CLK_SEL_ANATOP :
+                                IMX6Q_GPR1_ENET_CLK_SEL_PAD;
         gpr = syscon_regmap_lookup_by_compatible("fsl,imx6q-iomuxc-gpr");
         if (!IS_ERR(gpr))
                 regmap_update_bits(gpr, IOMUXC_GPR1,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 92afb723dcfc..355b08936871 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1692,16 +1692,15 @@ static int _deassert_hardreset(struct omap_hwmod *oh, const char *name)
         if (ret == -EBUSY)
                 pr_warn("omap_hwmod: %s: failed to hardreset\n", oh->name);
 
-        if (!ret) {
+        if (oh->clkdm) {
                 /*
                  * Set the clockdomain to HW_AUTO, assuming that the
                  * previous state was HW_AUTO.
                  */
-                if (oh->clkdm && hwsup)
+                if (hwsup)
                         clkdm_allow_idle(oh->clkdm);
-        } else {
-                if (oh->clkdm)
-                        clkdm_hwmod_disable(oh->clkdm, oh);
+
+                clkdm_hwmod_disable(oh->clkdm, oh);
         }
 
         return ret;
@@ -2698,6 +2697,7 @@ static int __init _register(struct omap_hwmod *oh)
         INIT_LIST_HEAD(&oh->master_ports);
         INIT_LIST_HEAD(&oh->slave_ports);
         spin_lock_init(&oh->_lock);
+        lockdep_set_class(&oh->_lock, &oh->hwmod_key);
 
         oh->_state = _HWMOD_STATE_REGISTERED;
 
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 9d4bec6ee742..9611c91d9b82 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -674,6 +674,7 @@ struct omap_hwmod {
         u32                             _sysc_cache;
         void __iomem                    *_mpu_rt_va;
         spinlock_t                      _lock;
+        struct lock_class_key           hwmod_key; /* unique lock class */
         struct list_head                node;
         struct omap_hwmod_ocp_if        *_mpu_port;
         unsigned int                    (*xlate_irq)(unsigned int);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index e8692e7675b8..16fe7a1b7a35 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1466,55 +1466,18 @@ static struct omap_hwmod dra7xx_ocp2scp3_hwmod = {
  *
  */
 
-static struct omap_hwmod_class dra7xx_pcie_hwmod_class = {
+static struct omap_hwmod_class dra7xx_pciess_hwmod_class = {
         .name   = "pcie",
 };
 
 /* pcie1 */
-static struct omap_hwmod dra7xx_pcie1_hwmod = {
+static struct omap_hwmod dra7xx_pciess1_hwmod = {
         .name           = "pcie1",
-        .class          = &dra7xx_pcie_hwmod_class,
+        .class          = &dra7xx_pciess_hwmod_class,
         .clkdm_name     = "pcie_clkdm",
         .main_clk       = "l4_root_clk_div",
         .prcm = {
                 .omap4 = {
-                        .clkctrl_offs   = DRA7XX_CM_PCIE_CLKSTCTRL_OFFSET,
-                        .modulemode     = MODULEMODE_SWCTRL,
-                },
-        },
-};
-
-/* pcie2 */
-static struct omap_hwmod dra7xx_pcie2_hwmod = {
-        .name           = "pcie2",
-        .class          = &dra7xx_pcie_hwmod_class,
-        .clkdm_name     = "pcie_clkdm",
-        .main_clk       = "l4_root_clk_div",
-        .prcm = {
-                .omap4 = {
-                        .clkctrl_offs = DRA7XX_CM_PCIE_CLKSTCTRL_OFFSET,
-                        .modulemode   = MODULEMODE_SWCTRL,
-                },
-        },
-};
-
-/*
- * 'PCIE PHY' class
- *
- */
-
-static struct omap_hwmod_class dra7xx_pcie_phy_hwmod_class = {
-        .name   = "pcie-phy",
-};
-
-/* pcie1 phy */
-static struct omap_hwmod dra7xx_pcie1_phy_hwmod = {
-        .name           = "pcie1-phy",
-        .class          = &dra7xx_pcie_phy_hwmod_class,
-        .clkdm_name     = "l3init_clkdm",
-        .main_clk       = "l4_root_clk_div",
-        .prcm = {
-                .omap4 = {
                         .clkctrl_offs = DRA7XX_CM_L3INIT_PCIESS1_CLKCTRL_OFFSET,
                         .context_offs = DRA7XX_RM_L3INIT_PCIESS1_CONTEXT_OFFSET,
                         .modulemode   = MODULEMODE_SWCTRL,
@@ -1522,11 +1485,11 @@ static struct omap_hwmod dra7xx_pcie1_phy_hwmod = {
         },
 };
 
-/* pcie2 phy */
-static struct omap_hwmod dra7xx_pcie2_phy_hwmod = {
-        .name           = "pcie2-phy",
-        .class          = &dra7xx_pcie_phy_hwmod_class,
-        .clkdm_name     = "l3init_clkdm",
+/* pcie2 */
+static struct omap_hwmod dra7xx_pciess2_hwmod = {
+        .name           = "pcie2",
+        .class          = &dra7xx_pciess_hwmod_class,
+        .clkdm_name     = "pcie_clkdm",
         .main_clk       = "l4_root_clk_div",
         .prcm = {
                 .omap4 = {
@@ -2877,50 +2840,34 @@ static struct omap_hwmod_ocp_if dra7xx_l4_cfg__ocp2scp3 = {
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l3_main_1 -> pcie1 */
-static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pcie1 = {
+/* l3_main_1 -> pciess1 */
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pciess1 = {
         .master         = &dra7xx_l3_main_1_hwmod,
-        .slave          = &dra7xx_pcie1_hwmod,
+        .slave          = &dra7xx_pciess1_hwmod,
         .clk            = "l3_iclk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l4_cfg -> pcie1 */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie1 = {
+/* l4_cfg -> pciess1 */
+static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pciess1 = {
         .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie1_hwmod,
+        .slave          = &dra7xx_pciess1_hwmod,
         .clk            = "l4_root_clk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l3_main_1 -> pcie2 */
-static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pcie2 = {
+/* l3_main_1 -> pciess2 */
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pciess2 = {
         .master         = &dra7xx_l3_main_1_hwmod,
-        .slave          = &dra7xx_pcie2_hwmod,
+        .slave          = &dra7xx_pciess2_hwmod,
         .clk            = "l3_iclk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
-/* l4_cfg -> pcie2 */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie2 = {
-        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie2_hwmod,
-        .clk            = "l4_root_clk_div",
-        .user           = OCP_USER_MPU | OCP_USER_SDMA,
-};
-
-/* l4_cfg -> pcie1 phy */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie1_phy = {
-        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie1_phy_hwmod,
-        .clk            = "l4_root_clk_div",
-        .user           = OCP_USER_MPU | OCP_USER_SDMA,
-};
-
-/* l4_cfg -> pcie2 phy */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie2_phy = {
+/* l4_cfg -> pciess2 */
+static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pciess2 = {
         .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie2_phy_hwmod,
+        .slave          = &dra7xx_pciess2_hwmod,
         .clk            = "l4_root_clk_div",
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
@@ -3327,12 +3274,10 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
         &dra7xx_l4_cfg__mpu,
         &dra7xx_l4_cfg__ocp2scp1,
         &dra7xx_l4_cfg__ocp2scp3,
-        &dra7xx_l3_main_1__pcie1,
-        &dra7xx_l4_cfg__pcie1,
-        &dra7xx_l3_main_1__pcie2,
-        &dra7xx_l4_cfg__pcie2,
-        &dra7xx_l4_cfg__pcie1_phy,
-        &dra7xx_l4_cfg__pcie2_phy,
+        &dra7xx_l3_main_1__pciess1,
+        &dra7xx_l4_cfg__pciess1,
+        &dra7xx_l3_main_1__pciess2,
+        &dra7xx_l4_cfg__pciess2,
         &dra7xx_l3_main_1__qspi,
         &dra7xx_l4_per3__rtcss,
         &dra7xx_l4_cfg__sata,
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 190fa43e7479..e642b079e9f3 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -173,6 +173,7 @@ static void __init omap3_igep0030_rev_g_legacy_init(void)
 
 static void __init omap3_evm_legacy_init(void)
 {
+        hsmmc2_internal_input_clk();
         legacy_init_wl12xx(WL12XX_REFCLOCK_38, 0, 149);
 }
 
diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
index a08a617a6c11..d6d6bc39e05c 100644
--- a/arch/arm/mach-omap2/prm44xx.c
+++ b/arch/arm/mach-omap2/prm44xx.c
@@ -252,10 +252,10 @@ static void omap44xx_prm_save_and_clear_irqen(u32 *saved_mask)
 {
         saved_mask[0] =
                 omap4_prm_read_inst_reg(OMAP4430_PRM_OCP_SOCKET_INST,
-                                        OMAP4_PRM_IRQSTATUS_MPU_OFFSET);
+                                        OMAP4_PRM_IRQENABLE_MPU_OFFSET);
         saved_mask[1] =
                 omap4_prm_read_inst_reg(OMAP4430_PRM_OCP_SOCKET_INST,
-                                        OMAP4_PRM_IRQSTATUS_MPU_2_OFFSET);
+                                        OMAP4_PRM_IRQENABLE_MPU_2_OFFSET);
 
         omap4_prm_write_inst_reg(0, OMAP4430_PRM_OCP_SOCKET_INST,
                                  OMAP4_PRM_IRQENABLE_MPU_OFFSET);
diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h
index 483cb467bf65..a0f3b1cd497c 100644
--- a/arch/arm/mach-socfpga/core.h
+++ b/arch/arm/mach-socfpga/core.h
@@ -45,6 +45,6 @@ extern char secondary_trampoline, secondary_trampoline_end;
 
 extern unsigned long socfpga_cpu1start_addr;
 
-#define SOCFPGA_SCU_VIRT_BASE   0xfffec000
+#define SOCFPGA_SCU_VIRT_BASE   0xfee00000
 
 #endif
diff --git a/arch/arm/mach-socfpga/socfpga.c b/arch/arm/mach-socfpga/socfpga.c
index 383d61e138af..f5e597c207b9 100644
--- a/arch/arm/mach-socfpga/socfpga.c
+++ b/arch/arm/mach-socfpga/socfpga.c
@@ -23,6 +23,7 @@
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
+#include <asm/cacheflush.h>
 
 #include "core.h"
 
@@ -73,6 +74,10 @@ void __init socfpga_sysmgr_init(void)
                         (u32 *) &socfpga_cpu1start_addr))
                 pr_err("SMP: Need cpu1-start-addr in device tree.\n");
 
+        /* Ensure that socfpga_cpu1start_addr is visible to other CPUs */
+        smp_wmb();
+        sync_cache_w(&socfpga_cpu1start_addr);
+
         sys_manager_base_addr = of_iomap(np, 0);
 
         np = of_find_compatible_node(NULL, NULL, "altr,rst-mgr");
diff --git a/arch/arm/mach-sti/board-dt.c b/arch/arm/mach-sti/board-dt.c
index b067390cef4e..b373acade338 100644
--- a/arch/arm/mach-sti/board-dt.c
+++ b/arch/arm/mach-sti/board-dt.c
@@ -18,6 +18,7 @@ static const char *stih41x_dt_match[] __initdata = {
         "st,stih415",
         "st,stih416",
         "st,stih407",
+        "st,stih410",
         "st,stih418",
         NULL
 };
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 94674eb7e7bb..54bb4ba97441 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -129,6 +129,9 @@
  * 40 bits wide (T0SZ = 24).  Systems with a PARange smaller than 40 bits are
  * not known to exist and will break with this configuration.
  *
+ * VTCR_EL2.PS is extracted from ID_AA64MMFR0_EL1.PARange at boot time
+ * (see hyp-init.S).
+ *
  * Note that when using 4K pages, we concatenate two first level page tables
  * together.
  *
@@ -138,7 +141,6 @@
 #ifdef CONFIG_ARM64_64K_PAGES
 /*
  * Stage2 translation configuration:
- * 40bits output (PS = 2)
  * 40bits input  (T0SZ = 24)
  * 64kB pages (TG0 = 1)
  * 2 level page tables (SL = 1)
@@ -150,7 +152,6 @@
 #else
 /*
  * Stage2 translation configuration:
- * 40bits output (PS = 2)
  * 40bits input  (T0SZ = 24)
  * 4kB pages (TG0 = 0)
  * 3 level page tables (SL = 1)
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 6458b5373142..bbfb600fa822 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -158,6 +158,8 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define PTRS_PER_S2_PGD         (1 << PTRS_PER_S2_PGD_SHIFT)
 #define S2_PGD_ORDER            get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
 
+#define kvm_pgd_index(addr)     (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
+
 /*
  * If we are concatenating first level stage-2 page tables, we would have less
  * than or equal to 16 pointers in the fake PGD, because that's what the
@@ -171,43 +173,6 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define KVM_PREALLOC_LEVEL      (0)
 #endif
 
-/**
- * kvm_prealloc_hwpgd - allocate inital table for VTTBR
- * @kvm:        The KVM struct pointer for the VM.
- * @pgd:        The kernel pseudo pgd
- *
- * When the kernel uses more levels of page tables than the guest, we allocate
- * a fake PGD and pre-populate it to point to the next-level page table, which
- * will be the real initial page table pointed to by the VTTBR.
- *
- * When KVM_PREALLOC_LEVEL==2, we allocate a single page for the PMD and
- * the kernel will use folded pud.  When KVM_PREALLOC_LEVEL==1, we
- * allocate 2 consecutive PUD pages.
- */
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
-{
-        unsigned int i;
-        unsigned long hwpgd;
-
-        if (KVM_PREALLOC_LEVEL == 0)
-                return 0;
-
-        hwpgd = __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTRS_PER_S2_PGD_SHIFT);
-        if (!hwpgd)
-                return -ENOMEM;
-
-        for (i = 0; i < PTRS_PER_S2_PGD; i++) {
-                if (KVM_PREALLOC_LEVEL == 1)
-                        pgd_populate(NULL, pgd + i,
-                                     (pud_t *)hwpgd + i * PTRS_PER_PUD);
-                else if (KVM_PREALLOC_LEVEL == 2)
-                        pud_populate(NULL, pud_offset(pgd, 0) + i,
-                                     (pmd_t *)hwpgd + i * PTRS_PER_PMD);
-        }
-
-        return 0;
-}
-
 static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
         pgd_t *pgd = kvm->arch.pgd;
@@ -224,12 +189,11 @@ static inline void *kvm_get_hwpgd(struct kvm *kvm)
         return pmd_offset(pud, 0);
 }
 
-static inline void kvm_free_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        if (KVM_PREALLOC_LEVEL > 0) {
-                unsigned long hwpgd = (unsigned long)kvm_get_hwpgd(kvm);
-                free_pages(hwpgd, PTRS_PER_S2_PGD_SHIFT);
-        }
+        if (KVM_PREALLOC_LEVEL > 0)
+                return PTRS_PER_S2_PGD * PAGE_SIZE;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index c028fe37456f..53d9c354219f 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_gather *tlb)
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
                                   unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
         pgtable_page_dtor(pte);
         tlb_remove_entry(tlb, pte);
 }
@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
                                   unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
         tlb_remove_entry(tlb, virt_to_page(pmdp));
 }
 #endif
@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
                                   unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
         tlb_remove_entry(tlb, virt_to_page(pudp));
 }
 #endif
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index 4abe9b945f77..c3bb05b98616 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -144,6 +144,19 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end
 }
 
 /*
+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
+ * table levels (pgd/pud/pmd).
+ */
+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
+                                       unsigned long uaddr)
+{
+        unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
+
+        dsb(ishst);
+        asm("tlbi       vae1is, %0" : : "r" (addr));
+        dsb(ish);
+}
+/*
  * On AArch64, the cache coherency is handled via the set_pte_at() function.
  */
 static inline void update_mmu_cache(struct vm_area_struct *vma,
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index b42c7b480e1e..2b8d70164428 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -354,3 +354,12 @@ void efi_virtmap_unload(void)
         efi_set_pgd(current->active_mm);
         preempt_enable();
 }
+
+/*
+ * UpdateCapsule() depends on the system being shutdown via
+ * ResetSystem().
+ */
+bool efi_poweroff_required(void)
+{
+        return efi_enabled(EFI_RUNTIME_SERVICES);
+}
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 8ce88e08c030..07f930540f4a 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -585,8 +585,8 @@ ENDPROC(set_cpu_boot_mode_flag)
  * zeroing of .bss would clobber it.
  */
         .pushsection    .data..cacheline_aligned
-ENTRY(__boot_cpu_mode)
         .align  L1_CACHE_SHIFT
+ENTRY(__boot_cpu_mode)
         .long   BOOT_CPU_MODE_EL2
         .long   0
         .popsection
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index fde9923af859..c6b1f3b96f45 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -21,6 +21,7 @@
 #include <stdarg.h>
 
 #include <linux/compat.h>
+#include <linux/efi.h>
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
@@ -150,6 +151,13 @@ void machine_restart(char *cmd)
         local_irq_disable();
         smp_send_stop();
 
+        /*
+         * UpdateCapsule() depends on the system being reset via
+         * ResetSystem().
+         */
+        if (efi_enabled(EFI_RUNTIME_SERVICES))
+                efi_reboot(reboot_mode, NULL);
+
         /* Now call the architecture specific reboot code. */
         if (arm_pm_restart)
                 arm_pm_restart(reboot_mode, cmd);
diff --git a/arch/c6x/include/asm/pgtable.h b/arch/c6x/include/asm/pgtable.h
index 78d4483ba40c..ec4db6df5e0d 100644
--- a/arch/c6x/include/asm/pgtable.h
+++ b/arch/c6x/include/asm/pgtable.h
@@ -67,6 +67,11 @@ extern unsigned long empty_zero_page;
  */
 #define pgtable_cache_init()   do { } while (0)
 
+/*
+ * c6x is !MMU, so define the simpliest implementation
+ */
+#define pgprot_writecombine pgprot_noncached
+
 #include <asm-generic/pgtable.h>
 
 #endif /* _ASM_C6X_PGTABLE_H */
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 0536bc021cc6..ef548510b951 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -348,8 +348,9 @@ C_ENTRY(_user_exception):
  * The LP register should point to the location where the called function
  * should return.  [note that MAKE_SYS_CALL uses label 1] */
         /* See if the system call number is valid */
+        blti    r12, 5f
         addi    r11, r12, -__NR_syscalls;
-        bgei    r11,5f;
+        bgei    r11, 5f;
         /* Figure out which function to use for this system call.  */
         /* Note Microblaze barrel shift is optional, so don't rely on it */
         add     r12, r12, r12;                  /* convert num -> ptr */
@@ -375,7 +376,7 @@ C_ENTRY(_user_exception):
 
         /* The syscall number is invalid, return an error.  */
 5:
-        rtsd    r15, 8;         /* looks like a normal subroutine return */
+        braid   ret_from_trap
         addi    r3, r0, -ENOSYS;
 
 /* Entry point used to return from a syscall/trap */
@@ -411,7 +412,7 @@ C_ENTRY(ret_from_trap):
         bri     1b
 
         /* Maybe handle a signal */
-5:      
+5:
         andi    r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
         beqi    r11, 4f;                /* Signals to handle, handle them */
 
diff --git a/arch/nios2/include/asm/ptrace.h b/arch/nios2/include/asm/ptrace.h
index 20fb1cf2dab6..642462144872 100644
--- a/arch/nios2/include/asm/ptrace.h
+++ b/arch/nios2/include/asm/ptrace.h
@@ -15,7 +15,54 @@
 
 #include <uapi/asm/ptrace.h>
 
+/* This struct defines the way the registers are stored on the
+   stack during a system call.  */
+
 #ifndef __ASSEMBLY__
+struct pt_regs {
+        unsigned long  r8;      /* r8-r15 Caller-saved GP registers */
+        unsigned long  r9;
+        unsigned long  r10;
+        unsigned long  r11;
+        unsigned long  r12;
+        unsigned long  r13;
+        unsigned long  r14;
+        unsigned long  r15;
+        unsigned long  r1;      /* Assembler temporary */
+        unsigned long  r2;      /* Retval LS 32bits */
+        unsigned long  r3;      /* Retval MS 32bits */
+        unsigned long  r4;      /* r4-r7 Register arguments */
+        unsigned long  r5;
+        unsigned long  r6;
+        unsigned long  r7;
+        unsigned long  orig_r2; /* Copy of r2 ?? */
+        unsigned long  ra;      /* Return address */
+        unsigned long  fp;      /* Frame pointer */
+        unsigned long  sp;      /* Stack pointer */
+        unsigned long  gp;      /* Global pointer */
+        unsigned long  estatus;
+        unsigned long  ea;      /* Exception return address (pc) */
+        unsigned long  orig_r7;
+};
+
+/*
+ * This is the extended stack used by signal handlers and the context
+ * switcher: it's pushed after the normal "struct pt_regs".
+ */
+struct switch_stack {
+        unsigned long  r16;     /* r16-r23 Callee-saved GP registers */
+        unsigned long  r17;
+        unsigned long  r18;
+        unsigned long  r19;
+        unsigned long  r20;
+        unsigned long  r21;
+        unsigned long  r22;
+        unsigned long  r23;
+        unsigned long  fp;
+        unsigned long  gp;
+        unsigned long  ra;
+};
+
 #define user_mode(regs) (((regs)->estatus & ESTATUS_EU))
 
 #define instruction_pointer(regs)       ((regs)->ra)
diff --git a/arch/nios2/include/asm/ucontext.h b/arch/nios2/include/asm/ucontext.h
deleted file mode 100644
index 2c87614b0f6e..000000000000
--- a/arch/nios2/include/asm/ucontext.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) 2010 Tobias Klauser <tklauser@distanz.ch>
- * Copyright (C) 2004 Microtronix Datacom Ltd
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef _ASM_NIOS2_UCONTEXT_H
-#define _ASM_NIOS2_UCONTEXT_H
-
-typedef int greg_t;
-#define NGREG 32
-typedef greg_t gregset_t[NGREG];
-
-struct mcontext {
-        int version;
-        gregset_t gregs;
-};
-
-#define MCONTEXT_VERSION 2
-
-struct ucontext {
-        unsigned long     uc_flags;
-        struct ucontext  *uc_link;
-        stack_t           uc_stack;
-        struct mcontext   uc_mcontext;
-        sigset_t          uc_sigmask;   /* mask last for extensibility */
-};
-
-#endif
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 4f07ca3f8d10..e0bb972a50d7 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 header-y += elf.h
-header-y += ucontext.h
+
+generic-y += ucontext.h
diff --git a/arch/nios2/include/uapi/asm/elf.h b/arch/nios2/include/uapi/asm/elf.h
index a5b91ae5cf56..6f06d3b2949e 100644
--- a/arch/nios2/include/uapi/asm/elf.h
+++ b/arch/nios2/include/uapi/asm/elf.h
@@ -50,9 +50,7 @@
 
 typedef unsigned long elf_greg_t;
 
-#define ELF_NGREG       \
-        ((sizeof(struct pt_regs) + sizeof(struct switch_stack)) /       \
-                sizeof(elf_greg_t))
+#define ELF_NGREG               49
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
 typedef unsigned long elf_fpregset_t;
diff --git a/arch/nios2/include/uapi/asm/ptrace.h b/arch/nios2/include/uapi/asm/ptrace.h
index e83a7c9d1c36..71a330597adf 100644
--- a/arch/nios2/include/uapi/asm/ptrace.h
+++ b/arch/nios2/include/uapi/asm/ptrace.h
@@ -67,53 +67,9 @@
 
 #define NUM_PTRACE_REG (PTR_TLBMISC + 1)
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call.
-
-   There is a fake_regs in setup.c that has to match pt_regs.*/
-
-struct pt_regs {
-        unsigned long  r8;              /* r8-r15 Caller-saved GP registers */
-        unsigned long  r9;
-        unsigned long  r10;
-        unsigned long  r11;
-        unsigned long  r12;
-        unsigned long  r13;
-        unsigned long  r14;
-        unsigned long  r15;
-        unsigned long  r1;              /* Assembler temporary */
-        unsigned long  r2;              /* Retval LS 32bits */
-        unsigned long  r3;              /* Retval MS 32bits */
-        unsigned long  r4;              /* r4-r7 Register arguments */
-        unsigned long  r5;
-        unsigned long  r6;
-        unsigned long  r7;
-        unsigned long  orig_r2;         /* Copy of r2 ?? */
-        unsigned long  ra;              /* Return address */
-        unsigned long  fp;              /* Frame pointer */
-        unsigned long  sp;              /* Stack pointer */
-        unsigned long  gp;              /* Global pointer */
-        unsigned long  estatus;
-        unsigned long  ea;              /* Exception return address (pc) */
-        unsigned long  orig_r7;
-};
-
-/*
- * This is the extended stack used by signal handlers and the context
- * switcher: it's pushed after the normal "struct pt_regs".
- */
-struct switch_stack {
-        unsigned long  r16;             /* r16-r23 Callee-saved GP registers */
-        unsigned long  r17;
-        unsigned long  r18;
-        unsigned long  r19;
-        unsigned long  r20;
-        unsigned long  r21;
-        unsigned long  r22;
-        unsigned long  r23;
-        unsigned long  fp;
-        unsigned long  gp;
-        unsigned long  ra;
+/* User structures for general purpose registers.  */
+struct user_pt_regs {
+        __u32           regs[49];
 };
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/nios2/include/uapi/asm/sigcontext.h b/arch/nios2/include/uapi/asm/sigcontext.h
index 7b8bb41867d4..b67944a50927 100644
--- a/arch/nios2/include/uapi/asm/sigcontext.h
+++ b/arch/nios2/include/uapi/asm/sigcontext.h
@@ -15,14 +15,16 @@
  * details.
  */
 
-#ifndef _ASM_NIOS2_SIGCONTEXT_H
-#define _ASM_NIOS2_SIGCONTEXT_H
+#ifndef _UAPI__ASM_SIGCONTEXT_H
+#define _UAPI__ASM_SIGCONTEXT_H
 
-#include <asm/ptrace.h>
+#include <linux/types.h>
+
+#define MCONTEXT_VERSION 2
 
 struct sigcontext {
-        struct pt_regs regs;
-        unsigned long  sc_mask; /* old sigmask */
+        int version;
+        unsigned long gregs[32];
 };
 
 #endif
diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c
index 2d0ea25be171..dda41e4fe707 100644
--- a/arch/nios2/kernel/signal.c
+++ b/arch/nios2/kernel/signal.c
@@ -39,7 +39,7 @@ static inline int rt_restore_ucontext(struct pt_regs *regs,
                                         struct ucontext *uc, int *pr2)
 {
         int temp;
-        greg_t *gregs = uc->uc_mcontext.gregs;
+        unsigned long *gregs = uc->uc_mcontext.gregs;
         int err;
 
         /* Always make any pending restarted system calls return -EINTR */
@@ -127,7 +127,7 @@ badframe:
 static inline int rt_setup_ucontext(struct ucontext *uc, struct pt_regs *regs)
 {
         struct switch_stack *sw = (struct switch_stack *)regs - 1;
-        greg_t *gregs = uc->uc_mcontext.gregs;
+        unsigned long *gregs = uc->uc_mcontext.gregs;
         int err = 0;
 
         err |= __put_user(MCONTEXT_VERSION, &uc->uc_mcontext.version);
diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c
index 0d231adfe576..0c9b6afe69e9 100644
--- a/arch/nios2/mm/fault.c
+++ b/arch/nios2/mm/fault.c
@@ -126,7 +126,6 @@ good_area:
                 break;
         }
 
-survive:
         /*
          * If for any reason at all we couldn't handle the fault,
          * make sure we exit gracefully rather than endlessly redo
@@ -220,11 +219,6 @@ no_context:
  */
 out_of_memory:
         up_read(&mm->mmap_sem);
-        if (is_global_init(tsk)) {
-                yield();
-                down_read(&mm->mmap_sem);
-                goto survive;
-        }
         if (!user_mode(regs))
                 goto no_context;
         pagefault_out_of_memory();
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f6579cfde2df..19e17bd7aec0 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -165,7 +165,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_ONE_REG:
         case KVM_CAP_ENABLE_CAP:
         case KVM_CAP_S390_CSS_SUPPORT:
-        case KVM_CAP_IRQFD:
         case KVM_CAP_IOEVENTFD:
         case KVM_CAP_DEVICE_CTRL:
         case KVM_CAP_ENABLE_CAP_VM:
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 96ac69c5eba0..efb00ec75805 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -86,6 +86,9 @@ config ARCH_DEFCONFIG
         default "arch/sparc/configs/sparc32_defconfig" if SPARC32
         default "arch/sparc/configs/sparc64_defconfig" if SPARC64
 
+config ARCH_PROC_KCORE_TEXT
+        def_bool y
+
 config IOMMU_HELPER
         bool
         default y if SPARC64
diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
index 9b672be70dda..50d4840d9aeb 100644
--- a/arch/sparc/include/asm/io_64.h
+++ b/arch/sparc/include/asm/io_64.h
@@ -407,16 +407,16 @@ static inline void iounmap(volatile void __iomem *addr)
 {
 }
 
-#define ioread8(X)                      readb(X)
-#define ioread16(X)                     readw(X)
-#define ioread16be(X)                   __raw_readw(X)
-#define ioread32(X)                     readl(X)
-#define ioread32be(X)                   __raw_readl(X)
-#define iowrite8(val,X)                 writeb(val,X)
-#define iowrite16(val,X)                writew(val,X)
-#define iowrite16be(val,X)              __raw_writew(val,X)
-#define iowrite32(val,X)                writel(val,X)
-#define iowrite32be(val,X)              __raw_writel(val,X)
+#define ioread8                 readb
+#define ioread16                readw
+#define ioread16be              __raw_readw
+#define ioread32                readl
+#define ioread32be              __raw_readl
+#define iowrite8                writeb
+#define iowrite16               writew
+#define iowrite16be             __raw_writew
+#define iowrite32               writel
+#define iowrite32be             __raw_writel
 
 /* Create a virtual mapping cookie for an IO port range */
 void __iomem *ioport_map(unsigned long port, unsigned int nr);
diff --git a/arch/sparc/include/asm/starfire.h b/arch/sparc/include/asm/starfire.h
index c100dc27a0a9..176fa0ad19f1 100644
--- a/arch/sparc/include/asm/starfire.h
+++ b/arch/sparc/include/asm/starfire.h
@@ -12,7 +12,6 @@
 extern int this_is_starfire;
 
 void check_if_starfire(void);
-int starfire_hard_smp_processor_id(void);
 void starfire_hookup(int);
 unsigned int starfire_translate(unsigned long imap, unsigned int upaid);
 
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 88d322b67fac..07cc49e541f4 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -98,11 +98,7 @@ void sun4v_do_mna(struct pt_regs *regs,
 void do_privop(struct pt_regs *regs);
 void do_privact(struct pt_regs *regs);
 void do_cee(struct pt_regs *regs);
-void do_cee_tl1(struct pt_regs *regs);
-void do_dae_tl1(struct pt_regs *regs);
-void do_iae_tl1(struct pt_regs *regs);
 void do_div0_tl1(struct pt_regs *regs);
-void do_fpdis_tl1(struct pt_regs *regs);
 void do_fpieee_tl1(struct pt_regs *regs);
 void do_fpother_tl1(struct pt_regs *regs);
 void do_ill_tl1(struct pt_regs *regs);
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index da6f1a7fc4db..61139d9924ca 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1406,11 +1406,32 @@ void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs)
         scheduler_ipi();
 }
 
-/* This is a nop because we capture all other cpus
- * anyways when making the PROM active.
- */
+static void stop_this_cpu(void *dummy)
+{
+        prom_stopself();
+}
+
 void smp_send_stop(void)
 {
+        int cpu;
+
+        if (tlb_type == hypervisor) {
+                for_each_online_cpu(cpu) {
+                        if (cpu == smp_processor_id())
+                                continue;
+#ifdef CONFIG_SUN_LDOMS
+                        if (ldom_domaining_enabled) {
+                                unsigned long hv_err;
+                                hv_err = sun4v_cpu_stop(cpu);
+                                if (hv_err)
+                                        printk(KERN_ERR "sun4v_cpu_stop() "
+                                               "failed err=%lu\n", hv_err);
+                        } else
+#endif
+                                prom_stopcpu_cpuid(cpu);
+                }
+        } else
+                smp_call_function(stop_this_cpu, NULL, 0);
 }
 
 /**
diff --git a/arch/sparc/kernel/starfire.c b/arch/sparc/kernel/starfire.c
index 82281a566bb8..167fdfd9c837 100644
--- a/arch/sparc/kernel/starfire.c
+++ b/arch/sparc/kernel/starfire.c
@@ -28,11 +28,6 @@ void check_if_starfire(void)
                 this_is_starfire = 1;
 }
 
-int starfire_hard_smp_processor_id(void)
-{
-        return upa_readl(0x1fff40000d0UL);
-}
-
 /*
  * Each Starfire board has 32 registers which perform translation
  * and delivery of traditional interrupt packets into the extended
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index c85403d0496c..30e7ddb27a3a 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
         long err;
 
         /* No need for backward compatibility. We can start fresh... */
-        if (call <= SEMCTL) {
+        if (call <= SEMTIMEDOP) {
                 switch (call) {
                 case SEMOP:
                         err = sys_semtimedop(first, ptr,
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index a27651e866e7..0e699745d643 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2427,6 +2427,8 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
                 }
                 user_instruction_dump ((unsigned int __user *) regs->tpc);
         }
+        if (panic_on_oops)
+                panic("Fatal exception");
         if (regs->tstate & TSTATE_PRIV)
                 do_exit(SIGKILL);
         do_exit(SIGSEGV);
@@ -2564,27 +2566,6 @@ void do_cee(struct pt_regs *regs)
         die_if_kernel("TL0: Cache Error Exception", regs);
 }
 
-void do_cee_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Cache Error Exception", regs);
-}
-
-void do_dae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Data Access Exception", regs);
-}
-
-void do_iae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Instruction Access Exception", regs);
-}
-
 void do_div0_tl1(struct pt_regs *regs)
 {
         exception_enter();
@@ -2592,13 +2573,6 @@ void do_div0_tl1(struct pt_regs *regs)
         die_if_kernel("TL1: DIV0 Exception", regs);
 }
 
-void do_fpdis_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: FPU Disabled", regs);
-}
-
 void do_fpieee_tl1(struct pt_regs *regs)
 {
         exception_enter();
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 3ea267c53320..4ca0d6ba5ec8 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2820,7 +2820,7 @@ static int __init report_memory(void)
 
         return 0;
 }
-device_initcall(report_memory);
+arch_initcall(report_memory);
 
 #ifdef CONFIG_SMP
 #define do_flush_tlb_kernel_range       smp_flush_tlb_kernel_range
diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index 7083c16cccba..bb1376381985 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -14,13 +14,6 @@
 static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
                 LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
 
-struct kaslr_setup_data {
-        __u64 next;
-        __u32 type;
-        __u32 len;
-        __u8 data[1];
-} kaslr_setup_data;
-
 #define I8254_PORT_CONTROL      0x43
 #define I8254_PORT_COUNTER0     0x40
 #define I8254_CMD_READBACK      0xC0
@@ -302,29 +295,7 @@ static unsigned long find_random_addr(unsigned long minimum,
         return slots_fetch_random();
 }
 
-static void add_kaslr_setup_data(struct boot_params *params, __u8 enabled)
-{
-        struct setup_data *data;
-
-        kaslr_setup_data.type = SETUP_KASLR;
-        kaslr_setup_data.len = 1;
-        kaslr_setup_data.next = 0;
-        kaslr_setup_data.data[0] = enabled;
-
-        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
-
-        while (data && data->next)
-                data = (struct setup_data *)(unsigned long)data->next;
-
-        if (data)
-                data->next = (unsigned long)&kaslr_setup_data;
-        else
-                params->hdr.setup_data = (unsigned long)&kaslr_setup_data;
-
-}
-
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size)
@@ -335,17 +306,14 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 #ifdef CONFIG_HIBERNATION
         if (!cmdline_find_option_bool("kaslr")) {
                 debug_putstr("KASLR disabled by default...\n");
-                add_kaslr_setup_data(params, 0);
                 goto out;
         }
 #else
         if (cmdline_find_option_bool("nokaslr")) {
                 debug_putstr("KASLR disabled by cmdline...\n");
-                add_kaslr_setup_data(params, 0);
                 goto out;
         }
 #endif
-        add_kaslr_setup_data(params, 1);
 
         /* Record the various known unsafe memory ranges. */
         mem_avoid_init((unsigned long)input, input_size,
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 5903089c818f..a950864a64da 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -401,8 +401,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
          * the entire decompressed kernel plus relocation table, or the
          * entire decompressed kernel plus .bss and .brk sections.
          */
-        output = choose_kernel_location(real_mode, input_data, input_len,
-                                        output,
+        output = choose_kernel_location(input_data, input_len, output,
                                         output_len > run_size ? output_len
                                                               : run_size);
 
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index ee3576b2666b..04477d68403f 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -57,8 +57,7 @@ int cmdline_find_option_bool(const char *option);
 
 #if CONFIG_RANDOMIZE_BASE
 /* aslr.c */
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size);
@@ -66,8 +65,7 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 bool has_cpuflag(int flag);
 #else
 static inline
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size)
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 947c6bf52c33..54f60ab41c63 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1155,7 +1155,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                 src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
                 if (!src)
                         return -ENOMEM;
-                assoc = (src + req->cryptlen + auth_tag_len);
+                assoc = (src + req->cryptlen);
                 scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
                 scatterwalk_map_and_copy(assoc, req->assoc, 0,
                         req->assoclen, 0);
@@ -1180,7 +1180,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                 scatterwalk_done(&src_sg_walk, 0, 0);
                 scatterwalk_done(&assoc_sg_walk, 0, 0);
         } else {
-                scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
+                scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
                 kfree(src);
         }
         return retval;
diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
index 0dbc08282291..72ba21a8b5fc 100644
--- a/arch/x86/include/asm/fpu-internal.h
+++ b/arch/x86/include/asm/fpu-internal.h
@@ -370,7 +370,7 @@ static inline void drop_fpu(struct task_struct *tsk)
         preempt_disable();
         tsk->thread.fpu_counter = 0;
         __drop_fpu(tsk);
-        clear_used_math();
+        clear_stopped_child_used_math(tsk);
         preempt_enable();
 }
 
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
index 95e11f79f123..f97fbe3abb67 100644
--- a/arch/x86/include/asm/page_types.h
+++ b/arch/x86/include/asm/page_types.h
@@ -51,8 +51,6 @@ extern int devmem_is_allowed(unsigned long pagenr);
 extern unsigned long max_low_pfn_mapped;
 extern unsigned long max_pfn_mapped;
 
-extern bool kaslr_enabled;
-
 static inline phys_addr_t get_max_mapped(void)
 {
         return (phys_addr_t)max_pfn_mapped << PAGE_SHIFT;
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 44e6dd7e36a2..225b0988043a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -7,7 +7,6 @@
 #define SETUP_DTB                       2
 #define SETUP_PCI                       3
 #define SETUP_EFI                       4
-#define SETUP_KASLR                     5
 
 /* ram_size flags */
 #define RAMDISK_IMAGE_START_MASK        0x07FF
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 3d525c6124f6..803b684676ff 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1338,6 +1338,26 @@ static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
 }
 
 /*
+ * ACPI offers an alternative platform interface model that removes
+ * ACPI hardware requirements for platforms that do not implement
+ * the PC Architecture.
+ *
+ * We initialize the Hardware-reduced ACPI model here:
+ */
+static void __init acpi_reduced_hw_init(void)
+{
+        if (acpi_gbl_reduced_hardware) {
+                /*
+                 * Override x86_init functions and bypass legacy pic
+                 * in Hardware-reduced ACPI mode
+                 */
+                x86_init.timers.timer_init      = x86_init_noop;
+                x86_init.irqs.pre_vector_init   = x86_init_noop;
+                legacy_pic                      = &null_legacy_pic;
+        }
+}
+
+/*
  * If your system is blacklisted here, but you find that acpi=force
  * works for you, please contact linux-acpi@vger.kernel.org
  */
@@ -1536,6 +1556,11 @@ int __init early_acpi_boot_init(void)
          */
         early_acpi_process_madt();
 
+        /*
+         * Hardware-reduced ACPI mode initialization:
+         */
+        acpi_reduced_hw_init();
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
index c2fd21fed002..017149cded07 100644
--- a/arch/x86/kernel/apic/apic_numachip.c
+++ b/arch/x86/kernel/apic/apic_numachip.c
@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
 static unsigned int get_apic_id(unsigned long x)
 {
         unsigned long value;
-        unsigned int id;
+        unsigned int id = (x >> 24) & 0xff;
 
-        rdmsrl(MSR_FAM10H_NODE_ID, value);
-        id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, value);
+                id |= (value << 2) & 0xff00;
+        }
 
         return id;
 }
@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
 
 static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
 {
-        if (c->phys_proc_id != node) {
-                c->phys_proc_id = node;
-                per_cpu(cpu_llc_id, smp_processor_id()) = node;
+        u64 val;
+        u32 nodes = 1;
+
+        this_cpu_write(cpu_llc_id, node);
+
+        /* Account for nodes per socket in multi-core-module processors */
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, val);
+                nodes = ((val >> 3) & 7) + 1;
         }
+
+        c->phys_proc_id = node / nodes;
 }
 
 static int __init numachip_system_init(void)
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index 9bbb9b35c144..d1ac80b72c72 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -47,13 +47,21 @@ do {							\
 
 #ifdef CONFIG_RANDOMIZE_BASE
 static unsigned long module_load_offset;
+static int randomize_modules = 1;
 
 /* Mutex protects the module_load_offset. */
 static DEFINE_MUTEX(module_kaslr_mutex);
 
+static int __init parse_nokaslr(char *p)
+{
+        randomize_modules = 0;
+        return 0;
+}
+early_param("nokaslr", parse_nokaslr);
+
 static unsigned long int get_module_load_offset(void)
 {
-        if (kaslr_enabled) {
+        if (randomize_modules) {
                 mutex_lock(&module_kaslr_mutex);
                 /*
                  * Calculate the module_load_offset the first time this
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 98dc9317286e..0a2421cca01f 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -122,8 +122,6 @@
 unsigned long max_low_pfn_mapped;
 unsigned long max_pfn_mapped;
 
-bool __read_mostly kaslr_enabled = false;
-
 #ifdef CONFIG_DMI
 RESERVE_BRK(dmi_alloc, 65536);
 #endif
@@ -427,11 +425,6 @@ static void __init reserve_initrd(void)
 }
 #endif /* CONFIG_BLK_DEV_INITRD */
 
-static void __init parse_kaslr_setup(u64 pa_data, u32 data_len)
-{
-        kaslr_enabled = (bool)(pa_data + sizeof(struct setup_data));
-}
-
 static void __init parse_setup_data(void)
 {
         struct setup_data *data;
@@ -457,9 +450,6 @@ static void __init parse_setup_data(void)
                 case SETUP_EFI:
                         parse_efi_setup(pa_data, data_len);
                         break;
-                case SETUP_KASLR:
-                        parse_kaslr_setup(pa_data, data_len);
-                        break;
                 default:
                         break;
                 }
@@ -842,14 +832,10 @@ static void __init trim_low_memory_range(void)
 static int
 dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
 {
-        if (kaslr_enabled)
-                pr_emerg("Kernel Offset: 0x%lx from 0x%lx (relocation range: 0x%lx-0x%lx)\n",
-                         (unsigned long)&_text - __START_KERNEL,
-                         __START_KERNEL,
-                         __START_KERNEL_map,
-                         MODULES_VADDR-1);
-        else
-                pr_emerg("Kernel Offset: disabled\n");
+        pr_emerg("Kernel Offset: 0x%lx from 0x%lx "
+                 "(relocation range: 0x%lx-0x%lx)\n",
+                 (unsigned long)&_text - __START_KERNEL, __START_KERNEL,
+                 __START_KERNEL_map, MODULES_VADDR-1);
 
         return 0;
 }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9d2073e2ecc9..4ff5d162ff9f 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -384,7 +384,7 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
                 goto exit;
         conditional_sti(regs);
 
-        if (!user_mode(regs))
+        if (!user_mode_vm(regs))
                 die("bounds", regs, error_code);
 
         if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
@@ -637,7 +637,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
          * then it's very likely the result of an icebp/int01 trap.
          * User wants a sigtrap for that.
          */
-        if (!dr6 && user_mode(regs))
+        if (!dr6 && user_mode_vm(regs))
                 user_icebp = 1;
 
         /* Catch kmemcheck conditions first of all! */
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 34f66e58a896..cdc6cf903078 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -379,7 +379,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                  * thread's fpu state, reconstruct fxstate from the fsave
                  * header. Sanitize the copied state etc.
                  */
-                struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
+                struct fpu *fpu = &tsk->thread.fpu;
                 struct user_i387_ia32_struct env;
                 int err = 0;
 
@@ -393,14 +393,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                  */
                 drop_fpu(tsk);
 
-                if (__copy_from_user(xsave, buf_fx, state_size) ||
+                if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
                     __copy_from_user(&env, buf, sizeof(env))) {
+                        fpu_finit(fpu);
                         err = -1;
                 } else {
                         sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-                        set_used_math();
                 }
 
+                set_used_math();
                 if (use_eager_fpu()) {
                         preempt_disable();
                         math_state_restore();
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index cc31f7c06d3d..9541ba34126b 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -507,6 +507,7 @@ static int picdev_read(struct kvm_pic *s,
                 return -EOPNOTSUPP;
 
         if (len != 1) {
+                memset(val, 0, len);
                 pr_pic_unimpl("non byte read\n");
                 return 0;
         }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f7b20b417a3a..10a481b7674d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2168,7 +2168,10 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
 {
         unsigned long *msr_bitmap;
 
-        if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) {
+        if (is_guest_mode(vcpu))
+                msr_bitmap = vmx_msr_bitmap_nested;
+        else if (irqchip_in_kernel(vcpu->kvm) &&
+                apic_x2apic_mode(vcpu->arch.apic)) {
                 if (is_long_mode(vcpu))
                         msr_bitmap = vmx_msr_bitmap_longmode_x2apic;
                 else
@@ -9218,9 +9221,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         }
 
         if (cpu_has_vmx_msr_bitmap() &&
-            exec_control & CPU_BASED_USE_MSR_BITMAPS &&
-            nested_vmx_merge_msr_bitmap(vcpu, vmcs12)) {
-                vmcs_write64(MSR_BITMAP, __pa(vmx_msr_bitmap_nested));
+            exec_control & CPU_BASED_USE_MSR_BITMAPS) {
+                nested_vmx_merge_msr_bitmap(vcpu, vmcs12);
+                /* MSR_BITMAP will be set by following vmx_set_efer. */
         } else
                 exec_control &= ~CPU_BASED_USE_MSR_BITMAPS;
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bd7a70be41b3..32bf19ef3115 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2744,7 +2744,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_USER_NMI:
         case KVM_CAP_REINJECT_CONTROL:
         case KVM_CAP_IRQ_INJECT_STATUS:
-        case KVM_CAP_IRQFD:
         case KVM_CAP_IOEVENTFD:
         case KVM_CAP_IOEVENTFD_NO_LENGTH:
         case KVM_CAP_PIT2:
diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
index 31776d0efc8c..d7ec4e251c0a 100644
--- a/arch/x86/vdso/vdso32/sigreturn.S
+++ b/arch/x86/vdso/vdso32/sigreturn.S
@@ -17,6 +17,7 @@
         .text
         .globl __kernel_sigreturn
         .type __kernel_sigreturn,@function
+        nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
         ALIGN
 __kernel_sigreturn:
 .LSTART_sigreturn:
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 740ae3026a14..9f93af56a5fc 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -563,7 +563,7 @@ static bool alloc_p2m(unsigned long pfn)
                 if (p2m_pfn == PFN_DOWN(__pa(p2m_missing)))
                         p2m_init(p2m);
                 else
-                        p2m_init_identity(p2m, pfn);
+                        p2m_init_identity(p2m, pfn & ~(P2M_PER_PAGE - 1));
 
                 spin_lock_irqsave(&p2m_update_lock, flags);
 
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 657964e8ab7e..37fb19047603 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -65,6 +65,7 @@ struct lpss_private_data;
 
 struct lpss_device_desc {
         unsigned int flags;
+        const char *clk_con_id;
         unsigned int prv_offset;
         size_t prv_size_override;
         void (*setup)(struct lpss_private_data *pdata);
@@ -140,6 +141,7 @@ static struct lpss_device_desc lpt_i2c_dev_desc = {
 
 static struct lpss_device_desc lpt_uart_dev_desc = {
         .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
+        .clk_con_id = "baudclk",
         .prv_offset = 0x800,
         .setup = lpss_uart_setup,
 };
@@ -156,6 +158,7 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
 
 static struct lpss_device_desc byt_uart_dev_desc = {
         .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+        .clk_con_id = "baudclk",
         .prv_offset = 0x800,
         .setup = lpss_uart_setup,
 };
@@ -313,7 +316,7 @@ out:
                 return PTR_ERR(clk);
 
         pdata->clk = clk;
-        clk_register_clkdev(clk, NULL, devname);
+        clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
         return 0;
 }
 
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index d453a2c98ad0..81751a49d8bf 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
         if (pos == 0) {
                 memmove(blk + offset * map->cache_word_size,
                         blk, rbnode->blklen * map->cache_word_size);
-                bitmap_shift_right(present, present, offset, blklen);
+                bitmap_shift_left(present, present, offset, blklen);
         }
 
         /* update the rbnode block, its size and the base register */
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index f373c35f9e1d..da84f544c544 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -608,7 +608,8 @@ static int regcache_sync_block_single(struct regmap *map, void *block,
         for (i = start; i < end; i++) {
                 regtmp = block_base + (i * map->reg_stride);
 
-                if (!regcache_reg_present(cache_present, i))
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp))
                         continue;
 
                 val = regcache_get_val(map, block, i);
@@ -677,7 +678,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
         for (i = start; i < end; i++) {
                 regtmp = block_base + (i * map->reg_stride);
 
-                if (!regcache_reg_present(cache_present, i)) {
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp)) {
                         ret = regcache_sync_block_raw_flush(map, &data,
                                                             base, regtmp);
                         if (ret != 0)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 6299a50a5960..a6c3f75b4b01 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -499,7 +499,8 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                 goto err_alloc;
         }
 
-        ret = request_threaded_irq(irq, NULL, regmap_irq_thread, irq_flags,
+        ret = request_threaded_irq(irq, NULL, regmap_irq_thread,
+                                   irq_flags | IRQF_ONESHOT,
                                    chip->name, d);
         if (ret != 0) {
                 dev_err(map->dev, "Failed to request IRQ %d for %s: %d\n",
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index fae2dbbf5745..72d7028f779b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -142,6 +142,7 @@ struct ports_device {
          * notification
          */
         struct work_struct control_work;
+        struct work_struct config_work;
 
         struct list_head ports;
 
@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
 
         portdev = vdev->priv;
 
+        if (!use_multiport(portdev))
+                schedule_work(&portdev->config_work);
+}
+
+static void config_work_handler(struct work_struct *work)
+{
+        struct ports_device *portdev;
+
+        portdev = container_of(work, struct ports_device, control_work);
         if (!use_multiport(portdev)) {
+                struct virtio_device *vdev;
                 struct port *port;
                 u16 rows, cols;
 
+                vdev = portdev->vdev;
                 virtio_cread(vdev, struct virtio_console_config, cols, &cols);
                 virtio_cread(vdev, struct virtio_console_config, rows, &rows);
 
@@ -2040,12 +2052,14 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         virtio_device_ready(portdev->vdev);
 
+        INIT_WORK(&portdev->config_work, &config_work_handler);
+        INIT_WORK(&portdev->control_work, &control_work_handler);
+
         if (multiport) {
                 unsigned int nr_added_bufs;
 
                 spin_lock_init(&portdev->c_ivq_lock);
                 spin_lock_init(&portdev->c_ovq_lock);
-                INIT_WORK(&portdev->control_work, &control_work_handler);
 
                 nr_added_bufs = fill_queue(portdev->c_ivq,
                                            &portdev->c_ivq_lock);
@@ -2113,6 +2127,8 @@ static void virtcons_remove(struct virtio_device *vdev)
         /* Finish up work that's lined up */
         if (use_multiport(portdev))
                 cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
 
         list_for_each_entry_safe(port, port2, &portdev->ports, list)
                 unplug_port(port);
@@ -2164,6 +2180,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
 
         virtqueue_disable_cb(portdev->c_ivq);
         cancel_work_sync(&portdev->control_work);
+        cancel_work_sync(&portdev->config_work);
         /*
          * Once more: if control_work_handler() was running, it would
          * enable the cb as the last step.
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index db7f8bce7467..25006a8bb8e6 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,12 +144,6 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw,
                                    divider->flags);
 }
 
-/*
- * The reverse of DIV_ROUND_UP: The maximum number which
- * divided by m is r
- */
-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
-
 static bool _is_valid_table_div(const struct clk_div_table *table,
                                                          unsigned int div)
 {
@@ -225,19 +219,24 @@ static int _div_round_closest(const struct clk_div_table *table,
                               unsigned long parent_rate, unsigned long rate,
                               unsigned long flags)
 {
-        int up, down, div;
+        int up, down;
+        unsigned long up_rate, down_rate;
 
-        up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        up = DIV_ROUND_UP(parent_rate, rate);
+        down = parent_rate / rate;
 
         if (flags & CLK_DIVIDER_POWER_OF_TWO) {
-                up = __roundup_pow_of_two(div);
-                down = __rounddown_pow_of_two(div);
+                up = __roundup_pow_of_two(up);
+                down = __rounddown_pow_of_two(down);
         } else if (table) {
-                up = _round_up_table(table, div);
-                down = _round_down_table(table, div);
+                up = _round_up_table(table, up);
+                down = _round_down_table(table, down);
         }
 
-        return (up - div) <= (div - down) ? up : down;
+        up_rate = DIV_ROUND_UP(parent_rate, up);
+        down_rate = DIV_ROUND_UP(parent_rate, down);
+
+        return (rate - up_rate) <= (down_rate - rate) ? up : down;
 }
 
 static int _div_round(const struct clk_div_table *table,
@@ -313,7 +312,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                         return i;
                 }
                 parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
-                                MULT_ROUND_UP(rate, i));
+                                               rate * i);
                 now = DIV_ROUND_UP(parent_rate, i);
                 if (_is_best_div(rate, now, best, flags)) {
                         bestdiv = i;
@@ -353,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
                 bestdiv = readl(divider->reg) >> divider->shift;
                 bestdiv &= div_mask(divider->width);
                 bestdiv = _get_div(divider->table, bestdiv, divider->flags);
-                return bestdiv;
+                return DIV_ROUND_UP(*prate, bestdiv);
         }
 
         return divider_round_rate(hw, rate, prate, divider->table,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index eb0152961d3c..237f23f68bfc 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1350,7 +1350,6 @@ static unsigned long clk_core_get_rate(struct clk_core *clk)
 
         return rate;
 }
-EXPORT_SYMBOL_GPL(clk_core_get_rate);
 
 /**
  * clk_get_rate - return the rate of clk
@@ -2171,6 +2170,32 @@ int clk_get_phase(struct clk *clk)
 }
 
 /**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        /* trivial case: identical struct clk's or both NULL */
+        if (p == q)
+                return true;
+
+        /* true if clk->core pointers match. Avoid derefing garbage */
+        if (!IS_ERR_OR_NULL(p) && !IS_ERR_OR_NULL(q))
+                if (p->core == q->core)
+                        return true;
+
+        return false;
+}
+EXPORT_SYMBOL_GPL(clk_is_match);
+
+/**
  * __clk_init - initialize the data structures in a struct clk
  * @dev:        device initializing this clk, placeholder for now
  * @clk:        clk being initialized
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index b0b562b9ce0e..e60feffc10a1 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -48,6 +48,17 @@ static struct clk_pll pll3 = {
         },
 };
 
+static struct clk_regmap pll4_vote = {
+        .enable_reg = 0x34c0,
+        .enable_mask = BIT(4),
+        .hw.init = &(struct clk_init_data){
+                .name = "pll4_vote",
+                .parent_names = (const char *[]){ "pll4" },
+                .num_parents = 1,
+                .ops = &clk_pll_vote_ops,
+        },
+};
+
 static struct clk_pll pll8 = {
         .l_reg = 0x3144,
         .m_reg = 0x3148,
@@ -3023,6 +3034,7 @@ static struct clk_branch rpm_msg_ram_h_clk = {
 
 static struct clk_regmap *gcc_msm8960_clks[] = {
         [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
         [PLL8] = &pll8.clkr,
         [PLL8_VOTE] = &pll8_vote,
         [PLL14] = &pll14.clkr,
@@ -3247,6 +3259,7 @@ static const struct qcom_reset_map gcc_msm8960_resets[] = {
 
 static struct clk_regmap *gcc_apq8064_clks[] = {
         [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
         [PLL8] = &pll8.clkr,
         [PLL8_VOTE] = &pll8_vote,
         [PLL14] = &pll14.clkr,
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 121ffde25dc3..c9ff27b4648b 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -462,7 +462,6 @@ static struct platform_driver lcc_ipq806x_driver = {
         .remove         = lcc_ipq806x_remove,
         .driver         = {
                 .name   = "lcc-ipq806x",
-                .owner  = THIS_MODULE,
                 .of_match_table = lcc_ipq806x_match_table,
         },
 };
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index a75a408cfccd..e2c863295f00 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -417,8 +417,8 @@ static struct clk_rcg slimbus_src = {
                 .mnctr_en_bit = 8,
                 .mnctr_reset_bit = 7,
                 .mnctr_mode_shift = 5,
-                .n_val_shift = 16,
-                .m_val_shift = 16,
+                .n_val_shift = 24,
+                .m_val_shift = 8,
                 .width = 8,
         },
         .p = {
@@ -547,7 +547,7 @@ static int lcc_msm8960_probe(struct platform_device *pdev)
                 return PTR_ERR(regmap);
 
         /* Use the correct frequency plan depending on speed of PLL4 */
-        val = regmap_read(regmap, 0x4, &val);
+        regmap_read(regmap, 0x4, &val);
         if (val == 0x12) {
                 slimbus_src.freq_tbl = clk_tbl_aif_osr_492;
                 mi2s_osr_src.freq_tbl = clk_tbl_aif_osr_492;
@@ -574,7 +574,6 @@ static struct platform_driver lcc_msm8960_driver = {
         .remove         = lcc_msm8960_remove,
         .driver         = {
                 .name   = "lcc-msm8960",
-                .owner  = THIS_MODULE,
                 .of_match_table = lcc_msm8960_match_table,
         },
 };
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 6ef89639a9f6..d21640634adf 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -84,7 +84,7 @@ static int ti_fapll_enable(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        v |= (1 << FAPLL_MAIN_PLLEN);
+        v |= FAPLL_MAIN_PLLEN;
         writel_relaxed(v, fd->base);
 
         return 0;
@@ -95,7 +95,7 @@ static void ti_fapll_disable(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        v &= ~(1 << FAPLL_MAIN_PLLEN);
+        v &= ~FAPLL_MAIN_PLLEN;
         writel_relaxed(v, fd->base);
 }
 
@@ -104,7 +104,7 @@ static int ti_fapll_is_enabled(struct clk_hw *hw)
         struct fapll_data *fd = to_fapll(hw);
         u32 v = readl_relaxed(fd->base);
 
-        return v & (1 << FAPLL_MAIN_PLLEN);
+        return v & FAPLL_MAIN_PLLEN;
 }
 
 static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
index bba62f9deefb..ec57ba2bbd87 100644
--- a/drivers/clocksource/time-efm32.c
+++ b/drivers/clocksource/time-efm32.c
@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
         clock_event_ddata.base = base;
         clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
 
-        setup_irq(irq, &efm32_clock_event_irq);
-
         clockevents_config_and_register(&clock_event_ddata.evtdev,
                                         DIV_ROUND_CLOSEST(rate, 1024),
                                         0xf, 0xffff);
 
+        setup_irq(irq, &efm32_clock_event_irq);
+
         return 0;
 
 err_get_irq:
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 02268448dc85..5dcbf90b8015 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -178,10 +178,6 @@ static void __init sun5i_timer_init(struct device_node *node)
 
         ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
 
-        ret = setup_irq(irq, &sun5i_timer_irq);
-        if (ret)
-                pr_warn("failed to setup irq %d\n", irq);
-
         /* Enable timer0 interrupt */
         val = readl(timer_base + TIMER_IRQ_EN_REG);
         writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
@@ -191,6 +187,10 @@ static void __init sun5i_timer_init(struct device_node *node)
 
         clockevents_config_and_register(&sun5i_clockevent, rate,
                                         TIMER_SYNC_TICKS, 0xffffffff);
+
+        ret = setup_irq(irq, &sun5i_timer_irq);
+        if (ret)
+                pr_warn("failed to setup irq %d\n", irq);
 }
 CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
                        sun5i_timer_init);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b6b07ff720b..f6d04c7b5115 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -43,9 +43,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv);
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv);
 
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
@@ -2908,13 +2909,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
          */
         if (req->flags & DRM_MODE_CURSOR_BO) {
                 if (req->handle) {
-                        fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+                        fb = internal_framebuffer_create(dev, &fbreq, file_priv);
                         if (IS_ERR(fb)) {
                                 DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
                                 return PTR_ERR(fb);
                         }
-
-                        drm_framebuffer_reference(fb);
                 } else {
                         fb = NULL;
                 }
@@ -3267,9 +3266,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
         return 0;
 }
 
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-                                                        struct drm_mode_fb_cmd2 *r,
-                                                        struct drm_file *file_priv)
+static struct drm_framebuffer *
+internal_framebuffer_create(struct drm_device *dev,
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv)
 {
         struct drm_mode_config *config = &dev->mode_config;
         struct drm_framebuffer *fb;
@@ -3301,12 +3301,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
                 return fb;
         }
 
-        mutex_lock(&file_priv->fbs_lock);
-        r->fb_id = fb->base.id;
-        list_add(&fb->filp_head, &file_priv->fbs);
-        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-        mutex_unlock(&file_priv->fbs_lock);
-
         return fb;
 }
 
@@ -3328,15 +3322,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
 int drm_mode_addfb2(struct drm_device *dev,
                     void *data, struct drm_file *file_priv)
 {
+        struct drm_mode_fb_cmd2 *r = data;
         struct drm_framebuffer *fb;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        fb = add_framebuffer_internal(dev, data, file_priv);
+        fb = internal_framebuffer_create(dev, r, file_priv);
         if (IS_ERR(fb))
                 return PTR_ERR(fb);
 
+        /* Transfer ownership to the filp for reaping on close */
+
+        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_lock(&file_priv->fbs_lock);
+        r->fb_id = fb->base.id;
+        list_add(&fb->filp_head, &file_priv->fbs);
+        mutex_unlock(&file_priv->fbs_lock);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 9a5b68717ec8..379ab4555756 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -733,10 +733,14 @@ static bool check_txmsg_state(struct drm_dp_mst_topology_mgr *mgr,
                               struct drm_dp_sideband_msg_tx *txmsg)
 {
         bool ret;
-        mutex_lock(&mgr->qlock);
+
+        /*
+         * All updates to txmsg->state are protected by mgr->qlock, and the two
+         * cases we check here are terminal states. For those the barriers
+         * provided by the wake_up/wait_event pair are enough.
+         */
         ret = (txmsg->state == DRM_DP_SIDEBAND_TX_RX ||
                txmsg->state == DRM_DP_SIDEBAND_TX_TIMEOUT);
-        mutex_unlock(&mgr->qlock);
         return ret;
 }
 
@@ -1363,12 +1367,13 @@ static int process_single_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
         return 0;
 }
 
-/* must be called holding qlock */
 static void process_single_down_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
 {
         struct drm_dp_sideband_msg_tx *txmsg;
         int ret;
 
+        WARN_ON(!mutex_is_locked(&mgr->qlock));
+
         /* construct a chunk from the first msg in the tx_msg queue */
         if (list_empty(&mgr->tx_msg_downq)) {
                 mgr->tx_down_in_progress = false;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 7fc6f8bd4821..1134526286c8 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -403,7 +403,7 @@ static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
                 unsigned rem;
 
                 rem = do_div(tmp, alignment);
-                if (tmp)
+                if (rem)
                         start += alignment - rem;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e5daad5f75fb..5b205863b659 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2936,9 +2936,9 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
         req = obj->last_read_req;
 
         /* Do this after OLR check to make sure we make forward progress polling
-         * on this IOCTL with a timeout <=0 (like busy ioctl)
+         * on this IOCTL with a timeout == 0 (like busy ioctl)
          */
-        if (args->timeout_ns <= 0) {
+        if (args->timeout_ns == 0) {
                 ret = -ETIME;
                 goto out;
         }
@@ -2948,7 +2948,8 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
         i915_gem_request_reference(req);
         mutex_unlock(&dev->struct_mutex);
 
-        ret = __i915_wait_request(req, reset_counter, true, &args->timeout_ns,
+        ret = __i915_wait_request(req, reset_counter, true,
+                                  args->timeout_ns > 0 ? &args->timeout_ns : NULL,
                                   file->driver_priv);
         mutex_lock(&dev->struct_mutex);
         i915_gem_request_unreference(req);
@@ -4792,6 +4793,9 @@ i915_gem_init_hw(struct drm_device *dev)
         if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
                 return -EIO;
 
+        /* Double layer security blanket, see i915_gem_init() */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
+
         if (dev_priv->ellc_size)
                 I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
 
@@ -4824,7 +4828,7 @@ i915_gem_init_hw(struct drm_device *dev)
         for_each_ring(ring, dev_priv, i) {
                 ret = ring->init_hw(ring);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
         for (i = 0; i < NUM_L3_SLICES(dev); i++)
@@ -4841,9 +4845,11 @@ i915_gem_init_hw(struct drm_device *dev)
                 DRM_ERROR("Context enable failed %d\n", ret);
                 i915_gem_cleanup_ringbuffer(dev);
 
-                return ret;
+                goto out;
         }
 
+out:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
         return ret;
 }
 
@@ -4877,6 +4883,14 @@ int i915_gem_init(struct drm_device *dev)
                 dev_priv->gt.stop_ring = intel_logical_ring_stop;
         }
 
+        /* This is just a security blanket to placate dragons.
+         * On some systems, we very sporadically observe that the first TLBs
+         * used by the CS may be stale, despite us poking the TLB reset. If
+         * we hold the forcewake during initialisation these problems
+         * just magically go away.
+         */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
+
         ret = i915_gem_init_userptr(dev);
         if (ret)
                 goto out_unlock;
@@ -4903,6 +4917,7 @@ int i915_gem_init(struct drm_device *dev)
         }
 
 out_unlock:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
         mutex_unlock(&dev->struct_mutex);
 
         return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e730789b53b7..9943c20a741d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9716,7 +9716,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
         struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 
-        WARN_ON(!in_irq());
+        WARN_ON(!in_interrupt());
 
         if (crtc == NULL)
                 return;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index c47a3baa53d5..4e8fb891d4ea 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1048,8 +1048,14 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev)
 
                 /* We need to init first for ECOBUS access and then
                  * determine later if we want to reinit, in case of MT access is
-                 * not working
+                 * not working. In this stage we don't know which flavour this
+                 * ivb is, so it is better to reset also the gen6 fw registers
+                 * before the ecobus check.
                  */
+
+                __raw_i915_write32(dev_priv, FORCEWAKE, 0);
+                __raw_posting_read(dev_priv, ECOBUS);
+
                 fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
                                FORCEWAKE_MT, FORCEWAKE_MT_ACK);
 
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index d13d1b5a859f..df09ca7c4889 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
         return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
 
+struct radeon_wait_cb {
+        struct fence_cb base;
+        struct task_struct *task;
+};
+
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+        struct radeon_wait_cb *wait =
+                container_of(cb, struct radeon_wait_cb, base);
+
+        wake_up_process(wait->task);
+}
+
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
                                              signed long t)
 {
         struct radeon_fence *fence = to_radeon_fence(f);
         struct radeon_device *rdev = fence->rdev;
-        bool signaled;
+        struct radeon_wait_cb cb;
 
-        fence_enable_sw_signaling(&fence->base);
+        cb.task = current;
 
-        /*
-         * This function has to return -EDEADLK, but cannot hold
-         * exclusive_lock during the wait because some callers
-         * may already hold it. This means checking needs_reset without
-         * lock, and not fiddling with any gpu internals.
-         *
-         * The callback installed with fence_enable_sw_signaling will
-         * run before our wait_event_*timeout call, so we will see
-         * both the signaled fence and the changes to needs_reset.
-         */
+        if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
+                return t;
+
+        while (t > 0) {
+                if (intr)
+                        set_current_state(TASK_INTERRUPTIBLE);
+                else
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+
+                /*
+                 * radeon_test_signaled must be called after
+                 * set_current_state to prevent a race with wake_up_process
+                 */
+                if (radeon_test_signaled(fence))
+                        break;
+
+                if (rdev->needs_reset) {
+                        t = -EDEADLK;
+                        break;
+                }
+
+                t = schedule_timeout(t);
+
+                if (t > 0 && intr && signal_pending(current))
+                        t = -ERESTARTSYS;
+        }
+
+        __set_current_state(TASK_RUNNING);
+        fence_remove_callback(f, &cb.base);
 
-        if (intr)
-                t = wait_event_interruptible_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        else
-                t = wait_event_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-
-        if (t > 0 && !signaled)
-                return -EDEADLK;
         return t;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e088e5558da0..a7fb2735d4a9 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -7130,8 +7130,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
 
         if (!vclk || !dclk) {
-                /* keep the Bypass mode, put PLL to sleep */
-                WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+                /* keep the Bypass mode */
                 return 0;
         }
 
@@ -7147,8 +7146,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
         /* set VCO_MODE to 1 */
         WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
 
-        /* toggle UPLL_SLEEP to 1 then back to 0 */
-        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
+        /* disable sleep mode */
         WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
 
         /* deassert UPLL_RESET */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6c6b655defcf..e13b9cbc304e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_err1;
         }
 
-        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-                             (dev_priv->vram_size >> PAGE_SHIFT));
-        if (unlikely(ret != 0)) {
-                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-                goto out_err2;
-        }
-
-        dev_priv->has_gmr = true;
-        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-                                         VMW_PL_GMR) != 0) {
-                DRM_INFO("No GMR memory available. "
-                         "Graphics memory resources are very limited.\n");
-                dev_priv->has_gmr = false;
-        }
-
-        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-                dev_priv->has_mob = true;
-                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-                                   VMW_PL_MOB) != 0) {
-                        DRM_INFO("No MOB memory available. "
-                                 "3D will be disabled.\n");
-                        dev_priv->has_mob = false;
-                }
-        }
-
         dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
                                                dev_priv->mmio_size);
 
@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_no_fman;
         }
 
+
+        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+                             (dev_priv->vram_size >> PAGE_SHIFT));
+        if (unlikely(ret != 0)) {
+                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+                goto out_no_vram;
+        }
+
+        dev_priv->has_gmr = true;
+        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+                                         VMW_PL_GMR) != 0) {
+                DRM_INFO("No GMR memory available. "
+                         "Graphics memory resources are very limited.\n");
+                dev_priv->has_gmr = false;
+        }
+
+        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+                dev_priv->has_mob = true;
+                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+                                   VMW_PL_MOB) != 0) {
+                        DRM_INFO("No MOB memory available. "
+                                 "3D will be disabled.\n");
+                        dev_priv->has_mob = false;
+                }
+        }
+
         vmw_kms_save_vga(dev_priv);
 
         /* Start kms and overlay systems, needs fifo. */
@@ -838,6 +839,12 @@ out_no_fifo:
         vmw_kms_close(dev_priv);
 out_no_kms:
         vmw_kms_restore_vga(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
         vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@@ -853,12 +860,6 @@ out_err4:
         iounmap(dev_priv->mmio_virt);
 out_err3:
         arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
         (void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
         vmw_ttm_global_release(dev_priv);
@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
         }
         vmw_kms_close(dev_priv);
         vmw_overlay_close(dev_priv);
+
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+
         vmw_fence_manager_takedown(dev_priv->fman);
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                 drm_irq_uninstall(dev_priv->dev);
@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
         ttm_object_device_release(&dev_priv->tdev);
         iounmap(dev_priv->mmio_virt);
         arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
         (void)ttm_bo_device_release(&dev_priv->bdev);
         vmw_ttm_global_release(dev_priv);
 
@@ -1235,6 +1238,7 @@ static void vmw_remove(struct pci_dev *pdev)
 {
         struct drm_device *dev = pci_get_drvdata(pdev);
 
+        pci_disable_device(pdev);
         drm_put_dev(dev);
 }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 33176d05db35..654c8daeb5ab 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -890,7 +890,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
         ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use MOB buffer.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
         }
         bo = &vmw_bo->base;
 
@@ -914,7 +915,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 
 out_no_reloc:
         vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
         return ret;
 }
 
@@ -951,7 +952,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
         ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use GMR region.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
         }
         bo = &vmw_bo->base;
 
@@ -974,7 +976,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 
 out_no_reloc:
         vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
         return ret;
 }
 
@@ -2780,13 +2782,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
                                   NULL, arg->command_size, arg->throttle_us,
                                   (void __user *)(unsigned long)arg->fence_rep,
                                   NULL);
-
+        ttm_read_unlock(&dev_priv->reservation_sem);
         if (unlikely(ret != 0))
-                goto out_unlock;
+                return ret;
 
         vmw_kms_cursor_post_execbuf(dev_priv);
 
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
-        return ret;
+        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 8725b79e7847..07cda8cbbddb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         int i;
         struct drm_mode_config *mode_config = &dev->mode_config;
 
-        ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-        if (unlikely(ret != 0))
-                return ret;
-
         if (!arg->num_outputs) {
                 struct drm_vmw_rect def_rect = {0, 0, 800, 600};
                 vmw_du_update_layout(dev_priv, 1, &def_rect);
-                goto out_unlock;
+                return 0;
         }
 
         rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
         rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
                         GFP_KERNEL);
-        if (unlikely(!rects)) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (unlikely(!rects))
+                return -ENOMEM;
 
         user_rects = (void __user *)(unsigned long)arg->rects;
         ret = copy_from_user(rects, user_rects, rects_size);
@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
 
 out_free:
         kfree(rects);
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
         return ret;
 }
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7c669c328c4c..56ce8c2b5530 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1959,6 +1959,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 204312bfab2c..9c4786759f16 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -586,6 +586,7 @@
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
 #define USB_DEVICE_ID_LOGITECH_T651     0xb00c
+#define USB_DEVICE_ID_LOGITECH_C077     0xc007
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
@@ -898,6 +899,7 @@
 #define USB_VENDOR_ID_TIVO              0x150a
 #define USB_DEVICE_ID_TIVO_SLIDE_BT     0x1200
 #define USB_DEVICE_ID_TIVO_SLIDE        0x1201
+#define USB_DEVICE_ID_TIVO_SLIDE_PRO    0x1203
 
 #define USB_VENDOR_ID_TOPSEED           0x0766
 #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
index d790d8d71f7f..d98696927453 100644
--- a/drivers/hid/hid-tivo.c
+++ b/drivers/hid/hid-tivo.c
@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = {
         /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, tivo_devices);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 9be99a67bfe2..a82127753461 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -78,6 +78,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 046351cf17f3..bbe32d66e500 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -551,9 +551,13 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
            (features->type == CINTIQ && !(data[1] & 0x40)))
                 return 1;
 
-        if (features->quirks & WACOM_QUIRK_MULTI_INPUT)
+        if (wacom->shared) {
                 wacom->shared->stylus_in_proximity = true;
 
+                if (wacom->shared->touch_down)
+                        return 1;
+        }
+
         /* in Range while exiting */
         if (((data[1] & 0xfe) == 0x20) && wacom->reporting_data) {
                 input_report_key(input, BTN_TOUCH, 0);
@@ -1043,27 +1047,28 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
         struct input_dev *input = wacom->input;
         unsigned char *data = wacom->data;
         int i;
-        int current_num_contacts = 0;
+        int current_num_contacts = data[61];
         int contacts_to_send = 0;
         int num_contacts_left = 4; /* maximum contacts per packet */
         int byte_per_packet = WACOM_BYTES_PER_24HDT_PACKET;
         int y_offset = 2;
+        static int contact_with_no_pen_down_count = 0;
 
         if (wacom->features.type == WACOM_27QHDT) {
                 current_num_contacts = data[63];
                 num_contacts_left = 10;
                 byte_per_packet = WACOM_BYTES_PER_QHDTHID_PACKET;
                 y_offset = 0;
-        } else {
-                current_num_contacts = data[61];
         }
 
         /*
          * First packet resets the counter since only the first
          * packet in series will have non-zero current_num_contacts.
          */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                 wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
 
         contacts_to_send = min(num_contacts_left, wacom->num_contacts_left);
 
@@ -1096,15 +1101,16 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
                                 input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
                                 input_report_abs(input, ABS_MT_ORIENTATION, w > h);
                         }
+                        contact_with_no_pen_down_count++;
                 }
         }
         input_mt_report_pointer_emulation(input, true);
 
         wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left <= 0)
+        if (wacom->num_contacts_left <= 0) {
                 wacom->num_contacts_left = 0;
-
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
+        }
         return 1;
 }
 
@@ -1116,6 +1122,7 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
         int current_num_contacts = data[2];
         int contacts_to_send = 0;
         int x_offset = 0;
+        static int contact_with_no_pen_down_count = 0;
 
         /* MTTPC does not support Height and Width */
         if (wacom->features.type == MTTPC || wacom->features.type == MTTPC_B)
@@ -1125,8 +1132,10 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
          * First packet resets the counter since only the first
          * packet in series will have non-zero current_num_contacts.
          */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                 wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
 
         /* There are at most 5 contacts per packet */
         contacts_to_send = min(5, wacom->num_contacts_left);
@@ -1147,15 +1156,16 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
                         int y = get_unaligned_le16(&data[offset + x_offset + 9]);
                         input_report_abs(input, ABS_MT_POSITION_X, x);
                         input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                 }
         }
         input_mt_report_pointer_emulation(input, true);
 
         wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left < 0)
+        if (wacom->num_contacts_left <= 0) {
                 wacom->num_contacts_left = 0;
-
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
+        }
         return 1;
 }
 
@@ -1193,29 +1203,25 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
         unsigned char *data = wacom->data;
         struct input_dev *input = wacom->input;
-        bool prox;
+        bool prox = !wacom->shared->stylus_in_proximity;
         int x = 0, y = 0;
 
         if (wacom->features.touch_max > 1 || len > WACOM_PKGLEN_TPC2FG)
                 return 0;
 
-        if (!wacom->shared->stylus_in_proximity) {
-                if (len == WACOM_PKGLEN_TPC1FG) {
-                        prox = data[0] & 0x01;
-                        x = get_unaligned_le16(&data[1]);
-                        y = get_unaligned_le16(&data[3]);
-                } else if (len == WACOM_PKGLEN_TPC1FG_B) {
-                        prox = data[2] & 0x01;
-                        x = get_unaligned_le16(&data[3]);
-                        y = get_unaligned_le16(&data[5]);
-                } else {
-                        prox = data[1] & 0x01;
-                        x = le16_to_cpup((__le16 *)&data[2]);
-                        y = le16_to_cpup((__le16 *)&data[4]);
-                }
-        } else
-                /* force touch out when pen is in prox */
-                prox = 0;
+        if (len == WACOM_PKGLEN_TPC1FG) {
+                prox = prox && (data[0] & 0x01);
+                x = get_unaligned_le16(&data[1]);
+                y = get_unaligned_le16(&data[3]);
+        } else if (len == WACOM_PKGLEN_TPC1FG_B) {
+                prox = prox && (data[2] & 0x01);
+                x = get_unaligned_le16(&data[3]);
+                y = get_unaligned_le16(&data[5]);
+        } else {
+                prox = prox && (data[1] & 0x01);
+                x = le16_to_cpup((__le16 *)&data[2]);
+                y = le16_to_cpup((__le16 *)&data[4]);
+        }
 
         if (prox) {
                 input_report_abs(input, ABS_X, x);
@@ -1613,6 +1619,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
         struct input_dev *pad_input = wacom->pad_input;
         unsigned char *data = wacom->data;
         int i;
+        int contact_with_no_pen_down_count = 0;
 
         if (data[0] != 0x02)
             return 0;
@@ -1640,6 +1647,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
                         }
                         input_report_abs(input, ABS_MT_POSITION_X, x);
                         input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                 }
         }
 
@@ -1649,11 +1657,12 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
         input_report_key(pad_input, BTN_FORWARD, (data[1] & 0x04) != 0);
         input_report_key(pad_input, BTN_BACK, (data[1] & 0x02) != 0);
         input_report_key(pad_input, BTN_RIGHT, (data[1] & 0x01) != 0);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
 
         return 1;
 }
 
-static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
+static int wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data, int last_touch_count)
 {
         struct wacom_features *features = &wacom->features;
         struct input_dev *input = wacom->input;
@@ -1661,7 +1670,7 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
         int slot = input_mt_get_slot_by_key(input, data[0]);
 
         if (slot < 0)
-                return;
+                return 0;
 
         touch = touch && !wacom->shared->stylus_in_proximity;
 
@@ -1693,7 +1702,9 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
                 input_report_abs(input, ABS_MT_POSITION_Y, y);
                 input_report_abs(input, ABS_MT_TOUCH_MAJOR, width);
                 input_report_abs(input, ABS_MT_TOUCH_MINOR, height);
+                last_touch_count++;
         }
+        return last_touch_count;
 }
 
 static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
@@ -1718,6 +1729,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
         unsigned char *data = wacom->data;
         int count = data[1] & 0x07;
         int i;
+        int contact_with_no_pen_down_count = 0;
 
         if (data[0] != 0x02)
             return 0;
@@ -1728,12 +1740,15 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
                 int msg_id = data[offset];
 
                 if (msg_id >= 2 && msg_id <= 17)
-                        wacom_bpt3_touch_msg(wacom, data + offset);
+                        contact_with_no_pen_down_count = 
+                            wacom_bpt3_touch_msg(wacom, data + offset,
+                                                 contact_with_no_pen_down_count);
                 else if (msg_id == 128)
                         wacom_bpt3_button_msg(wacom, data + offset);
 
         }
         input_mt_report_pointer_emulation(input, true);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
 
         return 1;
 }
@@ -1759,6 +1774,9 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
                 return 0;
         }
 
+        if (wacom->shared->touch_down)
+                return 0;
+
         prox = (data[1] & 0x20) == 0x20;
 
         /*
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 210cf4874cb7..edf274cabe81 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
                 status = driver->remove(client);
         }
 
-        if (dev->of_node)
-                irq_dispose_mapping(client->irq);
-
         dev_pm_domain_detach(&client->dev, true);
         return status;
 }
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1793aea4a7d2..6eb738ca6d2f 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1793,11 +1793,11 @@ static void idetape_setup(ide_drive_t *drive, idetape_tape_t *tape, int minor)
         tape->best_dsc_rw_freq = clamp_t(unsigned long, t, IDETAPE_DSC_RW_MIN,
                                          IDETAPE_DSC_RW_MAX);
         printk(KERN_INFO "ide-tape: %s <-> %s: %dKBps, %d*%dkB buffer, "
-                "%lums tDSC%s\n",
+                "%ums tDSC%s\n",
                 drive->name, tape->name, *(u16 *)&tape->caps[14],
                 (*(u16 *)&tape->caps[16] * 512) / tape->buffer_size,
                 tape->buffer_size / 1024,
-                tape->best_dsc_rw_freq * 1000 / HZ,
+                jiffies_to_msecs(tape->best_dsc_rw_freq),
                 (drive->dev_flags & IDE_DFLAG_USING_DMA) ? ", DMA" : "");
 
         ide_proc_register_driver(drive, tape->driver);
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c7619716c31d..59040265e361 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -64,6 +64,14 @@ enum {
 #define GUID_TBL_BLK_NUM_ENTRIES 8
 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
 
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+        if ((value) > U32_MAX)                   \
+                counter = cpu_to_be32(U32_MAX); \
+        else                                     \
+                counter = cpu_to_be32(value);    \
+} while (0)
+
 struct mlx4_mad_rcv_buf {
         struct ib_grh grh;
         u8 payload[256];
@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 static void edit_counter(struct mlx4_counter *cnt,
                                         struct ib_pma_portcounters *pma_cnt)
 {
-        pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
-        pma_cnt->port_rcv_data  = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
-        pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
-        pma_cnt->port_rcv_packets  = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
+                             (be64_to_cpu(cnt->tx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
+                             (be64_to_cpu(cnt->rx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+                             be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+                             be64_to_cpu(cnt->rx_frames));
 }
 
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ac6e2b710ea6..b972c0b41799 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2697,8 +2697,12 @@ static void handle_bonded_port_state_event(struct work_struct *work)
         spin_lock_bh(&ibdev->iboe.lock);
         for (i = 0; i < MLX4_MAX_PORTS; ++i) {
                 struct net_device *curr_netdev = ibdev->iboe.netdevs[i];
+                enum ib_port_state curr_port_state;
 
-                enum ib_port_state curr_port_state =
+                if (!curr_netdev)
+                        continue;
+
+                curr_port_state =
                         (netif_running(curr_netdev) &&
                          netif_carrier_ok(curr_netdev)) ?
                         IB_PORT_ACTIVE : IB_PORT_DOWN;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f2cceb6493a0..dda605836546 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -67,9 +67,6 @@
 #define X_MAX_POSITIVE 8176
 #define Y_MAX_POSITIVE 8176
 
-/* maximum ABS_MT_POSITION displacement (in mm) */
-#define DMAX 10
-
 /*****************************************************************************
  *      Stuff we need even when we do not want native Synaptics support
  ****************************************************************************/
@@ -123,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
 
 static bool cr48_profile_sensor;
 
+#define ANY_BOARD_ID 0
 struct min_max_quirk {
         const char * const *pnp_ids;
+        struct {
+                unsigned long int min, max;
+        } board_id;
         int x_min, x_max, y_min, y_max;
 };
 
 static const struct min_max_quirk min_max_pnpid_table[] = {
         {
                 (const char * const []){"LEN0033", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1024, 5052, 2258, 4832
         },
         {
-                (const char * const []){"LEN0035", "LEN0042", NULL},
+                (const char * const []){"LEN0042", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1232, 5710, 1156, 4696
         },
         {
                 (const char * const []){"LEN0034", "LEN0036", "LEN0037",
                                         "LEN0039", "LEN2002", "LEN2004",
                                         NULL},
+                {ANY_BOARD_ID, 2961},
                 1024, 5112, 2024, 4832
         },
         {
                 (const char * const []){"LEN2001", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1024, 5022, 2508, 4832
         },
         {
                 (const char * const []){"LEN2006", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                 1264, 5675, 1171, 4688
         },
         { }
@@ -175,9 +181,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0041",
         "LEN0042", /* Yoga */
         "LEN0045",
-        "LEN0046",
         "LEN0047",
-        "LEN0048",
         "LEN0049",
         "LEN2000",
         "LEN2001", /* Edge E431 */
@@ -235,18 +239,39 @@ static int synaptics_model_id(struct psmouse *psmouse)
         return 0;
 }
 
+static int synaptics_more_extended_queries(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        unsigned char buf[3];
+
+        if (synaptics_send_cmd(psmouse, SYN_QUE_MEXT_CAPAB_10, buf))
+                return -1;
+
+        priv->ext_cap_10 = (buf[0]<<16) | (buf[1]<<8) | buf[2];
+
+        return 0;
+}
+
 /*
- * Read the board id from the touchpad
+ * Read the board id and the "More Extended Queries" from the touchpad
  * The board id is encoded in the "QUERY MODES" response
  */
-static int synaptics_board_id(struct psmouse *psmouse)
+static int synaptics_query_modes(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char bid[3];
 
+        /* firmwares prior 7.5 have no board_id encoded */
+        if (SYN_ID_FULL(priv->identity) < 0x705)
+                return 0;
+
         if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
                 return -1;
         priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+
+        if (SYN_MEXT_CAP_BIT(bid[0]))
+                return synaptics_more_extended_queries(psmouse);
+
         return 0;
 }
 
@@ -346,7 +371,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char resp[3];
-        int i;
 
         if (SYN_ID_MAJOR(priv->identity) < 4)
                 return 0;
@@ -358,17 +382,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
                 }
         }
 
-        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
-                if (psmouse_matches_pnp_id(psmouse,
-                                           min_max_pnpid_table[i].pnp_ids)) {
-                        priv->x_min = min_max_pnpid_table[i].x_min;
-                        priv->x_max = min_max_pnpid_table[i].x_max;
-                        priv->y_min = min_max_pnpid_table[i].y_min;
-                        priv->y_max = min_max_pnpid_table[i].y_max;
-                        return 0;
-                }
-        }
-
         if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
             SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
@@ -377,23 +390,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
                 } else {
                         priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                         priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried max coordinates: x [..%d], y [..%d]\n",
+                                     priv->x_max, priv->y_max);
                 }
         }
 
-        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
-            SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
+        if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
+            (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
+             /*
+              * Firmware v8.1 does not report proper number of extended
+              * capabilities, but has been proven to report correct min
+              * coordinates.
+              */
+             SYN_ID_FULL(priv->identity) == 0x801)) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
                         psmouse_warn(psmouse,
                                      "device claims to have min coordinates query, but I'm not able to read it.\n");
                 } else {
                         priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                         priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried min coordinates: x [%d..], y [%d..]\n",
+                                     priv->x_min, priv->y_min);
                 }
         }
 
         return 0;
 }
 
+/*
+ * Apply quirk(s) if the hardware matches
+ */
+
+static void synaptics_apply_quirks(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        int i;
+
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+                if (!psmouse_matches_pnp_id(psmouse,
+                                            min_max_pnpid_table[i].pnp_ids))
+                        continue;
+
+                if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
+                    priv->board_id < min_max_pnpid_table[i].board_id.min)
+                        continue;
+
+                if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
+                    priv->board_id > min_max_pnpid_table[i].board_id.max)
+                        continue;
+
+                priv->x_min = min_max_pnpid_table[i].x_min;
+                priv->x_max = min_max_pnpid_table[i].x_max;
+                priv->y_min = min_max_pnpid_table[i].y_min;
+                priv->y_max = min_max_pnpid_table[i].y_max;
+                psmouse_info(psmouse,
+                             "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
+                             priv->x_min, priv->x_max,
+                             priv->y_min, priv->y_max);
+                break;
+        }
+}
+
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
         if (synaptics_identify(psmouse))
@@ -402,13 +461,15 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
                 return -1;
         if (synaptics_firmware_id(psmouse))
                 return -1;
-        if (synaptics_board_id(psmouse))
+        if (synaptics_query_modes(psmouse))
                 return -1;
         if (synaptics_capability(psmouse))
                 return -1;
         if (synaptics_resolution(psmouse))
                 return -1;
 
+        synaptics_apply_quirks(psmouse);
+
         return 0;
 }
 
@@ -516,18 +577,22 @@ static int synaptics_is_pt_packet(unsigned char *buf)
         return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4;
 }
 
-static void synaptics_pass_pt_packet(struct serio *ptport, unsigned char *packet)
+static void synaptics_pass_pt_packet(struct psmouse *psmouse,
+                                     struct serio *ptport,
+                                     unsigned char *packet)
 {
+        struct synaptics_data *priv = psmouse->private;
         struct psmouse *child = serio_get_drvdata(ptport);
 
         if (child && child->state == PSMOUSE_ACTIVATED) {
-                serio_interrupt(ptport, packet[1], 0);
+                serio_interrupt(ptport, packet[1] | priv->pt_buttons, 0);
                 serio_interrupt(ptport, packet[4], 0);
                 serio_interrupt(ptport, packet[5], 0);
                 if (child->pktsize == 4)
                         serio_interrupt(ptport, packet[2], 0);
-        } else
+        } else {
                 serio_interrupt(ptport, packet[1], 0);
+        }
 }
 
 static void synaptics_pt_activate(struct psmouse *psmouse)
@@ -605,6 +670,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
         }
 }
 
+static void synaptics_parse_ext_buttons(const unsigned char buf[],
+                                        struct synaptics_data *priv,
+                                        struct synaptics_hw_state *hw)
+{
+        unsigned int ext_bits =
+                (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
+
+        hw->ext_buttons = buf[4] & ext_mask;
+        hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
+}
+
 static bool is_forcepad;
 
 static int synaptics_parse_hw_state(const unsigned char buf[],
@@ -691,28 +768,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
                         hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
                 }
 
-                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
                     ((buf[0] ^ buf[3]) & 0x02)) {
-                        switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
-                        default:
-                                /*
-                                 * if nExtBtn is greater than 8 it should be
-                                 * considered invalid and treated as 0
-                                 */
-                                break;
-                        case 8:
-                                hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
-                        case 6:
-                                hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
-                        case 4:
-                                hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
-                        case 2:
-                                hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
-                        }
+                        synaptics_parse_ext_buttons(buf, priv, hw);
                 }
         } else {
                 hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
@@ -774,12 +832,54 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
         }
 }
 
+static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+                                         const struct synaptics_hw_state *hw)
+{
+        struct input_dev *dev = psmouse->dev;
+        struct synaptics_data *priv = psmouse->private;
+        int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        char buf[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+        int i;
+
+        if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+                return;
+
+        /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+        if (SYN_ID_FULL(priv->identity) == 0x801 &&
+            !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+                return;
+
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10)) {
+                for (i = 0; i < ext_bits; i++) {
+                        input_report_key(dev, BTN_0 + 2 * i,
+                                hw->ext_buttons & (1 << i));
+                        input_report_key(dev, BTN_1 + 2 * i,
+                                hw->ext_buttons & (1 << (i + ext_bits)));
+                }
+                return;
+        }
+
+        /*
+         * This generation of touchpads has the trackstick buttons
+         * physically wired to the touchpad. Re-route them through
+         * the pass-through interface.
+         */
+        if (!priv->pt_port)
+                return;
+
+        /* The trackstick expects at most 3 buttons */
+        priv->pt_buttons = SYN_CAP_EXT_BUTTON_STICK_L(hw->ext_buttons)      |
+                           SYN_CAP_EXT_BUTTON_STICK_R(hw->ext_buttons) << 1 |
+                           SYN_CAP_EXT_BUTTON_STICK_M(hw->ext_buttons) << 2;
+
+        synaptics_pass_pt_packet(psmouse, priv->pt_port, buf);
+}
+
 static void synaptics_report_buttons(struct psmouse *psmouse,
                                      const struct synaptics_hw_state *hw)
 {
         struct input_dev *dev = psmouse->dev;
         struct synaptics_data *priv = psmouse->private;
-        int i;
 
         input_report_key(dev, BTN_LEFT, hw->left);
         input_report_key(dev, BTN_RIGHT, hw->right);
@@ -792,8 +892,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
                 input_report_key(dev, BTN_BACK, hw->down);
         }
 
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-                input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
+        synaptics_report_ext_buttons(psmouse, hw);
 }
 
 static void synaptics_report_mt_data(struct psmouse *psmouse,
@@ -813,7 +912,7 @@ static void synaptics_report_mt_data(struct psmouse *psmouse,
                 pos[i].y = synaptics_invert_y(hw[i]->y);
         }
 
-        input_mt_assign_slots(dev, slot, pos, nsemi, DMAX * priv->x_res);
+        input_mt_assign_slots(dev, slot, pos, nsemi, 0);
 
         for (i = 0; i < nsemi; i++) {
                 input_mt_slot(dev, slot[i]);
@@ -1014,7 +1113,8 @@ static psmouse_ret_t synaptics_process_byte(struct psmouse *psmouse)
                 if (SYN_CAP_PASS_THROUGH(priv->capabilities) &&
                     synaptics_is_pt_packet(psmouse->packet)) {
                         if (priv->pt_port)
-                                synaptics_pass_pt_packet(priv->pt_port, psmouse->packet);
+                                synaptics_pass_pt_packet(psmouse, priv->pt_port,
+                                                         psmouse->packet);
                 } else
                         synaptics_process_packet(psmouse);
 
@@ -1116,8 +1216,9 @@ static void set_input_params(struct psmouse *psmouse,
                 __set_bit(BTN_BACK, dev->keybit);
         }
 
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
-                __set_bit(BTN_0 + i, dev->keybit);
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
+                for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+                        __set_bit(BTN_0 + i, dev->keybit);
 
         __clear_bit(EV_REL, dev->evbit);
         __clear_bit(REL_X, dev->relbit);
@@ -1125,7 +1226,8 @@ static void set_input_params(struct psmouse *psmouse,
 
         if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                 __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+                    !SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
                         __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                 /* Clickpads report only left button */
                 __clear_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index aedc3299b14e..ee4bd0d12b26 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -22,6 +22,7 @@
 #define SYN_QUE_EXT_CAPAB_0C            0x0c
 #define SYN_QUE_EXT_MAX_COORDS          0x0d
 #define SYN_QUE_EXT_MIN_COORDS          0x0f
+#define SYN_QUE_MEXT_CAPAB_10           0x10
 
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -53,6 +54,7 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_MEXT_CAP_BIT(m)             ((m) & (1 << 1))
 
 /*
  * The following describes response for the 0x0c query.
@@ -89,6 +91,30 @@
 #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
 #define SYN_CAP_IMAGE_SENSOR(ex0c)      ((ex0c) & 0x000800)
 
+/*
+ * The following descibes response for the 0x10 query.
+ *
+ * byte mask    name                    meaning
+ * ---- ----    -------                 ------------
+ * 1    0x01    ext buttons are stick   buttons exported in the extended
+ *                                      capability are actually meant to be used
+ *                                      by the tracktick (pass-through).
+ * 1    0x02    SecurePad               the touchpad is a SecurePad, so it
+ *                                      contains a built-in fingerprint reader.
+ * 1    0xe0    more ext count          how many more extented queries are
+ *                                      available after this one.
+ * 2    0xff    SecurePad width         the width of the SecurePad fingerprint
+ *                                      reader.
+ * 3    0xff    SecurePad height        the height of the SecurePad fingerprint
+ *                                      reader.
+ */
+#define SYN_CAP_EXT_BUTTONS_STICK(ex10) ((ex10) & 0x010000)
+#define SYN_CAP_SECUREPAD(ex10)         ((ex10) & 0x020000)
+
+#define SYN_CAP_EXT_BUTTON_STICK_L(eb)  (!!((eb) & 0x01))
+#define SYN_CAP_EXT_BUTTON_STICK_M(eb)  (!!((eb) & 0x02))
+#define SYN_CAP_EXT_BUTTON_STICK_R(eb)  (!!((eb) & 0x04))
+
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
 #define SYN_MODE_RATE(m)                ((m) & (1 << 6))
@@ -143,6 +169,7 @@ struct synaptics_data {
         unsigned long int capabilities;         /* Capabilities */
         unsigned long int ext_cap;              /* Extended Capabilities */
         unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
+        unsigned long int ext_cap_10;           /* Ext Caps from 0x10 query */
         unsigned long int identity;             /* Identification */
         unsigned int x_res, y_res;              /* X/Y resolution in units/mm */
         unsigned int x_max, y_max;              /* Max coordinates (from FW) */
@@ -156,6 +183,7 @@ struct synaptics_data {
         bool disable_gesture;                   /* disable gestures */
 
         struct serio *pt_port;                  /* Pass-through serio port */
+        unsigned char pt_buttons;               /* Pass-through buttons */
 
         /*
          * Last received Advanced Gesture Mode (AGM) packet. An AGM packet
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index baa0d9786f50..1ae4e547b419 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -23,6 +23,7 @@ config IOMMU_IO_PGTABLE
 config IOMMU_IO_PGTABLE_LPAE
         bool "ARMv7/v8 Long Descriptor Format"
         select IOMMU_IO_PGTABLE
+        depends on ARM || ARM64 || COMPILE_TEST
         help
           Enable support for the ARM long descriptor pagetable format.
           This allocator supports 4K/2M/1G, 16K/32M and 64K/512M page
@@ -63,6 +64,7 @@ config MSM_IOMMU
         bool "MSM IOMMU Support"
         depends on ARM
         depends on ARCH_MSM8X60 || ARCH_MSM8960 || COMPILE_TEST
+        depends on BROKEN
         select IOMMU_API
         help
           Support for the IOMMUs found on certain Qualcomm SOCs.
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 7ce52737c7a1..dc14fec4ede1 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -1186,8 +1186,15 @@ static const struct iommu_ops exynos_iommu_ops = {
 
 static int __init exynos_iommu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        np = of_find_matching_node(NULL, sysmmu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table",
                                 LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL);
         if (!lv2table_kmem_cache) {
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 5a500edf00cc..b610a8dee238 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -56,7 +56,8 @@
         ((((d)->levels - ((l) - ARM_LPAE_START_LVL(d) + 1))             \
           * (d)->bits_per_level) + (d)->pg_shift)
 
-#define ARM_LPAE_PAGES_PER_PGD(d)       ((d)->pgd_size >> (d)->pg_shift)
+#define ARM_LPAE_PAGES_PER_PGD(d)                                       \
+        DIV_ROUND_UP((d)->pgd_size, 1UL << (d)->pg_shift)
 
 /*
  * Calculate the index at level l used to map virtual address a using the
@@ -66,7 +67,7 @@
         ((l) == ARM_LPAE_START_LVL(d) ? ilog2(ARM_LPAE_PAGES_PER_PGD(d)) : 0)
 
 #define ARM_LPAE_LVL_IDX(a,l,d)                                         \
-        (((a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                             \
+        (((u64)(a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                        \
          ((1 << ((d)->bits_per_level + ARM_LPAE_PGD_IDX(l,d))) - 1))
 
 /* Calculate the block/page mapping size at level l for pagetable in d. */
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index f59f857b702e..a4ba851825c2 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1376,6 +1376,13 @@ static int __init omap_iommu_init(void)
         struct kmem_cache *p;
         const unsigned long flags = SLAB_HWCACHE_ALIGN;
         size_t align = 1 << 10; /* L2 pagetable alignement */
+        struct device_node *np;
+
+        np = of_find_matching_node(NULL, omap_iommu_of_match);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
 
         p = kmem_cache_create("iopte_cache", IOPTE_TABLE_SIZE, align, flags,
                               iopte_cachep_ctor);
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 6a8b1ec4a48a..9f74fddcd304 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1015,8 +1015,15 @@ static struct platform_driver rk_iommu_driver = {
 
 static int __init rk_iommu_init(void)
 {
+        struct device_node *np;
         int ret;
 
+        np = of_find_matching_node(NULL, rk_iommu_dt_ids);
+        if (!np)
+                return 0;
+
+        of_node_put(np);
+
         ret = bus_set_iommu(&platform_bus_type, &rk_iommu_ops);
         if (ret)
                 return ret;
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 463c235acbdc..4387dae14e45 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
 static u32 doorbell_mask_reg;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
 {
         if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
                 armada_xp_mpic_smp_cpu_init();
+
         return NOTIFY_OK;
 }
 
@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
         .priority = 100,
 };
 
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+                                        unsigned long action, void *hcpu)
+{
+        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+                enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+        .notifier_call = mpic_cascaded_secondary_init,
+        .priority = 100,
+};
+
 #endif /* CONFIG_SMP */
 
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                              struct device_node *parent)
 {
         struct resource main_int_res, per_cpu_int_res;
-        int parent_irq, nr_irqs, i;
+        int nr_irqs, i;
         u32 control;
 
         BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                 register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
         } else {
+#ifdef CONFIG_SMP
+                register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
                 irq_set_chained_handler(parent_irq,
                                         armada_370_xp_mpic_handle_cascade_irq);
         }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d8996bdf0f61..596b0a9eee99 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -416,13 +416,14 @@ static void its_send_single_command(struct its_node *its,
 {
         struct its_cmd_block *cmd, *sync_cmd, *next_cmd;
         struct its_collection *sync_col;
+        unsigned long flags;
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
 
         cmd = its_allocate_entry(its);
         if (!cmd) {             /* We're soooooo screewed... */
                 pr_err_ratelimited("ITS can't allocate, dropping command\n");
-                raw_spin_unlock(&its->lock);
+                raw_spin_unlock_irqrestore(&its->lock, flags);
                 return;
         }
         sync_col = builder(cmd, desc);
@@ -442,7 +443,7 @@ static void its_send_single_command(struct its_node *its,
 
 post:
         next_cmd = its_post_commands(its);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         its_wait_for_range_completion(its, cmd, next_cmd);
 }
@@ -799,21 +800,43 @@ static int its_alloc_tables(struct its_node *its)
 {
         int err;
         int i;
-        int psz = PAGE_SIZE;
+        int psz = SZ_64K;
         u64 shr = GITS_BASER_InnerShareable;
 
         for (i = 0; i < GITS_BASER_NR_REGS; i++) {
                 u64 val = readq_relaxed(its->base + GITS_BASER + i * 8);
                 u64 type = GITS_BASER_TYPE(val);
                 u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
+                int order = get_order(psz);
+                int alloc_size;
                 u64 tmp;
                 void *base;
 
                 if (type == GITS_BASER_TYPE_NONE)
                         continue;
 
-                /* We're lazy and only allocate a single page for now */
-                base = (void *)get_zeroed_page(GFP_KERNEL);
+                /*
+                 * Allocate as many entries as required to fit the
+                 * range of device IDs that the ITS can grok... The ID
+                 * space being incredibly sparse, this results in a
+                 * massive waste of memory.
+                 *
+                 * For other tables, only allocate a single page.
+                 */
+                if (type == GITS_BASER_TYPE_DEVICE) {
+                        u64 typer = readq_relaxed(its->base + GITS_TYPER);
+                        u32 ids = GITS_TYPER_DEVBITS(typer);
+
+                        order = get_order((1UL << ids) * entry_size);
+                        if (order >= MAX_ORDER) {
+                                order = MAX_ORDER - 1;
+                                pr_warn("%s: Device Table too large, reduce its page order to %u\n",
+                                        its->msi_chip.of_node->full_name, order);
+                        }
+                }
+
+                alloc_size = (1 << order) * PAGE_SIZE;
+                base = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
                 if (!base) {
                         err = -ENOMEM;
                         goto out_free;
@@ -841,7 +864,7 @@ retry_baser:
                         break;
                 }
 
-                val |= (PAGE_SIZE / psz) - 1;
+                val |= (alloc_size / psz) - 1;
 
                 writeq_relaxed(val, its->base + GITS_BASER + i * 8);
                 tmp = readq_relaxed(its->base + GITS_BASER + i * 8);
@@ -882,7 +905,7 @@ retry_baser:
                 }
 
                 pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
-                        (int)(PAGE_SIZE / entry_size),
+                        (int)(alloc_size / entry_size),
                         its_base_type_string[type],
                         (unsigned long)virt_to_phys(base),
                         psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
@@ -1020,8 +1043,9 @@ static void its_cpu_init_collection(void)
 static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
 {
         struct its_device *its_dev = NULL, *tmp;
+        unsigned long flags;
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
 
         list_for_each_entry(tmp, &its->its_device_list, entry) {
                 if (tmp->device_id == dev_id) {
@@ -1030,7 +1054,7 @@ static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
                 }
         }
 
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         return its_dev;
 }
@@ -1040,6 +1064,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 {
         struct its_device *dev;
         unsigned long *lpi_map;
+        unsigned long flags;
         void *itt;
         int lpi_base;
         int nr_lpis;
@@ -1056,7 +1081,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         nr_ites = max(2UL, roundup_pow_of_two(nvecs));
         sz = nr_ites * its->ite_size;
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
-        itt = kmalloc(sz, GFP_KERNEL);
+        itt = kzalloc(sz, GFP_KERNEL);
         lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
 
         if (!dev || !itt || !lpi_map) {
@@ -1075,9 +1100,9 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         dev->device_id = dev_id;
         INIT_LIST_HEAD(&dev->entry);
 
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
         list_add(&dev->entry, &its->its_device_list);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
 
         /* Bind the device to the first possible CPU */
         cpu = cpumask_first(cpu_online_mask);
@@ -1091,9 +1116,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 
 static void its_free_device(struct its_device *its_dev)
 {
-        raw_spin_lock(&its_dev->its->lock);
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&its_dev->its->lock, flags);
         list_del(&its_dev->entry);
-        raw_spin_unlock(&its_dev->its->lock);
+        raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
         kfree(its_dev->itt);
         kfree(its_dev);
 }
@@ -1112,31 +1139,69 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
         return 0;
 }
 
+struct its_pci_alias {
+        struct pci_dev  *pdev;
+        u32             dev_id;
+        u32             count;
+};
+
+static int its_pci_msi_vec_count(struct pci_dev *pdev)
+{
+        int msi, msix;
+
+        msi = max(pci_msi_vec_count(pdev), 0);
+        msix = max(pci_msix_vec_count(pdev), 0);
+
+        return max(msi, msix);
+}
+
+static int its_get_pci_alias(struct pci_dev *pdev, u16 alias, void *data)
+{
+        struct its_pci_alias *dev_alias = data;
+
+        dev_alias->dev_id = alias;
+        if (pdev != dev_alias->pdev)
+                dev_alias->count += its_pci_msi_vec_count(dev_alias->pdev);
+
+        return 0;
+}
+
 static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                            int nvec, msi_alloc_info_t *info)
 {
         struct pci_dev *pdev;
         struct its_node *its;
-        u32 dev_id;
         struct its_device *its_dev;
+        struct its_pci_alias dev_alias;
 
         if (!dev_is_pci(dev))
                 return -EINVAL;
 
         pdev = to_pci_dev(dev);
-        dev_id = PCI_DEVID(pdev->bus->number, pdev->devfn);
+        dev_alias.pdev = pdev;
+        dev_alias.count = nvec;
+
+        pci_for_each_dma_alias(pdev, its_get_pci_alias, &dev_alias);
         its = domain->parent->host_data;
 
-        its_dev = its_find_device(its, dev_id);
-        if (WARN_ON(its_dev))
-                return -EINVAL;
+        its_dev = its_find_device(its, dev_alias.dev_id);
+        if (its_dev) {
+                /*
+                 * We already have seen this ID, probably through
+                 * another alias (PCI bridge of some sort). No need to
+                 * create the device.
+                 */
+                dev_dbg(dev, "Reusing ITT for devID %x\n", dev_alias.dev_id);
+                goto out;
+        }
 
-        its_dev = its_create_device(its, dev_id, nvec);
+        its_dev = its_create_device(its, dev_alias.dev_id, dev_alias.count);
         if (!its_dev)
                 return -ENOMEM;
 
-        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n", nvec, ilog2(nvec));
-
+        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n",
+                dev_alias.count, ilog2(dev_alias.count));
+out:
         info->scratchpad[0].ptr = its_dev;
         info->scratchpad[1].ptr = dev;
         return 0;
@@ -1255,6 +1320,34 @@ static const struct irq_domain_ops its_domain_ops = {
         .deactivate             = its_irq_domain_deactivate,
 };
 
+static int its_force_quiescent(void __iomem *base)
+{
+        u32 count = 1000000;    /* 1s */
+        u32 val;
+
+        val = readl_relaxed(base + GITS_CTLR);
+        if (val & GITS_CTLR_QUIESCENT)
+                return 0;
+
+        /* Disable the generation of all interrupts to this ITS */
+        val &= ~GITS_CTLR_ENABLE;
+        writel_relaxed(val, base + GITS_CTLR);
+
+        /* Poll GITS_CTLR and wait until ITS becomes quiescent */
+        while (1) {
+                val = readl_relaxed(base + GITS_CTLR);
+                if (val & GITS_CTLR_QUIESCENT)
+                        return 0;
+
+                count--;
+                if (!count)
+                        return -EBUSY;
+
+                cpu_relax();
+                udelay(1);
+        }
+}
+
 static int its_probe(struct device_node *node, struct irq_domain *parent)
 {
         struct resource res;
@@ -1283,6 +1376,13 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
                 goto out_unmap;
         }
 
+        err = its_force_quiescent(its_base);
+        if (err) {
+                pr_warn("%s: failed to quiesce, giving up\n",
+                        node->full_name);
+                goto out_unmap;
+        }
+
         pr_info("ITS: %s\n", node->full_name);
 
         its = kzalloc(sizeof(*its), GFP_KERNEL);
@@ -1323,7 +1423,7 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
         writeq_relaxed(baser, its->base + GITS_CBASER);
         tmp = readq_relaxed(its->base + GITS_CBASER);
         writeq_relaxed(0, its->base + GITS_CWRITER);
-        writel_relaxed(1, its->base + GITS_CTLR);
+        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
 
         if ((tmp ^ baser) & GITS_BASER_SHAREABILITY_MASK) {
                 pr_info("ITS: using cache flushing for cmd queue\n");
@@ -1382,12 +1482,11 @@ static bool gic_rdists_supports_plpis(void)
 
 int its_cpu_init(void)
 {
-        if (!gic_rdists_supports_plpis()) {
-                pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
-                return -ENXIO;
-        }
-
         if (!list_empty(&its_nodes)) {
+                if (!gic_rdists_supports_plpis()) {
+                        pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+                        return -ENXIO;
+                }
                 its_cpu_init_lpis();
                 its_cpu_init_collection();
         }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 1c6dea2fbc34..fd8850def1b8 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -466,7 +466,7 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                 tlist |= 1 << (mpidr & 0xf);
 
                 cpu = cpumask_next(cpu, mask);
-                if (cpu == nr_cpu_ids)
+                if (cpu >= nr_cpu_ids)
                         goto out;
 
                 mpidr = cpu_logical_map(cpu);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4634cf7d0ec3..471e1cdc1933 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -154,23 +154,25 @@ static inline unsigned int gic_irq(struct irq_data *d)
 static void gic_mask_irq(struct irq_data *d)
 {
         u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_CLEAR + (gic_irq(d) / 32) * 4);
         if (gic_arch_extn.irq_mask)
                 gic_arch_extn.irq_mask(d);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 
 static void gic_unmask_irq(struct irq_data *d)
 {
         u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         if (gic_arch_extn.irq_unmask)
                 gic_arch_extn.irq_unmask(d);
         writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_SET + (gic_irq(d) / 32) * 4);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 
 static void gic_eoi_irq(struct irq_data *d)
@@ -188,6 +190,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
 {
         void __iomem *base = gic_dist_base(d);
         unsigned int gicirq = gic_irq(d);
+        unsigned long flags;
         int ret;
 
         /* Interrupt configuration for SGIs can't be changed */
@@ -199,14 +202,14 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
                             type != IRQ_TYPE_EDGE_RISING)
                 return -EINVAL;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
 
         if (gic_arch_extn.irq_set_type)
                 gic_arch_extn.irq_set_type(d, type);
 
         ret = gic_configure_irq(gicirq, type, base, NULL);
 
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 
         return ret;
 }
@@ -227,6 +230,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
         void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
         unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
         u32 val, mask, bit;
+        unsigned long flags;
 
         if (!force)
                 cpu = cpumask_any_and(mask_val, cpu_online_mask);
@@ -236,12 +240,12 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
         if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                 return -EINVAL;
 
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
         mask = 0xff << shift;
         bit = gic_cpu_map[cpu] << shift;
         val = readl_relaxed(reg) & ~mask;
         writel_relaxed(val | bit, reg);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 
         return IRQ_SET_MASK_OK;
 }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6a7447c304ac..358a574d9e8b 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1609,7 +1609,7 @@ icn_setup(char *line)
         if (ints[0] > 1)
                 membase = (unsigned long)ints[2];
         if (str && *str) {
-                strcpy(sid, str);
+                strlcpy(sid, str, sizeof(sid));
                 icn_id = sid;
                 if ((p = strchr(sid, ','))) {
                         *p++ = 0;
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index e9f1d8d84613..c53f14a7ce54 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -124,7 +124,7 @@ int mmc_pwrseq_simple_alloc(struct mmc_host *host, struct device *dev)
                     PTR_ERR(pwrseq->reset_gpios[i]) != -ENOSYS) {
                         ret = PTR_ERR(pwrseq->reset_gpios[i]);
 
-                        while (--i)
+                        while (i--)
                                 gpiod_put(pwrseq->reset_gpios[i]);
 
                         goto clk_put;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 5b76a173cd95..5897d8d8fa5a 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -526,6 +526,7 @@ config MTD_NAND_SUNXI
 
 config MTD_NAND_HISI504
         tristate "Support for NAND controller on Hisilicon SoC Hip04"
+        depends on HAS_DMA
         help
           Enables support for NAND controller on Hisilicon SoC Hip04.
 
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 96b0b1d27df1..10b1f7a4fe50 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
         nand_writel(info, NDCR, ndcr | int_mask);
 }
 
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+        if (info->ecc_bch) {
+                int timeout;
+
+                /*
+                 * According to the datasheet, when reading from NDDB
+                 * with BCH enabled, after each 32 bytes reads, we
+                 * have to make sure that the NDSR.RDDREQ bit is set.
+                 *
+                 * Drain the FIFO 8 32 bits reads at a time, and skip
+                 * the polling on the last read.
+                 */
+                while (len > 8) {
+                        __raw_readsl(info->mmio_base + NDDB, data, 8);
+
+                        for (timeout = 0;
+                             !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+                             timeout++) {
+                                if (timeout >= 5) {
+                                        dev_err(&info->pdev->dev,
+                                                "Timeout on RDDREQ while draining the FIFO\n");
+                                        return;
+                                }
+
+                                mdelay(1);
+                        }
+
+                        data += 32;
+                        len -= 8;
+                }
+        }
+
+        __raw_readsl(info->mmio_base + NDDB, data, len);
+}
+
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
         unsigned int do_bytes = min(info->data_size, info->chunk_size);
@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
                                       DIV_ROUND_UP(info->oob_size, 4));
                 break;
         case STATE_PIO_READING:
-                __raw_readsl(info->mmio_base + NDDB,
-                             info->data_buff + info->data_buff_pos,
-                             DIV_ROUND_UP(do_bytes, 4));
+                drain_fifo(info,
+                           info->data_buff + info->data_buff_pos,
+                           DIV_ROUND_UP(do_bytes, 4));
 
                 if (info->oob_size > 0)
-                        __raw_readsl(info->mmio_base + NDDB,
-                                     info->oob_buff + info->oob_buff_pos,
-                                     DIV_ROUND_UP(info->oob_size, 4));
+                        drain_fifo(info,
+                                   info->oob_buff + info->oob_buff_pos,
+                                   DIV_ROUND_UP(info->oob_size, 4));
                 break;
         default:
                 dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
@@ -1572,6 +1608,8 @@ static int alloc_nand_resource(struct platform_device *pdev)
         int ret, irq, cs;
 
         pdata = dev_get_platdata(&pdev->dev);
+        if (pdata->num_cs <= 0)
+                return -ENODEV;
         info = devm_kzalloc(&pdev->dev, sizeof(*info) + (sizeof(*mtd) +
                             sizeof(*host)) * pdata->num_cs, GFP_KERNEL);
         if (!info)
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index 98d73aab52fe..58808f651452 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -131,7 +131,7 @@ config CAN_RCAR
 
 config CAN_XILINXCAN
         tristate "Xilinx CAN"
-        depends on ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST
+        depends on ARCH_ZYNQ || ARM64 || MICROBLAZE || COMPILE_TEST
         depends on COMMON_CLK && HAS_IOMEM
         ---help---
           Xilinx CAN driver. This driver supports both soft AXI CAN IP and
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index a316fa4b91ab..e97a08ce0b90 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 Valeo S.A.
  */
 
+#include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
@@ -467,10 +468,11 @@ struct kvaser_usb {
 struct kvaser_usb_net_priv {
         struct can_priv can;
 
-        atomic_t active_tx_urbs;
-        struct usb_anchor tx_submitted;
+        spinlock_t tx_contexts_lock;
+        int active_tx_contexts;
         struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];
 
+        struct usb_anchor tx_submitted;
         struct completion start_comp, stop_comp;
 
         struct kvaser_usb *dev;
@@ -694,6 +696,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
         struct kvaser_usb_net_priv *priv;
         struct sk_buff *skb;
         struct can_frame *cf;
+        unsigned long flags;
         u8 channel, tid;
 
         channel = msg->u.tx_acknowledge_header.channel;
@@ -737,12 +740,15 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
 
         stats->tx_packets++;
         stats->tx_bytes += context->dlc;
-        can_get_echo_skb(priv->netdev, context->echo_index);
 
-        context->echo_index = MAX_TX_URBS;
-        atomic_dec(&priv->active_tx_urbs);
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
 
+        can_get_echo_skb(priv->netdev, context->echo_index);
+        context->echo_index = MAX_TX_URBS;
+        --priv->active_tx_contexts;
         netif_wake_queue(priv->netdev);
+
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 }
 
 static void kvaser_usb_simple_msg_callback(struct urb *urb)
@@ -803,17 +809,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
         return 0;
 }
 
-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
-{
-        int i;
-
-        usb_kill_anchored_urbs(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-
-        for (i = 0; i < MAX_TX_URBS; i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-}
-
 static void kvaser_usb_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
                                                  const struct kvaser_usb_error_summary *es,
                                                  struct can_frame *cf)
@@ -1515,6 +1510,24 @@ error:
         return err;
 }
 
+static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
+{
+        int i;
+
+        priv->active_tx_contexts = 0;
+        for (i = 0; i < MAX_TX_URBS; i++)
+                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
+}
+
+/* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+{
+        usb_kill_anchored_urbs(&priv->tx_submitted);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+}
+
 static void kvaser_usb_unlink_all_urbs(struct kvaser_usb *dev)
 {
         int i;
@@ -1634,6 +1647,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         struct kvaser_msg *msg;
         int i, err, ret = NETDEV_TX_OK;
         u8 *msg_tx_can_flags = NULL;            /* GCC */
+        unsigned long flags;
 
         if (can_dropped_invalid_skb(netdev, skb))
                 return NETDEV_TX_OK;
@@ -1687,12 +1701,21 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         if (cf->can_id & CAN_RTR_FLAG)
                 *msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;
 
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
         for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
                 if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
                         context = &priv->tx_contexts[i];
+
+                        context->echo_index = i;
+                        can_put_echo_skb(skb, netdev, context->echo_index);
+                        ++priv->active_tx_contexts;
+                        if (priv->active_tx_contexts >= MAX_TX_URBS)
+                                netif_stop_queue(netdev);
+
                         break;
                 }
         }
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
         /* This should never happen; it implies a flow control bug */
         if (!context) {
@@ -1704,7 +1727,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
         }
 
         context->priv = priv;
-        context->echo_index = i;
         context->dlc = cf->can_dlc;
 
         msg->u.tx_can.tid = context->echo_index;
@@ -1716,18 +1738,17 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                           kvaser_usb_write_bulk_callback, context);
         usb_anchor_urb(urb, &priv->tx_submitted);
 
-        can_put_echo_skb(skb, netdev, context->echo_index);
-
-        atomic_inc(&priv->active_tx_urbs);
-
-        if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
-                netif_stop_queue(netdev);
-
         err = usb_submit_urb(urb, GFP_ATOMIC);
         if (unlikely(err)) {
+                spin_lock_irqsave(&priv->tx_contexts_lock, flags);
+
                 can_free_echo_skb(netdev, context->echo_index);
+                context->echo_index = MAX_TX_URBS;
+                --priv->active_tx_contexts;
+                netif_wake_queue(netdev);
+
+                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
-                atomic_dec(&priv->active_tx_urbs);
                 usb_unanchor_urb(urb);
 
                 stats->tx_dropped++;
@@ -1854,7 +1875,7 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
         struct kvaser_usb *dev = usb_get_intfdata(intf);
         struct net_device *netdev;
         struct kvaser_usb_net_priv *priv;
-        int i, err;
+        int err;
 
         err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
         if (err)
@@ -1868,19 +1889,17 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
 
         priv = netdev_priv(netdev);
 
+        init_usb_anchor(&priv->tx_submitted);
         init_completion(&priv->start_comp);
         init_completion(&priv->stop_comp);
 
-        init_usb_anchor(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-
         priv->dev = dev;
         priv->netdev = netdev;
         priv->channel = channel;
 
+        spin_lock_init(&priv->tx_contexts_lock);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+
         priv->can.state = CAN_STATE_STOPPED;
         priv->can.clock.freq = CAN_USB_CLOCK;
         priv->can.bittiming_const = &kvaser_usb_bittiming_const;
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 8eb37e0194b5..bc8b04f42882 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
         struct pcnet32_private *lp;
         int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
         int chip_version;
         char *chipname;
         struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
         }
 
         /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
         chip_version = (chip_version >> 12) & 0xffff;
 
         switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C973";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2626:
                 chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C975";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2628:
                 chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 dxsuflo = 1;
         }
 
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
+
         dev = alloc_etherdev(sizeof(*lp));
         if (!dev) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2ee12b54239b..9677431c582a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12769,7 +12769,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                 NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 |
                 NETIF_F_RXCSUM | NETIF_F_LRO | NETIF_F_GRO |
                 NETIF_F_RXHASH | NETIF_F_HW_VLAN_CTAG_TX;
-        if (!CHIP_IS_E1x(bp)) {
+        if (!chip_is_e1x) {
                 dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL |
                                     NETIF_F_GSO_IPIP | NETIF_F_GSO_SIT;
                 dev->hw_enc_features =
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 1498d078c319..afbe1682ff48 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -1120,7 +1120,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
                 }
 
                 /* Installed successfully, update the cached header too. */
-                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                *card_fw = *fs_fw;
                 card_fw_usable = 1;
                 *reset = 0;     /* already reset as part of load_fw */
         }
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index 3b42556f7f8d..ed41559bae77 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -589,7 +589,7 @@ static void tulip_tx_timeout(struct net_device *dev)
                                (unsigned int)tp->rx_ring[i].buffer1,
                                (unsigned int)tp->rx_ring[i].buffer2,
                                buf[0], buf[1], buf[2]);
-                        for (j = 0; buf[j] != 0xee && j < 1600; j++)
+                        for (j = 0; ((j < 1600) && buf[j] != 0xee); j++)
                                 if (j < 100)
                                         pr_cont(" %02x", buf[j]);
                         pr_cont(" j=%d\n", j);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 996bbc6a244f..eb39673ed6a6 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -362,6 +362,7 @@ struct be_vf_cfg {
         u16 vlan_tag;
         u32 tx_rate;
         u32 plink_tracking;
+        u32 privileges;
 };
 
 enum vf_state {
@@ -468,6 +469,7 @@ struct be_adapter {
 
         u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
         u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
 
         struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
         struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index dc278391a391..fb140faeafb1 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1849,15 +1849,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
         int num_eqs, i = 0;
 
-        if (lancer_chip(adapter) && num > 8) {
-                while (num) {
-                        num_eqs = min(num, 8);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        i += num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
+        while (num) {
+                num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
+                num -= num_eqs;
         }
 
         return 0;
@@ -1865,7 +1861,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_vlan_config *req;
@@ -1883,6 +1879,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
         be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                                OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                                wrb, NULL);
+        req->hdr.domain = domain;
 
         req->interface_id = if_id;
         req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 53e903f37247..1ec22300e254 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2266,7 +2266,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 5652b005947f..d8df78b6554d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1261,7 +1261,7 @@ static int be_vid_config(struct be_adapter *adapter)
         for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                 vids[num++] = cpu_to_le16(i);
 
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
         if (status) {
                 dev_err(dev, "Setting HW VLAN filtering failed\n");
                 /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1470,11 +1470,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
         return 0;
 }
 
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
+
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
         struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
 
         if (!sriov_enabled(adapter))
                 return -EPERM;
@@ -1484,24 +1540,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
+                status = be_set_vf_tvt(adapter, vf, vlan);
         } else {
-                /* Reset Transparent Vlan Tagging. */
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
+                status = be_clear_vf_tvt(adapter, vf);
         }
 
         if (status) {
                 dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
-                        vf, status);
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
+                        status);
                 return be_cmd_status(status);
         }
 
         vf_cfg->vlan_tag = vlan;
-
         return 0;
 }
 
@@ -2868,14 +2919,12 @@ void be_detect_error(struct be_adapter *adapter)
                         }
                 }
         } else {
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
+                ue_lo_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_LOW_MASK);
+                ue_hi_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_HI_MASK);
 
                 ue_lo = (ue_lo & ~ue_lo_mask);
                 ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3480,7 +3529,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                         u32 cap_flags, u32 vf)
 {
         u32 en_flags;
-        int status;
 
         en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                    BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3488,10 +3536,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
 
         en_flags &= cap_flags;
 
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
-                                  if_handle, vf);
-
-        return status;
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
 }
 
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3510,8 +3555,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                         status = be_cmd_get_profile_config(adapter, &res,
                                                            RESOURCE_LIMITS,
                                                            vf + 1);
-                        if (!status)
+                        if (!status) {
                                 cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                 }
 
                 status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3545,7 +3595,6 @@ static int be_vf_setup(struct be_adapter *adapter)
         struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
         int status, old_vfs, vf;
-        u32 privileges;
 
         old_vfs = pci_num_vf(adapter->pdev);
 
@@ -3575,15 +3624,18 @@ static int be_vf_setup(struct be_adapter *adapter)
 
         for_all_vfs(adapter, vf_cfg, vf) {
                 /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                         status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                           BE_PRIV_FILTMGMT,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                 dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                          vf);
+                        }
                 }
 
                 /* Allow full available bandwidth */
@@ -5154,6 +5206,7 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
         u8 __iomem *addr;
         u32 sli_intf;
 
@@ -5163,21 +5216,33 @@ static int be_map_pci_bars(struct be_adapter *adapter)
         adapter->virtfn = (sli_intf & SLI_INTF_FT_MASK) ? 1 : 0;
 
         if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                 if (!adapter->csr)
                         return -ENOMEM;
         }
 
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
         if (!addr)
                 goto pci_map_err;
         adapter->db = addr;
 
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
+
         be_roce_map_pci_bars(adapter);
         return 0;
 
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
         be_unmap_pci_bars(adapter);
         return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 99492b7e3713..78e1ce09b1ab 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1189,13 +1189,12 @@ static void
 fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
 {
         struct  fec_enet_private *fep;
-        struct bufdesc *bdp, *bdp_t;
+        struct bufdesc *bdp;
         unsigned short status;
         struct  sk_buff *skb;
         struct fec_enet_priv_tx_q *txq;
         struct netdev_queue *nq;
         int     index = 0;
-        int     i, bdnum;
         int     entries_free;
 
         fep = netdev_priv(ndev);
@@ -1216,29 +1215,18 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
                 if (bdp == txq->cur_tx)
                         break;
 
-                bdp_t = bdp;
-                bdnum = 1;
-                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                skb = txq->tx_skbuff[index];
-                while (!skb) {
-                        bdp_t = fec_enet_get_nextdesc(bdp_t, fep, queue_id);
-                        index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                        skb = txq->tx_skbuff[index];
-                        bdnum++;
-                }
-                if (skb_shinfo(skb)->nr_frags &&
-                    (status = bdp_t->cbd_sc) & BD_ENET_TX_READY)
-                        break;
+                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp, fep);
 
-                for (i = 0; i < bdnum; i++) {
-                        if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
-                                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                                 bdp->cbd_datlen, DMA_TO_DEVICE);
-                        bdp->cbd_bufaddr = 0;
-                        if (i < bdnum - 1)
-                                bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
-                }
+                skb = txq->tx_skbuff[index];
                 txq->tx_skbuff[index] = NULL;
+                if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
+                        dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        bdp->cbd_datlen, DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
+                if (!skb) {
+                        bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
+                        continue;
+                }
 
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -1479,8 +1467,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
 
                         vlan_packet_rcvd = true;
 
-                        skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
-                                                       data, (2 * ETH_ALEN));
+                        memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
                         skb_pull(skb, VLAN_HLEN);
                 }
 
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 072426a72745..cd7675ac5bf9 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1136,6 +1136,8 @@ restart_poll:
         ibmveth_replenish_task(adapter);
 
         if (frames_processed < budget) {
+                napi_complete(napi);
+
                 /* We think we are done - reenable interrupts,
                  * then check once more to make sure we are done.
                  */
@@ -1144,8 +1146,6 @@ restart_poll:
 
                 BUG_ON(lpar_rc != H_SUCCESS);
 
-                napi_complete(napi);
-
                 if (ibmveth_rxq_pending_buffer(adapter) &&
                     napi_reschedule(napi)) {
                         lpar_rc = h_vio_signal(adapter->vdev->unit_address,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 763ba2641d5c..a8339e98ad24 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1698,8 +1698,6 @@ int mlx4_en_start_port(struct net_device *dev)
         /* Schedule multicast task to populate multicast list */
         queue_work(mdev->workqueue, &priv->rx_mode_task);
 
-        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
-
 #ifdef CONFIG_MLX4_EN_VXLAN
         if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
@@ -2882,6 +2880,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                 queue_delayed_work(mdev->workqueue, &priv->service_task,
                                    SERVICE_TASK_DELAY);
 
+        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
+
         return 0;
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 94553b501c76..8ad241bbcf25 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -453,7 +453,7 @@ struct mlx4_en_port_stats {
         unsigned long rx_chksum_none;
         unsigned long rx_chksum_complete;
         unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS          9
+#define NUM_PORT_STATS          10
 };
 
 struct mlx4_en_perf_stats {
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5d093dc0f5f5..8678e39aba08 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2248,10 +2248,9 @@ static int smc_drv_probe(struct platform_device *pdev)
         const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
-        struct resource *res;
+        struct resource *res, *ires;
         unsigned int __iomem *addr;
         unsigned long irq_flags = SMC_IRQ_FLAGS;
-        unsigned long irq_resflags;
         int ret;
 
         ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2343,19 +2342,16 @@ static int smc_drv_probe(struct platform_device *pdev)
                 goto out_free_netdev;
         }
 
-        ndev->irq = platform_get_irq(pdev, 0);
-        if (ndev->irq <= 0) {
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!ires) {
                 ret = -ENODEV;
                 goto out_release_io;
         }
-        /*
-         * If this platform does not specify any special irqflags, or if
-         * the resource supplies a trigger, override the irqflags with
-         * the trigger flags from the resource.
-         */
-        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
-        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
-                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
+
+        ndev->irq = ires->start;
+
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
+                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index f5498c26b3c7..8b282d0b169c 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -498,9 +498,9 @@ static int w5100_napi_poll(struct napi_struct *napi, int budget)
         }
 
         if (rx_count < budget) {
+                napi_complete(napi);
                 w5100_write(priv, W5100_IMR, IR_S0);
                 mmiowb();
-                napi_complete(napi);
         }
 
         return rx_count;
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index ca0c631ed628..8da7b930ff59 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -418,9 +418,9 @@ static int w5300_napi_poll(struct napi_struct *napi, int budget)
         }
 
         if (rx_count < budget) {
+                napi_complete(napi);
                 w5300_write(priv, W5300_IMR, IR_S0);
                 mmiowb();
-                napi_complete(napi);
         }
 
         return rx_count;
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 3eed708a6182..fe48f4c51373 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -300,9 +300,18 @@ static const struct driver_info	cx82310_info = {
         .tx_fixup       = cx82310_tx_fixup,
 };
 
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                       USB_DEVICE_ID_MATCH_DEV_INFO, \
+        .idVendor = (vend), \
+        .idProduct = (prod), \
+        .bDeviceClass = (cl), \
+        .bDeviceSubClass = (sc), \
+        .bDeviceProtocol = (pr)
+
 static const struct usb_device_id products[] = {
         {
-                USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+                USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
                 .driver_info = (unsigned long) &cx82310_info
         },
         { },
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f1ff3666f090..59b0e9754ae3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1448,8 +1448,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
 {
         int i;
 
-        for (i = 0; i < vi->max_queue_pairs; i++)
+        for (i = 0; i < vi->max_queue_pairs; i++) {
+                napi_hash_del(&vi->rq[i].napi);
                 netif_napi_del(&vi->rq[i].napi);
+        }
 
         kfree(vi->rq);
         kfree(vi->sq);
@@ -1948,11 +1950,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
         cancel_delayed_work_sync(&vi->refill);
 
         if (netif_running(vi->dev)) {
-                for (i = 0; i < vi->max_queue_pairs; i++) {
+                for (i = 0; i < vi->max_queue_pairs; i++)
                         napi_disable(&vi->rq[i].napi);
-                        napi_hash_del(&vi->rq[i].napi);
-                        netif_napi_del(&vi->rq[i].napi);
-                }
         }
 
         remove_vq_common(vi);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index e75e4b2e6031..94603ee742ea 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1203,7 +1203,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                         goto drop;
 
                 flags &= ~VXLAN_HF_RCO;
-                vni &= VXLAN_VID_MASK;
+                vni &= VXLAN_VNI_MASK;
         }
 
         /* For backwards compatibility, only allow reserved fields to be
@@ -1224,7 +1224,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                 flags &= ~VXLAN_GBP_USED_BITS;
         }
 
-        if (flags || (vni & ~VXLAN_VID_MASK)) {
+        if (flags || vni & ~VXLAN_VNI_MASK) {
                 /* If there are any unprocessed flags remaining treat
                  * this as a malformed packet. This behavior diverges from
                  * VXLAN RFC (RFC7348) which stipulates that bits in reserved
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ac99798570e8..ea4843be773c 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5370,6 +5370,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
         case 0x432a: /* BCM4321 */
         case 0x432d: /* BCM4322 */
         case 0x4352: /* BCM43222 */
+        case 0x435a: /* BCM43228 */
         case 0x4333: /* BCM4331 */
         case 0x43a2: /* BCM4360 */
         case 0x43b3: /* BCM4352 */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf7090198..8eff2753abad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
         void *dcmd_buf = NULL, *wr_pointer;
         u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
 
-        brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
-                  cmdhdr->len);
+        if (len < sizeof(*cmdhdr)) {
+                brcmf_err("vendor command too short: %d\n", len);
+                return -EINVAL;
+        }
 
         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
         ifp = vif->ifp;
 
-        len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+        brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+
+        if (cmdhdr->offset > len) {
+                brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+                return -EINVAL;
+        }
+
+        len -= cmdhdr->offset;
         ret_len = cmdhdr->len;
         if (ret_len > 0 || len > 0) {
                 if (len > BRCMF_DCMD_MAXLEN) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index c3817fae16c0..06f6cc08f451 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
         .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION,  \
         .base_params = &iwl1000_base_params,                    \
         .eeprom_params = &iwl1000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl1000_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
         .base_params = &iwl1000_base_params,                    \
         .eeprom_params = &iwl1000_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl100_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 21e5d0843a62..890b95f497d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,          \
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
 
 const struct iwl_cfg iwl2000_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
         .base_params = &iwl2030_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl2030_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl105_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
         .base_params = &iwl2030_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl135_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 332bbede39e5..724194e23414 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
         .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION,  \
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl5300_agn_cfg = {
         .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl5150_agn_cfg = {
         .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8f2c3c8c6b84..21b2630763dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
         .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6005_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6030_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
         .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION,  \
         .base_params = &iwl6000_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6000i_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
         .base_params = &iwl6050_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6050_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
         .base_params = &iwl6050_base_params,                    \
         .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 
 const struct iwl_cfg iwl6150_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index ce99572a982d..638ec0945009 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+        if (mvmvif->phy_ctxt &&
+            IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
                                mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 9717ee61928c..05d31713ed38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         if (!vif->bss_conf.assoc)
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
-        if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+        if (mvmvif->phy_ctxt &&
+            data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
         IWL_DEBUG_COEX(data->mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 204255423d99..7396b52262b5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -402,7 +402,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 
-                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                if ((mvm->fw->ucode_capa.capa[0] &
+                     IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+                    (mvm->fw->ucode_capa.api[0] &
+                     IWL_UCODE_TLV_API_LQ_SS_PARAMS))
                         hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
                                 IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
         }
@@ -2271,7 +2274,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
 
         mutex_unlock(&mvm->mutex);
 }
@@ -2609,12 +2624,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
         int ret;
 
         mutex_lock(&mvm->mutex);
+
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
+
         ret = iwl_mvm_scan_offload_stop(mvm, false);
         mutex_unlock(&mvm->mutex);
         iwl_mvm_wait_for_async_handlers(mvm);
 
         return ret;
-
 }
 
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index f0946b5dd7c8..a75bb150ea27 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -587,8 +587,10 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                 return 0;
 
-        if (iwl_mvm_is_radio_killed(mvm))
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ret = 0;
                 goto out;
+        }
 
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_done,
                                    scan_done_notif,
@@ -600,16 +602,14 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
                                sched ? "offloaded " : "", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
-                return ret;
+                goto out;
         }
 
         IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
                        sched ? "offloaded " : "");
 
         ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-        if (ret)
-                return ret;
-
+out:
         /*
          * Clear the scan status so the next scan requests will succeed. This
          * also ensures the Rx handler doesn't do anything, as the scan was
@@ -619,7 +619,6 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
-out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -629,7 +628,7 @@ out:
                         ieee80211_scan_completed(mvm->hw, true);
         }
 
-        return 0;
+        return ret;
 }
 
 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 54fafbf9a711..f8d6f306dd76 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->time_event_list, list) {
-                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
-                    te_data->running) {
+                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                         is_p2p = true;
                         goto remove_te;
@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
          * request
          */
         list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
-                if (te_data->running) {
-                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-                        goto remove_te;
-                }
+                mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+                goto remove_te;
         }
 
 remove_te:
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 1d4677460711..074f716020aa 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1386,8 +1386,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
 
                 return true;
-        } else if (0x86DD == ether_type) {
-                return true;
+        } else if (ETH_P_IPV6 == ether_type) {
+                /* TODO: Handle any IPv6 cases that need special handling.
+                 * For now, always return false
+                 */
+                goto end;
         }
 
 end:
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 2c25e8e1a91e..b8c471813f4c 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -96,6 +96,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 static void make_tx_response(struct xenvif_queue *queue,
                              struct xen_netif_tx_request *txp,
                              s8       st);
+static void push_tx_responses(struct xenvif_queue *queue);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
 
@@ -655,15 +656,10 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
         unsigned long flags;
 
         do {
-                int notify;
-
                 spin_lock_irqsave(&queue->response_lock, flags);
                 make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
-                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+                push_tx_responses(queue);
                 spin_unlock_irqrestore(&queue->response_lock, flags);
-                if (notify)
-                        notify_remote_via_irq(queue->tx_irq);
-
                 if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1655,7 +1651,6 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
         struct pending_tx_info *pending_tx_info;
         pending_ring_idx_t index;
-        int notify;
         unsigned long flags;
 
         pending_tx_info = &queue->pending_tx_info[pending_idx];
@@ -1671,12 +1666,9 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
         index = pending_index(queue->pending_prod++);
         queue->pending_ring[index] = pending_idx;
 
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        push_tx_responses(queue);
 
         spin_unlock_irqrestore(&queue->response_lock, flags);
-
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
 
 
@@ -1697,6 +1689,15 @@ static void make_tx_response(struct xenvif_queue *queue,
         queue->tx.rsp_prod_pvt = ++i;
 }
 
+static void push_tx_responses(struct xenvif_queue *queue)
+{
+        int notify;
+
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
+}
+
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
                                              s8       st,
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 38d1c51f58b1..7bcaeec876c0 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -84,8 +84,7 @@ config OF_RESOLVE
         bool
 
 config OF_OVERLAY
-        bool
-        depends on OF
+        bool "Device Tree overlays"
         select OF_DYNAMIC
         select OF_RESOLVE
 
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 0a8aeb8523fe..adb8764861c0 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -714,16 +714,17 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
                                                 const char *path)
 {
         struct device_node *child;
-        int len = strchrnul(path, '/') - path;
-        int term;
+        int len;
+        const char *end;
 
+        end = strchr(path, ':');
+        if (!end)
+                end = strchrnul(path, '/');
+
+        len = end - path;
         if (!len)
                 return NULL;
 
-        term = strchrnul(path, ':') - path;
-        if (term < len)
-                len = term;
-
         __for_each_child_of_node(parent, child) {
                 const char *name = strrchr(child->full_name, '/');
                 if (WARN(!name, "malformed device_node %s\n", child->full_name))
@@ -768,8 +769,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
 
         /* The path could begin with an alias */
         if (*path != '/') {
-                char *p = strchrnul(path, '/');
-                int len = separator ? separator - path : p - path;
+                int len;
+                const char *p = separator;
+
+                if (!p)
+                        p = strchrnul(path, '/');
+                len = p - path;
 
                 /* of_aliases must not be NULL */
                 if (!of_aliases)
@@ -794,6 +799,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
                 path++; /* Increment past '/' delimiter */
                 np = __of_find_node_by_path(np, path);
                 path = strchrnul(path, '/');
+                if (separator && separator < path)
+                        break;
         }
         raw_spin_unlock_irqrestore(&devtree_lock, flags);
         return np;
@@ -1886,8 +1893,10 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
                         name = of_get_property(of_chosen, "linux,stdout-path", NULL);
                 if (IS_ENABLED(CONFIG_PPC) && !name)
                         name = of_get_property(of_aliases, "stdout", NULL);
-                if (name)
+                if (name) {
                         of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
+                        add_preferred_console("stdout-path", 0, NULL);
+                }
         }
 
         if (!of_aliases)
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 352b4f28f82c..dee9270ba547 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -19,6 +19,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/idr.h>
 
 #include "of_private.h"
 
@@ -85,7 +86,7 @@ static int of_overlay_apply_single_device_node(struct of_overlay *ov,
                 struct device_node *target, struct device_node *child)
 {
         const char *cname;
-        struct device_node *tchild, *grandchild;
+        struct device_node *tchild;
         int ret = 0;
 
         cname = kbasename(child->full_name);
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 0cf9a236d438..aba8946cac46 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -92,6 +92,11 @@ static void __init of_selftest_find_node_by_name(void)
                  "option path test failed\n");
         of_node_put(np);
 
+        np = of_find_node_opts_by_path("/testcase-data:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #1 failed\n");
+        of_node_put(np);
+
         np = of_find_node_opts_by_path("/testcase-data:testoption", NULL);
         selftest(np, "NULL option path test failed\n");
         of_node_put(np);
@@ -102,6 +107,12 @@ static void __init of_selftest_find_node_by_name(void)
                  "option alias path test failed\n");
         of_node_put(np);
 
+        np = of_find_node_opts_by_path("testcase-alias:test/alias/option",
+                                       &options);
+        selftest(np && !strcmp("test/alias/option", options),
+                 "option alias path test, subcase #1 failed\n");
+        of_node_put(np);
+
         np = of_find_node_opts_by_path("testcase-alias:testaliasoption", NULL);
         selftest(np, "NULL option alias path test failed\n");
         of_node_put(np);
@@ -378,9 +389,9 @@ static void __init of_selftest_property_string(void)
         rc = of_property_match_string(np, "phandle-list-names", "first");
         selftest(rc == 0, "first expected:0 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "second");
-        selftest(rc == 1, "second expected:0 got:%i\n", rc);
+        selftest(rc == 1, "second expected:1 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "third");
-        selftest(rc == 2, "third expected:0 got:%i\n", rc);
+        selftest(rc == 2, "third expected:2 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "fourth");
         selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
         rc = of_property_match_string(np, "missing-property", "blah");
@@ -478,7 +489,6 @@ static void __init of_selftest_changeset(void)
         struct device_node *n1, *n2, *n21, *nremove, *parent, *np;
         struct of_changeset chgset;
 
-        of_changeset_init(&chgset);
         n1 = __of_node_dup(NULL, "/testcase-data/changeset/n1");
         selftest(n1, "testcase setup failure\n");
         n2 = __of_node_dup(NULL, "/testcase-data/changeset/n2");
@@ -979,7 +989,7 @@ static int of_path_platform_device_exists(const char *path)
         return pdev != NULL;
 }
 
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
 
 /* get the i2c client device instantiated at the path */
 static struct i2c_client *of_path_to_i2c_client(const char *path)
@@ -1445,7 +1455,7 @@ static void of_selftest_overlay_11(void)
                 return;
 }
 
-#if IS_ENABLED(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
+#if IS_BUILTIN(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
 
 struct selftest_i2c_bus_data {
         struct platform_device  *pdev;
@@ -1584,7 +1594,7 @@ static struct i2c_driver selftest_i2c_dev_driver = {
         .id_table = selftest_i2c_dev_id,
 };
 
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
 
 struct selftest_i2c_mux_data {
         int nchans;
@@ -1695,7 +1705,7 @@ static int of_selftest_overlay_i2c_init(void)
                         "could not register selftest i2c bus driver\n"))
                 return ret;
 
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
         ret = i2c_add_driver(&selftest_i2c_mux_driver);
         if (selftest(ret == 0,
                         "could not register selftest i2c mux driver\n"))
@@ -1707,7 +1717,7 @@ static int of_selftest_overlay_i2c_init(void)
 
 static void of_selftest_overlay_i2c_cleanup(void)
 {
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
         i2c_del_driver(&selftest_i2c_mux_driver);
 #endif
         platform_driver_unregister(&selftest_i2c_bus_driver);
@@ -1814,7 +1824,7 @@ static void __init of_selftest_overlay(void)
         of_selftest_overlay_10();
         of_selftest_overlay_11();
 
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
         if (selftest(of_selftest_overlay_i2c_init() == 0, "i2c init failed\n"))
                 goto out;
 
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index aab55474dd0d..ee082c0366ec 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -127,7 +127,7 @@ static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
         return false;
 }
 
-static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
+static void __iomem *xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                               int offset)
 {
         struct xgene_pcie_port *port = bus->sysdata;
@@ -137,7 +137,7 @@ static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                 return NULL;
 
         xgene_pcie_set_rtdid_reg(bus, devfn);
-        return xgene_pcie_get_cfg_base(bus);
+        return xgene_pcie_get_cfg_base(bus) + offset;
 }
 
 static struct pci_ops xgene_pcie_ops = {
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index aa012fb3834b..312f23a8429c 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
         struct pci_dev *pdev = to_pci_dev(dev);
         char *driver_override, *old = pdev->driver_override, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
 {
         struct pci_dev *pdev = to_pci_dev(dev);
 
-        return sprintf(buf, "%s\n", pdev->driver_override);
+        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5afe03e28b91..2062c224e32f 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -66,6 +66,10 @@
 #define BYT_DIR_MASK            (BIT(1) | BIT(2))
 #define BYT_TRIG_MASK           (BIT(26) | BIT(25) | BIT(24))
 
+#define BYT_CONF0_RESTORE_MASK  (BYT_DIRECT_IRQ_EN | BYT_TRIG_MASK | \
+                                 BYT_PIN_MUX)
+#define BYT_VAL_RESTORE_MASK    (BYT_DIR_MASK | BYT_LEVEL)
+
 #define BYT_NGPIO_SCORE         102
 #define BYT_NGPIO_NCORE         28
 #define BYT_NGPIO_SUS           44
@@ -134,12 +138,18 @@ static struct pinctrl_gpio_range byt_ranges[] = {
         },
 };
 
+struct byt_gpio_pin_context {
+        u32 conf0;
+        u32 val;
+};
+
 struct byt_gpio {
         struct gpio_chip                chip;
         struct platform_device          *pdev;
         spinlock_t                      lock;
         void __iomem                    *reg_base;
         struct pinctrl_gpio_range       *range;
+        struct byt_gpio_pin_context     *saved_context;
 };
 
 #define to_byt_gpio(c)  container_of(c, struct byt_gpio, chip)
@@ -158,40 +168,62 @@ static void __iomem *byt_gpio_reg(struct gpio_chip *chip, unsigned offset,
         return vg->reg_base + reg_offset + reg;
 }
 
-static bool is_special_pin(struct byt_gpio *vg, unsigned offset)
+static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned offset)
+{
+        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        unsigned long flags;
+        u32 value;
+
+        spin_lock_irqsave(&vg->lock, flags);
+        value = readl(reg);
+        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
+}
+
+static u32 byt_get_gpio_mux(struct byt_gpio *vg, unsigned offset)
 {
         /* SCORE pin 92-93 */
         if (!strcmp(vg->range->name, BYT_SCORE_ACPI_UID) &&
                 offset >= 92 && offset <= 93)
-                return true;
+                return 1;
 
         /* SUS pin 11-21 */
         if (!strcmp(vg->range->name, BYT_SUS_ACPI_UID) &&
                 offset >= 11 && offset <= 21)
-                return true;
+                return 1;
 
-        return false;
+        return 0;
 }
 
 static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 {
         struct byt_gpio *vg = to_byt_gpio(chip);
         void __iomem *reg = byt_gpio_reg(chip, offset, BYT_CONF0_REG);
-        u32 value;
-        bool special;
+        u32 value, gpio_mux;
 
         /*
          * In most cases, func pin mux 000 means GPIO function.
          * But, some pins may have func pin mux 001 represents
-         * GPIO function. Only allow user to export pin with
-         * func pin mux preset as GPIO function by BIOS/FW.
+         * GPIO function.
+         *
+         * Because there are devices out there where some pins were not
+         * configured correctly we allow changing the mux value from
+         * request (but print out warning about that).
          */
         value = readl(reg) & BYT_PIN_MUX;
-        special = is_special_pin(vg, offset);
-        if ((special && value != 1) || (!special && value)) {
-                dev_err(&vg->pdev->dev,
-                        "pin %u cannot be used as GPIO.\n", offset);
-                return -EINVAL;
+        gpio_mux = byt_get_gpio_mux(vg, offset);
+        if (WARN_ON(gpio_mux != value)) {
+                unsigned long flags;
+
+                spin_lock_irqsave(&vg->lock, flags);
+                value = readl(reg) & ~BYT_PIN_MUX;
+                value |= gpio_mux;
+                writel(value, reg);
+                spin_unlock_irqrestore(&vg->lock, flags);
+
+                dev_warn(&vg->pdev->dev,
+                         "pin %u forcibly re-configured as GPIO\n", offset);
         }
 
         pm_runtime_get(&vg->pdev->dev);
@@ -202,14 +234,8 @@ static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void byt_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
         struct byt_gpio *vg = to_byt_gpio(chip);
-        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
-        u32 value;
-
-        /* clear interrupt triggering */
-        value = readl(reg);
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
-        writel(value, reg);
 
+        byt_gpio_clear_triggering(vg, offset);
         pm_runtime_put(&vg->pdev->dev);
 }
 
@@ -236,23 +262,13 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
         value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
                    BYT_TRIG_LVL);
 
-        switch (type) {
-        case IRQ_TYPE_LEVEL_HIGH:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_RISING:
-                value |= BYT_TRIG_POS;
-                break;
-        case IRQ_TYPE_LEVEL_LOW:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_FALLING:
-                value |= BYT_TRIG_NEG;
-                break;
-        case IRQ_TYPE_EDGE_BOTH:
-                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
-                break;
-        }
         writel(value, reg);
 
+        if (type & IRQ_TYPE_EDGE_BOTH)
+                __irq_set_handler_locked(d->irq, handle_edge_irq);
+        else if (type & IRQ_TYPE_LEVEL_MASK)
+                __irq_set_handler_locked(d->irq, handle_level_irq);
+
         spin_unlock_irqrestore(&vg->lock, flags);
 
         return 0;
@@ -410,58 +426,80 @@ static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct byt_gpio *vg = to_byt_gpio(irq_desc_get_handler_data(desc));
         struct irq_chip *chip = irq_data_get_irq_chip(data);
-        u32 base, pin, mask;
+        u32 base, pin;
         void __iomem *reg;
-        u32 pending;
+        unsigned long pending;
         unsigned virq;
-        int looplimit = 0;
 
         /* check from GPIO controller which pin triggered the interrupt */
         for (base = 0; base < vg->chip.ngpio; base += 32) {
-
                 reg = byt_gpio_reg(&vg->chip, base, BYT_INT_STAT_REG);
-
-                while ((pending = readl(reg))) {
-                        pin = __ffs(pending);
-                        mask = BIT(pin);
-                        /* Clear before handling so we can't lose an edge */
-                        writel(mask, reg);
-
+                pending = readl(reg);
+                for_each_set_bit(pin, &pending, 32) {
                         virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                         generic_handle_irq(virq);
-
-                        /* In case bios or user sets triggering incorretly a pin
-                         * might remain in "interrupt triggered" state.
-                         */
-                        if (looplimit++ > 32) {
-                                dev_err(&vg->pdev->dev,
-                                        "Gpio %d interrupt flood, disabling\n",
-                                        base + pin);
-
-                                reg = byt_gpio_reg(&vg->chip, base + pin,
-                                                   BYT_CONF0_REG);
-                                mask = readl(reg);
-                                mask &= ~(BYT_TRIG_NEG | BYT_TRIG_POS |
-                                          BYT_TRIG_LVL);
-                                writel(mask, reg);
-                                mask = readl(reg); /* flush */
-                                break;
-                        }
                 }
         }
         chip->irq_eoi(data);
 }
 
+static void byt_irq_ack(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        void __iomem *reg;
+
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
+        writel(BIT(offset % 32), reg);
+}
+
 static void byt_irq_unmask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        unsigned long flags;
+        void __iomem *reg;
+        u32 value;
+
+        spin_lock_irqsave(&vg->lock, flags);
+
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        value = readl(reg);
+
+        switch (irqd_get_trigger_type(d)) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_RISING:
+                value |= BYT_TRIG_POS;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_FALLING:
+                value |= BYT_TRIG_NEG;
+                break;
+        case IRQ_TYPE_EDGE_BOTH:
+                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
+                break;
+        }
+
+        writel(value, reg);
+
+        spin_unlock_irqrestore(&vg->lock, flags);
 }
 
 static void byt_irq_mask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+
+        byt_gpio_clear_triggering(vg, irqd_to_hwirq(d));
 }
 
 static struct irq_chip byt_irqchip = {
         .name = "BYT-GPIO",
+        .irq_ack = byt_irq_ack,
         .irq_mask = byt_irq_mask,
         .irq_unmask = byt_irq_unmask,
         .irq_set_type = byt_irq_type,
@@ -472,6 +510,21 @@ static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
 {
         void __iomem *reg;
         u32 base, value;
+        int i;
+
+        /*
+         * Clear interrupt triggers for all pins that are GPIOs and
+         * do not use direct IRQ mode. This will prevent spurious
+         * interrupts from misconfigured pins.
+         */
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                value = readl(byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG));
+                if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i) &&
+                    !(value & BYT_DIRECT_IRQ_EN)) {
+                        byt_gpio_clear_triggering(vg, i);
+                        dev_dbg(&vg->pdev->dev, "disabling GPIO %d\n", i);
+                }
+        }
 
         /* clear interrupt status trigger registers */
         for (base = 0; base < vg->chip.ngpio; base += 32) {
@@ -541,6 +594,11 @@ static int byt_gpio_probe(struct platform_device *pdev)
         gc->can_sleep = false;
         gc->dev = dev;
 
+#ifdef CONFIG_PM_SLEEP
+        vg->saved_context = devm_kcalloc(&pdev->dev, gc->ngpio,
+                                       sizeof(*vg->saved_context), GFP_KERNEL);
+#endif
+
         ret = gpiochip_add(gc);
         if (ret) {
                 dev_err(&pdev->dev, "failed adding byt-gpio chip\n");
@@ -569,6 +627,69 @@ static int byt_gpio_probe(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int byt_gpio_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg) & BYT_CONF0_RESTORE_MASK;
+                vg->saved_context[i].conf0 = value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg) & BYT_VAL_RESTORE_MASK;
+                vg->saved_context[i].val = value;
+        }
+
+        return 0;
+}
+
+static int byt_gpio_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg);
+                if ((value & BYT_CONF0_RESTORE_MASK) !=
+                     vg->saved_context[i].conf0) {
+                        value &= ~BYT_CONF0_RESTORE_MASK;
+                        value |= vg->saved_context[i].conf0;
+                        writel(value, reg);
+                        dev_info(dev, "restored pin %d conf0 %#08x", i, value);
+                }
+
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg);
+                if ((value & BYT_VAL_RESTORE_MASK) !=
+                     vg->saved_context[i].val) {
+                        u32 v;
+
+                        v = value & ~BYT_VAL_RESTORE_MASK;
+                        v |= vg->saved_context[i].val;
+                        if (v != value) {
+                                writel(v, reg);
+                                dev_dbg(dev, "restored pin %d val %#08x\n",
+                                        i, v);
+                        }
+                }
+        }
+
+        return 0;
+}
+#endif
+
 static int byt_gpio_runtime_suspend(struct device *dev)
 {
         return 0;
@@ -580,8 +701,9 @@ static int byt_gpio_runtime_resume(struct device *dev)
 }
 
 static const struct dev_pm_ops byt_gpio_pm_ops = {
-        .runtime_suspend = byt_gpio_runtime_suspend,
-        .runtime_resume = byt_gpio_runtime_resume,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(byt_gpio_suspend, byt_gpio_resume)
+        SET_RUNTIME_PM_OPS(byt_gpio_runtime_suspend, byt_gpio_runtime_resume,
+                           NULL)
 };
 
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 3034fd03bced..82f691eeeec4 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1226,6 +1226,7 @@ static int chv_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int chv_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                                      int value)
 {
+        chv_gpio_set(chip, offset, value);
         return pinctrl_gpio_direction_output(chip->base + offset);
 }
 
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index f4cd0b9b2438..a4814066ea08 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1477,28 +1477,25 @@ static void gpio_irq_ack(struct irq_data *d)
         /* the interrupt is already cleared before by reading ISR */
 }
 
-static unsigned int gpio_irq_startup(struct irq_data *d)
+static int gpio_irq_request_res(struct irq_data *d)
 {
         struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
         unsigned        pin = d->hwirq;
         int ret;
 
         ret = gpiochip_lock_as_irq(&at91_gpio->chip, pin);
-        if (ret) {
+        if (ret)
                 dev_err(at91_gpio->chip.dev, "unable to lock pind %lu IRQ\n",
                         d->hwirq);
-                return ret;
-        }
-        gpio_irq_unmask(d);
-        return 0;
+
+        return ret;
 }
 
-static void gpio_irq_shutdown(struct irq_data *d)
+static void gpio_irq_release_res(struct irq_data *d)
 {
         struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
         unsigned        pin = d->hwirq;
 
-        gpio_irq_mask(d);
         gpiochip_unlock_as_irq(&at91_gpio->chip, pin);
 }
 
@@ -1577,8 +1574,8 @@ void at91_pinctrl_gpio_resume(void)
 static struct irq_chip gpio_irqchip = {
         .name           = "GPIO",
         .irq_ack        = gpio_irq_ack,
-        .irq_startup    = gpio_irq_startup,
-        .irq_shutdown   = gpio_irq_shutdown,
+        .irq_request_resources = gpio_irq_request_res,
+        .irq_release_resources = gpio_irq_release_res,
         .irq_disable    = gpio_irq_mask,
         .irq_mask       = gpio_irq_mask,
         .irq_unmask     = gpio_irq_unmask,
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 24c5d88f943f..3c68a8e5e0dd 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -1011,6 +1011,7 @@ static const struct sunxi_pinctrl_desc sun4i_a10_pinctrl_data = {
         .pins = sun4i_a10_pins,
         .npins = ARRAY_SIZE(sun4i_a10_pins),
         .irq_banks = 1,
+        .irq_read_needs_mux = true,
 };
 
 static int sun4i_a10_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 3d0744337736..f8e171b76693 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -29,6 +29,7 @@
 #include <linux/slab.h>
 
 #include "../core.h"
+#include "../../gpio/gpiolib.h"
 #include "pinctrl-sunxi.h"
 
 static struct irq_chip sunxi_pinctrl_edge_irq_chip;
@@ -464,10 +465,19 @@ static int sunxi_pinctrl_gpio_direction_input(struct gpio_chip *chip,
 static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
-
         u32 reg = sunxi_data_reg(offset);
         u8 index = sunxi_data_offset(offset);
-        u32 val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        u32 set_mux = pctl->desc->irq_read_needs_mux &&
+                        test_bit(FLAG_USED_AS_IRQ, &chip->desc[offset].flags);
+        u32 val;
+
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_INPUT);
+
+        val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_IRQ);
 
         return val;
 }
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index 5a51523a3459..e248e81a0f9e 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -77,6 +77,9 @@
 #define IRQ_LEVEL_LOW           0x03
 #define IRQ_EDGE_BOTH           0x04
 
+#define SUN4I_FUNC_INPUT        0
+#define SUN4I_FUNC_IRQ          6
+
 struct sunxi_desc_function {
         const char      *name;
         u8              muxval;
@@ -94,6 +97,7 @@ struct sunxi_pinctrl_desc {
         int                             npins;
         unsigned                        pin_base;
         unsigned                        irq_banks;
+        bool                            irq_read_needs_mux;
 };
 
 struct sunxi_pinctrl_function {
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 1245dca79009..a4a8a6dc60c4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1839,10 +1839,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
         }
 
         if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, true);
-                if (ret < 0)
-                        return ret;
-                rdev->ena_gpio_state = 1;
+                if (!rdev->ena_gpio_state) {
+                        ret = regulator_ena_gpio_ctrl(rdev, true);
+                        if (ret < 0)
+                                return ret;
+                        rdev->ena_gpio_state = 1;
+                }
         } else if (rdev->desc->ops->enable) {
                 ret = rdev->desc->ops->enable(rdev);
                 if (ret < 0)
@@ -1939,10 +1941,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
         trace_regulator_disable(rdev_get_name(rdev));
 
         if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, false);
-                if (ret < 0)
-                        return ret;
-                rdev->ena_gpio_state = 0;
+                if (rdev->ena_gpio_state) {
+                        ret = regulator_ena_gpio_ctrl(rdev, false);
+                        if (ret < 0)
+                                return ret;
+                        rdev->ena_gpio_state = 0;
+                }
 
         } else if (rdev->desc->ops->disable) {
                 ret = rdev->desc->ops->disable(rdev);
@@ -3626,12 +3630,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
                                  config->ena_gpio, ret);
                         goto wash;
                 }
-
-                if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-                        rdev->ena_gpio_state = 1;
-
-                if (config->ena_gpio_invert)
-                        rdev->ena_gpio_state = !rdev->ena_gpio_state;
         }
 
         /* set regulator constraints */
@@ -3800,9 +3798,11 @@ int regulator_suspend_finish(void)
         list_for_each_entry(rdev, &regulator_list, list) {
                 mutex_lock(&rdev->mutex);
                 if (rdev->use_count > 0  || rdev->constraints->always_on) {
-                        error = _regulator_do_enable(rdev);
-                        if (error)
-                                ret = error;
+                        if (!_regulator_is_enabled(rdev)) {
+                                error = _regulator_do_enable(rdev);
+                                if (error)
+                                        ret = error;
+                        }
                 } else {
                         if (!have_full_constraints())
                                 goto unlock;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index e2cffe01b807..fb991ec76423 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 92f6af6da699..73354ee27877 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -951,6 +951,7 @@ static int rpmsg_probe(struct virtio_device *vdev)
         void *bufs_va;
         int err = 0, i;
         size_t total_buf_space;
+        bool notify;
 
         vrp = kzalloc(sizeof(*vrp), GFP_KERNEL);
         if (!vrp)
@@ -1030,8 +1031,22 @@ static int rpmsg_probe(struct virtio_device *vdev)
                 }
         }
 
+        /*
+         * Prepare to kick but don't notify yet - we can't do this before
+         * device is ready.
+         */
+        notify = virtqueue_kick_prepare(vrp->rvq);
+
+        /* From this point on, we can notify and get callbacks. */
+        virtio_device_ready(vdev);
+
         /* tell the remote processor it can start sending messages */
-        virtqueue_kick(vrp->rvq);
+        /*
+         * this might be concurrent with callbacks, but we are only
+         * doing notify, not a full kick here, so that's ok.
+         */
+        if (notify)
+                virtqueue_notify(vrp->rvq);
 
         dev_info(&vdev->dev, "rpmsg host is online\n");
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 4241eeab3386..f4cf6851fae9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
 
 static struct s3c_rtc_data const s3c6410_rtc_data = {
         .max_user_freq          = 32768,
+        .needs_src_clk          = true,
         .irq_handler            = s3c6410_rtc_irq,
         .set_freq               = s3c6410_rtc_setfreq,
         .enable_tick            = s3c6410_rtc_enable_tick,
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 62b58d38ce2e..60de66252fa2 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
         struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
         struct sas_ha_struct *ha = port->ha;
+        struct domain_device *ddev = port->port_dev;
 
         /* prevent revalidation from finding sata links in recovery */
         mutex_lock(&ha->disco_mutex);
@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
         SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
                     task_pid_nr(current));
 
-        if (port->port_dev)
-                res = sas_ex_revalidate_domain(port->port_dev);
+        if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
+                     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+                res = sas_ex_revalidate_domain(ddev);
 
         SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
                     port->id, task_pid_nr(current), res);
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index af98b096af2f..175c9956cbe3 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -144,10 +144,9 @@ struct ffs_io_data {
         bool read;
 
         struct kiocb *kiocb;
-        const struct iovec *iovec;
-        unsigned long nr_segs;
-        char __user *buf;
-        size_t len;
+        struct iov_iter data;
+        const void *to_free;
+        char *buf;
 
         struct mm_struct *mm;
         struct work_struct work;
@@ -649,29 +648,10 @@ static void ffs_user_copy_worker(struct work_struct *work)
                                          io_data->req->actual;
 
         if (io_data->read && ret > 0) {
-                int i;
-                size_t pos = 0;
-
-                /*
-                 * Since req->length may be bigger than io_data->len (after
-                 * being rounded up to maxpacketsize), we may end up with more
-                 * data then user space has space for.
-                 */
-                ret = min_t(int, ret, io_data->len);
-
                 use_mm(io_data->mm);
-                for (i = 0; i < io_data->nr_segs; i++) {
-                        size_t len = min_t(size_t, ret - pos,
-                                        io_data->iovec[i].iov_len);
-                        if (!len)
-                                break;
-                        if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos], len))) {
-                                ret = -EFAULT;
-                                break;
-                        }
-                        pos += len;
-                }
+                ret = copy_to_iter(io_data->buf, ret, &io_data->data);
+                if (iov_iter_count(&io_data->data))
+                        ret = -EFAULT;
                 unuse_mm(io_data->mm);
         }
 
@@ -684,7 +664,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
 
         io_data->kiocb->private = NULL;
         if (io_data->read)
-                kfree(io_data->iovec);
+                kfree(io_data->to_free);
         kfree(io_data->buf);
         kfree(io_data);
 }
@@ -743,6 +723,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                  * before the waiting completes, so do not assign to 'gadget' earlier
                  */
                 struct usb_gadget *gadget = epfile->ffs->gadget;
+                size_t copied;
 
                 spin_lock_irq(&epfile->ffs->eps_lock);
                 /* In the meantime, endpoint got disabled or changed. */
@@ -750,34 +731,21 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                         spin_unlock_irq(&epfile->ffs->eps_lock);
                         return -ESHUTDOWN;
                 }
+                data_len = iov_iter_count(&io_data->data);
                 /*
                  * Controller may require buffer size to be aligned to
                  * maxpacketsize of an out endpoint.
                  */
-                data_len = io_data->read ?
-                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
-                           io_data->len;
+                if (io_data->read)
+                        data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
                 spin_unlock_irq(&epfile->ffs->eps_lock);
 
                 data = kmalloc(data_len, GFP_KERNEL);
                 if (unlikely(!data))
                         return -ENOMEM;
-                if (io_data->aio && !io_data->read) {
-                        int i;
-                        size_t pos = 0;
-                        for (i = 0; i < io_data->nr_segs; i++) {
-                                if (unlikely(copy_from_user(&data[pos],
-                                             io_data->iovec[i].iov_base,
-                                             io_data->iovec[i].iov_len))) {
-                                        ret = -EFAULT;
-                                        goto error;
-                                }
-                                pos += io_data->iovec[i].iov_len;
-                        }
-                } else {
-                        if (!io_data->read &&
-                            unlikely(__copy_from_user(data, io_data->buf,
-                                                      io_data->len))) {
+                if (!io_data->read) {
+                        copied = copy_from_iter(data, data_len, &io_data->data);
+                        if (copied != data_len) {
                                 ret = -EFAULT;
                                 goto error;
                         }
@@ -876,10 +844,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                                  */
                                 ret = ep->status;
                                 if (io_data->read && ret > 0) {
-                                        ret = min_t(size_t, ret, io_data->len);
-
-                                        if (unlikely(copy_to_user(io_data->buf,
-                                                data, ret)))
+                                        ret = copy_to_iter(data, ret, &io_data->data);
+                                        if (unlikely(iov_iter_count(&io_data->data)))
                                                 ret = -EFAULT;
                                 }
                         }
@@ -898,37 +864,6 @@ error:
         return ret;
 }
 
-static ssize_t
-ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
-                 loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-
-        ENTER();
-
-        io_data.aio = false;
-        io_data.read = false;
-        io_data.buf = (char * __user)buf;
-        io_data.len = len;
-
-        return ffs_epfile_io(file, &io_data);
-}
-
-static ssize_t
-ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-
-        ENTER();
-
-        io_data.aio = false;
-        io_data.read = true;
-        io_data.buf = buf;
-        io_data.len = len;
-
-        return ffs_epfile_io(file, &io_data);
-}
-
 static int
 ffs_epfile_open(struct inode *inode, struct file *file)
 {
@@ -965,67 +900,86 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
         return value;
 }
 
-static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb,
-                                    const struct iovec *iovec,
-                                    unsigned long nr_segs, loff_t loff)
+static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
 
         ENTER();
 
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
-        if (unlikely(!io_data))
-                return -ENOMEM;
+        if (!is_sync_kiocb(kiocb)) {
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
+        }
 
-        io_data->aio = true;
-        io_data->read = false;
-        io_data->kiocb = kiocb;
-        io_data->iovec = iovec;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
+        p->read = false;
+        p->kiocb = kiocb;
+        p->data = *from;
+        p->mm = current->mm;
 
-        kiocb->private = io_data;
+        kiocb->private = p;
 
         kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio)
+                kfree(p);
+        else
+                *from = p->data;
+        return res;
 }
 
-static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,
-                                   const struct iovec *iovec,
-                                   unsigned long nr_segs, loff_t loff)
+static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
 {
-        struct ffs_io_data *io_data;
-        struct iovec *iovec_copy;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
 
         ENTER();
 
-        iovec_copy = kmalloc_array(nr_segs, sizeof(*iovec_copy), GFP_KERNEL);
-        if (unlikely(!iovec_copy))
-                return -ENOMEM;
-
-        memcpy(iovec_copy, iovec, sizeof(struct iovec)*nr_segs);
-
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
-        if (unlikely(!io_data)) {
-                kfree(iovec_copy);
-                return -ENOMEM;
+        if (!is_sync_kiocb(kiocb)) {
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
         }
 
-        io_data->aio = true;
-        io_data->read = true;
-        io_data->kiocb = kiocb;
-        io_data->iovec = iovec_copy;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
+        p->read = true;
+        p->kiocb = kiocb;
+        if (p->aio) {
+                p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
+                if (!p->to_free) {
+                        kfree(p);
+                        return -ENOMEM;
+                }
+        } else {
+                p->data = *to;
+                p->to_free = NULL;
+        }
+        p->mm = current->mm;
 
-        kiocb->private = io_data;
+        kiocb->private = p;
 
         kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+
+        if (p->aio) {
+                kfree(p->to_free);
+                kfree(p);
+        } else {
+                *to = p->data;
+        }
+        return res;
 }
 
 static int
@@ -1105,10 +1059,10 @@ static const struct file_operations ffs_epfile_operations = {
         .llseek =       no_llseek,
 
         .open =         ffs_epfile_open,
-        .write =        ffs_epfile_write,
-        .read =         ffs_epfile_read,
-        .aio_write =    ffs_epfile_aio_write,
-        .aio_read =     ffs_epfile_aio_read,
+        .write =        new_sync_write,
+        .read =         new_sync_read,
+        .write_iter =   ffs_epfile_write_iter,
+        .read_iter =    ffs_epfile_read_iter,
         .release =      ffs_epfile_release,
         .unlocked_ioctl =       ffs_epfile_ioctl,
 };
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index db49ec4c748e..200f9a584064 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -74,6 +74,8 @@ MODULE_DESCRIPTION (DRIVER_DESC);
 MODULE_AUTHOR ("David Brownell");
 MODULE_LICENSE ("GPL");
 
+static int ep_open(struct inode *, struct file *);
+
 
 /*----------------------------------------------------------------------*/
 
@@ -283,14 +285,15 @@ static void epio_complete (struct usb_ep *ep, struct usb_request *req)
  * still need dev->lock to use epdata->ep.
  */
 static int
-get_ready_ep (unsigned f_flags, struct ep_data *epdata)
+get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
 {
         int     val;
 
         if (f_flags & O_NONBLOCK) {
                 if (!mutex_trylock(&epdata->lock))
                         goto nonblock;
-                if (epdata->state != STATE_EP_ENABLED) {
+                if (epdata->state != STATE_EP_ENABLED &&
+                    (!is_write || epdata->state != STATE_EP_READY)) {
                         mutex_unlock(&epdata->lock);
 nonblock:
                         val = -EAGAIN;
@@ -305,18 +308,20 @@ nonblock:
 
         switch (epdata->state) {
         case STATE_EP_ENABLED:
+                return 0;
+        case STATE_EP_READY:                    /* not configured yet */
+                if (is_write)
+                        return 0;
+                // FALLTHRU
+        case STATE_EP_UNBOUND:                  /* clean disconnect */
                 break;
         // case STATE_EP_DISABLED:              /* "can't happen" */
-        // case STATE_EP_READY:                 /* "can't happen" */
         default:                                /* error! */
                 pr_debug ("%s: ep %p not available, state %d\n",
                                 shortname, epdata, epdata->state);
-                // FALLTHROUGH
-        case STATE_EP_UNBOUND:                  /* clean disconnect */
-                val = -ENODEV;
-                mutex_unlock(&epdata->lock);
         }
-        return val;
+        mutex_unlock(&epdata->lock);
+        return -ENODEV;
 }
 
 static ssize_t
@@ -363,97 +368,6 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
         return value;
 }
 
-
-/* handle a synchronous OUT bulk/intr/iso transfer */
-static ssize_t
-ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-
-        /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
-
-        value = -ENOMEM;
-        kbuf = kmalloc (len, GFP_KERNEL);
-        if (unlikely (!kbuf))
-                goto free1;
-
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s read %zu OUT, status %d\n",
-                data->name, len, (int) value);
-        if (value >= 0 && copy_to_user (buf, kbuf, value))
-                value = -EFAULT;
-
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-
-/* handle a synchronous IN bulk/intr/iso transfer */
-static ssize_t
-ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (!usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-
-        /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
-
-        value = -ENOMEM;
-        kbuf = memdup_user(buf, len);
-        if (IS_ERR(kbuf)) {
-                value = PTR_ERR(kbuf);
-                kbuf = NULL;
-                goto free1;
-        }
-
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s write %zu IN, status %d\n",
-                data->name, len, (int) value);
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-
 static int
 ep_release (struct inode *inode, struct file *fd)
 {
@@ -481,7 +395,7 @@ static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
         struct ep_data          *data = fd->private_data;
         int                     status;
 
-        if ((status = get_ready_ep (fd->f_flags, data)) < 0)
+        if ((status = get_ready_ep (fd->f_flags, data, false)) < 0)
                 return status;
 
         spin_lock_irq (&data->dev->lock);
@@ -517,8 +431,8 @@ struct kiocb_priv {
         struct mm_struct        *mm;
         struct work_struct      work;
         void                    *buf;
-        const struct iovec      *iv;
-        unsigned long           nr_segs;
+        struct iov_iter         to;
+        const void              *to_free;
         unsigned                actual;
 };
 
@@ -541,35 +455,6 @@ static int ep_aio_cancel(struct kiocb *iocb)
         return value;
 }
 
-static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
-{
-        ssize_t                 len, total;
-        void                    *to_copy;
-        int                     i;
-
-        /* copy stuff into user buffers */
-        total = priv->actual;
-        len = 0;
-        to_copy = priv->buf;
-        for (i=0; i < priv->nr_segs; i++) {
-                ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
-
-                if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
-                        if (len == 0)
-                                len = -EFAULT;
-                        break;
-                }
-
-                total -= this;
-                len += this;
-                to_copy += this;
-                if (total == 0)
-                        break;
-        }
-
-        return len;
-}
-
 static void ep_user_copy_worker(struct work_struct *work)
 {
         struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
@@ -578,13 +463,16 @@ static void ep_user_copy_worker(struct work_struct *work)
         size_t ret;
 
         use_mm(mm);
-        ret = ep_copy_to_user(priv);
+        ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
         unuse_mm(mm);
+        if (!ret)
+                ret = -EFAULT;
 
         /* completing the iocb can drop the ctx and mm, don't touch mm after */
         aio_complete(iocb, ret, ret);
 
         kfree(priv->buf);
+        kfree(priv->to_free);
         kfree(priv);
 }
 
@@ -603,8 +491,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
          * don't need to copy anything to userspace, so we can
          * complete the aio request immediately.
          */
-        if (priv->iv == NULL || unlikely(req->actual == 0)) {
+        if (priv->to_free == NULL || unlikely(req->actual == 0)) {
                 kfree(req->buf);
+                kfree(priv->to_free);
                 kfree(priv);
                 iocb->private = NULL;
                 /* aio_complete() reports bytes-transferred _and_ faults */
@@ -618,6 +507,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
 
                 priv->buf = req->buf;
                 priv->actual = req->actual;
+                INIT_WORK(&priv->work, ep_user_copy_worker);
                 schedule_work(&priv->work);
         }
         spin_unlock(&epdata->dev->lock);
@@ -626,38 +516,17 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
         put_ep(epdata);
 }
 
-static ssize_t
-ep_aio_rwtail(
-        struct kiocb    *iocb,
-        char            *buf,
-        size_t          len,
-        struct ep_data  *epdata,
-        const struct iovec *iv,
-        unsigned long   nr_segs
-)
+static ssize_t ep_aio(struct kiocb *iocb,
+                      struct kiocb_priv *priv,
+                      struct ep_data *epdata,
+                      char *buf,
+                      size_t len)
 {
-        struct kiocb_priv       *priv;
-        struct usb_request      *req;
-        ssize_t                 value;
+        struct usb_request *req;
+        ssize_t value;
 
-        priv = kmalloc(sizeof *priv, GFP_KERNEL);
-        if (!priv) {
-                value = -ENOMEM;
-fail:
-                kfree(buf);
-                return value;
-        }
         iocb->private = priv;
         priv->iocb = iocb;
-        priv->iv = iv;
-        priv->nr_segs = nr_segs;
-        INIT_WORK(&priv->work, ep_user_copy_worker);
-
-        value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
-        if (unlikely(value < 0)) {
-                kfree(priv);
-                goto fail;
-        }
 
         kiocb_set_cancel_fn(iocb, ep_aio_cancel);
         get_ep(epdata);
@@ -669,75 +538,154 @@ fail:
          * allocate or submit those if the host disconnected.
          */
         spin_lock_irq(&epdata->dev->lock);
-        if (likely(epdata->ep)) {
-                req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
-                if (likely(req)) {
-                        priv->req = req;
-                        req->buf = buf;
-                        req->length = len;
-                        req->complete = ep_aio_complete;
-                        req->context = iocb;
-                        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
-                        if (unlikely(0 != value))
-                                usb_ep_free_request(epdata->ep, req);
-                } else
-                        value = -EAGAIN;
-        } else
-                value = -ENODEV;
-        spin_unlock_irq(&epdata->dev->lock);
+        value = -ENODEV;
+        if (unlikely(epdata->ep))
+                goto fail;
 
-        mutex_unlock(&epdata->lock);
+        req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        value = -ENOMEM;
+        if (unlikely(!req))
+                goto fail;
 
-        if (unlikely(value)) {
-                kfree(priv);
-                put_ep(epdata);
-        } else
-                value = -EIOCBQUEUED;
+        priv->req = req;
+        req->buf = buf;
+        req->length = len;
+        req->complete = ep_aio_complete;
+        req->context = iocb;
+        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
+        if (unlikely(0 != value)) {
+                usb_ep_free_request(epdata->ep, req);
+                goto fail;
+        }
+        spin_unlock_irq(&epdata->dev->lock);
+        return -EIOCBQUEUED;
+
+fail:
+        spin_unlock_irq(&epdata->dev->lock);
+        kfree(priv->to_free);
+        kfree(priv);
+        put_ep(epdata);
         return value;
 }
 
 static ssize_t
-ep_aio_read(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t o)
+ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
-        char                    *buf;
+        struct file *file = iocb->ki_filp;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(to);
+        ssize_t value;
+        char *buf;
 
-        if (unlikely(usb_endpoint_dir_in(&epdata->desc)))
-                return -EINVAL;
+        if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0)
+                return value;
 
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
-        if (unlikely(!buf))
-                return -ENOMEM;
+        /* halt any endpoint by doing a "wrong direction" i/o call */
+        if (usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
 
-        return ep_aio_rwtail(iocb, buf, iocb->ki_nbytes, epdata, iov, nr_segs);
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
+                return -ENOMEM;
+        }
+        if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+                if (value >= 0 && copy_to_iter(buf, value, to))
+                        value = -EFAULT;
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (!priv)
+                        goto fail;
+                priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL);
+                if (!priv->to_free) {
+                        kfree(priv);
+                        goto fail;
+                }
+                value = ep_aio(iocb, priv, epdata, buf, len);
+                if (value == -EIOCBQUEUED)
+                        buf = NULL;
+        }
+fail:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 
+static ssize_t ep_config(struct ep_data *, const char *, size_t);
+
 static ssize_t
-ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
-                unsigned long nr_segs, loff_t o)
+ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
-        char                    *buf;
-        size_t                  len = 0;
-        int                     i = 0;
+        struct file *file = iocb->ki_filp;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(from);
+        bool configured;
+        ssize_t value;
+        char *buf;
+
+        if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0)
+                return value;
 
-        if (unlikely(!usb_endpoint_dir_in(&epdata->desc)))
-                return -EINVAL;
+        configured = epdata->state == STATE_EP_ENABLED;
 
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
-        if (unlikely(!buf))
+        /* halt any endpoint by doing a "wrong direction" i/o call */
+        if (configured && !usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
+
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
                 return -ENOMEM;
+        }
 
-        for (i=0; i < nr_segs; i++) {
-                if (unlikely(copy_from_user(&buf[len], iov[i].iov_base,
-                                iov[i].iov_len) != 0)) {
-                        kfree(buf);
-                        return -EFAULT;
+        if (unlikely(copy_from_iter(buf, len, from) != len)) {
+                value = -EFAULT;
+                goto out;
+        }
+
+        if (unlikely(!configured)) {
+                value = ep_config(epdata, buf, len);
+        } else if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (priv) {
+                        value = ep_aio(iocb, priv, epdata, buf, len);
+                        if (value == -EIOCBQUEUED)
+                                buf = NULL;
                 }
-                len += iov[i].iov_len;
         }
-        return ep_aio_rwtail(iocb, buf, len, epdata, NULL, 0);
+out:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 
 /*----------------------------------------------------------------------*/
@@ -745,15 +693,15 @@ ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
 /* used after endpoint configuration */
 static const struct file_operations ep_io_operations = {
         .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
 
-        .read =         ep_read,
-        .write =        ep_write,
-        .unlocked_ioctl = ep_ioctl,
+        .open =         ep_open,
         .release =      ep_release,
-
-        .aio_read =     ep_aio_read,
-        .aio_write =    ep_aio_write,
+        .llseek =       no_llseek,
+        .read =         new_sync_read,
+        .write =        new_sync_write,
+        .unlocked_ioctl = ep_ioctl,
+        .read_iter =    ep_read_iter,
+        .write_iter =   ep_write_iter,
 };
 
 /* ENDPOINT INITIALIZATION
@@ -770,17 +718,12 @@ static const struct file_operations ep_io_operations = {
  * speed descriptor, then optional high speed descriptor.
  */
 static ssize_t
-ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ep_config (struct ep_data *data, const char *buf, size_t len)
 {
-        struct ep_data          *data = fd->private_data;
         struct usb_ep           *ep;
         u32                     tag;
         int                     value, length = len;
 
-        value = mutex_lock_interruptible(&data->lock);
-        if (value < 0)
-                return value;
-
         if (data->state != STATE_EP_READY) {
                 value = -EL2HLT;
                 goto fail;
@@ -791,9 +734,7 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 goto fail0;
 
         /* we might need to change message format someday */
-        if (copy_from_user (&tag, buf, 4)) {
-                goto fail1;
-        }
+        memcpy(&tag, buf, 4);
         if (tag != 1) {
                 DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
                 goto fail0;
@@ -806,19 +747,15 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
          */
 
         /* full/low speed descriptor, then high speed */
-        if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
-                goto fail1;
-        }
+        memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
         if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
                         || data->desc.bDescriptorType != USB_DT_ENDPOINT)
                 goto fail0;
         if (len != USB_DT_ENDPOINT_SIZE) {
                 if (len != 2 * USB_DT_ENDPOINT_SIZE)
                         goto fail0;
-                if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
-                                        USB_DT_ENDPOINT_SIZE)) {
-                        goto fail1;
-                }
+                memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
+                        USB_DT_ENDPOINT_SIZE);
                 if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
                                 || data->hs_desc.bDescriptorType
                                         != USB_DT_ENDPOINT) {
@@ -840,24 +777,20 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         case USB_SPEED_LOW:
         case USB_SPEED_FULL:
                 ep->desc = &data->desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                 break;
         case USB_SPEED_HIGH:
                 /* fails if caller didn't provide that descriptor... */
                 ep->desc = &data->hs_desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                 break;
         default:
                 DBG(data->dev, "unconnected, %s init abandoned\n",
                                 data->name);
                 value = -EINVAL;
+                goto gone;
         }
+        value = usb_ep_enable(ep);
         if (value == 0) {
-                fd->f_op = &ep_io_operations;
+                data->state = STATE_EP_ENABLED;
                 value = length;
         }
 gone:
@@ -867,14 +800,10 @@ fail:
                 data->desc.bDescriptorType = 0;
                 data->hs_desc.bDescriptorType = 0;
         }
-        mutex_unlock(&data->lock);
         return value;
 fail0:
         value = -EINVAL;
         goto fail;
-fail1:
-        value = -EFAULT;
-        goto fail;
 }
 
 static int
@@ -902,15 +831,6 @@ ep_open (struct inode *inode, struct file *fd)
         return value;
 }
 
-/* used before endpoint configuration */
-static const struct file_operations ep_config_operations = {
-        .llseek =       no_llseek,
-
-        .open =         ep_open,
-        .write =        ep_config,
-        .release =      ep_release,
-};
-
 /*----------------------------------------------------------------------*/
 
 /* EP0 IMPLEMENTATION can be partly in userspace.
@@ -989,6 +909,10 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
         enum ep0_state                  state;
 
         spin_lock_irq (&dev->lock);
+        if (dev->state <= STATE_DEV_OPENED) {
+                retval = -EINVAL;
+                goto done;
+        }
 
         /* report fd mode change before acting on it */
         if (dev->setup_abort) {
@@ -1187,8 +1111,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         struct dev_data         *dev = fd->private_data;
         ssize_t                 retval = -ESRCH;
 
-        spin_lock_irq (&dev->lock);
-
         /* report fd mode change before acting on it */
         if (dev->setup_abort) {
                 dev->setup_abort = 0;
@@ -1234,7 +1156,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         } else
                 DBG (dev, "fail %s, state %d\n", __func__, dev->state);
 
-        spin_unlock_irq (&dev->lock);
         return retval;
 }
 
@@ -1281,6 +1202,9 @@ ep0_poll (struct file *fd, poll_table *wait)
        struct dev_data         *dev = fd->private_data;
        int                     mask = 0;
 
+        if (dev->state <= STATE_DEV_OPENED)
+                return DEFAULT_POLLMASK;
+
        poll_wait(fd, &dev->wait, wait);
 
        spin_lock_irq (&dev->lock);
@@ -1316,19 +1240,6 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         return ret;
 }
 
-/* used after device configuration */
-static const struct file_operations ep0_io_operations = {
-        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-
-        .read =         ep0_read,
-        .write =        ep0_write,
-        .fasync =       ep0_fasync,
-        .poll =         ep0_poll,
-        .unlocked_ioctl =       dev_ioctl,
-        .release =      dev_release,
-};
-
 /*----------------------------------------------------------------------*/
 
 /* The in-kernel gadget driver handles most ep0 issues, in particular
@@ -1650,7 +1561,7 @@ static int activate_ep_files (struct dev_data *dev)
                         goto enomem1;
 
                 data->dentry = gadgetfs_create_file (dev->sb, data->name,
-                                data, &ep_config_operations);
+                                data, &ep_io_operations);
                 if (!data->dentry)
                         goto enomem2;
                 list_add_tail (&data->epfiles, &dev->epfiles);
@@ -1852,6 +1763,14 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         u32                     tag;
         char                    *kbuf;
 
+        spin_lock_irq(&dev->lock);
+        if (dev->state > STATE_DEV_OPENED) {
+                value = ep0_write(fd, buf, len, ptr);
+                spin_unlock_irq(&dev->lock);
+                return value;
+        }
+        spin_unlock_irq(&dev->lock);
+
         if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
                 return -EINVAL;
 
@@ -1925,7 +1844,6 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * on, they can work ... except in cleanup paths that
                  * kick in after the ep0 descriptor is closed.
                  */
-                fd->f_op = &ep0_io_operations;
                 value = len;
         }
         return value;
@@ -1956,12 +1874,14 @@ dev_open (struct inode *inode, struct file *fd)
         return value;
 }
 
-static const struct file_operations dev_init_operations = {
+static const struct file_operations ep0_operations = {
         .llseek =       no_llseek,
 
         .open =         dev_open,
+        .read =         ep0_read,
         .write =        dev_config,
         .fasync =       ep0_fasync,
+        .poll =         ep0_poll,
         .unlocked_ioctl = dev_ioctl,
         .release =      dev_release,
 };
@@ -2077,7 +1997,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                 goto Enomem;
 
         dev->sb = sb;
-        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &dev_init_operations);
+        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
         if (!dev->dentry) {
                 put_dev(dev);
                 goto Enomem;
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index f88bfdf5b6a0..2027a27546ef 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -868,12 +868,14 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
                                 func = vfio_pci_set_err_trigger;
                         break;
                 }
+                break;
         case VFIO_PCI_REQ_IRQ_INDEX:
                 switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
                 case VFIO_IRQ_SET_ACTION_TRIGGER:
                         func = vfio_pci_set_req_trigger;
                         break;
                 }
+                break;
         }
 
         if (!func)
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0413157f3b49..6a356e344f82 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/balloon_compaction.h>
 #include <linux/oom.h>
+#include <linux/wait.h>
 
 /*
  * Balloon device works in 4K page units.  So each page is pointed to by
@@ -334,17 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
 static int balloon(void *_vballoon)
 {
         struct virtio_balloon *vb = _vballoon;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         set_freezable();
         while (!kthread_should_stop()) {
                 s64 diff;
 
                 try_to_freeze();
-                wait_event_interruptible(vb->config_change,
-                                         (diff = towards_target(vb)) != 0
-                                         || vb->need_stats_update
-                                         || kthread_should_stop()
-                                         || freezing(current));
+
+                add_wait_queue(&vb->config_change, &wait);
+                for (;;) {
+                        if ((diff = towards_target(vb)) != 0 ||
+                            vb->need_stats_update ||
+                            kthread_should_stop() ||
+                            freezing(current))
+                                break;
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+                }
+                remove_wait_queue(&vb->config_change, &wait);
+
                 if (vb->need_stats_update)
                         stats_handle_request(vb);
                 if (diff > 0)
@@ -499,6 +508,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
         if (err < 0)
                 goto out_oom_notify;
 
+        virtio_device_ready(vdev);
+
         vb->thread = kthread_run(balloon, vb, "vballoon");
         if (IS_ERR(vb->thread)) {
                 err = PTR_ERR(vb->thread);
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index cad569890908..6010d7ec0a0f 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -156,22 +156,95 @@ static void vm_get(struct virtio_device *vdev, unsigned offset,
                    void *buf, unsigned len)
 {
         struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        u8 *ptr = buf;
-        int i;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
+        u8 b;
+        __le16 w;
+        __le32 l;
 
-        for (i = 0; i < len; i++)
-                ptr[i] = readb(vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+        if (vm_dev->version == 1) {
+                u8 *ptr = buf;
+                int i;
+
+                for (i = 0; i < len; i++)
+                        ptr[i] = readb(base + offset + i);
+                return;
+        }
+
+        switch (len) {
+        case 1:
+                b = readb(base + offset);
+                memcpy(buf, &b, sizeof b);
+                break;
+        case 2:
+                w = cpu_to_le16(readw(base + offset));
+                memcpy(buf, &w, sizeof w);
+                break;
+        case 4:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                break;
+        case 8:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                l = cpu_to_le32(ioread32(base + offset + sizeof l));
+                memcpy(buf + sizeof l, &l, sizeof l);
+                break;
+        default:
+                BUG();
+        }
 }
 
 static void vm_set(struct virtio_device *vdev, unsigned offset,
                    const void *buf, unsigned len)
 {
         struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        const u8 *ptr = buf;
-        int i;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
+        u8 b;
+        __le16 w;
+        __le32 l;
 
-        for (i = 0; i < len; i++)
-                writeb(ptr[i], vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+        if (vm_dev->version == 1) {
+                const u8 *ptr = buf;
+                int i;
+
+                for (i = 0; i < len; i++)
+                        writeb(ptr[i], base + offset + i);
+
+                return;
+        }
+
+        switch (len) {
+        case 1:
+                memcpy(&b, buf, sizeof b);
+                writeb(b, base + offset);
+                break;
+        case 2:
+                memcpy(&w, buf, sizeof w);
+                writew(le16_to_cpu(w), base + offset);
+                break;
+        case 4:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                break;
+        case 8:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                memcpy(&l, buf + sizeof l, sizeof l);
+                writel(le32_to_cpu(l), base + offset + sizeof l);
+                break;
+        default:
+                BUG();
+        }
+}
+
+static u32 vm_generation(struct virtio_device *vdev)
+{
+        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
+
+        if (vm_dev->version == 1)
+                return 0;
+        else
+                return readl(vm_dev->base + VIRTIO_MMIO_CONFIG_GENERATION);
 }
 
 static u8 vm_get_status(struct virtio_device *vdev)
@@ -440,6 +513,7 @@ static const char *vm_bus_name(struct virtio_device *vdev)
 static const struct virtio_config_ops virtio_mmio_config_ops = {
         .get            = vm_get,
         .set            = vm_set,
+        .generation     = vm_generation,
         .get_status     = vm_get_status,
         .set_status     = vm_set_status,
         .reset          = vm_reset,
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b4bca2d4a7e5..70fba973a107 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
         pirq_query_unmask(irq);
 
         rc = set_evtchn_to_irq(evtchn, irq);
-        if (rc != 0) {
-                pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-                       irq, rc);
-                xen_evtchn_close(evtchn);
-                return 0;
-        }
+        if (rc)
+                goto err;
+
         bind_evtchn_to_cpu(evtchn, 0);
         info->evtchn = evtchn;
 
+        rc = xen_evtchn_port_setup(info);
+        if (rc)
+                goto err;
+
 out:
         unmask_evtchn(evtchn);
         eoi_pirq(irq_get_irq_data(irq));
 
         return 0;
+
+err:
+        pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+        xen_evtchn_close(evtchn);
+        return 0;
 }
 
 static unsigned int startup_pirq(struct irq_data *data)
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 46ae0f9f02ad..75fe3d466515 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -16,7 +16,7 @@
 #include "conf_space.h"
 #include "conf_space_quirks.h"
 
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
index e56c934ad137..2e1d73d1d5d0 100644
--- a/drivers/xen/xen-pciback/conf_space.h
+++ b/drivers/xen/xen-pciback/conf_space.h
@@ -64,6 +64,8 @@ struct config_field_entry {
         void *data;
 };
 
+extern bool permissive;
+
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 
 /* Add fields to a device - the add_fields macro expects to get a pointer to
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index c5ee82587e8c..2d7369391472 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -11,6 +11,10 @@
 #include "pciback.h"
 #include "conf_space.h"
 
+struct pci_cmd_info {
+        u16 val;
+};
+
 struct pci_bar_info {
         u32 val;
         u32 len_val;
@@ -20,22 +24,36 @@ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
 
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+                           PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+                           PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+
+static void *command_init(struct pci_dev *dev, int offset)
 {
-        int i;
-        int ret;
-
-        ret = xen_pcibk_read_config_word(dev, offset, value, data);
-        if (!pci_is_enabled(dev))
-                return ret;
-
-        for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-                if (dev->resource[i].flags & IORESOURCE_IO)
-                        *value |= PCI_COMMAND_IO;
-                if (dev->resource[i].flags & IORESOURCE_MEM)
-                        *value |= PCI_COMMAND_MEMORY;
+        struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
+        int err;
+
+        if (!cmd)
+                return ERR_PTR(-ENOMEM);
+
+        err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
+        if (err) {
+                kfree(cmd);
+                return ERR_PTR(err);
         }
 
+        return cmd;
+}
+
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+        int ret = pci_read_config_word(dev, offset, value);
+        const struct pci_cmd_info *cmd = data;
+
+        *value &= PCI_COMMAND_GUEST;
+        *value |= cmd->val & ~PCI_COMMAND_GUEST;
+
         return ret;
 }
 
@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
 {
         struct xen_pcibk_dev_data *dev_data;
         int err;
+        u16 val;
+        struct pci_cmd_info *cmd = data;
 
         dev_data = pci_get_drvdata(dev);
         if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
                 }
         }
 
+        cmd->val = value;
+
+        if (!permissive && (!dev_data || !dev_data->permissive))
+                return 0;
+
+        /* Only allow the guest to control certain bits. */
+        err = pci_read_config_word(dev, offset, &val);
+        if (err || val == value)
+                return err;
+
+        value &= PCI_COMMAND_GUEST;
+        value |= val & ~PCI_COMMAND_GUEST;
+
         return pci_write_config_word(dev, offset, value);
 }
 
@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
         {
          .offset    = PCI_COMMAND,
          .size      = 2,
+         .init      = command_init,
+         .release   = bar_release,
          .u.w.read  = command_read,
          .u.w.write = command_write,
         },
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ed19a7d622fa..39706c57ad3c 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
 
         newpage = buf->page;
 
-        if (WARN_ON(!PageUptodate(newpage)))
-                return -EIO;
+        if (!PageUptodate(newpage))
+                SetPageUptodate(newpage);
 
         ClearPageMappedToDisk(newpage);
 
@@ -1353,6 +1353,17 @@ static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
         return err;
 }
 
+static int fuse_dev_open(struct inode *inode, struct file *file)
+{
+        /*
+         * The fuse device's file's private_data is used to hold
+         * the fuse_conn(ection) when it is mounted, and is used to
+         * keep track of whether the file has been mounted already.
+         */
+        file->private_data = NULL;
+        return 0;
+}
+
 static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
                               unsigned long nr_segs, loff_t pos)
 {
@@ -1797,6 +1808,9 @@ copy_finish:
 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
                        unsigned int size, struct fuse_copy_state *cs)
 {
+        /* Don't try to move pages (yet) */
+        cs->move_pages = 0;
+
         switch (code) {
         case FUSE_NOTIFY_POLL:
                 return fuse_notify_poll(fc, size, cs);
@@ -2217,6 +2231,7 @@ static int fuse_dev_fasync(int fd, struct file *file, int on)
 
 const struct file_operations fuse_dev_operations = {
         .owner          = THIS_MODULE,
+        .open           = fuse_dev_open,
         .llseek         = no_llseek,
         .read           = do_sync_read,
         .aio_read       = fuse_dev_read,
diff --git a/fs/locks.c b/fs/locks.c
index f1bad681fc1c..528fedfda15e 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1728,7 +1728,7 @@ static int generic_delete_lease(struct file *filp, void *owner)
                         break;
                 }
         }
-        trace_generic_delete_lease(inode, fl);
+        trace_generic_delete_lease(inode, victim);
         if (victim)
                 error = fl->fl_lmops->lm_change(victim, F_UNLCK, &dispose);
         spin_unlock(&ctx->flc_lock);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 469086b9f99b..0c3f303baf32 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                                              struct the_nilfs *nilfs)
 {
         struct nilfs_inode_info *ii, *n;
+        int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
         int defer_iput = false;
 
         spin_lock(&nilfs->ns_inode_lock);
@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                 brelse(ii->i_bh);
                 ii->i_bh = NULL;
                 list_del_init(&ii->i_dirty);
-                if (!ii->vfs_inode.i_nlink) {
+                if (!ii->vfs_inode.i_nlink || during_mount) {
                         /*
-                         * Defer calling iput() to avoid a deadlock
-                         * over I_SYNC flag for inodes with i_nlink == 0
+                         * Defer calling iput() to avoid deadlocks if
+                         * i_nlink == 0 or mount is not yet finished.
                          */
                         list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
                         defer_iput = true;
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 9a66ff79ff27..d2f97ecca6a5 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -143,7 +143,8 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
             !(marks_mask & FS_ISDIR & ~marks_ignored_mask))
                 return false;
 
-        if (event_mask & marks_mask & ~marks_ignored_mask)
+        if (event_mask & FAN_ALL_OUTGOING_EVENTS & marks_mask &
+                                 ~marks_ignored_mask)
                 return true;
 
         return false;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 8490c64d34fe..460c6c37e683 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -502,7 +502,7 @@ static inline int ocfs2_writes_unwritten_extents(struct ocfs2_super *osb)
 
 static inline int ocfs2_supports_append_dio(struct ocfs2_super *osb)
 {
-        if (osb->s_feature_ro_compat & OCFS2_FEATURE_RO_COMPAT_APPEND_DIO)
+        if (osb->s_feature_incompat & OCFS2_FEATURE_INCOMPAT_APPEND_DIO)
                 return 1;
         return 0;
 }
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 20e37a3ed26f..db64ce2d4667 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -102,11 +102,11 @@
                                          | OCFS2_FEATURE_INCOMPAT_INDEXED_DIRS \
                                          | OCFS2_FEATURE_INCOMPAT_REFCOUNT_TREE \
                                          | OCFS2_FEATURE_INCOMPAT_DISCONTIG_BG  \
-                                         | OCFS2_FEATURE_INCOMPAT_CLUSTERINFO)
+                                         | OCFS2_FEATURE_INCOMPAT_CLUSTERINFO \
+                                         | OCFS2_FEATURE_INCOMPAT_APPEND_DIO)
 #define OCFS2_FEATURE_RO_COMPAT_SUPP    (OCFS2_FEATURE_RO_COMPAT_UNWRITTEN \
                                          | OCFS2_FEATURE_RO_COMPAT_USRQUOTA \
-                                         | OCFS2_FEATURE_RO_COMPAT_GRPQUOTA \
-                                         | OCFS2_FEATURE_RO_COMPAT_APPEND_DIO)
+                                         | OCFS2_FEATURE_RO_COMPAT_GRPQUOTA)
 
 /*
  * Heartbeat-only devices are missing journals and other files.  The
@@ -179,6 +179,11 @@
 #define OCFS2_FEATURE_INCOMPAT_CLUSTERINFO      0x4000
 
 /*
+ * Append Direct IO support
+ */
+#define OCFS2_FEATURE_INCOMPAT_APPEND_DIO       0x8000
+
+/*
  * backup superblock flag is used to indicate that this volume
  * has backup superblocks.
  */
@@ -200,10 +205,6 @@
 #define OCFS2_FEATURE_RO_COMPAT_USRQUOTA        0x0002
 #define OCFS2_FEATURE_RO_COMPAT_GRPQUOTA        0x0004
 
-/*
- * Append Direct IO support
- */
-#define OCFS2_FEATURE_RO_COMPAT_APPEND_DIO      0x0008
 
 /* The byte offset of the first backup block will be 1G.
  * The following will be 4G, 16G, 64G, 256G and 1T.
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index b90952f528b1..5f0d1993e6e3 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -529,8 +529,7 @@ static int ovl_remount(struct super_block *sb, int *flags, char *data)
 {
         struct ovl_fs *ufs = sb->s_fs_info;
 
-        if (!(*flags & MS_RDONLY) &&
-            (!ufs->upper_mnt || (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY)))
+        if (!(*flags & MS_RDONLY) && !ufs->upper_mnt)
                 return -EROFS;
 
         return 0;
@@ -615,9 +614,19 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
                         break;
 
                 default:
+                        pr_err("overlayfs: unrecognized mount option \"%s\" or missing value\n", p);
                         return -EINVAL;
                 }
         }
+
+        /* Workdir is useless in non-upper mount */
+        if (!config->upperdir && config->workdir) {
+                pr_info("overlayfs: option \"workdir=%s\" is useless in a non-upper mount, ignore\n",
+                        config->workdir);
+                kfree(config->workdir);
+                config->workdir = NULL;
+        }
+
         return 0;
 }
 
@@ -837,7 +846,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         sb->s_stack_depth = 0;
         if (ufs->config.upperdir) {
-                /* FIXME: workdir is not needed for a R/O mount */
                 if (!ufs->config.workdir) {
                         pr_err("overlayfs: missing 'workdir'\n");
                         goto out_free_config;
@@ -847,6 +855,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 if (err)
                         goto out_free_config;
 
+                /* Upper fs should not be r/o */
+                if (upperpath.mnt->mnt_sb->s_flags & MS_RDONLY) {
+                        pr_err("overlayfs: upper fs is r/o, try multi-lower layers mount\n");
+                        err = -EINVAL;
+                        goto out_put_upperpath;
+                }
+
                 err = ovl_mount_dir(ufs->config.workdir, &workpath);
                 if (err)
                         goto out_put_upperpath;
@@ -869,8 +884,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         err = -EINVAL;
         stacklen = ovl_split_lowerdirs(lowertmp);
-        if (stacklen > OVL_MAX_STACK)
+        if (stacklen > OVL_MAX_STACK) {
+                pr_err("overlayfs: too many lower directries, limit is %d\n",
+                       OVL_MAX_STACK);
                 goto out_free_lowertmp;
+        } else if (!ufs->config.upperdir && stacklen == 1) {
+                pr_err("overlayfs: at least 2 lowerdir are needed while upperdir nonexistent\n");
+                goto out_free_lowertmp;
+        }
 
         stack = kcalloc(stacklen, sizeof(struct path), GFP_KERNEL);
         if (!stack)
@@ -932,8 +953,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 ufs->numlower++;
         }
 
-        /* If the upper fs is r/o or nonexistent, we mark overlayfs r/o too */
-        if (!ufs->upper_mnt || (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY))
+        /* If the upper fs is nonexistent, we mark overlayfs r/o too */
+        if (!ufs->upper_mnt)
                 sb->s_flags |= MS_RDONLY;
 
         sb->s_d_op = &ovl_dentry_operations;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 956b75d61809..6dee68d013ff 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1325,6 +1325,9 @@ out:
 
 static int pagemap_open(struct inode *inode, struct file *file)
 {
+        /* do not disclose physical addresses: attack vector */
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
         pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
                         "to stop being page-shift some time soon. See the "
                         "linux/Documentation/vm/pagemap.txt for details.\n");
diff --git a/include/dt-bindings/pinctrl/am33xx.h b/include/dt-bindings/pinctrl/am33xx.h
index 2fbc804e1a45..226f77246a70 100644
--- a/include/dt-bindings/pinctrl/am33xx.h
+++ b/include/dt-bindings/pinctrl/am33xx.h
@@ -13,7 +13,8 @@
 
 #define PULL_DISABLE            (1 << 3)
 #define INPUT_EN                (1 << 5)
-#define SLEWCTRL_FAST           (1 << 6)
+#define SLEWCTRL_SLOW           (1 << 6)
+#define SLEWCTRL_FAST           0
 
 /* update macro depending on INPUT_EN and PULL_ENA */
 #undef PIN_OUTPUT
diff --git a/include/dt-bindings/pinctrl/am43xx.h b/include/dt-bindings/pinctrl/am43xx.h
index 9c2e4f82381e..5f4d01898c9c 100644
--- a/include/dt-bindings/pinctrl/am43xx.h
+++ b/include/dt-bindings/pinctrl/am43xx.h
@@ -18,7 +18,8 @@
 #define PULL_DISABLE            (1 << 16)
 #define PULL_UP                 (1 << 17)
 #define INPUT_EN                (1 << 18)
-#define SLEWCTRL_FAST           (1 << 19)
+#define SLEWCTRL_SLOW           (1 << 19)
+#define SLEWCTRL_FAST           0
 #define DS0_PULL_UP_DOWN_EN     (1 << 27)
 
 #define PIN_OUTPUT              (PULL_DISABLE)
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 7c55dd5dd2c9..66203b268984 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -114,6 +114,7 @@ struct vgic_ops {
         void    (*sync_lr_elrsr)(struct kvm_vcpu *, int, struct vgic_lr);
         u64     (*get_elrsr)(const struct kvm_vcpu *vcpu);
         u64     (*get_eisr)(const struct kvm_vcpu *vcpu);
+        void    (*clear_eisr)(struct kvm_vcpu *vcpu);
         u32     (*get_interrupt_status)(const struct kvm_vcpu *vcpu);
         void    (*enable_underflow)(struct kvm_vcpu *vcpu);
         void    (*disable_underflow)(struct kvm_vcpu *vcpu);
diff --git a/include/linux/clk.h b/include/linux/clk.h
index 8381bbfbc308..68c16a6bedb3 100644
--- a/include/linux/clk.h
+++ b/include/linux/clk.h
@@ -125,6 +125,19 @@ int clk_set_phase(struct clk *clk, int degrees);
  */
 int clk_get_phase(struct clk *clk);
 
+/**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q);
+
 #else
 
 static inline long clk_get_accuracy(struct clk *clk)
@@ -142,6 +155,11 @@ static inline long clk_get_phase(struct clk *clk)
         return -ENOTSUPP;
 }
 
+static inline bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        return p == q;
+}
+
 #endif
 
 /**
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 800544bc7bfd..781974afff9f 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -166,6 +166,11 @@
 
 #define GITS_TRANSLATER                 0x10040
 
+#define GITS_CTLR_ENABLE                (1U << 0)
+#define GITS_CTLR_QUIESCENT             (1U << 31)
+
+#define GITS_TYPER_DEVBITS_SHIFT        13
+#define GITS_TYPER_DEVBITS(r)           ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
 #define GITS_TYPER_PTA                  (1UL << 19)
 
 #define GITS_CBASER_VALID               (1UL << 63)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 72ba725ddf9c..5bb074431eb0 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -5,6 +5,7 @@
 
 struct kmem_cache;
 struct page;
+struct vm_struct;
 
 #ifdef CONFIG_KASAN
 
@@ -49,15 +50,11 @@ void kasan_krealloc(const void *object, size_t new_size);
 void kasan_slab_alloc(struct kmem_cache *s, void *object);
 void kasan_slab_free(struct kmem_cache *s, void *object);
 
-#define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
-
 int kasan_module_alloc(void *addr, size_t size);
-void kasan_module_free(void *addr);
+void kasan_free_shadow(const struct vm_struct *vm);
 
 #else /* CONFIG_KASAN */
 
-#define MODULE_ALIGN 1
-
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
 
 static inline void kasan_enable_current(void) {}
@@ -82,7 +79,7 @@ static inline void kasan_slab_alloc(struct kmem_cache *s, void *object) {}
 static inline void kasan_slab_free(struct kmem_cache *s, void *object) {}
 
 static inline int kasan_module_alloc(void *addr, size_t size) { return 0; }
-static inline void kasan_module_free(void *addr) {}
+static inline void kasan_free_shadow(const struct vm_struct *vm) {}
 
 #endif /* CONFIG_KASAN */
 
diff --git a/include/linux/module.h b/include/linux/module.h
index 42999fe2dbd0..b03485bcb82a 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -344,6 +344,10 @@ struct module {
         unsigned long *ftrace_callsites;
 #endif
 
+#ifdef CONFIG_LIVEPATCH
+        bool klp_alive;
+#endif
+
 #ifdef CONFIG_MODULE_UNLOAD
         /* What modules depend on me? */
         struct list_head source_list;
diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
index f7556261fe3c..4d0cb9bba93e 100644
--- a/include/linux/moduleloader.h
+++ b/include/linux/moduleloader.h
@@ -84,4 +84,12 @@ void module_arch_cleanup(struct module *mod);
 
 /* Any cleanup before freeing mod->module_init */
 void module_arch_freeing_init(struct module *mod);
+
+#ifdef CONFIG_KASAN
+#include <linux/kasan.h>
+#define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
+#else
+#define MODULE_ALIGN PAGE_SIZE
+#endif
+
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 76951c5fbedf..5ae69e7df867 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -965,9 +965,12 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
  *      Used to add FDB entries to dump requests. Implementers should add
  *      entries to skb and update idx with the number of entries.
  *
- * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
+ * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh,
+ *                           u16 flags)
  * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
  *                           struct net_device *dev, u32 filter_mask)
+ * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh,
+ *                           u16 flags);
  *
  * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
  *      Called to change device carrier. Soft-devices (like dummy, team, etc)
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index 8a860f096c35..611a691145c4 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -84,7 +84,7 @@ static inline int of_platform_populate(struct device_node *root,
 static inline void of_platform_depopulate(struct device *parent) { }
 #endif
 
-#ifdef CONFIG_OF_DYNAMIC
+#if defined(CONFIG_OF_DYNAMIC) && defined(CONFIG_OF_ADDRESS)
 extern void of_platform_register_reconfig_notifier(void);
 #else
 static inline void of_platform_register_reconfig_notifier(void) { }
diff --git a/include/linux/pinctrl/consumer.h b/include/linux/pinctrl/consumer.h
index 72c0415d6c21..18eccefea06e 100644
--- a/include/linux/pinctrl/consumer.h
+++ b/include/linux/pinctrl/consumer.h
@@ -82,7 +82,7 @@ static inline int pinctrl_gpio_direction_output(unsigned gpio)
 
 static inline struct pinctrl * __must_check pinctrl_get(struct device *dev)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 
 static inline void pinctrl_put(struct pinctrl *p)
@@ -93,7 +93,7 @@ static inline struct pinctrl_state * __must_check pinctrl_lookup_state(
                                                         struct pinctrl *p,
                                                         const char *name)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 
 static inline int pinctrl_select_state(struct pinctrl *p,
@@ -104,7 +104,7 @@ static inline int pinctrl_select_state(struct pinctrl *p,
 
 static inline struct pinctrl * __must_check devm_pinctrl_get(struct device *dev)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 
 static inline void devm_pinctrl_put(struct pinctrl *p)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index bba1330757c0..36f3f43c0117 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -945,6 +945,13 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from)
         to->l4_hash = from->l4_hash;
 };
 
+static inline void skb_sender_cpu_clear(struct sk_buff *skb)
+{
+#ifdef CONFIG_XPS
+        skb->sender_cpu = 0;
+#endif
+}
+
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
 static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
 {
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 07a022641996..71880299ed48 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -98,6 +98,8 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, struct page ***pages,
                         size_t maxsize, size_t *start);
 int iov_iter_npages(const struct iov_iter *i, int maxpages);
 
+const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags);
+
 static inline size_t iov_iter_count(struct iov_iter *i)
 {
         return i->count;
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 7d7acb35603d..0ec598381f97 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -17,6 +17,7 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
 #define VM_VPAGES               0x00000010      /* buffer for pages was vmalloc'ed */
 #define VM_UNINITIALIZED        0x00000020      /* vm_struct is not fully initialized */
 #define VM_NO_GUARD             0x00000040      /* don't add guard page */
+#define VM_KASAN                0x00000080      /* has allocated kasan shadow memory */
 /* bits [20..32] reserved for arch specific ioremap internals */
 
 /*
diff --git a/include/net/dst.h b/include/net/dst.h
index a8ae4e760778..0fb99a26e973 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -481,6 +481,7 @@ void dst_init(void);
 enum {
         XFRM_LOOKUP_ICMP = 1 << 0,
         XFRM_LOOKUP_QUEUE = 1 << 1,
+        XFRM_LOOKUP_KEEP_DST_REF = 1 << 2,
 };
 
 struct flowi;
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 9564b779246f..756e4636bad8 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -91,6 +91,7 @@ struct vxlanhdr {
 
 #define VXLAN_N_VID     (1u << 24)
 #define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
+#define VXLAN_VNI_MASK  (VXLAN_VID_MASK << 8)
 #define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
 
 struct vxlan_metadata {
diff --git a/include/soc/at91/at91sam9_ddrsdr.h b/include/soc/at91/at91sam9_ddrsdr.h
index 0210797abf2e..dc10c52e0e91 100644
--- a/include/soc/at91/at91sam9_ddrsdr.h
+++ b/include/soc/at91/at91sam9_ddrsdr.h
@@ -92,7 +92,7 @@
 #define         AT91_DDRSDRC_UPD_MR     (3 << 20)        /* Update load mode register and extended mode register */
 
 #define AT91_DDRSDRC_MDR        0x20    /* Memory Device Register */
-#define         AT91_DDRSDRC_MD         (3 << 0)                /* Memory Device Type */
+#define         AT91_DDRSDRC_MD         (7 << 0)        /* Memory Device Type */
 #define                 AT91_DDRSDRC_MD_SDR             0
 #define                 AT91_DDRSDRC_MD_LOW_POWER_SDR   1
 #define                 AT91_DDRSDRC_MD_LOW_POWER_DDR   3
diff --git a/include/uapi/linux/virtio_blk.h b/include/uapi/linux/virtio_blk.h
index 3c53eec4ae22..19c66fcbab8a 100644
--- a/include/uapi/linux/virtio_blk.h
+++ b/include/uapi/linux/virtio_blk.h
@@ -60,7 +60,7 @@ struct virtio_blk_config {
         __u32 size_max;
         /* The maximum number of segments (if VIRTIO_BLK_F_SEG_MAX) */
         __u32 seg_max;
-        /* geometry the device (if VIRTIO_BLK_F_GEOMETRY) */
+        /* geometry of the device (if VIRTIO_BLK_F_GEOMETRY) */
         struct virtio_blk_geometry {
                 __u16 cylinders;
                 __u8 heads;
@@ -119,7 +119,11 @@ struct virtio_blk_config {
 #define VIRTIO_BLK_T_BARRIER    0x80000000
 #endif /* !VIRTIO_BLK_NO_LEGACY */
 
-/* This is the first element of the read scatter-gather list. */
+/*
+ * This comes first in the read scatter-gather list.
+ * For legacy virtio, if VIRTIO_F_ANY_LAYOUT is not negotiated,
+ * this is the first element of the read scatter-gather list.
+ */
 struct virtio_blk_outhdr {
         /* VIRTIO_BLK_T* */
         __virtio32 type;
diff --git a/include/uapi/linux/virtio_scsi.h b/include/uapi/linux/virtio_scsi.h
index 42b9370771b0..cc18ef8825c0 100644
--- a/include/uapi/linux/virtio_scsi.h
+++ b/include/uapi/linux/virtio_scsi.h
@@ -29,8 +29,16 @@
 
 #include <linux/virtio_types.h>
 
-#define VIRTIO_SCSI_CDB_SIZE   32
-#define VIRTIO_SCSI_SENSE_SIZE 96
+/* Default values of the CDB and sense data size configuration fields */
+#define VIRTIO_SCSI_CDB_DEFAULT_SIZE   32
+#define VIRTIO_SCSI_SENSE_DEFAULT_SIZE 96
+
+#ifndef VIRTIO_SCSI_CDB_SIZE
+#define VIRTIO_SCSI_CDB_SIZE VIRTIO_SCSI_CDB_DEFAULT_SIZE
+#endif
+#ifndef VIRTIO_SCSI_SENSE_SIZE
+#define VIRTIO_SCSI_SENSE_SIZE VIRTIO_SCSI_SENSE_DEFAULT_SIZE
+#endif
 
 /* SCSI command request, followed by data-out */
 struct virtio_scsi_cmd_req {
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index b78f21caf55a..b0f1c9e5d687 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -114,9 +114,9 @@ int __must_check __xenbus_register_backend(struct xenbus_driver *drv,
                                            const char *mod_name);
 
 #define xenbus_register_frontend(drv) \
-        __xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME);
+        __xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME)
 #define xenbus_register_backend(drv) \
-        __xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME);
+        __xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME)
 
 void xenbus_unregister_driver(struct xenbus_driver *drv);
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index f04daabfd1cf..453ef61311d4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3591,7 +3591,7 @@ static void put_event(struct perf_event *event)
         ctx = perf_event_ctx_lock_nested(event, SINGLE_DEPTH_NESTING);
         WARN_ON_ONCE(ctx->parent_ctx);
         perf_remove_from_context(event, true);
-        mutex_unlock(&ctx->mutex);
+        perf_event_ctx_unlock(event, ctx);
 
         _free_event(event);
 }
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 01ca08804f51..3f9f1d6b4c2e 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -89,16 +89,28 @@ static bool klp_is_object_loaded(struct klp_object *obj)
 /* sets obj->mod if object is not vmlinux and module is found */
 static void klp_find_object_module(struct klp_object *obj)
 {
+        struct module *mod;
+
         if (!klp_is_module(obj))
                 return;
 
         mutex_lock(&module_mutex);
         /*
-         * We don't need to take a reference on the module here because we have
-         * the klp_mutex, which is also taken by the module notifier.  This
-         * prevents any module from unloading until we release the klp_mutex.
+         * We do not want to block removal of patched modules and therefore
+         * we do not take a reference here. The patches are removed by
+         * a going module handler instead.
+         */
+        mod = find_module(obj->name);
+        /*
+         * Do not mess work of the module coming and going notifiers.
+         * Note that the patch might still be needed before the going handler
+         * is called. Module functions can be called even in the GOING state
+         * until mod->exit() finishes. This is especially important for
+         * patches that modify semantic of the functions.
          */
-        obj->mod = find_module(obj->name);
+        if (mod && mod->klp_alive)
+                obj->mod = mod;
+
         mutex_unlock(&module_mutex);
 }
 
@@ -767,6 +779,7 @@ static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
                 return -EINVAL;
 
         obj->state = KLP_DISABLED;
+        obj->mod = NULL;
 
         klp_find_object_module(obj);
 
@@ -961,6 +974,15 @@ static int klp_module_notify(struct notifier_block *nb, unsigned long action,
 
         mutex_lock(&klp_mutex);
 
+        /*
+         * Each module has to know that the notifier has been called.
+         * We never know what module will get patched by a new patch.
+         */
+        if (action == MODULE_STATE_COMING)
+                mod->klp_alive = true;
+        else /* MODULE_STATE_GOING */
+                mod->klp_alive = false;
+
         list_for_each_entry(patch, &klp_patches, list) {
                 for (obj = patch->objs; obj->funcs; obj++) {
                         if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
diff --git a/kernel/module.c b/kernel/module.c
index cc93cf68653c..b3d634ed06c9 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -56,7 +56,6 @@
 #include <linux/async.h>
 #include <linux/percpu.h>
 #include <linux/kmemleak.h>
-#include <linux/kasan.h>
 #include <linux/jump_label.h>
 #include <linux/pfn.h>
 #include <linux/bsearch.h>
@@ -1814,7 +1813,6 @@ static void unset_module_init_ro_nx(struct module *mod) { }
 void __weak module_memfree(void *module_region)
 {
         vfree(module_region);
-        kasan_module_free(module_region);
 }
 
 void __weak module_arch_cleanup(struct module *mod)
diff --git a/lib/Makefile b/lib/Makefile
index 87eb3bffc283..58f74d2dd396 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,7 @@ obj-y	+= lockref.o
 
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o kasprintf.o bitmap.o scatterlist.o \
-         gcd.o lcm.o list_sort.o uuid.o flex_array.o clz_ctz.o \
+         gcd.o lcm.o list_sort.o uuid.o flex_array.o iov_iter.o clz_ctz.o \
          bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o \
          percpu-refcount.o percpu_ida.o rhashtable.o reciprocal_div.o
 obj-y += string_helpers.o
diff --git a/mm/iov_iter.c b/lib/iov_iter.c
index 827732047da1..9d96e283520c 100644
--- a/mm/iov_iter.c
+++ b/lib/iov_iter.c
@@ -751,3 +751,18 @@ int iov_iter_npages(const struct iov_iter *i, int maxpages)
         return npages;
 }
 EXPORT_SYMBOL(iov_iter_npages);
+
+const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags)
+{
+        *new = *old;
+        if (new->type & ITER_BVEC)
+                return new->bvec = kmemdup(new->bvec,
+                                    new->nr_segs * sizeof(struct bio_vec),
+                                    flags);
+        else
+                /* iovec and kvec have identical layout */
+                return new->iov = kmemdup(new->iov,
+                                   new->nr_segs * sizeof(struct iovec),
+                                   flags);
+}
+EXPORT_SYMBOL(dup_iter);
diff --git a/mm/Makefile b/mm/Makefile
index 3c1caa2693bd..15dbe9903c27 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -21,7 +21,7 @@ obj-y			:= filemap.o mempool.o oom_kill.o \
                            mm_init.o mmu_context.o percpu.o slab_common.o \
                            compaction.o vmacache.o \
                            interval_tree.o list_lru.o workingset.o \
-                           iov_iter.o debug.o $(mmu-y)
+                           debug.o $(mmu-y)
 
 obj-y += init-mm.o
 
diff --git a/mm/cma.c b/mm/cma.c
index 75016fd1de90..68ecb7a42983 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -64,15 +64,17 @@ static unsigned long cma_bitmap_aligned_mask(struct cma *cma, int align_order)
         return (1UL << (align_order - cma->order_per_bit)) - 1;
 }
 
+/*
+ * Find a PFN aligned to the specified order and return an offset represented in
+ * order_per_bits.
+ */
 static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
 {
-        unsigned int alignment;
-
         if (align_order <= cma->order_per_bit)
                 return 0;
-        alignment = 1UL << (align_order - cma->order_per_bit);
-        return ALIGN(cma->base_pfn, alignment) -
-                (cma->base_pfn >> cma->order_per_bit);
+
+        return (ALIGN(cma->base_pfn, (1UL << align_order))
+                - cma->base_pfn) >> cma->order_per_bit;
 }
 
 static unsigned long cma_bitmap_maxno(struct cma *cma)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index fc00c8cb5a82..626e93db28ba 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1295,8 +1295,13 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
          * Avoid grouping on DSO/COW pages in specific and RO pages
          * in general, RO pages shouldn't hurt as much anyway since
          * they can be in shared cache state.
+         *
+         * FIXME! This checks "pmd_dirty()" as an approximation of
+         * "is this a read-only page", since checking "pmd_write()"
+         * is even more broken. We haven't actually turned this into
+         * a writable page, so pmd_write() will always be false.
          */
-        if (!pmd_write(pmd))
+        if (!pmd_dirty(pmd))
                 flags |= TNF_NO_GROUP;
 
         /*
@@ -1482,6 +1487,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 
         if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
                 pmd_t entry;
+                ret = 1;
 
                 /*
                  * Avoid trapping faults against the zero page. The read-only
@@ -1490,11 +1496,10 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                  */
                 if (prot_numa && is_huge_zero_pmd(*pmd)) {
                         spin_unlock(ptl);
-                        return 0;
+                        return ret;
                 }
 
                 if (!prot_numa || !pmd_protnone(*pmd)) {
-                        ret = 1;
                         entry = pmdp_get_and_clear_notify(mm, addr, pmd);
                         entry = pmd_modify(entry, newprot);
                         ret = HPAGE_PMD_NR;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 0a9ac6c26832..c41b2a0ee273 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -917,7 +917,6 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
         __SetPageHead(page);
         __ClearPageReserved(page);
         for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
-                __SetPageTail(p);
                 /*
                  * For gigantic hugepages allocated through bootmem at
                  * boot, it's safer to be consistent with the not-gigantic
@@ -933,6 +932,9 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
                 __ClearPageReserved(p);
                 set_page_count(p, 0);
                 p->first_page = page;
+                /* Make sure p->first_page is always valid for PageTail() */
+                smp_wmb();
+                __SetPageTail(p);
         }
 }
 
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 78fee632a7ee..936d81661c47 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -29,6 +29,7 @@
 #include <linux/stacktrace.h>
 #include <linux/string.h>
 #include <linux/types.h>
+#include <linux/vmalloc.h>
 #include <linux/kasan.h>
 
 #include "kasan.h"
@@ -414,12 +415,19 @@ int kasan_module_alloc(void *addr, size_t size)
                         GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
                         PAGE_KERNEL, VM_NO_GUARD, NUMA_NO_NODE,
                         __builtin_return_address(0));
-        return ret ? 0 : -ENOMEM;
+
+        if (ret) {
+                find_vm_area(addr)->flags |= VM_KASAN;
+                return 0;
+        }
+
+        return -ENOMEM;
 }
 
-void kasan_module_free(void *addr)
+void kasan_free_shadow(const struct vm_struct *vm)
 {
-        vfree(kasan_mem_to_shadow(addr));
+        if (vm->flags & VM_KASAN)
+                vfree(kasan_mem_to_shadow(vm->addr));
 }
 
 static void register_global(struct kasan_global *global)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9fe07692eaad..b34ef4a32a3b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5232,7 +5232,9 @@ static void mem_cgroup_bind(struct cgroup_subsys_state *root_css)
          * on for the root memcg is enough.
          */
         if (cgroup_on_dfl(root_css->cgroup))
-                mem_cgroup_from_css(root_css)->use_hierarchy = true;
+                root_mem_cgroup->use_hierarchy = true;
+        else
+                root_mem_cgroup->use_hierarchy = false;
 }
 
 static u64 memory_current_read(struct cgroup_subsys_state *css,
diff --git a/mm/memory.c b/mm/memory.c
index 8068893697bb..411144f977b1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3072,8 +3072,13 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
          * Avoid grouping on DSO/COW pages in specific and RO pages
          * in general, RO pages shouldn't hurt as much anyway since
          * they can be in shared cache state.
+         *
+         * FIXME! This checks "pmd_dirty()" as an approximation of
+         * "is this a read-only page", since checking "pmd_write()"
+         * is even more broken. We haven't actually turned this into
+         * a writable page, so pmd_write() will always be false.
          */
-        if (!pte_write(pte))
+        if (!pte_dirty(pte))
                 flags |= TNF_NO_GROUP;
 
         /*
diff --git a/mm/mlock.c b/mm/mlock.c
index 73cf0987088c..8a54cd214925 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -26,10 +26,10 @@
 
 int can_do_mlock(void)
 {
-        if (capable(CAP_IPC_LOCK))
-                return 1;
         if (rlimit(RLIMIT_MEMLOCK) != 0)
                 return 1;
+        if (capable(CAP_IPC_LOCK))
+                return 1;
         return 0;
 }
 EXPORT_SYMBOL(can_do_mlock);
diff --git a/mm/nommu.c b/mm/nommu.c
index 3e67e7538ecf..3fba2dc97c44 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -62,6 +62,7 @@ void *high_memory;
 EXPORT_SYMBOL(high_memory);
 struct page *mem_map;
 unsigned long max_mapnr;
+EXPORT_SYMBOL(max_mapnr);
 unsigned long highest_memmap_pfn;
 struct percpu_counter vm_committed_as;
 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 7abfa70cdc1a..40e29429e7b0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2373,7 +2373,8 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                         goto out;
         }
         /* Exhausted what can be done so it's blamo time */
-        if (out_of_memory(ac->zonelist, gfp_mask, order, ac->nodemask, false))
+        if (out_of_memory(ac->zonelist, gfp_mask, order, ac->nodemask, false)
+                        || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL))
                 *did_some_progress = 1;
 out:
         oom_zonelist_unlock(ac->zonelist, gfp_mask);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 35b25e1340ca..49abccf29a29 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1418,6 +1418,7 @@ struct vm_struct *remove_vm_area(const void *addr)
                 spin_unlock(&vmap_area_lock);
 
                 vmap_debug_free_range(va->va_start, va->va_end);
+                kasan_free_shadow(vm);
                 free_unmap_vmap_area(va);
                 vm->size -= PAGE_SIZE;
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index d8e376a5f0f1..36a1a739ad68 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -658,14 +658,30 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 static void p9_virtio_remove(struct virtio_device *vdev)
 {
         struct virtio_chan *chan = vdev->priv;
-
-        if (chan->inuse)
-                p9_virtio_close(chan->client);
-        vdev->config->del_vqs(vdev);
+        unsigned long warning_time;
 
         mutex_lock(&virtio_9p_lock);
+
+        /* Remove self from list so we don't get new users. */
         list_del(&chan->chan_list);
+        warning_time = jiffies;
+
+        /* Wait for existing users to close. */
+        while (chan->inuse) {
+                mutex_unlock(&virtio_9p_lock);
+                msleep(250);
+                if (time_after(jiffies, warning_time + 10 * HZ)) {
+                        dev_emerg(&vdev->dev,
+                                  "p9_virtio_remove: waiting for device in use.\n");
+                        warning_time = jiffies;
+                }
+                mutex_lock(&virtio_9p_lock);
+        }
+
         mutex_unlock(&virtio_9p_lock);
+
+        vdev->config->del_vqs(vdev);
+
         sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
         kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
         kfree(chan->tag);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b087d278c679..1849d96b3c91 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -563,6 +563,8 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
          */
         del_nbp(p);
 
+        dev_set_mtu(br->dev, br_min_mtu(br));
+
         spin_lock_bh(&br->lock);
         changed_addr = br_stp_recalculate_bridge_id(br);
         spin_unlock_bh(&br->lock);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index b6bf51bb187d..4ec0c803aef1 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct socket *sock, struct msghdr *m,
         int copylen;
 
         ret = -EOPNOTSUPP;
-        if (m->msg_flags&MSG_OOB)
+        if (flags & MSG_OOB)
                 goto read_error;
 
         skb = skb_recv_datagram(sk, flags, 0 , &ret);
diff --git a/net/compat.c b/net/compat.c
index 478443182bbe..13c0c9a25cd9 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
             __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
+
+        if (!uaddr)
+                kmsg->msg_namelen = 0;
+
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
+
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 6abe634c666c..e7695104dbf0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2187,28 +2187,28 @@ replay:
                         }
                 }
                 err = rtnl_configure_link(dev, ifm);
-                if (err < 0) {
-                        if (ops->newlink) {
-                                LIST_HEAD(list_kill);
-
-                                ops->dellink(dev, &list_kill);
-                                unregister_netdevice_many(&list_kill);
-                        } else {
-                                unregister_netdevice(dev);
-                        }
-                        goto out;
-                }
-
+                if (err < 0)
+                        goto out_unregister;
                 if (link_net) {
                         err = dev_change_net_namespace(dev, dest_net, ifname);
                         if (err < 0)
-                                unregister_netdevice(dev);
+                                goto out_unregister;
                 }
 out:
                 if (link_net)
                         put_net(link_net);
                 put_net(dest_net);
                 return err;
+out_unregister:
+                if (ops->newlink) {
+                        LIST_HEAD(list_kill);
+
+                        ops->dellink(dev, &list_kill);
+                        unregister_netdevice_many(&list_kill);
+                } else {
+                        unregister_netdevice(dev);
+                }
+                goto out;
         }
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 47c32413d5b9..cdb939b731aa 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3689,9 +3689,13 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                      struct sock *sk, int tstype)
 {
         struct sk_buff *skb;
-        bool tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        bool tsonly;
 
-        if (!sk || !skb_may_tx_timestamp(sk, tsonly))
+        if (!sk)
+                return;
+
+        tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        if (!skb_may_tx_timestamp(sk, tsonly))
                 return;
 
         if (tsonly)
@@ -4129,7 +4133,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         skb->ignore_df = 0;
         skb_dst_drop(skb);
         skb->mark = 0;
-        skb->sender_cpu = 0;
+        skb_sender_cpu_clear(skb);
         skb_init_secmark(skb);
         secpath_reset(skb);
         nf_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index 744a04ddb61c..841108b5649f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1655,6 +1655,10 @@ void sock_rfree(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_rfree);
 
+/*
+ * Buffer destructor for skbs that are not used directly in read or write
+ * path, e.g. for error handler skbs. Automatically called from kfree_skb.
+ */
 void sock_efree(struct sk_buff *skb)
 {
         sock_put(skb->sk);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index e1c85db5216f..95b6139d710c 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -24,6 +24,8 @@
 
 static int zero = 0;
 static int one = 1;
+static int min_sndbuf = SOCK_MIN_SNDBUF;
+static int min_rcvbuf = SOCK_MIN_RCVBUF;
 
 static int net_msg_warn;        /* Unused, but still a sysctl */
 
@@ -236,7 +238,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
         },
         {
                 .procname       = "rmem_max",
@@ -244,7 +246,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
         },
         {
                 .procname       = "wmem_default",
@@ -252,7 +254,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
         },
         {
                 .procname       = "rmem_default",
@@ -260,7 +262,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
         },
         {
                 .procname       = "dev_weight",
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 126a37a156cf..844808d9337b 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -269,6 +269,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
                 release_sock(sk);
                 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
                         timeo = schedule_timeout(timeo);
+                sched_annotate_sleep();
                 lock_sock(sk);
                 err = 0;
                 if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 34073bbe2700..f984b2001d0a 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -90,6 +90,20 @@ static void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk)
         }
 }
 
+static size_t inet_sk_attr_size(void)
+{
+        return    nla_total_size(sizeof(struct tcp_info))
+                + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+                + nla_total_size(1) /* INET_DIAG_TOS */
+                + nla_total_size(1) /* INET_DIAG_TCLASS */
+                + nla_total_size(sizeof(struct inet_diag_meminfo))
+                + nla_total_size(sizeof(struct inet_diag_msg))
+                + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+                + nla_total_size(TCP_CA_NAME_MAX)
+                + nla_total_size(sizeof(struct tcpvegas_info))
+                + 64;
+}
+
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                       struct sk_buff *skb, const struct inet_diag_req_v2 *req,
                       struct user_namespace *user_ns,
@@ -349,9 +363,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo,
         if (err)
                 goto out;
 
-        rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-                        sizeof(struct inet_diag_meminfo) +
-                        sizeof(struct tcp_info) + 64, GFP_KERNEL);
+        rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
         if (!rep) {
                 err = -ENOMEM;
                 goto out;
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 787b3c294ce6..d9bc28ac5d1b 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -67,6 +67,7 @@ static int ip_forward_finish(struct sk_buff *skb)
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
 
+        skb_sender_cpu_clear(skb);
         return dst_output(skb);
 }
 
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index d4c3a5e66380..7a5ae50c80c8 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -378,6 +378,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
  */
 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
 {
+        /* If credits accumulated at a higher w, apply them gently now. */
+        if (tp->snd_cwnd_cnt >= w) {
+                tp->snd_cwnd_cnt = 0;
+                tp->snd_cwnd++;
+        }
+
         tp->snd_cwnd_cnt += acked;
         if (tp->snd_cwnd_cnt >= w) {
                 u32 delta = tp->snd_cwnd_cnt / w;
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 4b276d1ed980..06d3d665a9fd 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -306,8 +306,10 @@ tcp_friendliness:
                 }
         }
 
-        if (ca->cnt == 0)                       /* cannot be zero */
-                ca->cnt = 1;
+        /* The maximum rate of cwnd increase CUBIC allows is 1 packet per
+         * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
+         */
+        ca->cnt = max(ca->cnt, 2U);
 }
 
 static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5a73ad5afaf7..c2f0f6065cb1 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2820,15 +2820,11 @@ void tcp_send_fin(struct sock *sk)
         } else {
                 /* Socket is locked, keep trying until memory is available. */
                 for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
-                                               sk->sk_allocation);
+                        skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
                         if (skb)
                                 break;
                         yield();
                 }
-
-                /* Reserve space for headers and prepare control bits. */
-                skb_reserve(skb, MAX_TCP_HEADER);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 tcp_init_nondata_skb(skb, tp->write_seq,
                                      TCPHDR_ACK | TCPHDR_FIN);
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index d5f6bd9a210a..dab73813cb92 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -63,6 +63,7 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
+        skb->protocol = htons(ETH_P_IP);
 
         return x->outer_mode->output2(x, skb);
 }
@@ -71,7 +72,6 @@ EXPORT_SYMBOL(xfrm4_prepare_output);
 int xfrm4_output_finish(struct sk_buff *skb)
 {
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        skb->protocol = htons(ETH_P_IP);
 
 #ifdef CONFIG_NETFILTER
         IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b4d5e1d97c1b..27ca79682efb 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                                 goto again;
                         flp6->saddr = saddr;
                 }
+                err = rt->dst.error;
                 goto out;
         }
 again:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0a04a37305d5..7e80b61b51ff 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 
 static inline int ip6_forward_finish(struct sk_buff *skb)
 {
+        skb_sender_cpu_clear(skb);
         return dst_output(skb);
 }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 88300d42fc95..41f84f76ad9d 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -308,7 +308,7 @@ out:
  *   Create tunnel matching given parameters.
  *
  * Return:
- *   created tunnel or NULL
+ *   created tunnel or error pointer
  **/
 
 static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
@@ -316,7 +316,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
         struct net_device *dev;
         struct ip6_tnl *t;
         char name[IFNAMSIZ];
-        int err;
+        int err = -ENOMEM;
 
         if (p->name[0])
                 strlcpy(name, p->name, IFNAMSIZ);
@@ -342,7 +342,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 failed_free:
         ip6_dev_free(dev);
 failed:
-        return NULL;
+        return ERR_PTR(err);
 }
 
 /**
@@ -356,7 +356,7 @@ failed:
  *   tunnel device is created and registered for use.
  *
  * Return:
- *   matching tunnel or NULL
+ *   matching tunnel or error pointer
  **/
 
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
@@ -374,13 +374,13 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr)) {
                         if (create)
-                                return NULL;
+                                return ERR_PTR(-EEXIST);
 
                         return t;
                 }
         }
         if (!create)
-                return NULL;
+                return ERR_PTR(-ENODEV);
         return ip6_tnl_create(net, p);
 }
 
@@ -1414,7 +1414,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         }
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                 t = netdev_priv(dev);
                 } else {
                         memset(&p, 0, sizeof(p));
@@ -1439,7 +1439,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 ip6_tnl_parm_from_user(&p1, &p);
                 t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
                 if (cmd == SIOCCHGTUNNEL) {
-                        if (t != NULL) {
+                        if (!IS_ERR(t)) {
                                 if (t->dev != dev) {
                                         err = -EEXIST;
                                         break;
@@ -1451,14 +1451,15 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         else
                                 err = ip6_tnl_update(t, &p1);
                 }
-                if (t) {
+                if (!IS_ERR(t)) {
                         err = 0;
                         ip6_tnl_parm_to_user(&p, &t->parms);
                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
                                 err = -EFAULT;
 
-                } else
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+                } else {
+                        err = PTR_ERR(t);
+                }
                 break;
         case SIOCDELTUNNEL:
                 err = -EPERM;
@@ -1472,7 +1473,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         err = -ENOENT;
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                 break;
                         err = -EPERM;
                         if (t->dev == ip6n->fb_tnl_dev)
@@ -1666,12 +1667,13 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
                            struct nlattr *tb[], struct nlattr *data[])
 {
         struct net *net = dev_net(dev);
-        struct ip6_tnl *nt;
+        struct ip6_tnl *nt, *t;
 
         nt = netdev_priv(dev);
         ip6_tnl_netlink_parms(data, &nt->parms);
 
-        if (ip6_tnl_locate(net, &nt->parms, 0))
+        t = ip6_tnl_locate(net, &nt->parms, 0);
+        if (!IS_ERR(t))
                 return -EEXIST;
 
         return ip6_tnl_create2(dev);
@@ -1691,8 +1693,7 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
         ip6_tnl_netlink_parms(data, &p);
 
         t = ip6_tnl_locate(net, &p, 0);
-
-        if (t) {
+        if (!IS_ERR(t)) {
                 if (t->dev != dev)
                         return -EEXIST;
         } else
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ab889bb16b3c..be2c0ba82c85 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                 fptr->nexthdr = nexthdr;
                 fptr->reserved = 0;
-                if (skb_shinfo(skb)->ip6_frag_id)
-                        fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-                else
-                        ipv6_select_ident(fptr,
-                                          (struct rt6_info *)skb_dst(skb));
+                if (!skb_shinfo(skb)->ip6_frag_id)
+                        ipv6_proxy_select_ident(skb);
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
                 /* Fragment the skb. ipv6 header and the remaining fields of the
                  * fragment header are updated in ipv6_gso_segment()
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index ca3f29b98ae5..010f8bd2d577 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -114,6 +114,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         skb->ignore_df = 1;
+        skb->protocol = htons(ETH_P_IPV6);
 
         return x->outer_mode->output2(x, skb);
 }
@@ -122,7 +123,6 @@ EXPORT_SYMBOL(xfrm6_prepare_output);
 int xfrm6_output_finish(struct sk_buff *skb)
 {
         memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-        skb->protocol = htons(ETH_P_IPV6);
 
 #ifdef CONFIG_NETFILTER
         IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8ddf2b545151..11dbcc1790d2 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -200,6 +200,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 #if IS_ENABLED(CONFIG_IPV6_MIP6)
                 case IPPROTO_MH:
+                        offset += ipv6_optlen(exthdr);
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3afe36824703..8d53d65bd2ab 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -58,13 +58,24 @@ struct ieee80211_local;
 #define IEEE80211_UNSET_POWER_LEVEL     INT_MIN
 
 /*
- * Some APs experience problems when working with U-APSD. Decrease the
- * probability of that happening by using legacy mode for all ACs but VO.
- * The AP that caused us trouble was a Cisco 4410N. It ignores our
- * setting, and always treats non-VO ACs as legacy.
+ * Some APs experience problems when working with U-APSD. Decreasing the
+ * probability of that happening by using legacy mode for all ACs but VO isn't
+ * enough.
+ *
+ * Cisco 4410N originally forced us to enable VO by default only because it
+ * treated non-VO ACs as legacy.
+ *
+ * However some APs (notably Netgear R7000) silently reclassify packets to
+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
+ * clients would never see some frames (e.g. ARP responses) or would fetch them
+ * accidentally after a long time.
+ *
+ * It makes little sense to enable u-APSD queues by default because it needs
+ * userspace applications to be aware of it to actually take advantage of the
+ * possible additional powersavings. Implicitly depending on driver autotrigger
+ * frame support doesn't make much sense.
  */
-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
-        IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
 
 #define IEEE80211_DEFAULT_MAX_SP_LEN            \
         IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
@@ -453,6 +464,7 @@ struct ieee80211_if_managed {
         unsigned int flags;
 
         bool csa_waiting_bcn;
+        bool csa_ignored_same_chan;
 
         bool beacon_crc_valid;
         u32 beacon_crc;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9f6f3562396a..a4b1dd332e0f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1150,6 +1150,17 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 return;
         }
 
+        if (cfg80211_chandef_identical(&csa_ie.chandef,
+                                       &sdata->vif.bss_conf.chandef)) {
+                if (ifmgd->csa_ignored_same_chan)
+                        return;
+                sdata_info(sdata,
+                           "AP %pM tries to chanswitch to same channel, ignore\n",
+                           ifmgd->associated->bssid);
+                ifmgd->csa_ignored_same_chan = true;
+                return;
+        }
+
         mutex_lock(&local->mtx);
         mutex_lock(&local->chanctx_mtx);
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
@@ -1210,6 +1221,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         sdata->vif.csa_active = true;
         sdata->csa_chandef = csa_ie.chandef;
         sdata->csa_block_tx = csa_ie.mode;
+        ifmgd->csa_ignored_same_chan = false;
 
         if (sdata->csa_block_tx)
                 ieee80211_stop_vif_queues(local, sdata,
@@ -2090,6 +2102,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         sdata->vif.csa_active = false;
         ifmgd->csa_waiting_bcn = false;
+        ifmgd->csa_ignored_same_chan = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3204,7 +3217,8 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
         (1ULL << WLAN_EID_HT_CAPABILITY) |
-        (1ULL << WLAN_EID_HT_OPERATION);
+        (1ULL << WLAN_EID_HT_OPERATION) |
+        (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
 
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt, size_t len,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1101563357ea..944bdc04e913 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2214,6 +2214,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         hdr = (struct ieee80211_hdr *) skb->data;
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
 
+        if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+                return RX_DROP_MONITOR;
+
         /* frame is in RMC, don't forward */
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8428f4a95479..747bdcf72e92 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3178,7 +3178,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                 wdev_iter = &sdata_iter->wdev;
 
                 if (sdata_iter == sdata ||
-                    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+                    !ieee80211_sdata_running(sdata_iter) ||
                     local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
                         continue;
 
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index a817705ce2d0..dba8d0864f18 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                         int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
+                             struct rds_iw_device **rds_iwdev,
+                             struct rdma_cm_id **cm_id)
 {
         struct rds_iw_device *iwdev;
         struct rds_iw_cm_id *i_cm_id;
@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                                 src_addr->sin_port,
                                 dst_addr->sin_addr.s_addr,
                                 dst_addr->sin_port,
-                                rs->rs_bound_addr,
-                                rs->rs_bound_port,
-                                rs->rs_conn_addr,
-                                rs->rs_conn_port);
+                                src->sin_addr.s_addr,
+                                src->sin_port,
+                                dst->sin_addr.s_addr,
+                                dst->sin_port);
 #ifdef WORKING_TUPLE_DETECTION
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-                            src_addr->sin_port == rs->rs_bound_port &&
-                            dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-                            dst_addr->sin_port == rs->rs_conn_port) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
+                            src_addr->sin_port == src->sin_port &&
+                            dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
+                            dst_addr->sin_port == dst->sin_port) {
 #else
                         /* FIXME - needs to compare the local and remote
                          * ipaddr/port tuple, but the ipaddr is the only
@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                          * zero'ed.  It doesn't appear to be properly populated
                          * during connection setup...
                          */
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
 #endif
                                 spin_unlock_irq(&iwdev->spinlock);
                                 *rds_iwdev = iwdev;
@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
 {
         struct sockaddr_in *src_addr, *dst_addr;
         struct rds_iw_device *rds_iwdev_old;
-        struct rds_sock rs;
         struct rdma_cm_id *pcm_id;
         int rc;
 
         src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
         dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
 
-        rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-        rs.rs_bound_port = src_addr->sin_port;
-        rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-        rs.rs_conn_port = dst_addr->sin_port;
-
-        rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
+        rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
         if (rc)
                 rds_iw_remove_cm_id(rds_iwdev, cm_id);
 
@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
         struct rds_iw_device *rds_iwdev;
         struct rds_iw_mr *ibmr = NULL;
         struct rdma_cm_id *cm_id;
+        struct sockaddr_in src = {
+                .sin_addr.s_addr = rs->rs_bound_addr,
+                .sin_port = rs->rs_bound_port,
+        };
+        struct sockaddr_in dst = {
+                .sin_addr.s_addr = rs->rs_conn_addr,
+                .sin_port = rs->rs_conn_port,
+        };
         int ret;
 
-        ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
+        ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
         if (ret || !cm_id) {
                 ret = -ENODEV;
                 goto out;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index a4f883e2d66f..b92beded7459 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 if (!skb) {
                         /* nothing remains on the queue */
                         if (copied &&
-                            (msg->msg_flags & MSG_PEEK || timeo == 0))
+                            (flags & MSG_PEEK || timeo == 0))
                                 goto out;
 
                         /* wait for a message to turn up */
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 82c5d7fc1988..5f6288fa3f12 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -25,21 +25,41 @@ static int tcf_bpf(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
         struct tcf_bpf *b = a->priv;
-        int action;
-        int filter_res;
+        int action, filter_res;
 
         spin_lock(&b->tcf_lock);
+
         b->tcf_tm.lastuse = jiffies;
         bstats_update(&b->tcf_bstats, skb);
-        action = b->tcf_action;
 
         filter_res = BPF_PROG_RUN(b->filter, skb);
-        if (filter_res == 0) {
-                /* Return code 0 from the BPF program
-                 * is being interpreted as a drop here.
-                 */
-                action = TC_ACT_SHOT;
+
+        /* A BPF program may overwrite the default action opcode.
+         * Similarly as in cls_bpf, if filter_res == -1 we use the
+         * default action specified from tc.
+         *
+         * In case a different well-known TC_ACT opcode has been
+         * returned, it will overwrite the default one.
+         *
+         * For everything else that is unkown, TC_ACT_UNSPEC is
+         * returned.
+         */
+        switch (filter_res) {
+        case TC_ACT_PIPE:
+        case TC_ACT_RECLASSIFY:
+        case TC_ACT_OK:
+                action = filter_res;
+                break;
+        case TC_ACT_SHOT:
+                action = filter_res;
                 b->tcf_qstats.drops++;
+                break;
+        case TC_ACT_UNSPEC:
+                action = b->tcf_action;
+                break;
+        default:
+                action = TC_ACT_UNSPEC;
+                break;
         }
 
         spin_unlock(&b->tcf_lock);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 375e51b71c80..cab9e9b43967 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -78,8 +78,11 @@ struct tc_u_hnode {
         struct tc_u_common      *tp_c;
         int                     refcnt;
         unsigned int            divisor;
-        struct tc_u_knode __rcu *ht[1];
         struct rcu_head         rcu;
+        /* The 'ht' field MUST be the last field in structure to allow for
+         * more entries allocated at end of structure.
+         */
+        struct tc_u_knode __rcu *ht[1];
 };
 
 struct tc_u_common {
diff --git a/net/socket.c b/net/socket.c
index 95d3085cb477..3e776776f42c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1650,6 +1650,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 
         if (len > INT_MAX)
                 len = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
@@ -1708,6 +1710,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 
         if (size > INT_MAX)
                 size = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 864b782c0202..d6ba4a6bbff6 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4400,6 +4400,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
                 return -EINVAL;
 
+        /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
+         * as userspace might just pass through the capabilities from the IEs
+         * directly, rather than enforcing this restriction and returning an
+         * error in this case.
+         */
+        if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
+                params.ht_capa = NULL;
+                params.vht_capa = NULL;
+        }
+
         /* When you run into this, adjust the code below for the new flag */
         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cee479bc655c..638af0655aaf 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2269,11 +2269,9 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                  * have the xfrm_state's. We need to wait for KM to
                  * negotiate new SA's or bail out with error.*/
                 if (net->xfrm.sysctl_larval_drop) {
-                        dst_release(dst);
-                        xfrm_pols_put(pols, drop_pols);
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
-
-                        return ERR_PTR(-EREMOTE);
+                        err = -EREMOTE;
+                        goto error;
                 }
 
                 err = -EAGAIN;
@@ -2324,7 +2322,8 @@ nopol:
 error:
         dst_release(dst);
 dropdst:
-        dst_release(dst_orig);
+        if (!(flags & XFRM_LOOKUP_KEEP_DST_REF))
+                dst_release(dst_orig);
         xfrm_pols_put(pols, drop_pols);
         return ERR_PTR(err);
 }
@@ -2338,7 +2337,8 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
                                     struct sock *sk, int flags)
 {
         struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk,
-                                            flags | XFRM_LOOKUP_QUEUE);
+                                            flags | XFRM_LOOKUP_QUEUE |
+                                            XFRM_LOOKUP_KEEP_DST_REF);
 
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);
diff --git a/sound/core/control.c b/sound/core/control.c
index 35324a8e83c8..eeb691d1911f 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1170,6 +1170,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
 
         if (info->count < 1)
                 return -EINVAL;
+        if (!*info->id.name)
+                return -EINVAL;
+        if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
+                return -EINVAL;
         access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
                 (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
                                  SNDRV_CTL_ELEM_ACCESS_INACTIVE|
diff --git a/sound/firewire/dice/dice-interface.h b/sound/firewire/dice/dice-interface.h
index de7602bd69b5..27b044f84c81 100644
--- a/sound/firewire/dice/dice-interface.h
+++ b/sound/firewire/dice/dice-interface.h
@@ -299,23 +299,23 @@
 #define RX_ISOCHRONOUS                  0x008
 
 /*
+ * Index of first quadlet to be interpreted; read/write.  If > 0, that many
+ * quadlets at the beginning of each data block will be ignored, and all the
+ * audio and MIDI quadlets will follow.
+ */
+#define RX_SEQ_START                    0x00c
+
+/*
  * The number of audio channels; read-only.  There will be one quadlet per
  * channel.
  */
-#define RX_NUMBER_AUDIO                 0x00c
+#define RX_NUMBER_AUDIO                 0x010
 
 /*
  * The number of MIDI ports, 0-8; read-only.  If > 0, there will be one
  * additional quadlet in each data block, following the audio quadlets.
  */
-#define RX_NUMBER_MIDI                  0x010
-
-/*
- * Index of first quadlet to be interpreted; read/write.  If > 0, that many
- * quadlets at the beginning of each data block will be ignored, and all the
- * audio and MIDI quadlets will follow.
- */
-#define RX_SEQ_START                    0x014
+#define RX_NUMBER_MIDI                  0x014
 
 /*
  * Names of all audio channels; read-only.  Quadlets are byte-swapped.  Names
diff --git a/sound/firewire/dice/dice-proc.c b/sound/firewire/dice/dice-proc.c
index ecfe20fd4de5..f5c1d1bced59 100644
--- a/sound/firewire/dice/dice-proc.c
+++ b/sound/firewire/dice/dice-proc.c
@@ -99,9 +99,9 @@ static void dice_proc_read(struct snd_info_entry *entry,
                 } tx;
                 struct {
                         u32 iso;
+                        u32 seq_start;
                         u32 number_audio;
                         u32 number_midi;
-                        u32 seq_start;
                         char names[RX_NAMES_SIZE];
                         u32 ac3_caps;
                         u32 ac3_enable;
@@ -204,10 +204,10 @@ static void dice_proc_read(struct snd_info_entry *entry,
                         break;
                 snd_iprintf(buffer, "rx %u:\n", stream);
                 snd_iprintf(buffer, "  iso channel: %d\n", (int)buf.rx.iso);
+                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 snd_iprintf(buffer, "  audio channels: %u\n",
                             buf.rx.number_audio);
                 snd_iprintf(buffer, "  midi ports: %u\n", buf.rx.number_midi);
-                snd_iprintf(buffer, "  sequence start: %u\n", buf.rx.seq_start);
                 if (quadlets >= 68) {
                         dice_proc_fixup_string(buf.rx.names, RX_NAMES_SIZE);
                         snd_iprintf(buffer, "  names: %s\n", buf.rx.names);
diff --git a/sound/firewire/iso-resources.c b/sound/firewire/iso-resources.c
index 5f17b77ee152..f0e4d502d604 100644
--- a/sound/firewire/iso-resources.c
+++ b/sound/firewire/iso-resources.c
@@ -26,7 +26,7 @@
 int fw_iso_resources_init(struct fw_iso_resources *r, struct fw_unit *unit)
 {
         r->channels_mask = ~0uLL;
-        r->unit = fw_unit_get(unit);
+        r->unit = unit;
         mutex_init(&r->mutex);
         r->allocated = false;
 
@@ -42,7 +42,6 @@ void fw_iso_resources_destroy(struct fw_iso_resources *r)
 {
         WARN_ON(r->allocated);
         mutex_destroy(&r->mutex);
-        fw_unit_put(r->unit);
 }
 EXPORT_SYMBOL(fw_iso_resources_destroy);
 
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index a2ce773bdc62..17c2637d842c 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -1164,7 +1164,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
                 }
         }
 
-        if (!bus->no_response_fallback)
+        if (bus->no_response_fallback)
                 return -1;
 
         if (!chip->polling_mode && chip->poll_count < 2) {
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index b680b4ec6331..8ec5289f8e05 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -687,12 +687,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
         return val;
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
+{
+        unsigned int wcaps = get_wcaps(codec, nid);
+        hda_nid_t conn;
+
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+        if (snd_hda_get_num_conns(codec, nid) != 1)
+                return false;
+        if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
+}
+
 /* initialize the amp value (only at the first time) */
 static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 {
         unsigned int caps = query_amp_caps(codec, nid, dir);
         int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-        snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+
+        if (is_stereo_amps(codec, nid, dir))
+                snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+        else
+                snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
+}
+
+/* update the amp, doing in stereo or mono depending on NID */
+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
+                      unsigned int mask, unsigned int val)
+{
+        if (is_stereo_amps(codec, nid, dir))
+                return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
+                                                mask, val);
+        else
+                return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
+                                                mask, val);
 }
 
 /* calculate amp value mask we can modify;
@@ -732,7 +765,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
                 return;
 
         val &= mask;
-        snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
+        update_amp(codec, nid, dir, idx, mask, val);
 }
 
 static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
@@ -4424,13 +4457,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
         has_amp = nid_has_mute(codec, mix, HDA_INPUT);
         for (i = 0; i < nums; i++) {
                 if (has_amp)
-                        snd_hda_codec_amp_stereo(codec, mix,
-                                                 HDA_INPUT, i,
-                                                 0xff, HDA_AMP_MUTE);
+                        update_amp(codec, mix, HDA_INPUT, i,
+                                   0xff, HDA_AMP_MUTE);
                 else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-                        snd_hda_codec_amp_stereo(codec, conn[i],
-                                                 HDA_OUTPUT, 0,
-                                                 0xff, HDA_AMP_MUTE);
+                        update_amp(codec, conn[i], HDA_OUTPUT, 0,
+                                   0xff, HDA_AMP_MUTE);
         }
 }
 
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index ce5a6da83419..05e19f78b4cb 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
                     (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
 }
 
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
+                           int dir, unsigned int wcaps, int indices)
+{
+        hda_nid_t conn;
+
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        /* check for a stereo-to-mono mix; it must be:
+         * only a single connection, only for input, and only a mixer widget
+         */
+        if (indices != 1 || dir != HDA_INPUT ||
+            get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+
+        if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        /* the connection source is a stereo? */
+        wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
+        return !!(wcaps & AC_WCAP_STEREO);
+}
+
 static void print_amp_vals(struct snd_info_buffer *buffer,
                            struct hda_codec *codec, hda_nid_t nid,
-                           int dir, int stereo, int indices)
+                           int dir, unsigned int wcaps, int indices)
 {
         unsigned int val;
+        bool stereo;
         int i;
 
+        stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
+
         dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
         for (i = 0; i < indices; i++) {
                 snd_iprintf(buffer, " [");
@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                             (codec->single_adc_amp &&
                              wid_type == AC_WID_AUD_IN))
                                 print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
-                                               1);
+                                               wid_caps, 1);
                         else
                                 print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
-                                               conn_len);
+                                               wid_caps, conn_len);
                 }
                 if (wid_caps & AC_WCAP_OUT_AMP) {
                         snd_iprintf(buffer, "  Amp-Out caps: ");
@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                         if (wid_type == AC_WID_PIN &&
                             codec->pin_amp_workaround)
                                 print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO,
-                                               conn_len);
+                                               wid_caps, conn_len);
                         else
                                 print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO, 1);
+                                               wid_caps, 1);
                 }
 
                 switch (wid_type) {
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 1589c9bcce3e..dd2b3d92071f 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
         SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
         SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+        SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
         SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
         SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
         {} /* terminator */
@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec *codec)
                 return -ENOMEM;
 
         spec->gen.automute_hook = cs_automute;
+        codec->single_adc_amp = 1;
 
         snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
                            cs420x_fixups);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index fd3ed18670e9..da67ea8645a6 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -223,6 +223,7 @@ enum {
         CXT_PINCFG_LENOVO_TP410,
         CXT_PINCFG_LEMOTE_A1004,
         CXT_PINCFG_LEMOTE_A1205,
+        CXT_PINCFG_COMPAQ_CQ60,
         CXT_FIXUP_STEREO_DMIC,
         CXT_FIXUP_INC_MIC_BOOST,
         CXT_FIXUP_HEADPHONE_MIC_PIN,
@@ -660,6 +661,15 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = cxt_pincfg_lemote,
         },
+        [CXT_PINCFG_COMPAQ_CQ60] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        /* 0x17 was falsely set up as a mic, it should 0x1d */
+                        { 0x17, 0x400001f0 },
+                        { 0x1d, 0x97a70120 },
+                        { }
+                }
+        },
         [CXT_FIXUP_STEREO_DMIC] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_stereo_dmic,
@@ -769,6 +779,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = {
 };
 
 static const struct snd_pci_quirk cxt5051_fixups[] = {
+        SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
         {}
 };
diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
index b67480f1b1aa..4373ada95648 100644
--- a/sound/soc/codecs/adav80x.c
+++ b/sound/soc/codecs/adav80x.c
@@ -317,7 +317,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
-        unsigned int deemph = ucontrol->value.enumerated.item[0];
+        unsigned int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
@@ -333,7 +333,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = adav80x->deemph;
+        ucontrol->value.integer.value[0] = adav80x->deemph;
         return 0;
 };
 
diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
index 70861c7b1631..81b54a270bd8 100644
--- a/sound/soc/codecs/ak4641.c
+++ b/sound/soc/codecs/ak4641.c
@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = ak4641->deemph;
+        ucontrol->value.integer.value[0] = ak4641->deemph;
         return 0;
 };
 
diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
index 632e89f793a7..2a58b1dccd2f 100644
--- a/sound/soc/codecs/ak4671.c
+++ b/sound/soc/codecs/ak4671.c
@@ -343,25 +343,25 @@ static const struct snd_soc_dapm_widget ak4671_dapm_widgets[] = {
 };
 
 static const struct snd_soc_dapm_route ak4671_intercon[] = {
-        {"DAC Left", "NULL", "PMPLL"},
-        {"DAC Right", "NULL", "PMPLL"},
-        {"ADC Left", "NULL", "PMPLL"},
-        {"ADC Right", "NULL", "PMPLL"},
+        {"DAC Left", NULL, "PMPLL"},
+        {"DAC Right", NULL, "PMPLL"},
+        {"ADC Left", NULL, "PMPLL"},
+        {"ADC Right", NULL, "PMPLL"},
 
         /* Outputs */
-        {"LOUT1", "NULL", "LOUT1 Mixer"},
-        {"ROUT1", "NULL", "ROUT1 Mixer"},
-        {"LOUT2", "NULL", "LOUT2 Mix Amp"},
-        {"ROUT2", "NULL", "ROUT2 Mix Amp"},
-        {"LOUT3", "NULL", "LOUT3 Mixer"},
-        {"ROUT3", "NULL", "ROUT3 Mixer"},
+        {"LOUT1", NULL, "LOUT1 Mixer"},
+        {"ROUT1", NULL, "ROUT1 Mixer"},
+        {"LOUT2", NULL, "LOUT2 Mix Amp"},
+        {"ROUT2", NULL, "ROUT2 Mix Amp"},
+        {"LOUT3", NULL, "LOUT3 Mixer"},
+        {"ROUT3", NULL, "ROUT3 Mixer"},
 
         {"LOUT1 Mixer", "DACL", "DAC Left"},
         {"ROUT1 Mixer", "DACR", "DAC Right"},
         {"LOUT2 Mixer", "DACHL", "DAC Left"},
         {"ROUT2 Mixer", "DACHR", "DAC Right"},
-        {"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
-        {"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
+        {"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
+        {"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
         {"LOUT3 Mixer", "DACSL", "DAC Left"},
         {"ROUT3 Mixer", "DACSR", "DAC Right"},
 
@@ -381,18 +381,18 @@ static const struct snd_soc_dapm_route ak4671_intercon[] = {
         {"LIN2", NULL, "Mic Bias"},
         {"RIN2", NULL, "Mic Bias"},
 
-        {"ADC Left", "NULL", "LIN MUX"},
-        {"ADC Right", "NULL", "RIN MUX"},
+        {"ADC Left", NULL, "LIN MUX"},
+        {"ADC Right", NULL, "RIN MUX"},
 
         /* Analog Loops */
-        {"LIN1 Mixing Circuit", "NULL", "LIN1"},
-        {"RIN1 Mixing Circuit", "NULL", "RIN1"},
-        {"LIN2 Mixing Circuit", "NULL", "LIN2"},
-        {"RIN2 Mixing Circuit", "NULL", "RIN2"},
-        {"LIN3 Mixing Circuit", "NULL", "LIN3"},
-        {"RIN3 Mixing Circuit", "NULL", "RIN3"},
-        {"LIN4 Mixing Circuit", "NULL", "LIN4"},
-        {"RIN4 Mixing Circuit", "NULL", "RIN4"},
+        {"LIN1 Mixing Circuit", NULL, "LIN1"},
+        {"RIN1 Mixing Circuit", NULL, "RIN1"},
+        {"LIN2 Mixing Circuit", NULL, "LIN2"},
+        {"RIN2 Mixing Circuit", NULL, "RIN2"},
+        {"LIN3 Mixing Circuit", NULL, "LIN3"},
+        {"RIN3 Mixing Circuit", NULL, "RIN3"},
+        {"LIN4 Mixing Circuit", NULL, "LIN4"},
+        {"RIN4 Mixing Circuit", NULL, "RIN4"},
 
         {"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
         {"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 79a4efcb894c..7d3a6accaf9a 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -286,7 +286,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = cs4271->deemph;
+        ucontrol->value.integer.value[0] = cs4271->deemph;
         return 0;
 }
 
@@ -296,7 +296,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
-        cs4271->deemph = ucontrol->value.enumerated.item[0];
+        cs4271->deemph = ucontrol->value.integer.value[0];
         return cs4271_set_deemph(codec);
 }
 
diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
index ffe96175a8a5..911c26c705fc 100644
--- a/sound/soc/codecs/da732x.c
+++ b/sound/soc/codecs/da732x.c
@@ -876,11 +876,11 @@ static const struct snd_soc_dapm_widget da732x_dapm_widgets[] = {
 
 static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
         /* Inputs */
-        {"AUX1L PGA", "NULL", "AUX1L"},
-        {"AUX1R PGA", "NULL", "AUX1R"},
+        {"AUX1L PGA", NULL, "AUX1L"},
+        {"AUX1R PGA", NULL, "AUX1R"},
         {"MIC1 PGA", NULL, "MIC1"},
-        {"MIC2 PGA", "NULL", "MIC2"},
-        {"MIC3 PGA", "NULL", "MIC3"},
+        {"MIC2 PGA", NULL, "MIC2"},
+        {"MIC3 PGA", NULL, "MIC3"},
 
         /* Capture Path */
         {"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index f27325155ace..c5f35a07e8e4 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -120,7 +120,7 @@ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = es8328->deemph;
+        ucontrol->value.integer.value[0] = es8328->deemph;
         return 0;
 }
 
@@ -129,7 +129,7 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
         int ret;
 
         if (deemph > 1)
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index a722a023c262..477e13d30971 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = priv->deemph;
+        ucontrol->value.integer.value[0] = priv->deemph;
 
         return 0;
 }
@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        priv->deemph = ucontrol->value.enumerated.item[0];
+        priv->deemph = ucontrol->value.integer.value[0];
 
         return pcm1681_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index f374840a5a7c..9b541e52da8c 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1198,7 +1198,7 @@ static struct dmi_system_id dmi_dell_dino[] = {
                 .ident = "Dell Dino",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_BOARD_NAME, "0144P8")
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343")
                 }
         },
         { }
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index e182e6569bbd..3593a1496056 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1151,13 +1151,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
                 /* Enable VDDC charge pump */
                 ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
         } else if (vddio >= 3100 && vdda >= 3100) {
-                /*
-                 * if vddio and vddd > 3.1v,
-                 * charge pump should be clean before set ana_pwr
-                 */
-                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
-                                SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
-
+                ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
                 /* VDDC use VDDIO rail */
                 lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
                 lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
index 47b257e41809..82095d6cd070 100644
--- a/sound/soc/codecs/sn95031.c
+++ b/sound/soc/codecs/sn95031.c
@@ -538,8 +538,8 @@ static const struct snd_soc_dapm_route sn95031_audio_map[] = {
         /* speaker map */
         { "IHFOUTL", NULL, "Speaker Rail"},
         { "IHFOUTR", NULL, "Speaker Rail"},
-        { "IHFOUTL", "NULL", "Speaker Left Playback"},
-        { "IHFOUTR", "NULL", "Speaker Right Playback"},
+        { "IHFOUTL", NULL, "Speaker Left Playback"},
+        { "IHFOUTR", NULL, "Speaker Right Playback"},
         { "Speaker Left Playback", NULL, "Speaker Left Filter"},
         { "Speaker Right Playback", NULL, "Speaker Right Filter"},
         { "Speaker Left Filter", NULL, "IHFDAC Left"},
diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
index 249ef5c4c762..32942bed34b1 100644
--- a/sound/soc/codecs/tas5086.c
+++ b/sound/soc/codecs/tas5086.c
@@ -281,7 +281,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = priv->deemph;
+        ucontrol->value.integer.value[0] = priv->deemph;
 
         return 0;
 }
@@ -292,7 +292,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
 
-        priv->deemph = ucontrol->value.enumerated.item[0];
+        priv->deemph = ucontrol->value.integer.value[0];
 
         return tas5086_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index 8d9de49a5052..21d5402e343f 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
 
-        ucontrol->value.enumerated.item[0] = wm2000->anc_active;
+        ucontrol->value.integer.value[0] = wm2000->anc_active;
 
         return 0;
 }
@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        int anc_active = ucontrol->value.enumerated.item[0];
+        int anc_active = ucontrol->value.integer.value[0];
         int ret;
 
         if (anc_active > 1)
@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
 
-        ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
+        ucontrol->value.integer.value[0] = wm2000->spk_ena;
 
         return 0;
 }
@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        int val = ucontrol->value.enumerated.item[0];
+        int val = ucontrol->value.integer.value[0];
         int ret;
 
         if (val > 1)
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index 098c143f44d6..c6d10533e2bd 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -125,7 +125,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8731->deemph;
+        ucontrol->value.integer.value[0] = wm8731->deemph;
 
         return 0;
 }
@@ -135,7 +135,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
         int ret = 0;
 
         if (deemph > 1)
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index dde462c082be..04b04f8e147c 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8903->deemph;
+        ucontrol->value.integer.value[0] = wm8903->deemph;
 
         return 0;
 }
@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
         int ret = 0;
 
         if (deemph > 1)
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index d3b3f57668cc..215e93c1ddf0 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -525,7 +525,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8904->deemph;
+        ucontrol->value.integer.value[0] = wm8904->deemph;
         return 0;
 }
 
@@ -534,7 +534,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
index 1ab2d462afad..00bec915d652 100644
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8955->deemph;
+        ucontrol->value.integer.value[0] = wm8955->deemph;
         return 0;
 }
 
@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index cf8fecf97f2c..3035d9856415 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -184,7 +184,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
 
-        ucontrol->value.enumerated.item[0] = wm8960->deemph;
+        ucontrol->value.integer.value[0] = wm8960->deemph;
         return 0;
 }
 
@@ -193,7 +193,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
         struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
 
         if (deemph > 1)
                 return -EINVAL;
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index 9517571e820d..98c9525bd751 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -180,7 +180,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
         struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
         struct wm9712_priv *wm9712 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val = ucontrol->value.enumerated.item[0];
+        unsigned int val = ucontrol->value.integer.value[0];
         struct soc_mixer_control *mc =
                 (struct soc_mixer_control *)kcontrol->private_value;
         unsigned int mixer, mask, shift, old;
@@ -193,7 +193,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
 
         mutex_lock(&wm9712->lock);
         old = wm9712->hp_mixer[mixer];
-        if (ucontrol->value.enumerated.item[0])
+        if (ucontrol->value.integer.value[0])
                 wm9712->hp_mixer[mixer] |= mask;
         else
                 wm9712->hp_mixer[mixer] &= ~mask;
@@ -231,7 +231,7 @@ static int wm9712_hp_mixer_get(struct snd_kcontrol *kcontrol,
         mixer = mc->shift >> 8;
         shift = mc->shift & 0xff;
 
-        ucontrol->value.enumerated.item[0] =
+        ucontrol->value.integer.value[0] =
                 (wm9712->hp_mixer[mixer] >> shift) & 1;
 
         return 0;
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index 68222917b396..79552953e1bd 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -255,7 +255,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
         struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
         struct wm9713_priv *wm9713 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val = ucontrol->value.enumerated.item[0];
+        unsigned int val = ucontrol->value.integer.value[0];
         struct soc_mixer_control *mc =
                 (struct soc_mixer_control *)kcontrol->private_value;
         unsigned int mixer, mask, shift, old;
@@ -268,7 +268,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
 
         mutex_lock(&wm9713->lock);
         old = wm9713->hp_mixer[mixer];
-        if (ucontrol->value.enumerated.item[0])
+        if (ucontrol->value.integer.value[0])
                 wm9713->hp_mixer[mixer] |= mask;
         else
                 wm9713->hp_mixer[mixer] &= ~mask;
@@ -306,7 +306,7 @@ static int wm9713_hp_mixer_get(struct snd_kcontrol *kcontrol,
         mixer = mc->shift >> 8;
         shift = mc->shift & 0xff;
 
-        ucontrol->value.enumerated.item[0] =
+        ucontrol->value.integer.value[0] =
                 (wm9713->hp_mixer[mixer] >> shift) & 1;
 
         return 0;
diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
index 75870c0ea2c9..91eb3aef7f02 100644
--- a/sound/soc/fsl/fsl_spdif.c
+++ b/sound/soc/fsl/fsl_spdif.c
@@ -1049,7 +1049,7 @@ static u32 fsl_spdif_txclk_caldiv(struct fsl_spdif_priv *spdif_priv,
                                 enum spdif_txrate index, bool round)
 {
         const u32 rate[] = { 32000, 44100, 48000, 96000, 192000 };
-        bool is_sysclk = clk == spdif_priv->sysclk;
+        bool is_sysclk = clk_is_match(clk, spdif_priv->sysclk);
         u64 rate_ideal, rate_actual, sub;
         u32 sysclk_dfmin, sysclk_dfmax;
         u32 txclk_df, sysclk_df, arate;
@@ -1143,7 +1143,7 @@ static int fsl_spdif_probe_txclk(struct fsl_spdif_priv *spdif_priv,
                         spdif_priv->txclk_src[index], rate[index]);
         dev_dbg(&pdev->dev, "use txclk df %d for %dHz sample rate\n",
                         spdif_priv->txclk_df[index], rate[index]);
-        if (spdif_priv->txclk[index] == spdif_priv->sysclk)
+        if (clk_is_match(spdif_priv->txclk[index], spdif_priv->sysclk))
                 dev_dbg(&pdev->dev, "use sysclk df %d for %dHz sample rate\n",
                                 spdif_priv->sysclk_df[index], rate[index]);
         dev_dbg(&pdev->dev, "the best rate for %dHz sample rate is %dHz\n",
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index b9fabbf69db6..6b0c8f717ec2 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -603,7 +603,7 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
         factor = (div2 + 1) * (7 * psr + 1) * 2;
 
         for (i = 0; i < 255; i++) {
-                tmprate = freq * factor * (i + 2);
+                tmprate = freq * factor * (i + 1);
 
                 if (baudclk_is_used)
                         clkrate = clk_get_rate(ssi_private->baudclk);
@@ -1227,7 +1227,7 @@ static int fsl_ssi_imx_probe(struct platform_device *pdev,
         ssi_private->dma_params_tx.addr = ssi_private->ssi_phys + CCSR_SSI_STX0;
         ssi_private->dma_params_rx.addr = ssi_private->ssi_phys + CCSR_SSI_SRX0;
 
-        ret = !of_property_read_u32_array(np, "dmas", dmas, 4);
+        ret = of_property_read_u32_array(np, "dmas", dmas, 4);
         if (ssi_private->use_dma && !ret && dmas[2] == IMX_DMATYPE_SSI_DUAL) {
                 ssi_private->use_dual_fifo = true;
                 /* When using dual fifo mode, we need to keep watermark
diff --git a/sound/soc/intel/sst-haswell-dsp.c b/sound/soc/intel/sst-haswell-dsp.c
index c42ffae5fe9f..402b728c0a06 100644
--- a/sound/soc/intel/sst-haswell-dsp.c
+++ b/sound/soc/intel/sst-haswell-dsp.c
@@ -207,9 +207,6 @@ static int hsw_parse_fw_image(struct sst_fw *sst_fw)
                 module = (void *)module + sizeof(*module) + module->mod_size;
         }
 
-        /* allocate scratch mem regions */
-        sst_block_alloc_scratch(dsp);
-
         return 0;
 }
 
diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c
index 394af5684c05..863a9ca34b8e 100644
--- a/sound/soc/intel/sst-haswell-ipc.c
+++ b/sound/soc/intel/sst-haswell-ipc.c
@@ -1732,6 +1732,7 @@ static void sst_hsw_drop_all(struct sst_hsw *hsw)
 int sst_hsw_dsp_load(struct sst_hsw *hsw)
 {
         struct sst_dsp *dsp = hsw->dsp;
+        struct sst_fw *sst_fw, *t;
         int ret;
 
         dev_dbg(hsw->dev, "loading audio DSP....");
@@ -1748,12 +1749,17 @@ int sst_hsw_dsp_load(struct sst_hsw *hsw)
                 return ret;
         }
 
-        ret = sst_fw_reload(hsw->sst_fw);
-        if (ret < 0) {
-                dev_err(hsw->dev, "error: SST FW reload failed\n");
-                sst_dsp_dma_put_channel(dsp);
-                return -ENOMEM;
+        list_for_each_entry_safe_reverse(sst_fw, t, &dsp->fw_list, list) {
+                ret = sst_fw_reload(sst_fw);
+                if (ret < 0) {
+                        dev_err(hsw->dev, "error: SST FW reload failed\n");
+                        sst_dsp_dma_put_channel(dsp);
+                        return -ENOMEM;
+                }
         }
+        ret = sst_block_alloc_scratch(hsw->dsp);
+        if (ret < 0)
+                return -EINVAL;
 
         sst_dsp_dma_put_channel(dsp);
         return 0;
@@ -1809,12 +1815,17 @@ int sst_hsw_dsp_runtime_suspend(struct sst_hsw *hsw)
 
 int sst_hsw_dsp_runtime_sleep(struct sst_hsw *hsw)
 {
-        sst_fw_unload(hsw->sst_fw);
-        sst_block_free_scratch(hsw->dsp);
+        struct sst_fw *sst_fw, *t;
+        struct sst_dsp *dsp = hsw->dsp;
+
+        list_for_each_entry_safe(sst_fw, t, &dsp->fw_list, list) {
+                sst_fw_unload(sst_fw);
+        }
+        sst_block_free_scratch(dsp);
 
         hsw->boot_complete = false;
 
-        sst_dsp_sleep(hsw->dsp);
+        sst_dsp_sleep(dsp);
 
         return 0;
 }
@@ -1943,6 +1954,11 @@ int sst_hsw_dsp_init(struct device *dev, struct sst_pdata *pdata)
                 goto fw_err;
         }
 
+        /* allocate scratch mem regions */
+        ret = sst_block_alloc_scratch(hsw->dsp);
+        if (ret < 0)
+                goto boot_err;
+
         /* wait for DSP boot completion */
         sst_dsp_boot(hsw->dsp);
         ret = wait_event_timeout(hsw->boot_wait, hsw->boot_complete,
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index def7d8260c4e..d19483081f9b 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -579,7 +579,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
                 if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
                         return -EPROBE_DEFER;
         } else {
-                if (priv->extclk == priv->clk) {
+                if (clk_is_match(priv->extclk, priv->clk)) {
                         devm_clk_put(&pdev->dev, priv->extclk);
                         priv->extclk = ERR_PTR(-EINVAL);
                 } else {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 30579ca5bacb..e5c990889dcc 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -347,6 +347,8 @@ static ssize_t codec_list_read_file(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&client_mutex);
+
         list_for_each_entry(codec, &codec_list, list) {
                 len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
                                codec->component.name);
@@ -358,6 +360,8 @@ static ssize_t codec_list_read_file(struct file *file, char __user *user_buf,
                 }
         }
 
+        mutex_unlock(&client_mutex);
+
         if (ret >= 0)
                 ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
@@ -382,6 +386,8 @@ static ssize_t dai_list_read_file(struct file *file, char __user *user_buf,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&client_mutex);
+
         list_for_each_entry(component, &component_list, list) {
                 list_for_each_entry(dai, &component->dai_list, list) {
                         len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
@@ -395,6 +401,8 @@ static ssize_t dai_list_read_file(struct file *file, char __user *user_buf,
                 }
         }
 
+        mutex_unlock(&client_mutex);
+
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
         kfree(buf);
@@ -418,6 +426,8 @@ static ssize_t platform_list_read_file(struct file *file,
         if (!buf)
                 return -ENOMEM;
 
+        mutex_lock(&client_mutex);
+
         list_for_each_entry(platform, &platform_list, list) {
                 len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
                                platform->component.name);
@@ -429,6 +439,8 @@ static ssize_t platform_list_read_file(struct file *file,
                 }
         }
 
+        mutex_unlock(&client_mutex);
+
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
 
         kfree(buf);
@@ -836,6 +848,8 @@ static struct snd_soc_component *soc_find_component(
 {
         struct snd_soc_component *component;
 
+        lockdep_assert_held(&client_mutex);
+
         list_for_each_entry(component, &component_list, list) {
                 if (of_node) {
                         if (component->dev->of_node == of_node)
@@ -854,6 +868,8 @@ static struct snd_soc_dai *snd_soc_find_dai(
         struct snd_soc_component *component;
         struct snd_soc_dai *dai;
 
+        lockdep_assert_held(&client_mutex);
+
         /* Find CPU DAI from registered DAIs*/
         list_for_each_entry(component, &component_list, list) {
                 if (dlc->of_node && component->dev->of_node != dlc->of_node)
@@ -1508,6 +1524,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
         struct snd_soc_codec *codec;
         int ret, i, order;
 
+        mutex_lock(&client_mutex);
         mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_INIT);
 
         /* bind DAIs */
@@ -1662,6 +1679,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
         card->instantiated = 1;
         snd_soc_dapm_sync(&card->dapm);
         mutex_unlock(&card->mutex);
+        mutex_unlock(&client_mutex);
 
         return 0;
 
@@ -1680,6 +1698,7 @@ card_probe_error:
 
 base_error:
         mutex_unlock(&card->mutex);
+        mutex_unlock(&client_mutex);
 
         return ret;
 }
@@ -2713,13 +2732,6 @@ static void snd_soc_component_del_unlocked(struct snd_soc_component *component)
         list_del(&component->list);
 }
 
-static void snd_soc_component_del(struct snd_soc_component *component)
-{
-        mutex_lock(&client_mutex);
-        snd_soc_component_del_unlocked(component);
-        mutex_unlock(&client_mutex);
-}
-
 int snd_soc_register_component(struct device *dev,
                                const struct snd_soc_component_driver *cmpnt_drv,
                                struct snd_soc_dai_driver *dai_drv,
@@ -2767,14 +2779,17 @@ void snd_soc_unregister_component(struct device *dev)
 {
         struct snd_soc_component *cmpnt;
 
+        mutex_lock(&client_mutex);
         list_for_each_entry(cmpnt, &component_list, list) {
                 if (dev == cmpnt->dev && cmpnt->registered_as_component)
                         goto found;
         }
+        mutex_unlock(&client_mutex);
         return;
 
 found:
-        snd_soc_component_del(cmpnt);
+        snd_soc_component_del_unlocked(cmpnt);
+        mutex_unlock(&client_mutex);
         snd_soc_component_cleanup(cmpnt);
         kfree(cmpnt);
 }
@@ -2882,10 +2897,14 @@ struct snd_soc_platform *snd_soc_lookup_platform(struct device *dev)
 {
         struct snd_soc_platform *platform;
 
+        mutex_lock(&client_mutex);
         list_for_each_entry(platform, &platform_list, list) {
-                if (dev == platform->dev)
+                if (dev == platform->dev) {
+                        mutex_unlock(&client_mutex);
                         return platform;
+                }
         }
+        mutex_unlock(&client_mutex);
 
         return NULL;
 }
@@ -3090,15 +3109,15 @@ void snd_soc_unregister_codec(struct device *dev)
 {
         struct snd_soc_codec *codec;
 
+        mutex_lock(&client_mutex);
         list_for_each_entry(codec, &codec_list, list) {
                 if (dev == codec->dev)
                         goto found;
         }
+        mutex_unlock(&client_mutex);
         return;
 
 found:
-
-        mutex_lock(&client_mutex);
         list_del(&codec->list);
         snd_soc_component_del_unlocked(&codec->component);
         mutex_unlock(&client_mutex);
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 67d476548dcf..07f984d5f516 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                 }
         }
 },
+{
+        USB_DEVICE(0x0582, 0x0159),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                /* .vendor_name = "Roland", */
+                /* .product_name = "UA-22", */
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = & (const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 /* this catches most recent vendor-specific Roland devices */
 {
         .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 61bf9128e1f2..9d9db3b296dd 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -30,6 +30,8 @@ static int disasm_line__parse(char *line, char **namep, char **rawp);
 
 static void ins__delete(struct ins_operands *ops)
 {
+        if (ops == NULL)
+                return;
         zfree(&ops->source.raw);
         zfree(&ops->source.name);
         zfree(&ops->target.raw);
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 3ed7c0476d48..2e2ba2efa0d9 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -209,7 +209,7 @@ $(OUTPUT)%.o: %.c
 
 $(OUTPUT)cpupower: $(UTIL_OBJS) $(OUTPUT)libcpupower.so.$(LIB_MAJ)
         $(ECHO) "  CC      " $@
-        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -Wl,-rpath=./ -lrt -lpci -L$(OUTPUT) -o $@
+        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -lrt -lpci -L$(OUTPUT) -o $@
         $(QUIET) $(STRIPCMD) $@
 
 $(OUTPUT)po/$(PACKAGE).pot: $(UTIL_SRC)
diff --git a/tools/testing/selftests/exec/execveat.c b/tools/testing/selftests/exec/execveat.c
index e238c9559caf..8d5d1d2ee7c1 100644
--- a/tools/testing/selftests/exec/execveat.c
+++ b/tools/testing/selftests/exec/execveat.c
@@ -30,7 +30,7 @@ static int execveat_(int fd, const char *path, char **argv, char **envp,
 #ifdef __NR_execveat
         return syscall(__NR_execveat, fd, path, argv, envp, flags);
 #else
-        errno = -ENOSYS;
+        errno = ENOSYS;
         return -1;
 #endif
 }
@@ -234,6 +234,14 @@ static int run_tests(void)
         int fd_cloexec = open_or_die("execveat", O_RDONLY|O_CLOEXEC);
         int fd_script_cloexec = open_or_die("script", O_RDONLY|O_CLOEXEC);
 
+        /* Check if we have execveat at all, and bail early if not */
+        errno = 0;
+        execveat_(-1, NULL, NULL, NULL, 0);
+        if (errno == ENOSYS) {
+                printf("[FAIL] ENOSYS calling execveat - no kernel support?\n");
+                return 1;
+        }
+
         /* Change file position to confirm it doesn't affect anything */
         lseek(fd, 10, SEEK_SET);
 
diff --git a/virt/kvm/arm/vgic-v2.c b/virt/kvm/arm/vgic-v2.c
index a0a7b5d1a070..f9b9c7c51372 100644
--- a/virt/kvm/arm/vgic-v2.c
+++ b/virt/kvm/arm/vgic-v2.c
@@ -72,6 +72,8 @@ static void vgic_v2_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
 {
         if (!(lr_desc.state & LR_STATE_MASK))
                 vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr |= (1ULL << lr);
+        else
+                vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr &= ~(1ULL << lr);
 }
 
 static u64 vgic_v2_get_elrsr(const struct kvm_vcpu *vcpu)
@@ -84,6 +86,11 @@ static u64 vgic_v2_get_eisr(const struct kvm_vcpu *vcpu)
         return vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr;
 }
 
+static void vgic_v2_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr = 0;
+}
+
 static u32 vgic_v2_get_interrupt_status(const struct kvm_vcpu *vcpu)
 {
         u32 misr = vcpu->arch.vgic_cpu.vgic_v2.vgic_misr;
@@ -148,6 +155,7 @@ static const struct vgic_ops vgic_v2_ops = {
         .sync_lr_elrsr          = vgic_v2_sync_lr_elrsr,
         .get_elrsr              = vgic_v2_get_elrsr,
         .get_eisr               = vgic_v2_get_eisr,
+        .clear_eisr             = vgic_v2_clear_eisr,
         .get_interrupt_status   = vgic_v2_get_interrupt_status,
         .enable_underflow       = vgic_v2_enable_underflow,
         .disable_underflow      = vgic_v2_disable_underflow,
diff --git a/virt/kvm/arm/vgic-v3.c b/virt/kvm/arm/vgic-v3.c
index 3a62d8a9a2c6..dff06021e748 100644
--- a/virt/kvm/arm/vgic-v3.c
+++ b/virt/kvm/arm/vgic-v3.c
@@ -104,6 +104,8 @@ static void vgic_v3_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
 {
         if (!(lr_desc.state & LR_STATE_MASK))
                 vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr |= (1U << lr);
+        else
+                vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr &= ~(1U << lr);
 }
 
 static u64 vgic_v3_get_elrsr(const struct kvm_vcpu *vcpu)
@@ -116,6 +118,11 @@ static u64 vgic_v3_get_eisr(const struct kvm_vcpu *vcpu)
         return vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr;
 }
 
+static void vgic_v3_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr = 0;
+}
+
 static u32 vgic_v3_get_interrupt_status(const struct kvm_vcpu *vcpu)
 {
         u32 misr = vcpu->arch.vgic_cpu.vgic_v3.vgic_misr;
@@ -192,6 +199,7 @@ static const struct vgic_ops vgic_v3_ops = {
         .sync_lr_elrsr          = vgic_v3_sync_lr_elrsr,
         .get_elrsr              = vgic_v3_get_elrsr,
         .get_eisr               = vgic_v3_get_eisr,
+        .clear_eisr             = vgic_v3_clear_eisr,
         .get_interrupt_status   = vgic_v3_get_interrupt_status,
         .enable_underflow       = vgic_v3_enable_underflow,
         .disable_underflow      = vgic_v3_disable_underflow,
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 0cc6ab6005a0..c9f60f524588 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -883,6 +883,11 @@ static inline u64 vgic_get_eisr(struct kvm_vcpu *vcpu)
         return vgic_ops->get_eisr(vcpu);
 }
 
+static inline void vgic_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vgic_ops->clear_eisr(vcpu);
+}
+
 static inline u32 vgic_get_interrupt_status(struct kvm_vcpu *vcpu)
 {
         return vgic_ops->get_interrupt_status(vcpu);
@@ -922,6 +927,7 @@ static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu)
         vgic_set_lr(vcpu, lr_nr, vlr);
         clear_bit(lr_nr, vgic_cpu->lr_used);
         vgic_cpu->vgic_irq_lr_map[irq] = LR_EMPTY;
+        vgic_sync_lr_elrsr(vcpu, lr_nr, vlr);
 }
 
 /*
@@ -978,6 +984,7 @@ bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
                         BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
                         vlr.state |= LR_STATE_PENDING;
                         vgic_set_lr(vcpu, lr, vlr);
+                        vgic_sync_lr_elrsr(vcpu, lr, vlr);
                         return true;
                 }
         }
@@ -999,6 +1006,7 @@ bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
                 vlr.state |= LR_EOI_INT;
 
         vgic_set_lr(vcpu, lr, vlr);
+        vgic_sync_lr_elrsr(vcpu, lr, vlr);
 
         return true;
 }
@@ -1136,6 +1144,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
         if (status & INT_STATUS_UNDERFLOW)
                 vgic_disable_underflow(vcpu);
 
+        /*
+         * In the next iterations of the vcpu loop, if we sync the vgic state
+         * after flushing it, but before entering the guest (this happens for
+         * pending signals and vmid rollovers), then make sure we don't pick
+         * up any old maintenance interrupts here.
+         */
+        vgic_clear_eisr(vcpu);
+
         return level_pending;
 }
 
@@ -1583,8 +1599,10 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
          * emulation. So check this here again. KVM_CREATE_DEVICE does
          * the proper checks already.
          */
-        if (type == KVM_DEV_TYPE_ARM_VGIC_V2 && !vgic->can_emulate_gicv2)
-                return -ENODEV;
+        if (type == KVM_DEV_TYPE_ARM_VGIC_V2 && !vgic->can_emulate_gicv2) {
+                ret = -ENODEV;
+                goto out;
+        }
 
         /*
          * Any time a vcpu is run, vcpu_load is called which tries to grab the
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a1093700f3a4..a2214d9609bd 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2492,6 +2492,7 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
         case KVM_CAP_SIGNAL_MSI:
 #endif
 #ifdef CONFIG_HAVE_KVM_IRQFD
+        case KVM_CAP_IRQFD:
         case KVM_CAP_IRQFD_RESAMPLE:
 #endif
         case KVM_CAP_CHECK_EXTENSION_VM: