135 files changed, 656 insertions, 411 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 1ff06dee651d..217dc542e808 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9557,6 +9557,14 @@ S:	Maintained
 F:      Documentation/usb/ohci.txt
 F:      drivers/usb/host/ohci*
 
+USB OVER IP DRIVER
+M:      Valentina Manea <valentina.manea.m@gmail.com>
+M:      Shuah Khan <shuah.kh@samsung.com>
+L:      linux-usb@vger.kernel.org
+S:      Maintained
+F:      drivers/usb/usbip/
+F:      tools/usb/usbip/
+
 USB PEGASUS DRIVER
 M:      Petko Manolov <petkan@nucleusys.com>
 L:      linux-usb@vger.kernel.org
diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
index 5ebab5895edb..f05bdb4b1cb9 100644
--- a/arch/alpha/include/asm/io.h
+++ b/arch/alpha/include/asm/io.h
@@ -500,10 +500,14 @@ extern inline void writeq(u64 b, volatile void __iomem *addr)
 #define outb_p          outb
 #define outw_p          outw
 #define outl_p          outl
-#define readb_relaxed(addr) __raw_readb(addr)
-#define readw_relaxed(addr) __raw_readw(addr)
-#define readl_relaxed(addr) __raw_readl(addr)
-#define readq_relaxed(addr) __raw_readq(addr)
+#define readb_relaxed(addr)     __raw_readb(addr)
+#define readw_relaxed(addr)     __raw_readw(addr)
+#define readl_relaxed(addr)     __raw_readl(addr)
+#define readq_relaxed(addr)     __raw_readq(addr)
+#define writeb_relaxed(b, addr) __raw_writeb(b, addr)
+#define writew_relaxed(b, addr) __raw_writew(b, addr)
+#define writel_relaxed(b, addr) __raw_writel(b, addr)
+#define writeq_relaxed(b, addr) __raw_writeq(b, addr)
 
 #define mmiowb()
 
diff --git a/arch/alpha/include/asm/unistd.h b/arch/alpha/include/asm/unistd.h
index f2c94402e2c8..c509d306db45 100644
--- a/arch/alpha/include/asm/unistd.h
+++ b/arch/alpha/include/asm/unistd.h
@@ -3,7 +3,7 @@
 
 #include <uapi/asm/unistd.h>
 
-#define NR_SYSCALLS                     508
+#define NR_SYSCALLS                     511
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
diff --git a/arch/alpha/include/uapi/asm/unistd.h b/arch/alpha/include/uapi/asm/unistd.h
index 53ae7bb1bfd1..d214a0358100 100644
--- a/arch/alpha/include/uapi/asm/unistd.h
+++ b/arch/alpha/include/uapi/asm/unistd.h
@@ -469,5 +469,8 @@
 #define __NR_process_vm_writev          505
 #define __NR_kcmp                       506
 #define __NR_finit_module               507
+#define __NR_sched_setattr              508
+#define __NR_sched_getattr              509
+#define __NR_renameat2                  510
 
 #endif /* _UAPI_ALPHA_UNISTD_H */
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index dca9b3fb0071..24789713f1ea 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -526,6 +526,9 @@ sys_call_table:
         .quad sys_process_vm_writev             /* 505 */
         .quad sys_kcmp
         .quad sys_finit_module
+        .quad sys_sched_setattr
+        .quad sys_sched_getattr
+        .quad sys_renameat2                     /* 510 */
 
         .size sys_call_table, . - sys_call_table
         .type sys_call_table, @object
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index bc423f7b02da..f14b4abbebd8 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -520,7 +520,7 @@ void bio_integrity_endio(struct bio *bio, int error)
          */
         if (error) {
                 bio->bi_end_io = bip->bip_end_io;
-                bio_endio(bio, error);
+                bio_endio_nodec(bio, error);
 
                 return;
         }
diff --git a/block/blk-core.c b/block/blk-core.c
index c359d72e9d76..bf930f481d43 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1252,7 +1252,6 @@ void blk_rq_set_block_pc(struct request *rq)
         rq->__sector = (sector_t) -1;
         rq->bio = rq->biotail = NULL;
         memset(rq->__cmd, 0, sizeof(rq->__cmd));
-        rq->cmd = rq->__cmd;
 }
 EXPORT_SYMBOL(blk_rq_set_block_pc);
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 5189cb1e478a..4aac82615a46 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -112,18 +112,22 @@ static void blk_mq_usage_counter_release(struct percpu_ref *ref)
  */
 void blk_mq_freeze_queue(struct request_queue *q)
 {
+        bool freeze;
+
         spin_lock_irq(q->queue_lock);
-        q->mq_freeze_depth++;
+        freeze = !q->mq_freeze_depth++;
         spin_unlock_irq(q->queue_lock);
 
-        percpu_ref_kill(&q->mq_usage_counter);
-        blk_mq_run_queues(q, false);
+        if (freeze) {
+                percpu_ref_kill(&q->mq_usage_counter);
+                blk_mq_run_queues(q, false);
+        }
         wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->mq_usage_counter));
 }
 
 static void blk_mq_unfreeze_queue(struct request_queue *q)
 {
-        bool wake = false;
+        bool wake;
 
         spin_lock_irq(q->queue_lock);
         wake = !--q->mq_freeze_depth;
@@ -172,6 +176,8 @@ static void blk_mq_rq_ctx_init(struct request_queue *q, struct blk_mq_ctx *ctx,
         /* tag was already set */
         rq->errors = 0;
 
+        rq->cmd = rq->__cmd;
+
         rq->extra_len = 0;
         rq->sense_len = 0;
         rq->resid_len = 0;
@@ -1068,13 +1074,17 @@ static void blk_mq_bio_to_request(struct request *rq, struct bio *bio)
                 blk_account_io_start(rq, 1);
 }
 
+static inline bool hctx_allow_merges(struct blk_mq_hw_ctx *hctx)
+{
+        return (hctx->flags & BLK_MQ_F_SHOULD_MERGE) &&
+                !blk_queue_nomerges(hctx->queue);
+}
+
 static inline bool blk_mq_merge_queue_io(struct blk_mq_hw_ctx *hctx,
                                          struct blk_mq_ctx *ctx,
                                          struct request *rq, struct bio *bio)
 {
-        struct request_queue *q = hctx->queue;
-
-        if (!(hctx->flags & BLK_MQ_F_SHOULD_MERGE)) {
+        if (!hctx_allow_merges(hctx)) {
                 blk_mq_bio_to_request(rq, bio);
                 spin_lock(&ctx->lock);
 insert_rq:
@@ -1082,6 +1092,8 @@ insert_rq:
                 spin_unlock(&ctx->lock);
                 return false;
         } else {
+                struct request_queue *q = hctx->queue;
+
                 spin_lock(&ctx->lock);
                 if (!blk_mq_attempt_merge(q, ctx, bio)) {
                         blk_mq_bio_to_request(rq, bio);
@@ -1574,7 +1586,7 @@ static int blk_mq_init_hw_queues(struct request_queue *q,
                 hctx->tags = set->tags[i];
 
                 /*
-                 * Allocate space for all possible cpus to avoid allocation in
+                 * Allocate space for all possible cpus to avoid allocation at
                  * runtime
                  */
                 hctx->ctxs = kmalloc_node(nr_cpu_ids * sizeof(void *),
@@ -1662,8 +1674,8 @@ static void blk_mq_map_swqueue(struct request_queue *q)
 
         queue_for_each_hw_ctx(q, hctx, i) {
                 /*
-                 * If not software queues are mapped to this hardware queue,
-                 * disable it and free the request entries
+                 * If no software queues are mapped to this hardware queue,
+                 * disable it and free the request entries.
                  */
                 if (!hctx->nr_ctx) {
                         struct blk_mq_tag_set *set = q->tag_set;
@@ -1713,14 +1725,10 @@ static void blk_mq_del_queue_tag_set(struct request_queue *q)
 {
         struct blk_mq_tag_set *set = q->tag_set;
 
-        blk_mq_freeze_queue(q);
-
         mutex_lock(&set->tag_list_lock);
         list_del_init(&q->tag_set_list);
         blk_mq_update_tag_set_depth(set);
         mutex_unlock(&set->tag_list_lock);
-
-        blk_mq_unfreeze_queue(q);
 }
 
 static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set,
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index cadc37841744..3f31cf9508e6 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1272,15 +1272,22 @@ __cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
         rb_insert_color(&cfqg->rb_node, &st->rb);
 }
 
+/*
+ * This has to be called only on activation of cfqg
+ */
 static void
 cfq_update_group_weight(struct cfq_group *cfqg)
 {
-        BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
-
         if (cfqg->new_weight) {
                 cfqg->weight = cfqg->new_weight;
                 cfqg->new_weight = 0;
         }
+}
+
+static void
+cfq_update_group_leaf_weight(struct cfq_group *cfqg)
+{
+        BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
 
         if (cfqg->new_leaf_weight) {
                 cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1306,12 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
         /* add to the service tree */
         BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
 
-        cfq_update_group_weight(cfqg);
+        /*
+         * Update leaf_weight.  We cannot update weight at this point
+         * because cfqg might already have been activated and is
+         * contributing its current weight to the parent's child_weight.
+         */
+        cfq_update_group_leaf_weight(cfqg);
         __cfq_group_service_tree_add(st, cfqg);
 
         /*
@@ -1323,6 +1335,7 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
          */
         while ((parent = cfqg_parent(pos))) {
                 if (propagate) {
+                        cfq_update_group_weight(pos);
                         propagate = !parent->nr_active++;
                         parent->children_weight += pos->weight;
                 }
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 51bf5155ee75..9b8eaeca6a79 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -279,7 +279,6 @@ static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
         r = blk_rq_unmap_user(bio);
         if (!ret)
                 ret = r;
-        blk_put_request(rq);
 
         return ret;
 }
@@ -297,8 +296,6 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
 
         if (hdr->interface_id != 'S')
                 return -EINVAL;
-        if (hdr->cmd_len > BLK_MAX_CDB)
-                return -EINVAL;
 
         if (hdr->dxfer_len > (queue_max_hw_sectors(q) << 9))
                 return -EIO;
@@ -317,16 +314,23 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
         if (hdr->flags & SG_FLAG_Q_AT_HEAD)
                 at_head = 1;
 
+        ret = -ENOMEM;
         rq = blk_get_request(q, writing ? WRITE : READ, GFP_KERNEL);
         if (!rq)
-                return -ENOMEM;
+                goto out;
         blk_rq_set_block_pc(rq);
 
-        if (blk_fill_sghdr_rq(q, rq, hdr, mode)) {
-                blk_put_request(rq);
-                return -EFAULT;
+        if (hdr->cmd_len > BLK_MAX_CDB) {
+                rq->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
+                if (!rq->cmd)
+                        goto out_put_request;
         }
 
+        ret = -EFAULT;
+        if (blk_fill_sghdr_rq(q, rq, hdr, mode))
+                goto out_free_cdb;
+
+        ret = 0;
         if (hdr->iovec_count) {
                 size_t iov_data_len;
                 struct iovec *iov = NULL;
@@ -335,7 +339,7 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
                                             0, NULL, &iov);
                 if (ret < 0) {
                         kfree(iov);
-                        goto out;
+                        goto out_free_cdb;
                 }
 
                 iov_data_len = ret;
@@ -358,7 +362,7 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
                                       GFP_KERNEL);
 
         if (ret)
-                goto out;
+                goto out_free_cdb;
 
         bio = rq->bio;
         memset(sense, 0, sizeof(sense));
@@ -376,9 +380,14 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
 
         hdr->duration = jiffies_to_msecs(jiffies - start_time);
 
-        return blk_complete_sghdr_rq(rq, hdr, bio);
-out:
+        ret = blk_complete_sghdr_rq(rq, hdr, bio);
+
+out_free_cdb:
+        if (rq->cmd != rq->__cmd)
+                kfree(rq->cmd);
+out_put_request:
         blk_put_request(rq);
+out:
         return ret;
 }
 
@@ -448,6 +457,11 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
         }
 
         rq = blk_get_request(q, in_len ? WRITE : READ, __GFP_WAIT);
+        if (!rq) {
+                err = -ENOMEM;
+                goto error;
+        }
+        blk_rq_set_block_pc(rq);
 
         cmdlen = COMMAND_SIZE(opcode);
 
@@ -501,7 +515,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
         memset(sense, 0, sizeof(sense));
         rq->sense = sense;
         rq->sense_len = 0;
-        blk_rq_set_block_pc(rq);
 
         blk_execute_rq(q, disk, rq, 0);
 
@@ -521,7 +534,8 @@ out:
         
 error:
         kfree(buffer);
-        blk_put_request(rq);
+        if (rq)
+                blk_put_request(rq);
         return err;
 }
 EXPORT_SYMBOL_GPL(sg_scsi_ioctl);
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index c7d138eca731..3598110d2cef 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -442,12 +442,15 @@ static int rd_nr;
 int rd_size = CONFIG_BLK_DEV_RAM_SIZE;
 static int max_part;
 static int part_shift;
+static int part_show = 0;
 module_param(rd_nr, int, S_IRUGO);
 MODULE_PARM_DESC(rd_nr, "Maximum number of brd devices");
 module_param(rd_size, int, S_IRUGO);
 MODULE_PARM_DESC(rd_size, "Size of each RAM disk in kbytes.");
 module_param(max_part, int, S_IRUGO);
 MODULE_PARM_DESC(max_part, "Maximum number of partitions per RAM disk");
+module_param(part_show, int, S_IRUGO);
+MODULE_PARM_DESC(part_show, "Control RAM disk visibility in /proc/partitions");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
 MODULE_ALIAS("rd");
@@ -501,7 +504,8 @@ static struct brd_device *brd_alloc(int i)
         disk->fops              = &brd_fops;
         disk->private_data      = brd;
         disk->queue             = brd->brd_queue;
-        disk->flags |= GENHD_FL_SUPPRESS_PARTITION_INFO;
+        if (!part_show)
+                disk->flags |= GENHD_FL_SUPPRESS_PARTITION_INFO;
         sprintf(disk->disk_name, "ram%d", i);
         set_capacity(disk, rd_size * 2);
 
diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
index ab3ea62e5dfc..c4328d9d9981 100644
--- a/drivers/block/xsysace.c
+++ b/drivers/block/xsysace.c
@@ -1203,7 +1203,6 @@ static struct platform_driver ace_platform_driver = {
         .probe = ace_probe,
         .remove = ace_remove,
         .driver = {
-                .owner = THIS_MODULE,
                 .name = "xsysace",
                 .of_match_table = ace_of_match,
         },
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 2785007e0e46..cd15e0801228 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1688,6 +1688,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         unsigned int key_size, opt_params;
         unsigned long long tmpll;
         int ret;
+        size_t iv_size_padding;
         struct dm_arg_set as;
         const char *opt_string;
         char dummy;
@@ -1724,20 +1725,32 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         cc->dmreq_start = sizeof(struct ablkcipher_request);
         cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
-        cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
-        cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
-                           ~(crypto_tfm_ctx_alignment() - 1);
+        cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
+
+        if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
+                /* Allocate the padding exactly */
+                iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
+                                & crypto_ablkcipher_alignmask(any_tfm(cc));
+        } else {
+                /*
+                 * If the cipher requires greater alignment than kmalloc
+                 * alignment, we don't know the exact position of the
+                 * initialization vector. We must assume worst case.
+                 */
+                iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
+        }
 
         cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
-                        sizeof(struct dm_crypt_request) + cc->iv_size);
+                        sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
         if (!cc->req_pool) {
                 ti->error = "Cannot allocate crypt request mempool";
                 goto bad;
         }
 
         cc->per_bio_data_size = ti->per_bio_data_size =
-                                sizeof(struct dm_crypt_io) + cc->dmreq_start +
-                                sizeof(struct dm_crypt_request) + cc->iv_size;
+                ALIGN(sizeof(struct dm_crypt_io) + cc->dmreq_start +
+                      sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size,
+                      ARCH_KMALLOC_MINALIGN);
 
         cc->page_pool = mempool_create_page_pool(MIN_POOL_PAGES, 0);
         if (!cc->page_pool) {
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 324e1de93687..2da05c0e113d 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -601,6 +601,7 @@ int mei_cl_connect(struct mei_cl *cl, struct file *file)
                 cl->timer_count = MEI_CONNECT_TIMEOUT;
                 list_add_tail(&cb->list, &dev->ctrl_rd_list.list);
         } else {
+                cl->state = MEI_FILE_INITIALIZING;
                 list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
         }
 
diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
index 3095fc514a65..5ccc23bc7690 100644
--- a/drivers/misc/mei/nfc.c
+++ b/drivers/misc/mei/nfc.c
@@ -342,9 +342,10 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
         ndev = (struct mei_nfc_dev *) cldev->priv_data;
         dev = ndev->cl->dev;
 
+        err = -ENOMEM;
         mei_buf = kzalloc(length + MEI_NFC_HEADER_SIZE, GFP_KERNEL);
         if (!mei_buf)
-                return -ENOMEM;
+                goto out;
 
         hdr = (struct mei_nfc_hci_hdr *) mei_buf;
         hdr->cmd = MEI_NFC_CMD_HCI_SEND;
@@ -354,12 +355,9 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
         hdr->data_size = length;
 
         memcpy(mei_buf + MEI_NFC_HEADER_SIZE, buf, length);
-
         err = __mei_cl_send(ndev->cl, mei_buf, length + MEI_NFC_HEADER_SIZE);
         if (err < 0)
-                return err;
-
-        kfree(mei_buf);
+                goto out;
 
         if (!wait_event_interruptible_timeout(ndev->send_wq,
                                 ndev->recv_req_id == ndev->req_id, HZ)) {
@@ -368,7 +366,8 @@ static int mei_nfc_send(struct mei_cl_device *cldev, u8 *buf, size_t length)
         } else {
                 ndev->req_id++;
         }
-
+out:
+        kfree(mei_buf);
         return err;
 }
 
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ce62e8798cc8..d837dc180522 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1808,7 +1808,6 @@ static int scsi_mq_prep_fn(struct request *req)
 
         cmd->tag = req->tag;
 
-        req->cmd = req->__cmd;
         cmd->cmnd = req->cmd;
         cmd->prot_op = SCSI_PROT_NORMAL;
 
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 2c486ea6236b..35b494f5667f 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -28,8 +28,6 @@ source "drivers/staging/et131x/Kconfig"
 
 source "drivers/staging/slicoss/Kconfig"
 
-source "drivers/staging/usbip/Kconfig"
-
 source "drivers/staging/wlan-ng/Kconfig"
 
 source "drivers/staging/comedi/Kconfig"
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 1e1a3a10faf7..e66a5dbd9b02 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -6,7 +6,6 @@ obj-$(CONFIG_STAGING)		+= staging.o
 obj-y                           += media/
 obj-$(CONFIG_ET131X)            += et131x/
 obj-$(CONFIG_SLICOSS)           += slicoss/
-obj-$(CONFIG_USBIP_CORE)        += usbip/
 obj-$(CONFIG_PRISM2_USB)        += wlan-ng/
 obj-$(CONFIG_COMEDI)            += comedi/
 obj-$(CONFIG_FB_OLPC_DCON)      += olpc_dcon/
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
index 9b47e66599a3..0bf0d24d12d5 100644
--- a/drivers/staging/android/logger.c
+++ b/drivers/staging/android/logger.c
@@ -790,7 +790,7 @@ static int __init create_log(char *log_name, int size)
         if (unlikely(ret)) {
                 pr_err("failed to register misc device for log '%s'!\n",
                                 log->misc.name);
-                goto out_free_log;
+                goto out_free_misc_name;
         }
 
         pr_info("created %luK log '%s'\n",
@@ -798,6 +798,9 @@ static int __init create_log(char *log_name, int size)
 
         return 0;
 
+out_free_misc_name:
+        kfree(log->misc.name);
+
 out_free_log:
         kfree(log);
 
diff --git a/drivers/staging/et131x/et131x.c b/drivers/staging/et131x/et131x.c
index 8bf1eb485163..831b7c6fe494 100644
--- a/drivers/staging/et131x/et131x.c
+++ b/drivers/staging/et131x/et131x.c
@@ -1421,22 +1421,16 @@ static int et131x_mii_read(struct et131x_adapter *adapter, u8 reg, u16 *value)
  * @reg: the register to read
  * @value: 16-bit value to write
  */
-static int et131x_mii_write(struct et131x_adapter *adapter, u8 reg, u16 value)
+static int et131x_mii_write(struct et131x_adapter *adapter, u8 addr, u8 reg,
+                            u16 value)
 {
         struct mac_regs __iomem *mac = &adapter->regs->mac;
-        struct phy_device *phydev = adapter->phydev;
         int status = 0;
-        u8 addr;
         u32 delay = 0;
         u32 mii_addr;
         u32 mii_cmd;
         u32 mii_indicator;
 
-        if (!phydev)
-                return -EIO;
-
-        addr = phydev->addr;
-
         /* Save a local copy of the registers we are dealing with so we can
          * set them back
          */
@@ -1631,17 +1625,7 @@ static int et131x_mdio_write(struct mii_bus *bus, int phy_addr,
         struct net_device *netdev = bus->priv;
         struct et131x_adapter *adapter = netdev_priv(netdev);
 
-        return et131x_mii_write(adapter, reg, value);
-}
-
-static int et131x_mdio_reset(struct mii_bus *bus)
-{
-        struct net_device *netdev = bus->priv;
-        struct et131x_adapter *adapter = netdev_priv(netdev);
-
-        et131x_mii_write(adapter, MII_BMCR, BMCR_RESET);
-
-        return 0;
+        return et131x_mii_write(adapter, phy_addr, reg, value);
 }
 
 /*      et1310_phy_power_switch -       PHY power control
@@ -1656,18 +1640,20 @@ static int et131x_mdio_reset(struct mii_bus *bus)
 static void et1310_phy_power_switch(struct et131x_adapter *adapter, bool down)
 {
         u16 data;
+        struct  phy_device *phydev = adapter->phydev;
 
         et131x_mii_read(adapter, MII_BMCR, &data);
         data &= ~BMCR_PDOWN;
         if (down)
                 data |= BMCR_PDOWN;
-        et131x_mii_write(adapter, MII_BMCR, data);
+        et131x_mii_write(adapter, phydev->addr, MII_BMCR, data);
 }
 
 /* et131x_xcvr_init - Init the phy if we are setting it into force mode */
 static void et131x_xcvr_init(struct et131x_adapter *adapter)
 {
         u16 lcr2;
+        struct  phy_device *phydev = adapter->phydev;
 
         /* Set the LED behavior such that LED 1 indicates speed (off =
          * 10Mbits, blink = 100Mbits, on = 1000Mbits) and LED 2 indicates
@@ -1688,7 +1674,7 @@ static void et131x_xcvr_init(struct et131x_adapter *adapter)
                 else
                         lcr2 |= (LED_VAL_LINKON << LED_TXRX_SHIFT);
 
-                et131x_mii_write(adapter, PHY_LED_2, lcr2);
+                et131x_mii_write(adapter, phydev->addr, PHY_LED_2, lcr2);
         }
 }
 
@@ -3643,14 +3629,14 @@ static void et131x_adjust_link(struct net_device *netdev)
 
                         et131x_mii_read(adapter, PHY_MPHY_CONTROL_REG,
                                          &register18);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18 | 0x4);
-                        et131x_mii_write(adapter, PHY_INDEX_REG,
+                        et131x_mii_write(adapter, phydev->addr,
+                                         PHY_MPHY_CONTROL_REG, register18 | 0x4);
+                        et131x_mii_write(adapter, phydev->addr, PHY_INDEX_REG,
                                          register18 | 0x8402);
-                        et131x_mii_write(adapter, PHY_DATA_REG,
+                        et131x_mii_write(adapter, phydev->addr, PHY_DATA_REG,
                                          register18 | 511);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18);
+                        et131x_mii_write(adapter, phydev->addr,
+                                         PHY_MPHY_CONTROL_REG, register18);
                 }
 
                 et1310_config_flow_control(adapter);
@@ -3662,7 +3648,8 @@ static void et131x_adjust_link(struct net_device *netdev)
                         et131x_mii_read(adapter, PHY_CONFIG, &reg);
                         reg &= ~ET_PHY_CONFIG_TX_FIFO_DEPTH;
                         reg |= ET_PHY_CONFIG_FIFO_DEPTH_32;
-                        et131x_mii_write(adapter, PHY_CONFIG, reg);
+                        et131x_mii_write(adapter, phydev->addr, PHY_CONFIG,
+                                         reg);
                 }
 
                 et131x_set_rx_dma_timer(adapter);
@@ -3675,14 +3662,14 @@ static void et131x_adjust_link(struct net_device *netdev)
 
                         et131x_mii_read(adapter, PHY_MPHY_CONTROL_REG,
                                          &register18);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18 | 0x4);
-                        et131x_mii_write(adapter, PHY_INDEX_REG,
-                                         register18 | 0x8402);
-                        et131x_mii_write(adapter, PHY_DATA_REG,
-                                         register18 | 511);
-                        et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
-                                         register18);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_MPHY_CONTROL_REG, register18 | 0x4);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_INDEX_REG, register18 | 0x8402);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_DATA_REG, register18 | 511);
+                        et131x_mii_write(adapter, phydev->addr,
+                                        PHY_MPHY_CONTROL_REG, register18);
                 }
 
                 /* Free the packets being actively sent & stopped */
@@ -4644,10 +4631,6 @@ static int et131x_pci_setup(struct pci_dev *pdev,
         /* Copy address into the net_device struct */
         memcpy(netdev->dev_addr, adapter->addr, ETH_ALEN);
 
-        /* Init variable for counting how long we do not have link status */
-        adapter->boot_coma = 0;
-        et1310_disable_phy_coma(adapter);
-
         rc = -ENOMEM;
 
         /* Setup the mii_bus struct */
@@ -4663,7 +4646,6 @@ static int et131x_pci_setup(struct pci_dev *pdev,
         adapter->mii_bus->priv = netdev;
         adapter->mii_bus->read = et131x_mdio_read;
         adapter->mii_bus->write = et131x_mdio_write;
-        adapter->mii_bus->reset = et131x_mdio_reset;
         adapter->mii_bus->irq = kmalloc_array(PHY_MAX_ADDR, sizeof(int),
                                               GFP_KERNEL);
         if (!adapter->mii_bus->irq)
@@ -4687,6 +4669,10 @@ static int et131x_pci_setup(struct pci_dev *pdev,
         /* Setup et1310 as per the documentation */
         et131x_adapter_setup(adapter);
 
+        /* Init variable for counting how long we do not have link status */
+        adapter->boot_coma = 0;
+        et1310_disable_phy_coma(adapter);
+
         /* We can enable interrupts now
          *
          *  NOTE - Because registration of interrupt handler is done in the
diff --git a/drivers/staging/lustre/lustre/libcfs/workitem.c b/drivers/staging/lustre/lustre/libcfs/workitem.c
index 65629579bd7d..03ab9e046784 100644
--- a/drivers/staging/lustre/lustre/libcfs/workitem.c
+++ b/drivers/staging/lustre/lustre/libcfs/workitem.c
@@ -365,6 +365,7 @@ cfs_wi_sched_create(char *name, struct cfs_cpt_table *cptab,
                 return -ENOMEM;
 
         strncpy(sched->ws_name, name, CFS_WS_NAME_LEN);
+        sched->ws_name[CFS_WS_NAME_LEN - 1] = '\0';
         sched->ws_cptab = cptab;
         sched->ws_cpt = cpt;
 
diff --git a/drivers/staging/lustre/lustre/obdclass/class_obd.c b/drivers/staging/lustre/lustre/obdclass/class_obd.c
index 8b19f3caa68f..701c6a776524 100644
--- a/drivers/staging/lustre/lustre/obdclass/class_obd.c
+++ b/drivers/staging/lustre/lustre/obdclass/class_obd.c
@@ -35,7 +35,7 @@
  */
 
 #define DEBUG_SUBSYSTEM S_CLASS
-# include <asm/atomic.h>
+# include <linux/atomic.h>
 
 #include "../include/obd_support.h"
 #include "../include/obd_class.h"
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index b8676ac77b0c..407a318b09db 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -43,9 +43,11 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
         /*=== Customer ID ===*/
         /****** 8188EUS ********/
+        {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
         {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
         {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+        {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/thunderbolt/path.c b/drivers/thunderbolt/path.c
index 8fcf8a7b6c22..9562cd026dc0 100644
--- a/drivers/thunderbolt/path.c
+++ b/drivers/thunderbolt/path.c
@@ -150,7 +150,26 @@ int tb_path_activate(struct tb_path *path)
 
         /* Activate hops. */
         for (i = path->path_length - 1; i >= 0; i--) {
-                struct tb_regs_hop hop;
+                struct tb_regs_hop hop = { 0 };
+
+                /*
+                 * We do (currently) not tear down paths setup by the firmeware.
+                 * If a firmware device is unplugged and plugged in again then
+                 * it can happen that we reuse some of the hops from the (now
+                 * defunct) firmeware path. This causes the hotplug operation to
+                 * fail (the pci device does not show up). Clearing the hop
+                 * before overwriting it fixes the problem.
+                 *
+                 * Should be removed once we discover and tear down firmeware
+                 * paths.
+                 */
+                res = tb_port_write(path->hops[i].in_port, &hop, TB_CFG_HOPS,
+                                    2 * path->hops[i].in_hop_index, 2);
+                if (res) {
+                        __tb_path_deactivate_hops(path, i);
+                        __tb_path_deallocate_nfc(path, 0);
+                        goto err;
+                }
 
                 /* dword 0 */
                 hop.next_hop = path->hops[i].next_hop_index;
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index e0cad4418085..cf1b19bca306 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -92,6 +92,8 @@ source "drivers/usb/storage/Kconfig"
 
 source "drivers/usb/image/Kconfig"
 
+source "drivers/usb/usbip/Kconfig"
+
 endif
 
 source "drivers/usb/musb/Kconfig"
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 3cba892b83a2..d7be71778059 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -60,3 +60,5 @@ obj-$(CONFIG_USB_RENESAS_USBHS)	+= renesas_usbhs/
 obj-$(CONFIG_USB_GADGET)        += gadget/
 
 obj-$(CONFIG_USB_COMMON)        += common/
+
+obj-$(CONFIG_USBIP_CORE)        += usbip/
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 8a4dcbc7a75f..46f5161c7891 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1728,8 +1728,14 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
          * - Change autosuspend delay of hub can avoid unnecessary auto
          *   suspend timer for hub, also may decrease power consumption
          *   of USB bus.
+         *
+         * - If user has indicated to prevent autosuspend by passing
+         *   usbcore.autosuspend = -1 then keep autosuspend disabled.
          */
-        pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+#ifdef CONFIG_PM_RUNTIME
+        if (hdev->dev.power.autosuspend_delay >= 0)
+                pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
+#endif
 
         /*
          * Hubs have proper suspend/resume support, except for root hubs
@@ -2107,8 +2113,8 @@ void usb_disconnect(struct usb_device **pdev)
 {
         struct usb_port *port_dev = NULL;
         struct usb_device *udev = *pdev;
-        struct usb_hub *hub;
-        int port1;
+        struct usb_hub *hub = NULL;
+        int port1 = 1;
 
         /* mark the device as inactive, so any further urb submissions for
          * this device (and any of its children) will fail immediately.
@@ -4631,9 +4637,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                         if (status != -ENODEV &&
                                 port1 != unreliable_port &&
                                 printk_ratelimit())
-                                dev_err(&udev->dev, "connect-debounce failed, port %d disabled\n",
-                                        port1);
-
+                                dev_err(&port_dev->dev, "connect-debounce failed\n");
                         portstatus &= ~USB_PORT_STAT_CONNECTION;
                         unreliable_port = port1;
                 } else {
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0ba9c335b584..7c9618e916e2 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1901,7 +1901,7 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
 static void s3c_hsotg_irq_enumdone(struct s3c_hsotg *hsotg)
 {
         u32 dsts = readl(hsotg->regs + DSTS);
-        int ep0_mps = 0, ep_mps;
+        int ep0_mps = 0, ep_mps = 8;
 
         /*
          * This should signal the finish of the enumeration phase
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index ef4936ff626c..9dcfbe7cd5f5 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -425,7 +425,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 
 static int dwc3_omap_extcon_register(struct dwc3_omap *omap)
 {
-        u32                     ret;
+        int                     ret;
         struct device_node      *node = omap->dev->of_node;
         struct extcon_dev       *edev;
 
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index a186afeaa700..9add915d41f7 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -3,7 +3,7 @@
 #
 subdir-ccflags-$(CONFIG_USB_GADGET_DEBUG)       := -DDEBUG
 subdir-ccflags-$(CONFIG_USB_GADGET_VERBOSE)     += -DVERBOSE_DEBUG
-ccflags-y                               += -I$(PWD)/drivers/usb/gadget/udc
+ccflags-y                               += -Idrivers/usb/gadget/udc
 
 obj-$(CONFIG_USB_LIBCOMPOSITE)  += libcomposite.o
 libcomposite-y                  := usbstring.o config.o epautoconf.o
diff --git a/drivers/usb/gadget/function/Makefile b/drivers/usb/gadget/function/Makefile
index 6d91f21b52a6..83ae1065149d 100644
--- a/drivers/usb/gadget/function/Makefile
+++ b/drivers/usb/gadget/function/Makefile
@@ -2,8 +2,8 @@
 # USB peripheral controller drivers
 #
 
-ccflags-y                       := -I$(PWD)/drivers/usb/gadget/
-ccflags-y                       += -I$(PWD)/drivers/usb/gadget/udc/
+ccflags-y                       := -Idrivers/usb/gadget/
+ccflags-y                       += -Idrivers/usb/gadget/udc/
 
 # USB Functions
 usb_f_acm-y                     := f_acm.o
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index d50adda913cf..6e6f87656e7b 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -1127,10 +1127,7 @@ void gether_disconnect(struct gether *link)
 
         DBG(dev, "%s\n", __func__);
 
-        netif_tx_lock(dev->net);
         netif_stop_queue(dev->net);
-        netif_tx_unlock(dev->net);
-
         netif_carrier_off(dev->net);
 
         /* disable endpoints, forcing (synchronous) completion
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 71e896d4c5ae..a5eb9a3fbb7a 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -195,6 +195,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
                 printk(KERN_INFO "Failed to queue request (%d).\n", ret);
                 usb_ep_set_halt(ep);
                 spin_unlock_irqrestore(&video->queue.irqlock, flags);
+                uvc_queue_cancel(queue, 0);
                 goto requeue;
         }
         spin_unlock_irqrestore(&video->queue.irqlock, flags);
@@ -281,6 +282,7 @@ error:
 static int
 uvc_video_pump(struct uvc_video *video)
 {
+        struct uvc_video_queue *queue = &video->queue;
         struct usb_request *req;
         struct uvc_buffer *buf;
         unsigned long flags;
@@ -322,6 +324,7 @@ uvc_video_pump(struct uvc_video *video)
                         printk(KERN_INFO "Failed to queue request (%d)\n", ret);
                         usb_ep_set_halt(video->ep);
                         spin_unlock_irqrestore(&video->queue.irqlock, flags);
+                        uvc_queue_cancel(queue, 0);
                         break;
                 }
                 spin_unlock_irqrestore(&video->queue.irqlock, flags);
diff --git a/drivers/usb/gadget/legacy/Makefile b/drivers/usb/gadget/legacy/Makefile
index a11aad5635df..edba2d1ee0f3 100644
--- a/drivers/usb/gadget/legacy/Makefile
+++ b/drivers/usb/gadget/legacy/Makefile
@@ -2,9 +2,9 @@
 # USB gadget drivers
 #
 
-ccflags-y                       := -I$(PWD)/drivers/usb/gadget/
-ccflags-y                       += -I$(PWD)/drivers/usb/gadget/udc/
-ccflags-y                       += -I$(PWD)/drivers/usb/gadget/function/
+ccflags-y                       := -Idrivers/usb/gadget/
+ccflags-y                       += -Idrivers/usb/gadget/udc/
+ccflags-y                       += -Idrivers/usb/gadget/function/
 
 g_zero-y                        := zero.o
 g_audio-y                       := audio.o
diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index 986fc511a2ed..225e385a6160 100644
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -222,10 +222,12 @@ static void dbgp_unbind(struct usb_gadget *gadget)
 {
 #ifdef CONFIG_USB_G_DBGP_SERIAL
         kfree(dbgp.serial);
+        dbgp.serial = NULL;
 #endif
         if (dbgp.req) {
                 kfree(dbgp.req->buf);
                 usb_ep_free_request(gadget->ep0, dbgp.req);
+                dbgp.req = NULL;
         }
 
         gadget->ep0->driver_data = NULL;
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 2e4ce7704908..e96077b8bf79 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -440,7 +440,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         value = -ENOMEM;
         kbuf = memdup_user(buf, len);
-        if (!kbuf) {
+        if (IS_ERR(kbuf)) {
                 value = PTR_ERR(kbuf);
                 goto free1;
         }
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 5151f947a4f5..34ebaa68504c 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -332,7 +332,7 @@ config USB_GOKU
            gadget drivers to also be dynamically linked.
 
 config USB_EG20T
-        tristate "Intel EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
+        tristate "Intel QUARK X1000/EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
         depends on PCI
         help
           This is a USB device driver for EG20T PCH.
@@ -353,6 +353,7 @@ config USB_EG20T
           ML7213/ML7831 is companion chip for Intel Atom E6xx series.
           ML7213/ML7831 is completely compatible for Intel EG20T PCH.
 
+          This driver can be used with Intel's Quark X1000 SOC platform
 #
 # LAST -- dummy/emulated controller
 #
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 906e65f0e4fa..c9fe67e29d35 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -1661,7 +1661,7 @@ static irqreturn_t usba_udc_irq(int irq, void *devid)
         if (dma_status) {
                 int i;
 
-                for (i = 1; i < USBA_NR_DMAS; i++)
+                for (i = 1; i <= USBA_NR_DMAS; i++)
                         if (dma_status & (1 << i))
                                 usba_dma_irq(udc, &udc->usba_ep[i]);
         }
diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
index d40255f784df..5c5d1adda7eb 100644
--- a/drivers/usb/gadget/udc/fusb300_udc.c
+++ b/drivers/usb/gadget/udc/fusb300_udc.c
@@ -1398,13 +1398,17 @@ static int fusb300_probe(struct platform_device *pdev)
 
         /* initialize udc */
         fusb300 = kzalloc(sizeof(struct fusb300), GFP_KERNEL);
-        if (fusb300 == NULL)
+        if (fusb300 == NULL) {
+                ret = -ENOMEM;
                 goto clean_up;
+        }
 
         for (i = 0; i < FUSB300_MAX_NUM_EP; i++) {
                 _ep[i] = kzalloc(sizeof(struct fusb300_ep), GFP_KERNEL);
-                if (_ep[i] == NULL)
+                if (_ep[i] == NULL) {
+                        ret = -ENOMEM;
                         goto clean_up;
+                }
                 fusb300->ep[i] = _ep[i];
         }
 
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index eb8c3bedb57a..460d953c91b6 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -343,6 +343,7 @@ struct pch_vbus_gpio_data {
  * @setup_data:         Received setup data
  * @phys_addr:          of device memory
  * @base_addr:          for mapped device memory
+ * @bar:                Indicates which PCI BAR for USB regs
  * @irq:                IRQ line for the device
  * @cfg_data:           current cfg, intf, and alt in use
  * @vbus_gpio:          GPIO informaton for detecting VBUS
@@ -370,14 +371,17 @@ struct pch_udc_dev {
         struct usb_ctrlrequest          setup_data;
         unsigned long                   phys_addr;
         void __iomem                    *base_addr;
+        unsigned                        bar;
         unsigned                        irq;
         struct pch_udc_cfg_data         cfg_data;
         struct pch_vbus_gpio_data       vbus_gpio;
 };
 #define to_pch_udc(g)   (container_of((g), struct pch_udc_dev, gadget))
 
+#define PCH_UDC_PCI_BAR_QUARK_X1000     0
 #define PCH_UDC_PCI_BAR                 1
 #define PCI_DEVICE_ID_INTEL_EG20T_UDC   0x8808
+#define PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC     0x0939
 #define PCI_VENDOR_ID_ROHM              0x10DB
 #define PCI_DEVICE_ID_ML7213_IOH_UDC    0x801D
 #define PCI_DEVICE_ID_ML7831_IOH_UDC    0x8808
@@ -3076,7 +3080,7 @@ static void pch_udc_remove(struct pci_dev *pdev)
                 iounmap(dev->base_addr);
         if (dev->mem_region)
                 release_mem_region(dev->phys_addr,
-                                   pci_resource_len(pdev, PCH_UDC_PCI_BAR));
+                                   pci_resource_len(pdev, dev->bar));
         if (dev->active)
                 pci_disable_device(pdev);
         kfree(dev);
@@ -3144,9 +3148,15 @@ static int pch_udc_probe(struct pci_dev *pdev,
         dev->active = 1;
         pci_set_drvdata(pdev, dev);
 
+        /* Determine BAR based on PCI ID */
+        if (id->device == PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC)
+                dev->bar = PCH_UDC_PCI_BAR_QUARK_X1000;
+        else
+                dev->bar = PCH_UDC_PCI_BAR;
+
         /* PCI resource allocation */
-        resource = pci_resource_start(pdev, 1);
-        len = pci_resource_len(pdev, 1);
+        resource = pci_resource_start(pdev, dev->bar);
+        len = pci_resource_len(pdev, dev->bar);
 
         if (!request_mem_region(resource, len, KBUILD_MODNAME)) {
                 dev_err(&pdev->dev, "%s: pci device used already\n", __func__);
@@ -3212,6 +3222,12 @@ finished:
 
 static const struct pci_device_id pch_udc_pcidev_id[] = {
         {
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL,
+                           PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC),
+                .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
+                .class_mask = 0xffffffff,
+        },
+        {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_EG20T_UDC),
                 .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
                 .class_mask = 0xffffffff,
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index 46008421c1ec..de2a8713b428 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1868,8 +1868,8 @@ static int r8a66597_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         reg = devm_ioremap_resource(&pdev->dev, res);
-        if (!reg)
-                return -ENODEV;
+        if (IS_ERR(reg))
+                return PTR_ERR(reg);
 
         ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         irq = ires->start;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index cc305c71ac3d..6130b7574908 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -1230,7 +1230,7 @@ int ehci_hub_control(
                         if (selector == EHSET_TEST_SINGLE_STEP_SET_FEATURE) {
                                 spin_unlock_irqrestore(&ehci->lock, flags);
                                 retval = ehset_single_step_set_feature(hcd,
-                                                                        wIndex);
+                                                                wIndex + 1);
                                 spin_lock_irqsave(&ehci->lock, flags);
                                 break;
                         }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 687d36608155..c22a3e15a16e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -101,6 +101,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         /* AMD PLL quirk */
         if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
+
+        if (pdev->vendor == PCI_VENDOR_ID_AMD)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
@@ -151,6 +155,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_VIA)
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
 
+        /* See https://bugzilla.kernel.org/show_bug.cgi?id=79511 */
+        if (pdev->vendor == PCI_VENDOR_ID_VIA &&
+                        pdev->device == 0x3432)
+                xhci->quirks |= XHCI_BROKEN_STREAMS;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 60fb52ae864b..abed30b82905 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -364,32 +364,6 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
         }
 }
 
-/*
- * Find the segment that trb is in.  Start searching in start_seg.
- * If we must move past a segment that has a link TRB with a toggle cycle state
- * bit set, then we will toggle the value pointed at by cycle_state.
- */
-static struct xhci_segment *find_trb_seg(
-                struct xhci_segment *start_seg,
-                union xhci_trb  *trb, int *cycle_state)
-{
-        struct xhci_segment *cur_seg = start_seg;
-        struct xhci_generic_trb *generic_trb;
-
-        while (cur_seg->trbs > trb ||
-                        &cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) {
-                generic_trb = &cur_seg->trbs[TRBS_PER_SEGMENT - 1].generic;
-                if (generic_trb->field[3] & cpu_to_le32(LINK_TOGGLE))
-                        *cycle_state ^= 0x1;
-                cur_seg = cur_seg->next;
-                if (cur_seg == start_seg)
-                        /* Looped over the entire list.  Oops! */
-                        return NULL;
-        }
-        return cur_seg;
-}
-
-
 static struct xhci_ring *xhci_triad_to_transfer_ring(struct xhci_hcd *xhci,
                 unsigned int slot_id, unsigned int ep_index,
                 unsigned int stream_id)
@@ -459,9 +433,12 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
         struct xhci_virt_device *dev = xhci->devs[slot_id];
         struct xhci_virt_ep *ep = &dev->eps[ep_index];
         struct xhci_ring *ep_ring;
-        struct xhci_generic_trb *trb;
+        struct xhci_segment *new_seg;
+        union xhci_trb *new_deq;
         dma_addr_t addr;
         u64 hw_dequeue;
+        bool cycle_found = false;
+        bool td_last_trb_found = false;
 
         ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
                         ep_index, stream_id);
@@ -486,45 +463,45 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                 hw_dequeue = le64_to_cpu(ep_ctx->deq);
         }
 
-        /* Find virtual address and segment of hardware dequeue pointer */
-        state->new_deq_seg = ep_ring->deq_seg;
-        state->new_deq_ptr = ep_ring->dequeue;
-        while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
-                        != (dma_addr_t)(hw_dequeue & ~0xf)) {
-                next_trb(xhci, ep_ring, &state->new_deq_seg,
-                                        &state->new_deq_ptr);
-                if (state->new_deq_ptr == ep_ring->dequeue) {
-                        WARN_ON(1);
-                        return;
-                }
-        }
+        new_seg = ep_ring->deq_seg;
+        new_deq = ep_ring->dequeue;
+        state->new_cycle_state = hw_dequeue & 0x1;
+
         /*
-         * Find cycle state for last_trb, starting at old cycle state of
-         * hw_dequeue. If there is only one segment ring, find_trb_seg() will
-         * return immediately and cannot toggle the cycle state if this search
-         * wraps around, so add one more toggle manually in that case.
+         * We want to find the pointer, segment and cycle state of the new trb
+         * (the one after current TD's last_trb). We know the cycle state at
+         * hw_dequeue, so walk the ring until both hw_dequeue and last_trb are
+         * found.
          */
-        state->new_cycle_state = hw_dequeue & 0x1;
-        if (ep_ring->first_seg == ep_ring->first_seg->next &&
-                        cur_td->last_trb < state->new_deq_ptr)
-                state->new_cycle_state ^= 0x1;
+        do {
+                if (!cycle_found && xhci_trb_virt_to_dma(new_seg, new_deq)
+                    == (dma_addr_t)(hw_dequeue & ~0xf)) {
+                        cycle_found = true;
+                        if (td_last_trb_found)
+                                break;
+                }
+                if (new_deq == cur_td->last_trb)
+                        td_last_trb_found = true;
 
-        state->new_deq_ptr = cur_td->last_trb;
-        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
-                        "Finding segment containing last TRB in TD.");
-        state->new_deq_seg = find_trb_seg(state->new_deq_seg,
-                        state->new_deq_ptr, &state->new_cycle_state);
-        if (!state->new_deq_seg) {
-                WARN_ON(1);
-                return;
-        }
+                if (cycle_found &&
+                    TRB_TYPE_LINK_LE32(new_deq->generic.field[3]) &&
+                    new_deq->generic.field[3] & cpu_to_le32(LINK_TOGGLE))
+                        state->new_cycle_state ^= 0x1;
+
+                next_trb(xhci, ep_ring, &new_seg, &new_deq);
+
+                /* Search wrapped around, bail out */
+                if (new_deq == ep->ring->dequeue) {
+                        xhci_err(xhci, "Error: Failed finding new dequeue state\n");
+                        state->new_deq_seg = NULL;
+                        state->new_deq_ptr = NULL;
+                        return;
+                }
+
+        } while (!cycle_found || !td_last_trb_found);
 
-        /* Increment to find next TRB after last_trb. Cycle if appropriate. */
-        trb = &state->new_deq_ptr->generic;
-        if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
-            (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
-                state->new_cycle_state ^= 0x1;
-        next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
+        state->new_deq_seg = new_seg;
+        state->new_deq_ptr = new_deq;
 
         /* Don't update the ring cycle state for the producer (us). */
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -2487,7 +2464,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                  * last TRB of the previous TD. The command completion handle
                  * will take care the rest.
                  */
-                if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
+                if (!event_seg && (trb_comp_code == COMP_STOP ||
+                                   trb_comp_code == COMP_STOP_INVAL)) {
                         ret = 0;
                         goto cleanup;
                 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b6f21175b872..c020b094fe7d 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2880,6 +2880,9 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
                         ep_index, ep->stopped_stream, ep->stopped_td,
                         &deq_state);
 
+        if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)
+                return;
+
         /* HW with the reset endpoint quirk will use the saved dequeue state to
          * issue a configure endpoint command later.
          */
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 06b5d77cd9ad..633caf643122 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3250,6 +3250,7 @@ static const struct usb_device_id sisusb_table[] = {
         { USB_DEVICE(0x0711, 0x0918) },
         { USB_DEVICE(0x0711, 0x0920) },
         { USB_DEVICE(0x0711, 0x0950) },
+        { USB_DEVICE(0x0711, 0x5200) },
         { USB_DEVICE(0x182d, 0x021c) },
         { USB_DEVICE(0x182d, 0x0269) },
         { }
diff --git a/drivers/usb/musb/ux500_dma.c b/drivers/usb/musb/ux500_dma.c
index 9aad00f11bd5..221faed9f074 100644
--- a/drivers/usb/musb/ux500_dma.c
+++ b/drivers/usb/musb/ux500_dma.c
@@ -96,7 +96,7 @@ static bool ux500_configure_channel(struct dma_channel *channel,
         struct musb *musb = ux500_channel->controller->private_data;
 
         dev_dbg(musb->controller,
-                "packet_sz=%d, mode=%d, dma_addr=0x%llu, len=%d is_tx=%d\n",
+                "packet_sz=%d, mode=%d, dma_addr=0x%llx, len=%d is_tx=%d\n",
                 packet_sz, mode, (unsigned long long) dma_addr,
                 len, ux500_channel->is_tx);
 
diff --git a/drivers/usb/phy/phy-gpio-vbus-usb.c b/drivers/usb/phy/phy-gpio-vbus-usb.c
index ea9e705555df..f4b14bd97e14 100644
--- a/drivers/usb/phy/phy-gpio-vbus-usb.c
+++ b/drivers/usb/phy/phy-gpio-vbus-usb.c
@@ -260,10 +260,8 @@ static int gpio_vbus_probe(struct platform_device *pdev)
 
         gpio_vbus->phy.otg = devm_kzalloc(&pdev->dev, sizeof(struct usb_otg),
                                           GFP_KERNEL);
-        if (!gpio_vbus->phy.otg) {
-                kfree(gpio_vbus);
+        if (!gpio_vbus->phy.otg)
                 return -ENOMEM;
-        }
 
         platform_set_drvdata(pdev, gpio_vbus);
         gpio_vbus->dev = &pdev->dev;
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index e4108eec5ef4..afc09087ec36 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1601,8 +1601,8 @@ static int msm_otg_probe(struct platform_device *pdev)
          */
         if (motg->phy_number) {
                 phy_select = devm_ioremap_nocache(&pdev->dev, USB2_PHY_SEL, 4);
-                if (IS_ERR(phy_select))
-                        return PTR_ERR(phy_select);
+                if (!phy_select)
+                        return -ENOMEM;
                 /* Enable second PHY with the OTG port */
                 writel(0x1, phy_select);
         }
diff --git a/drivers/usb/phy/phy-samsung-usb.h b/drivers/usb/phy/phy-samsung-usb.h
index 68771bfd1825..80eedd45a20a 100644
--- a/drivers/usb/phy/phy-samsung-usb.h
+++ b/drivers/usb/phy/phy-samsung-usb.h
@@ -216,7 +216,7 @@
 
 #define EXYNOS5_DRD_PHYPARAM1                   (0x20)
 
-#define PHYPARAM1_PCS_TXDEEMPH_MASK             (0x1f << 0)
+#define PHYPARAM1_PCS_TXDEEMPH_MASK             (0x3f << 0)
 #define PHYPARAM1_PCS_TXDEEMPH                  (0x1c)
 
 #define EXYNOS5_DRD_PHYTERM                     (0x24)
diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index 6d0f6080eceb..045cd309367a 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -232,6 +232,9 @@ struct usb_phy *usb_get_phy_dev(struct device *dev, u8 index)
         phy = __usb_find_phy_dev(dev, &phy_bind_list, index);
         if (IS_ERR(phy) || !try_module_get(phy->dev->driver->owner)) {
                 dev_dbg(dev, "unable to find transceiver\n");
+                if (!IS_ERR(phy))
+                        phy = ERR_PTR(-ENODEV);
+
                 goto err0;
         }
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 216ce3078270..824ea5e7ec8b 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -146,6 +146,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
@@ -934,6 +935,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
         { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
         { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+        /* ekey Devices */
+        { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
         /* Infineon Devices */
         { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
         { }                                     /* Terminating entry */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 1e58d90a0b6c..70b0b1d88ae9 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -42,6 +42,8 @@
 /* www.candapter.com Ewert Energy Systems CANdapter device */
 #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
 
+#define FTDI_BM_ATOM_NANO_PID   0xa559  /* Basic Micro ATOM Nano USB2Serial */
+
 /*
  * Texas Instruments XDS100v2 JTAG / BeagleBone A3
  * http://processors.wiki.ti.com/index.php/XDS100
@@ -1378,3 +1380,8 @@
 #define BRAINBOXES_US_160_6_PID         0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
 #define BRAINBOXES_US_160_7_PID         0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
 #define BRAINBOXES_US_160_8_PID         0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+
+/*
+ * ekey biometric systems GmbH (http://ekey.net/)
+ */
+#define FTDI_EKEY_CONV_USB_PID          0xCB08  /* Converter USB */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a9688940543d..54a8120897a6 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -275,8 +275,12 @@ static void option_instat_callback(struct urb *urb);
 #define ZTE_PRODUCT_MF622                       0x0001
 #define ZTE_PRODUCT_MF628                       0x0015
 #define ZTE_PRODUCT_MF626                       0x0031
-#define ZTE_PRODUCT_MC2718                      0xffe8
 #define ZTE_PRODUCT_AC2726                      0xfff1
+#define ZTE_PRODUCT_CDMA_TECH                   0xfffe
+#define ZTE_PRODUCT_AC8710T                     0xffff
+#define ZTE_PRODUCT_MC2718                      0xffe8
+#define ZTE_PRODUCT_AD3812                      0xffeb
+#define ZTE_PRODUCT_MC2716                      0xffed
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -494,6 +498,10 @@ static void option_instat_callback(struct urb *urb);
 #define INOVIA_VENDOR_ID                        0x20a6
 #define INOVIA_SEW858                           0x1105
 
+/* VIA Telecom */
+#define VIATELECOM_VENDOR_ID                    0x15eb
+#define VIATELECOM_PRODUCT_CDS7                 0x0001
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -527,10 +535,18 @@ static const struct option_blacklist_info zte_k3765_z_blacklist = {
         .reserved = BIT(4),
 };
 
+static const struct option_blacklist_info zte_ad3812_z_blacklist = {
+        .sendsetup = BIT(0) | BIT(1) | BIT(2),
+};
+
 static const struct option_blacklist_info zte_mc2718_z_blacklist = {
         .sendsetup = BIT(1) | BIT(2) | BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info zte_mc2716_z_blacklist = {
+        .sendsetup = BIT(1) | BIT(2) | BIT(3),
+};
+
 static const struct option_blacklist_info huawei_cdc12_blacklist = {
         .reserved = BIT(1) | BIT(2),
 };
@@ -1070,6 +1086,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) },
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
         { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
@@ -1544,13 +1561,18 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
 
-        /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
          .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff),
+         .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+         .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
         { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
 
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
@@ -1724,6 +1746,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+        { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
@@ -1916,6 +1939,8 @@ static void option_instat_callback(struct urb *urb)
                         dev_dbg(dev, "%s: type %x req %x\n", __func__,
                                 req_pkt->bRequestType, req_pkt->bRequest);
                 }
+        } else if (status == -ENOENT || status == -ESHUTDOWN) {
+                dev_dbg(dev, "%s: urb stopped: %d\n", __func__, status);
         } else
                 dev_err(dev, "%s: error %d\n", __func__, status);
 
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index b3d5a35c0d4b..e9bad928039f 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -45,6 +45,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 42bc082896ac..71fd9da1d6e7 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -22,6 +22,7 @@
 #define PL2303_PRODUCT_ID_GPRS          0x0609
 #define PL2303_PRODUCT_ID_HCR331        0x331a
 #define PL2303_PRODUCT_ID_MOTOROLA      0x0307
+#define PL2303_PRODUCT_ID_ZTEK          0xe1f1
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 02de3110fe94..475723c006f9 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_interface *interface,
                 if (usb_endpoint_is_bulk_in(endpoint)) {
                         /* we found a bulk in endpoint */
                         dev_dbg(ddev, "found bulk in on endpoint %d\n", i);
-                        bulk_in_endpoint[num_bulk_in] = endpoint;
-                        ++num_bulk_in;
+                        if (num_bulk_in < MAX_NUM_PORTS) {
+                                bulk_in_endpoint[num_bulk_in] = endpoint;
+                                ++num_bulk_in;
+                        }
                 }
 
                 if (usb_endpoint_is_bulk_out(endpoint)) {
                         /* we found a bulk out endpoint */
                         dev_dbg(ddev, "found bulk out on endpoint %d\n", i);
-                        bulk_out_endpoint[num_bulk_out] = endpoint;
-                        ++num_bulk_out;
+                        if (num_bulk_out < MAX_NUM_PORTS) {
+                                bulk_out_endpoint[num_bulk_out] = endpoint;
+                                ++num_bulk_out;
+                        }
                 }
 
                 if (usb_endpoint_is_int_in(endpoint)) {
                         /* we found a interrupt in endpoint */
                         dev_dbg(ddev, "found interrupt in on endpoint %d\n", i);
-                        interrupt_in_endpoint[num_interrupt_in] = endpoint;
-                        ++num_interrupt_in;
+                        if (num_interrupt_in < MAX_NUM_PORTS) {
+                                interrupt_in_endpoint[num_interrupt_in] =
+                                                endpoint;
+                                ++num_interrupt_in;
+                        }
                 }
 
                 if (usb_endpoint_is_int_out(endpoint)) {
                         /* we found an interrupt out endpoint */
                         dev_dbg(ddev, "found interrupt out on endpoint %d\n", i);
-                        interrupt_out_endpoint[num_interrupt_out] = endpoint;
-                        ++num_interrupt_out;
+                        if (num_interrupt_out < MAX_NUM_PORTS) {
+                                interrupt_out_endpoint[num_interrupt_out] =
+                                                endpoint;
+                                ++num_interrupt_out;
+                        }
                 }
         }
 
@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_interface *interface,
                                 if (usb_endpoint_is_int_in(endpoint)) {
                                         /* we found a interrupt in endpoint */
                                         dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n");
-                                        interrupt_in_endpoint[num_interrupt_in] = endpoint;
-                                        ++num_interrupt_in;
+                                        if (num_interrupt_in < MAX_NUM_PORTS) {
+                                                interrupt_in_endpoint[num_interrupt_in] = endpoint;
+                                                ++num_interrupt_in;
+                                        }
                                 }
                         }
                 }
@@ -850,6 +862,11 @@ static int usb_serial_probe(struct usb_interface *interface,
                         num_ports = type->num_ports;
         }
 
+        if (num_ports > MAX_NUM_PORTS) {
+                dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+                num_ports = MAX_NUM_PORTS;
+        }
+
         serial->num_ports = num_ports;
         serial->num_bulk_in = num_bulk_in;
         serial->num_bulk_out = num_bulk_out;
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index e62f2dff8b7d..6c3734d2b45a 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -514,6 +514,10 @@ static void command_port_read_callback(struct urb *urb)
                 dev_dbg(&urb->dev->dev, "%s - command_info is NULL, exiting.\n", __func__);
                 return;
         }
+        if (!urb->actual_length) {
+                dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
+                return;
+        }
         if (status) {
                 dev_dbg(&urb->dev->dev, "%s - nonzero urb status: %d\n", __func__, status);
                 if (status != -ENOENT)
@@ -534,7 +538,8 @@ static void command_port_read_callback(struct urb *urb)
                 /* These are unsolicited reports from the firmware, hence no
                    waiting command to wakeup */
                 dev_dbg(&urb->dev->dev, "%s - event received\n", __func__);
-        } else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
+        } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
+                (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
                 memcpy(command_info->result_buffer, &data[1],
                                                 urb->actual_length - 1);
                 command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
diff --git a/drivers/usb/serial/zte_ev.c b/drivers/usb/serial/zte_ev.c
index e40ab739c4a6..1a132e9e947a 100644
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -272,28 +272,8 @@ static void zte_ev_usb_serial_close(struct usb_serial_port *port)
 }
 
 static const struct usb_device_id id_table[] = {
-        /* AC8710, AC8710T */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffff, 0xff, 0xff, 0xff) },
-         /* AC8700 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfffe, 0xff, 0xff, 0xff) },
         /* MG880 */
         { USB_DEVICE(0x19d2, 0xfffd) },
-        { USB_DEVICE(0x19d2, 0xfffc) },
-        { USB_DEVICE(0x19d2, 0xfffb) },
-        /* AC8710_V3 */
-        { USB_DEVICE(0x19d2, 0xfff6) },
-        { USB_DEVICE(0x19d2, 0xfff7) },
-        { USB_DEVICE(0x19d2, 0xfff8) },
-        { USB_DEVICE(0x19d2, 0xfff9) },
-        { USB_DEVICE(0x19d2, 0xffee) },
-        /* AC2716, MC2716 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffed, 0xff, 0xff, 0xff) },
-        /* AD3812 */
-        { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffeb, 0xff, 0xff, 0xff) },
-        { USB_DEVICE(0x19d2, 0xffec) },
-        { USB_DEVICE(0x05C6, 0x3197) },
-        { USB_DEVICE(0x05C6, 0x6000) },
-        { USB_DEVICE(0x05C6, 0x9008) },
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 80a5b366255f..7ef99b2f3aaf 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -922,6 +922,12 @@ UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+UNUSUAL_DEV(  0x06ca, 0x2003, 0x0100, 0x0100,
+                "Newer Technology",
+                "uSCSI",
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+                US_FL_SCM_MULT_TARG ),
+
 /* Reported by Adrian Pilchowiec <adi1981@epf.pl> */
 UNUSUAL_DEV(  0x071b, 0x3203, 0x0000, 0x0000,
                 "RockChip",
diff --git a/drivers/staging/usbip/Kconfig b/drivers/usb/usbip/Kconfig
index bd99e9e47e50..bd99e9e47e50 100644
--- a/drivers/staging/usbip/Kconfig
+++ b/drivers/usb/usbip/Kconfig
diff --git a/drivers/staging/usbip/Makefile b/drivers/usb/usbip/Makefile
index 9ecd61545be1..9ecd61545be1 100644
--- a/drivers/staging/usbip/Makefile
+++ b/drivers/usb/usbip/Makefile
diff --git a/drivers/staging/usbip/README b/drivers/usb/usbip/README
index 41a2cf2e77a6..41a2cf2e77a6 100644
--- a/drivers/staging/usbip/README
+++ b/drivers/usb/usbip/README
diff --git a/drivers/staging/usbip/stub.h b/drivers/usb/usbip/stub.h
index 266e2b0ce9a8..266e2b0ce9a8 100644
--- a/drivers/staging/usbip/stub.h
+++ b/drivers/usb/usbip/stub.h
diff --git a/drivers/staging/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 51d0c7188738..fac20e0434c0 100644
--- a/drivers/staging/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -26,33 +26,6 @@
 #include "stub.h"
 
 /*
- * Define device IDs here if you want to explicitly limit exportable devices.
- * In most cases, wildcard matching will be okay because driver binding can be
- * changed dynamically by a userland program.
- */
-static struct usb_device_id stub_table[] = {
-#if 0
-        /* just an example */
-        { USB_DEVICE(0x05ac, 0x0301) },   /* Mac 1 button mouse */
-        { USB_DEVICE(0x0430, 0x0009) },   /* Plat Home Keyboard */
-        { USB_DEVICE(0x059b, 0x0001) },   /* Iomega USB Zip 100 */
-        { USB_DEVICE(0x04b3, 0x4427) },   /* IBM USB CD-ROM */
-        { USB_DEVICE(0x05a9, 0xa511) },   /* LifeView USB cam */
-        { USB_DEVICE(0x55aa, 0x0201) },   /* Imation card reader */
-        { USB_DEVICE(0x046d, 0x0870) },   /* Qcam Express(QV-30) */
-        { USB_DEVICE(0x04bb, 0x0101) },   /* IO-DATA HD 120GB */
-        { USB_DEVICE(0x04bb, 0x0904) },   /* IO-DATA USB-ET/TX */
-        { USB_DEVICE(0x04bb, 0x0201) },   /* IO-DATA USB-ET/TX */
-        { USB_DEVICE(0x08bb, 0x2702) },   /* ONKYO USB Speaker */
-        { USB_DEVICE(0x046d, 0x08b2) },   /* Logicool Qcam 4000 Pro */
-#endif
-        /* magic for wild card */
-        { .driver_info = 1 },
-        { 0, }                                     /* Terminating entry */
-};
-MODULE_DEVICE_TABLE(usb, stub_table);
-
-/*
  * usbip_status shows the status of usbip-host as long as this driver is bound
  * to the target device.
  */
diff --git a/drivers/staging/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index 44ab43fc4fcc..44ab43fc4fcc 100644
--- a/drivers/staging/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 00e475c51a12..00e475c51a12 100644
--- a/drivers/staging/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
diff --git a/drivers/staging/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
index dbcabc9dbe0d..dbcabc9dbe0d 100644
--- a/drivers/staging/usbip/stub_tx.c
+++ b/drivers/usb/usbip/stub_tx.c
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index facaaf003f19..facaaf003f19 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index 4da3866a037d..86b08475c254 100644
--- a/drivers/staging/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -29,7 +29,7 @@
 #include <linux/types.h>
 #include <linux/usb.h>
 #include <linux/wait.h>
-#include "uapi/usbip.h"
+#include <uapi/linux/usbip.h>
 
 #define USBIP_VERSION "1.0.0"
 
diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 64933b993d7a..64933b993d7a 100644
--- a/drivers/staging/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
diff --git a/drivers/staging/usbip/usbip_protocol.txt b/drivers/usb/usbip/usbip_protocol.txt
index 16b6fe27284c..16b6fe27284c 100644
--- a/drivers/staging/usbip/usbip_protocol.txt
+++ b/drivers/usb/usbip/usbip_protocol.txt
diff --git a/drivers/staging/usbip/vhci.h b/drivers/usb/usbip/vhci.h
index a863a98a91ce..a863a98a91ce 100644
--- a/drivers/staging/usbip/vhci.h
+++ b/drivers/usb/usbip/vhci.h
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index c02374b6049c..c02374b6049c 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
index 00e4a54308e4..00e4a54308e4 100644
--- a/drivers/staging/usbip/vhci_rx.c
+++ b/drivers/usb/usbip/vhci_rx.c
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index 211f43f67ea2..211f43f67ea2 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
diff --git a/drivers/staging/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
index 409fd99f3257..409fd99f3257 100644
--- a/drivers/staging/usbip/vhci_tx.c
+++ b/drivers/usb/usbip/vhci_tx.c
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 3e2e4ed20157..e279015be466 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -2602,6 +2602,7 @@ static void wa_buf_in_cb(struct urb *urb)
         dev = &wa->usb_iface->dev;
         --(wa->active_buf_in_urbs);
         active_buf_in_urbs = wa->active_buf_in_urbs;
+        rpipe = xfer->ep->hcpriv;
 
         if (usb_pipeisoc(xfer->urb->pipe)) {
                 struct usb_iso_packet_descriptor *iso_frame_desc =
@@ -2659,7 +2660,6 @@ static void wa_buf_in_cb(struct urb *urb)
                           resubmit_dti = (isoc_data_frame_count ==
                                                         urb_frame_count);
                 } else if (active_buf_in_urbs == 0) {
-                        rpipe = xfer->ep->hcpriv;
                         dev_dbg(dev,
                                 "xfer %p 0x%08X#%u: data in done (%zu bytes)\n",
                                 xfer, wa_xfer_id(xfer), seg->index,
@@ -2685,7 +2685,6 @@ static void wa_buf_in_cb(struct urb *urb)
                  */
                 resubmit_dti = wa->dti_state != WA_DTI_TRANSFER_RESULT_PENDING;
                 spin_lock_irqsave(&xfer->lock, flags);
-                rpipe = xfer->ep->hcpriv;
                 if (printk_ratelimit())
                         dev_err(dev, "xfer %p 0x%08X#%u: data in error %d\n",
                                 xfer, wa_xfer_id(xfer), seg->index,
diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
index beadd3edaa17..a7b6217ac87b 100644
--- a/drivers/video/fbdev/amba-clcd.c
+++ b/drivers/video/fbdev/amba-clcd.c
@@ -24,6 +24,7 @@
 #include <linux/list.h>
 #include <linux/amba/bus.h>
 #include <linux/amba/clcd.h>
+#include <linux/bitops.h>
 #include <linux/clk.h>
 #include <linux/hardirq.h>
 #include <linux/dma-mapping.h>
@@ -650,6 +651,7 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
 {
         struct device_node *endpoint;
         int err;
+        unsigned int bpp;
         u32 max_bandwidth;
         u32 tft_r0b0g0[3];
 
@@ -667,11 +669,22 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)
 
         err = of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth",
                         &max_bandwidth);
-        if (!err)
-                fb->panel->bpp = 8 * max_bandwidth / (fb->panel->mode.xres *
-                                fb->panel->mode.yres * fb->panel->mode.refresh);
-        else
-                fb->panel->bpp = 32;
+        if (!err) {
+                /*
+                 * max_bandwidth is in bytes per second and pixclock in
+                 * pico-seconds, so the maximum allowed bits per pixel is
+                 *   8 * max_bandwidth / (PICOS2KHZ(pixclock) * 1000)
+                 * Rearrange this calculation to avoid overflow and then ensure
+                 * result is a valid format.
+                 */
+                bpp = max_bandwidth / (1000 / 8)
+                        / PICOS2KHZ(fb->panel->mode.pixclock);
+                bpp = rounddown_pow_of_two(bpp);
+                if (bpp > 32)
+                        bpp = 32;
+        } else
+                bpp = 32;
+        fb->panel->bpp = bpp;
 
 #ifdef CONFIG_CPU_BIG_ENDIAN
         fb->panel->cntl |= CNTL_BEBO;
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 92640d46770a..1d8bdb92939b 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -1102,12 +1102,14 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
         timings = of_get_display_timings(display_np);
         if (!timings) {
                 dev_err(dev, "failed to get display timings\n");
+                ret = -EINVAL;
                 goto put_display_node;
         }
 
         timings_np = of_find_node_by_name(display_np, "display-timings");
         if (!timings_np) {
                 dev_err(dev, "failed to find display-timings node\n");
+                ret = -ENODEV;
                 goto put_display_node;
         }
 
diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index 206a66b61072..59abdc6a97f6 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -273,7 +273,7 @@ static struct chips_init_reg chips_init_xr[] = {
         { 0xa8, 0x00 }
 };
 
-static void __init chips_hw_init(void)
+static void chips_hw_init(void)
 {
         int i;
 
diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
index 788f6b37fce7..10c876c95772 100644
--- a/drivers/video/fbdev/da8xx-fb.c
+++ b/drivers/video/fbdev/da8xx-fb.c
@@ -419,7 +419,7 @@ static void lcd_cfg_horizontal_sync(int back_porch, int pulse_width,
 {
         u32 reg;
 
-        reg = lcdc_read(LCD_RASTER_TIMING_0_REG) & 0xf;
+        reg = lcdc_read(LCD_RASTER_TIMING_0_REG) & 0x3ff;
         reg |= (((back_porch-1) & 0xff) << 24)
             | (((front_porch-1) & 0xff) << 16)
             | (((pulse_width-1) & 0x3f) << 10);
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 987edf110038..5c098d5b4043 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -236,6 +236,7 @@ timingfail:
         if (native_mode)
                 of_node_put(native_mode);
         display_timings_release(disp);
+        disp = NULL;
 entryfail:
         kfree(disp);
 dispfail:
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 5b19760b1de5..b0c225cdb52c 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1825,7 +1825,7 @@ ext4_group_first_block_no(struct super_block *sb, ext4_group_t group_no)
 /*
  * Special error return code only used by dx_probe() and its callers.
  */
-#define ERR_BAD_DX_DIR  -75000
+#define ERR_BAD_DX_DIR  (-(MAX_ERRNO - 1))
 
 /*
  * Timeout and state flag for lazy initialization inode thread.
@@ -2454,6 +2454,22 @@ static inline void ext4_update_i_disksize(struct inode *inode, loff_t newsize)
         up_write(&EXT4_I(inode)->i_data_sem);
 }
 
+/* Update i_size, i_disksize. Requires i_mutex to avoid races with truncate */
+static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
+{
+        int changed = 0;
+
+        if (newsize > inode->i_size) {
+                i_size_write(inode, newsize);
+                changed = 1;
+        }
+        if (newsize > EXT4_I(inode)->i_disksize) {
+                ext4_update_i_disksize(inode, newsize);
+                changed |= 2;
+        }
+        return changed;
+}
+
 struct ext4_group_info {
         unsigned long   bb_state;
         struct rb_root  bb_free_root;
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 76c2df382b7d..74292a71b384 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4665,7 +4665,8 @@ retry:
 }
 
 static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
-                                  ext4_lblk_t len, int flags, int mode)
+                                  ext4_lblk_t len, loff_t new_size,
+                                  int flags, int mode)
 {
         struct inode *inode = file_inode(file);
         handle_t *handle;
@@ -4674,8 +4675,10 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
         int retries = 0;
         struct ext4_map_blocks map;
         unsigned int credits;
+        loff_t epos;
 
         map.m_lblk = offset;
+        map.m_len = len;
         /*
          * Don't normalize the request if it can fit in one extent so
          * that it doesn't get unnecessarily split into multiple
@@ -4690,9 +4693,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
         credits = ext4_chunk_trans_blocks(inode, len);
 
 retry:
-        while (ret >= 0 && ret < len) {
-                map.m_lblk = map.m_lblk + ret;
-                map.m_len = len = len - ret;
+        while (ret >= 0 && len) {
                 handle = ext4_journal_start(inode, EXT4_HT_MAP_BLOCKS,
                                             credits);
                 if (IS_ERR(handle)) {
@@ -4709,6 +4710,21 @@ retry:
                         ret2 = ext4_journal_stop(handle);
                         break;
                 }
+                map.m_lblk += ret;
+                map.m_len = len = len - ret;
+                epos = (loff_t)map.m_lblk << inode->i_blkbits;
+                inode->i_ctime = ext4_current_time(inode);
+                if (new_size) {
+                        if (epos > new_size)
+                                epos = new_size;
+                        if (ext4_update_inode_size(inode, epos) & 0x1)
+                                inode->i_mtime = inode->i_ctime;
+                } else {
+                        if (epos > inode->i_size)
+                                ext4_set_inode_flag(inode,
+                                                    EXT4_INODE_EOFBLOCKS);
+                }
+                ext4_mark_inode_dirty(handle, inode);
                 ret2 = ext4_journal_stop(handle);
                 if (ret2)
                         break;
@@ -4731,7 +4747,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
         loff_t new_size = 0;
         int ret = 0;
         int flags;
-        int partial;
+        int credits;
+        int partial_begin, partial_end;
         loff_t start, end;
         ext4_lblk_t lblk;
         struct address_space *mapping = inode->i_mapping;
@@ -4771,7 +4788,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
         if (start < offset || end > offset + len)
                 return -EINVAL;
-        partial = (offset + len) & ((1 << blkbits) - 1);
+        partial_begin = offset & ((1 << blkbits) - 1);
+        partial_end = (offset + len) & ((1 << blkbits) - 1);
 
         lblk = start >> blkbits;
         max_blocks = (end >> blkbits);
@@ -4805,7 +4823,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
                  * If we have a partial block after EOF we have to allocate
                  * the entire block.
                  */
-                if (partial)
+                if (partial_end)
                         max_blocks += 1;
         }
 
@@ -4813,6 +4831,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
                 /* Now release the pages and zero block aligned part of pages*/
                 truncate_pagecache_range(inode, start, end - 1);
+                inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
 
                 /* Wait all existing dio workers, newcomers will block on i_mutex */
                 ext4_inode_block_unlocked_dio(inode);
@@ -4825,13 +4844,22 @@ static long ext4_zero_range(struct file *file, loff_t offset,
                 if (ret)
                         goto out_dio;
 
-                ret = ext4_alloc_file_blocks(file, lblk, max_blocks, flags,
-                                             mode);
+                ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size,
+                                             flags, mode);
                 if (ret)
                         goto out_dio;
         }
+        if (!partial_begin && !partial_end)
+                goto out_dio;
 
-        handle = ext4_journal_start(inode, EXT4_HT_MISC, 4);
+        /*
+         * In worst case we have to writeout two nonadjacent unwritten
+         * blocks and update the inode
+         */
+        credits = (2 * ext4_ext_index_trans_blocks(inode, 2)) + 1;
+        if (ext4_should_journal_data(inode))
+                credits += 2;
+        handle = ext4_journal_start(inode, EXT4_HT_MISC, credits);
         if (IS_ERR(handle)) {
                 ret = PTR_ERR(handle);
                 ext4_std_error(inode->i_sb, ret);
@@ -4839,12 +4867,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
         }
 
         inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
-
         if (new_size) {
-                if (new_size > i_size_read(inode))
-                        i_size_write(inode, new_size);
-                if (new_size > EXT4_I(inode)->i_disksize)
-                        ext4_update_i_disksize(inode, new_size);
+                ext4_update_inode_size(inode, new_size);
         } else {
                 /*
                 * Mark that we allocate beyond EOF so the subsequent truncate
@@ -4853,7 +4877,6 @@ static long ext4_zero_range(struct file *file, loff_t offset,
                 if ((offset + len) > i_size_read(inode))
                         ext4_set_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
         }
-
         ext4_mark_inode_dirty(handle, inode);
 
         /* Zero out partial block at the edges of the range */
@@ -4880,13 +4903,11 @@ out_mutex:
 long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 {
         struct inode *inode = file_inode(file);
-        handle_t *handle;
         loff_t new_size = 0;
         unsigned int max_blocks;
         int ret = 0;
         int flags;
         ext4_lblk_t lblk;
-        struct timespec tv;
         unsigned int blkbits = inode->i_blkbits;
 
         /* Return error if mode is not supported */
@@ -4937,36 +4958,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
                         goto out;
         }
 
-        ret = ext4_alloc_file_blocks(file, lblk, max_blocks, flags, mode);
+        ret = ext4_alloc_file_blocks(file, lblk, max_blocks, new_size,
+                                     flags, mode);
         if (ret)
                 goto out;
 
-        handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
-        if (IS_ERR(handle))
-                goto out;
-
-        tv = inode->i_ctime = ext4_current_time(inode);
-
-        if (new_size) {
-                if (new_size > i_size_read(inode)) {
-                        i_size_write(inode, new_size);
-                        inode->i_mtime = tv;
-                }
-                if (new_size > EXT4_I(inode)->i_disksize)
-                        ext4_update_i_disksize(inode, new_size);
-        } else {
-                /*
-                * Mark that we allocate beyond EOF so the subsequent truncate
-                * can proceed even if the new size is the same as i_size.
-                */
-                if ((offset + len) > i_size_read(inode))
-                        ext4_set_inode_flag(inode, EXT4_INODE_EOFBLOCKS);
+        if (file->f_flags & O_SYNC && EXT4_SB(inode->i_sb)->s_journal) {
+                ret = jbd2_complete_transaction(EXT4_SB(inode->i_sb)->s_journal,
+                                                EXT4_I(inode)->i_sync_tid);
         }
-        ext4_mark_inode_dirty(handle, inode);
-        if (file->f_flags & O_SYNC)
-                ext4_handle_sync(handle);
-
-        ext4_journal_stop(handle);
 out:
         mutex_unlock(&inode->i_mutex);
         trace_ext4_fallocate_exit(inode, offset, max_blocks, ret);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 367a60c07cf0..3aa26e9117c4 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1055,27 +1055,11 @@ static int ext4_write_end(struct file *file,
         } else
                 copied = block_write_end(file, mapping, pos,
                                          len, copied, page, fsdata);
-
         /*
-         * No need to use i_size_read() here, the i_size
-         * cannot change under us because we hole i_mutex.
-         *
-         * But it's important to update i_size while still holding page lock:
+         * it's important to update i_size while still holding page lock:
          * page writeout could otherwise come in and zero beyond i_size.
          */
-        if (pos + copied > inode->i_size) {
-                i_size_write(inode, pos + copied);
-                i_size_changed = 1;
-        }
-
-        if (pos + copied > EXT4_I(inode)->i_disksize) {
-                /* We need to mark inode dirty even if
-                 * new_i_size is less that inode->i_size
-                 * but greater than i_disksize. (hint delalloc)
-                 */
-                ext4_update_i_disksize(inode, (pos + copied));
-                i_size_changed = 1;
-        }
+        i_size_changed = ext4_update_inode_size(inode, pos + copied);
         unlock_page(page);
         page_cache_release(page);
 
@@ -1123,7 +1107,7 @@ static int ext4_journalled_write_end(struct file *file,
         int ret = 0, ret2;
         int partial = 0;
         unsigned from, to;
-        loff_t new_i_size;
+        int size_changed = 0;
 
         trace_ext4_journalled_write_end(inode, pos, len, copied);
         from = pos & (PAGE_CACHE_SIZE - 1);
@@ -1146,20 +1130,18 @@ static int ext4_journalled_write_end(struct file *file,
                 if (!partial)
                         SetPageUptodate(page);
         }
-        new_i_size = pos + copied;
-        if (new_i_size > inode->i_size)
-                i_size_write(inode, pos+copied);
+        size_changed = ext4_update_inode_size(inode, pos + copied);
         ext4_set_inode_state(inode, EXT4_STATE_JDATA);
         EXT4_I(inode)->i_datasync_tid = handle->h_transaction->t_tid;
-        if (new_i_size > EXT4_I(inode)->i_disksize) {
-                ext4_update_i_disksize(inode, new_i_size);
+        unlock_page(page);
+        page_cache_release(page);
+
+        if (size_changed) {
                 ret2 = ext4_mark_inode_dirty(handle, inode);
                 if (!ret)
                         ret = ret2;
         }
 
-        unlock_page(page);
-        page_cache_release(page);
         if (pos + len > inode->i_size && ext4_can_truncate(inode))
                 /* if we have allocated more blocks and copied
                  * less. We will have blocks allocated outside
@@ -2095,6 +2077,7 @@ static int mpage_map_and_submit_extent(handle_t *handle,
         struct ext4_map_blocks *map = &mpd->map;
         int err;
         loff_t disksize;
+        int progress = 0;
 
         mpd->io_submit.io_end->offset =
                                 ((loff_t)map->m_lblk) << inode->i_blkbits;
@@ -2111,8 +2094,11 @@ static int mpage_map_and_submit_extent(handle_t *handle,
                          * is non-zero, a commit should free up blocks.
                          */
                         if ((err == -ENOMEM) ||
-                            (err == -ENOSPC && ext4_count_free_clusters(sb)))
+                            (err == -ENOSPC && ext4_count_free_clusters(sb))) {
+                                if (progress)
+                                        goto update_disksize;
                                 return err;
+                        }
                         ext4_msg(sb, KERN_CRIT,
                                  "Delayed block allocation failed for "
                                  "inode %lu at logical offset %llu with"
@@ -2129,15 +2115,17 @@ static int mpage_map_and_submit_extent(handle_t *handle,
                         *give_up_on_write = true;
                         return err;
                 }
+                progress = 1;
                 /*
                  * Update buffer state, submit mapped pages, and get us new
                  * extent to map
                  */
                 err = mpage_map_and_submit_buffers(mpd);
                 if (err < 0)
-                        return err;
+                        goto update_disksize;
         } while (map->m_len);
 
+update_disksize:
         /*
          * Update on-disk size after IO is submitted.  Races with
          * truncate are avoided by checking i_size under i_data_sem.
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 956027711faf..8b0f9ef517d6 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1412,6 +1412,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
         int last = first + count - 1;
         struct super_block *sb = e4b->bd_sb;
 
+        if (WARN_ON(count == 0))
+                return;
         BUG_ON(last >= (sb->s_blocksize << 3));
         assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
         /* Don't bother if the block group is corrupt. */
@@ -3221,6 +3223,8 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
         int err;
 
         if (pa == NULL) {
+                if (ac->ac_f_ex.fe_len == 0)
+                        return;
                 err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
                 if (err) {
                         /*
@@ -3235,6 +3239,7 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
                 mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
                                ac->ac_f_ex.fe_len);
                 ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
+                ext4_mb_unload_buddy(&e4b);
                 return;
         }
         if (pa->pa_type == MB_INODE_PA)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b147a67baa0d..90a3cdca3f88 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1227,7 +1227,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
                                    buffer */
         int num = 0;
         ext4_lblk_t  nblocks;
-        int i, err;
+        int i, err = 0;
         int namelen;
 
         *res_dir = NULL;
@@ -1264,7 +1264,11 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
                  * return.  Otherwise, fall back to doing a search the
                  * old fashioned way.
                  */
-                if (bh || (err != ERR_BAD_DX_DIR))
+                if (err == -ENOENT)
+                        return NULL;
+                if (err && err != ERR_BAD_DX_DIR)
+                        return ERR_PTR(err);
+                if (bh)
                         return bh;
                 dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, "
                                "falling back\n"));
@@ -1295,6 +1299,11 @@ restart:
                                 }
                                 num++;
                                 bh = ext4_getblk(NULL, dir, b++, 0, &err);
+                                if (unlikely(err)) {
+                                        if (ra_max == 0)
+                                                return ERR_PTR(err);
+                                        break;
+                                }
                                 bh_use[ra_max] = bh;
                                 if (bh)
                                         ll_rw_block(READ | REQ_META | REQ_PRIO,
@@ -1417,6 +1426,8 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
                 return ERR_PTR(-ENAMETOOLONG);
 
         bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return (struct dentry *) bh;
         inode = NULL;
         if (bh) {
                 __u32 ino = le32_to_cpu(de->inode);
@@ -1450,6 +1461,8 @@ struct dentry *ext4_get_parent(struct dentry *child)
         struct buffer_head *bh;
 
         bh = ext4_find_entry(child->d_inode, &dotdot, &de, NULL);
+        if (IS_ERR(bh))
+                return (struct dentry *) bh;
         if (!bh)
                 return ERR_PTR(-ENOENT);
         ino = le32_to_cpu(de->inode);
@@ -2727,6 +2740,8 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
 
         retval = -ENOENT;
         bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return PTR_ERR(bh);
         if (!bh)
                 goto end_rmdir;
 
@@ -2794,6 +2809,8 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
 
         retval = -ENOENT;
         bh = ext4_find_entry(dir, &dentry->d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return PTR_ERR(bh);
         if (!bh)
                 goto end_unlink;
 
@@ -3121,6 +3138,8 @@ static int ext4_find_delete_entry(handle_t *handle, struct inode *dir,
         struct ext4_dir_entry_2 *de;
 
         bh = ext4_find_entry(dir, d_name, &de, NULL);
+        if (IS_ERR(bh))
+                return PTR_ERR(bh);
         if (bh) {
                 retval = ext4_delete_entry(handle, dir, de, bh);
                 brelse(bh);
@@ -3128,7 +3147,8 @@ static int ext4_find_delete_entry(handle_t *handle, struct inode *dir,
         return retval;
 }
 
-static void ext4_rename_delete(handle_t *handle, struct ext4_renament *ent)
+static void ext4_rename_delete(handle_t *handle, struct ext4_renament *ent,
+                               int force_reread)
 {
         int retval;
         /*
@@ -3140,7 +3160,8 @@ static void ext4_rename_delete(handle_t *handle, struct ext4_renament *ent)
         if (le32_to_cpu(ent->de->inode) != ent->inode->i_ino ||
             ent->de->name_len != ent->dentry->d_name.len ||
             strncmp(ent->de->name, ent->dentry->d_name.name,
-                    ent->de->name_len)) {
+                    ent->de->name_len) ||
+            force_reread) {
                 retval = ext4_find_delete_entry(handle, ent->dir,
                                                 &ent->dentry->d_name);
         } else {
@@ -3191,6 +3212,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 .dentry = new_dentry,
                 .inode = new_dentry->d_inode,
         };
+        int force_reread;
         int retval;
 
         dquot_initialize(old.dir);
@@ -3202,6 +3224,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 dquot_initialize(new.inode);
 
         old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL);
+        if (IS_ERR(old.bh))
+                return PTR_ERR(old.bh);
         /*
          *  Check for inode number is _not_ due to possible IO errors.
          *  We might rmdir the source, keep it as pwd of some process
@@ -3214,6 +3238,10 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         new.bh = ext4_find_entry(new.dir, &new.dentry->d_name,
                                  &new.de, &new.inlined);
+        if (IS_ERR(new.bh)) {
+                retval = PTR_ERR(new.bh);
+                goto end_rename;
+        }
         if (new.bh) {
                 if (!new.inode) {
                         brelse(new.bh);
@@ -3246,6 +3274,15 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (retval)
                         goto end_rename;
         }
+        /*
+         * If we're renaming a file within an inline_data dir and adding or
+         * setting the new dirent causes a conversion from inline_data to
+         * extents/blockmap, we need to force the dirent delete code to
+         * re-read the directory, or else we end up trying to delete a dirent
+         * from what is now the extent tree root (or a block map).
+         */
+        force_reread = (new.dir->i_ino == old.dir->i_ino &&
+                        ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
         if (!new.bh) {
                 retval = ext4_add_entry(handle, new.dentry, old.inode);
                 if (retval)
@@ -3256,6 +3293,9 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (retval)
                         goto end_rename;
         }
+        if (force_reread)
+                force_reread = !ext4_test_inode_flag(new.dir,
+                                                     EXT4_INODE_INLINE_DATA);
 
         /*
          * Like most other Unix systems, set the ctime for inodes on a
@@ -3267,7 +3307,7 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
         /*
          * ok, that's it
          */
-        ext4_rename_delete(handle, &old);
+        ext4_rename_delete(handle, &old, force_reread);
 
         if (new.inode) {
                 ext4_dec_count(handle, new.inode);
@@ -3330,6 +3370,8 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         old.bh = ext4_find_entry(old.dir, &old.dentry->d_name,
                                  &old.de, &old.inlined);
+        if (IS_ERR(old.bh))
+                return PTR_ERR(old.bh);
         /*
          *  Check for inode number is _not_ due to possible IO errors.
          *  We might rmdir the source, keep it as pwd of some process
@@ -3342,6 +3384,10 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         new.bh = ext4_find_entry(new.dir, &new.dentry->d_name,
                                  &new.de, &new.inlined);
+        if (IS_ERR(new.bh)) {
+                retval = PTR_ERR(new.bh);
+                goto end_rename;
+        }
 
         /* RENAME_EXCHANGE case: old *and* new must both exist */
         if (!new.bh || le32_to_cpu(new.de->inode) != new.inode->i_ino)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 32b43ad154b9..0b28b36e7915 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3181,9 +3181,9 @@ static int set_journal_csum_feature_set(struct super_block *sb)
 
         if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
                                        EXT4_FEATURE_RO_COMPAT_METADATA_CSUM)) {
-                /* journal checksum v2 */
+                /* journal checksum v3 */
                 compat = 0;
-                incompat = JBD2_FEATURE_INCOMPAT_CSUM_V2;
+                incompat = JBD2_FEATURE_INCOMPAT_CSUM_V3;
         } else {
                 /* journal checksum v1 */
                 compat = JBD2_FEATURE_COMPAT_CHECKSUM;
@@ -3205,6 +3205,7 @@ static int set_journal_csum_feature_set(struct super_block *sb)
                 jbd2_journal_clear_features(sbi->s_journal,
                                 JBD2_FEATURE_COMPAT_CHECKSUM, 0,
                                 JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT |
+                                JBD2_FEATURE_INCOMPAT_CSUM_V3 |
                                 JBD2_FEATURE_INCOMPAT_CSUM_V2);
         }
 
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 6fac74349856..b73e0215baa7 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -97,7 +97,7 @@ static void jbd2_commit_block_csum_set(journal_t *j, struct buffer_head *bh)
         struct commit_header *h;
         __u32 csum;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         h = (struct commit_header *)(bh->b_data);
@@ -313,11 +313,11 @@ static __u32 jbd2_checksum_data(__u32 crc32_sum, struct buffer_head *bh)
         return checksum;
 }
 
-static void write_tag_block(int tag_bytes, journal_block_tag_t *tag,
+static void write_tag_block(journal_t *j, journal_block_tag_t *tag,
                                    unsigned long long block)
 {
         tag->t_blocknr = cpu_to_be32(block & (u32)~0);
-        if (tag_bytes > JBD2_TAG_SIZE32)
+        if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_64BIT))
                 tag->t_blocknr_high = cpu_to_be32((block >> 31) >> 1);
 }
 
@@ -327,7 +327,7 @@ static void jbd2_descr_block_csum_set(journal_t *j,
         struct jbd2_journal_block_tail *tail;
         __u32 csum;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         tail = (struct jbd2_journal_block_tail *)(bh->b_data + j->j_blocksize -
@@ -340,12 +340,13 @@ static void jbd2_descr_block_csum_set(journal_t *j,
 static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
                                     struct buffer_head *bh, __u32 sequence)
 {
+        journal_block_tag3_t *tag3 = (journal_block_tag3_t *)tag;
         struct page *page = bh->b_page;
         __u8 *addr;
         __u32 csum32;
         __be32 seq;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         seq = cpu_to_be32(sequence);
@@ -355,8 +356,10 @@ static void jbd2_block_tag_csum_set(journal_t *j, journal_block_tag_t *tag,
                              bh->b_size);
         kunmap_atomic(addr);
 
-        /* We only have space to store the lower 16 bits of the crc32c. */
-        tag->t_checksum = cpu_to_be16(csum32);
+        if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                tag3->t_checksum = cpu_to_be32(csum32);
+        else
+                tag->t_checksum = cpu_to_be16(csum32);
 }
 /*
  * jbd2_journal_commit_transaction
@@ -396,7 +399,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
         LIST_HEAD(io_bufs);
         LIST_HEAD(log_bufs);
 
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 csum_size = sizeof(struct jbd2_journal_block_tail);
 
         /*
@@ -690,7 +693,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
                         tag_flag |= JBD2_FLAG_SAME_UUID;
 
                 tag = (journal_block_tag_t *) tagp;
-                write_tag_block(tag_bytes, tag, jh2bh(jh)->b_blocknr);
+                write_tag_block(journal, tag, jh2bh(jh)->b_blocknr);
                 tag->t_flags = cpu_to_be16(tag_flag);
                 jbd2_block_tag_csum_set(journal, tag, wbuf[bufs],
                                         commit_transaction->t_tid);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 67b8e303946c..19d74d86d99c 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -124,7 +124,7 @@ EXPORT_SYMBOL(__jbd2_debug);
 /* Checksumming functions */
 static int jbd2_verify_csum_type(journal_t *j, journal_superblock_t *sb)
 {
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         return sb->s_checksum_type == JBD2_CRC32C_CHKSUM;
@@ -145,7 +145,7 @@ static __be32 jbd2_superblock_csum(journal_t *j, journal_superblock_t *sb)
 
 static int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
 {
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         return sb->s_checksum == jbd2_superblock_csum(j, sb);
@@ -153,7 +153,7 @@ static int jbd2_superblock_csum_verify(journal_t *j, journal_superblock_t *sb)
 
 static void jbd2_superblock_csum_set(journal_t *j, journal_superblock_t *sb)
 {
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         sb->s_checksum = jbd2_superblock_csum(j, sb);
@@ -1522,21 +1522,29 @@ static int journal_get_superblock(journal_t *journal)
                 goto out;
         }
 
-        if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
-            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+        if (jbd2_journal_has_csum_v2or3(journal) &&
+            JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM)) {
                 /* Can't have checksum v1 and v2 on at the same time! */
                 printk(KERN_ERR "JBD2: Can't enable checksumming v1 and v2 "
                        "at the same time!\n");
                 goto out;
         }
 
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2) &&
+            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
+                /* Can't have checksum v2 and v3 at the same time! */
+                printk(KERN_ERR "JBD2: Can't enable checksumming v2 and v3 "
+                       "at the same time!\n");
+                goto out;
+        }
+
         if (!jbd2_verify_csum_type(journal, sb)) {
                 printk(KERN_ERR "JBD2: Unknown checksum type\n");
                 goto out;
         }
 
         /* Load the checksum driver */
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+        if (jbd2_journal_has_csum_v2or3(journal)) {
                 journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
                 if (IS_ERR(journal->j_chksum_driver)) {
                         printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
@@ -1553,7 +1561,7 @@ static int journal_get_superblock(journal_t *journal)
         }
 
         /* Precompute checksum seed for all metadata */
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 journal->j_csum_seed = jbd2_chksum(journal, ~0, sb->s_uuid,
                                                    sizeof(sb->s_uuid));
 
@@ -1813,8 +1821,14 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
         if (!jbd2_journal_check_available_features(journal, compat, ro, incompat))
                 return 0;
 
-        /* Asking for checksumming v2 and v1?  Only give them v2. */
-        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2 &&
+        /* If enabling v2 checksums, turn on v3 instead */
+        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V2) {
+                incompat &= ~JBD2_FEATURE_INCOMPAT_CSUM_V2;
+                incompat |= JBD2_FEATURE_INCOMPAT_CSUM_V3;
+        }
+
+        /* Asking for checksumming v3 and v1?  Only give them v3. */
+        if (incompat & JBD2_FEATURE_INCOMPAT_CSUM_V3 &&
             compat & JBD2_FEATURE_COMPAT_CHECKSUM)
                 compat &= ~JBD2_FEATURE_COMPAT_CHECKSUM;
 
@@ -1823,8 +1837,8 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
 
         sb = journal->j_superblock;
 
-        /* If enabling v2 checksums, update superblock */
-        if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
+        /* If enabling v3 checksums, update superblock */
+        if (INCOMPAT_FEATURE_ON(JBD2_FEATURE_INCOMPAT_CSUM_V3)) {
                 sb->s_checksum_type = JBD2_CRC32C_CHKSUM;
                 sb->s_feature_compat &=
                         ~cpu_to_be32(JBD2_FEATURE_COMPAT_CHECKSUM);
@@ -1842,8 +1856,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                 }
 
                 /* Precompute checksum seed for all metadata */
-                if (JBD2_HAS_INCOMPAT_FEATURE(journal,
-                                              JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                if (jbd2_journal_has_csum_v2or3(journal))
                         journal->j_csum_seed = jbd2_chksum(journal, ~0,
                                                            sb->s_uuid,
                                                            sizeof(sb->s_uuid));
@@ -1852,7 +1865,8 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
         /* If enabling v1 checksums, downgrade superblock */
         if (COMPAT_FEATURE_ON(JBD2_FEATURE_COMPAT_CHECKSUM))
                 sb->s_feature_incompat &=
-                        ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2);
+                        ~cpu_to_be32(JBD2_FEATURE_INCOMPAT_CSUM_V2 |
+                                     JBD2_FEATURE_INCOMPAT_CSUM_V3);
 
         sb->s_feature_compat    |= cpu_to_be32(compat);
         sb->s_feature_ro_compat |= cpu_to_be32(ro);
@@ -2165,16 +2179,20 @@ int jbd2_journal_blocks_per_page(struct inode *inode)
  */
 size_t journal_tag_bytes(journal_t *journal)
 {
-        journal_block_tag_t tag;
-        size_t x = 0;
+        size_t sz;
+
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                return sizeof(journal_block_tag3_t);
+
+        sz = sizeof(journal_block_tag_t);
 
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
-                x += sizeof(tag.t_checksum);
+                sz += sizeof(__u16);
 
         if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
-                return x + JBD2_TAG_SIZE64;
+                return sz;
         else
-                return x + JBD2_TAG_SIZE32;
+                return sz - sizeof(__u32);
 }
 
 /*
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 3b6bb19d60b1..9b329b55ffe3 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -181,7 +181,7 @@ static int jbd2_descr_block_csum_verify(journal_t *j,
         __be32 provided;
         __u32 calculated;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         tail = (struct jbd2_journal_block_tail *)(buf + j->j_blocksize -
@@ -205,7 +205,7 @@ static int count_tags(journal_t *journal, struct buffer_head *bh)
         int                     nr = 0, size = journal->j_blocksize;
         int                     tag_bytes = journal_tag_bytes(journal);
 
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 size -= sizeof(struct jbd2_journal_block_tail);
 
         tagp = &bh->b_data[sizeof(journal_header_t)];
@@ -338,10 +338,11 @@ int jbd2_journal_skip_recovery(journal_t *journal)
         return err;
 }
 
-static inline unsigned long long read_tag_block(int tag_bytes, journal_block_tag_t *tag)
+static inline unsigned long long read_tag_block(journal_t *journal,
+                                                journal_block_tag_t *tag)
 {
         unsigned long long block = be32_to_cpu(tag->t_blocknr);
-        if (tag_bytes > JBD2_TAG_SIZE32)
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
                 block |= (u64)be32_to_cpu(tag->t_blocknr_high) << 32;
         return block;
 }
@@ -384,7 +385,7 @@ static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
         __be32 provided;
         __u32 calculated;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         h = buf;
@@ -399,17 +400,21 @@ static int jbd2_commit_block_csum_verify(journal_t *j, void *buf)
 static int jbd2_block_tag_csum_verify(journal_t *j, journal_block_tag_t *tag,
                                       void *buf, __u32 sequence)
 {
+        journal_block_tag3_t *tag3 = (journal_block_tag3_t *)tag;
         __u32 csum32;
         __be32 seq;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         seq = cpu_to_be32(sequence);
         csum32 = jbd2_chksum(j, j->j_csum_seed, (__u8 *)&seq, sizeof(seq));
         csum32 = jbd2_chksum(j, csum32, buf, j->j_blocksize);
 
-        return tag->t_checksum == cpu_to_be16(csum32);
+        if (JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                return tag3->t_checksum == cpu_to_be32(csum32);
+        else
+                return tag->t_checksum == cpu_to_be16(csum32);
 }
 
 static int do_one_pass(journal_t *journal,
@@ -426,6 +431,7 @@ static int do_one_pass(journal_t *journal,
         int                     tag_bytes = journal_tag_bytes(journal);
         __u32                   crc32_sum = ~0; /* Transactional Checksums */
         int                     descr_csum_size = 0;
+        int                     block_error = 0;
 
         /*
          * First thing is to establish what we expect to find in the log
@@ -512,8 +518,7 @@ static int do_one_pass(journal_t *journal,
                 switch(blocktype) {
                 case JBD2_DESCRIPTOR_BLOCK:
                         /* Verify checksum first */
-                        if (JBD2_HAS_INCOMPAT_FEATURE(journal,
-                                        JBD2_FEATURE_INCOMPAT_CSUM_V2))
+                        if (jbd2_journal_has_csum_v2or3(journal))
                                 descr_csum_size =
                                         sizeof(struct jbd2_journal_block_tail);
                         if (descr_csum_size > 0 &&
@@ -574,7 +579,7 @@ static int do_one_pass(journal_t *journal,
                                         unsigned long long blocknr;
 
                                         J_ASSERT(obh != NULL);
-                                        blocknr = read_tag_block(tag_bytes,
+                                        blocknr = read_tag_block(journal,
                                                                  tag);
 
                                         /* If the block has been
@@ -598,7 +603,8 @@ static int do_one_pass(journal_t *journal,
                                                        "checksum recovering "
                                                        "block %llu in log\n",
                                                        blocknr);
-                                                continue;
+                                                block_error = 1;
+                                                goto skip_write;
                                         }
 
                                         /* Find a buffer for the new
@@ -797,7 +803,8 @@ static int do_one_pass(journal_t *journal,
                                 success = -EIO;
                 }
         }
-
+        if (block_error && success == 0)
+                success = -EIO;
         return success;
 
  failed:
@@ -811,7 +818,7 @@ static int jbd2_revoke_block_csum_verify(journal_t *j,
         __be32 provided;
         __u32 calculated;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return 1;
 
         tail = (struct jbd2_journal_revoke_tail *)(buf + j->j_blocksize -
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index 198c9c10276d..d5e95a175c92 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -91,8 +91,8 @@
 #include <linux/list.h>
 #include <linux/init.h>
 #include <linux/bio.h>
-#endif
 #include <linux/log2.h>
+#endif
 
 static struct kmem_cache *jbd2_revoke_record_cache;
 static struct kmem_cache *jbd2_revoke_table_cache;
@@ -597,7 +597,7 @@ static void write_one_revoke_record(journal_t *journal,
         offset = *offsetp;
 
         /* Do we need to leave space at the end for a checksum? */
-        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (jbd2_journal_has_csum_v2or3(journal))
                 csum_size = sizeof(struct jbd2_journal_revoke_tail);
 
         /* Make sure we have a descriptor with space left for the record */
@@ -644,7 +644,7 @@ static void jbd2_revoke_csum_set(journal_t *j, struct buffer_head *bh)
         struct jbd2_journal_revoke_tail *tail;
         __u32 csum;
 
-        if (!JBD2_HAS_INCOMPAT_FEATURE(j, JBD2_FEATURE_INCOMPAT_CSUM_V2))
+        if (!jbd2_journal_has_csum_v2or3(j))
                 return;
 
         tail = (struct jbd2_journal_revoke_tail *)(bh->b_data + j->j_blocksize -
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index d0fec260132a..24c6898159cc 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -129,7 +129,10 @@ static int __nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
                 .rpc_argp       = &args,
                 .rpc_resp       = &fattr,
         };
-        int status;
+        int status = 0;
+
+        if (acl == NULL && (!S_ISDIR(inode->i_mode) || dfacl == NULL))
+                goto out;
 
         status = -EOPNOTSUPP;
         if (!nfs_server_capable(inode, NFS_CAP_ACLS))
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 75ae8d22f067..7dd8aca31c29 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2560,6 +2560,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
         struct nfs4_closedata *calldata = data;
         struct nfs4_state *state = calldata->state;
         struct nfs_server *server = NFS_SERVER(calldata->inode);
+        nfs4_stateid *res_stateid = NULL;
 
         dprintk("%s: begin!\n", __func__);
         if (!nfs4_sequence_done(task, &calldata->res.seq_res))
@@ -2570,12 +2571,12 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
          */
         switch (task->tk_status) {
                 case 0:
-                        if (calldata->roc)
+                        res_stateid = &calldata->res.stateid;
+                        if (calldata->arg.fmode == 0 && calldata->roc)
                                 pnfs_roc_set_barrier(state->inode,
                                                      calldata->roc_barrier);
-                        nfs_clear_open_stateid(state, &calldata->res.stateid, 0);
                         renew_lease(server, calldata->timestamp);
-                        goto out_release;
+                        break;
                 case -NFS4ERR_ADMIN_REVOKED:
                 case -NFS4ERR_STALE_STATEID:
                 case -NFS4ERR_OLD_STATEID:
@@ -2589,7 +2590,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data)
                                 goto out_release;
                         }
         }
-        nfs_clear_open_stateid(state, NULL, calldata->arg.fmode);
+        nfs_clear_open_stateid(state, res_stateid, calldata->arg.fmode);
 out_release:
         nfs_release_seqid(calldata->arg.seqid);
         nfs_refresh_inode(calldata->inode, calldata->res.fattr);
@@ -2601,6 +2602,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
         struct nfs4_closedata *calldata = data;
         struct nfs4_state *state = calldata->state;
         struct inode *inode = calldata->inode;
+        bool is_rdonly, is_wronly, is_rdwr;
         int call_close = 0;
 
         dprintk("%s: begin!\n", __func__);
@@ -2608,18 +2610,24 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                 goto out_wait;
 
         task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
-        calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
         spin_lock(&state->owner->so_lock);
+        is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
+        is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
+        is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
+        /* Calculate the current open share mode */
+        calldata->arg.fmode = 0;
+        if (is_rdonly || is_rdwr)
+                calldata->arg.fmode |= FMODE_READ;
+        if (is_wronly || is_rdwr)
+                calldata->arg.fmode |= FMODE_WRITE;
         /* Calculate the change in open mode */
         if (state->n_rdwr == 0) {
                 if (state->n_rdonly == 0) {
-                        call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
-                        call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+                        call_close |= is_rdonly || is_rdwr;
                         calldata->arg.fmode &= ~FMODE_READ;
                 }
                 if (state->n_wronly == 0) {
-                        call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
-                        call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
+                        call_close |= is_wronly || is_rdwr;
                         calldata->arg.fmode &= ~FMODE_WRITE;
                 }
         }
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index eb726b9c5762..a1e31f274fcd 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -127,10 +127,9 @@ enum {
         BLK_MQ_RQ_QUEUE_ERROR   = 2,    /* end IO with error */
 
         BLK_MQ_F_SHOULD_MERGE   = 1 << 0,
-        BLK_MQ_F_SHOULD_SORT    = 1 << 1,
-        BLK_MQ_F_TAG_SHARED     = 1 << 2,
-        BLK_MQ_F_SG_MERGE       = 1 << 3,
-        BLK_MQ_F_SYSFS_UP       = 1 << 4,
+        BLK_MQ_F_TAG_SHARED     = 1 << 1,
+        BLK_MQ_F_SG_MERGE       = 1 << 2,
+        BLK_MQ_F_SYSFS_UP       = 1 << 3,
 
         BLK_MQ_S_STOPPED        = 0,
         BLK_MQ_S_TAG_ACTIVE     = 1,
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index d5b50a19463c..0dae71e9971c 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -159,7 +159,11 @@ typedef struct journal_header_s
  * journal_block_tag (in the descriptor).  The other h_chksum* fields are
  * not used.
  *
- * Checksum v1 and v2 are mutually exclusive features.
+ * If FEATURE_INCOMPAT_CSUM_V3 is set, the descriptor block uses
+ * journal_block_tag3_t to store a full 32-bit checksum.  Everything else
+ * is the same as v2.
+ *
+ * Checksum v1, v2, and v3 are mutually exclusive features.
  */
 struct commit_header {
         __be32          h_magic;
@@ -179,6 +183,14 @@ struct commit_header {
  * raw struct shouldn't be used for pointer math or sizeof() - use
  * journal_tag_bytes(journal) instead to compute this.
  */
+typedef struct journal_block_tag3_s
+{
+        __be32          t_blocknr;      /* The on-disk block number */
+        __be32          t_flags;        /* See below */
+        __be32          t_blocknr_high; /* most-significant high 32bits. */
+        __be32          t_checksum;     /* crc32c(uuid+seq+block) */
+} journal_block_tag3_t;
+
 typedef struct journal_block_tag_s
 {
         __be32          t_blocknr;      /* The on-disk block number */
@@ -187,9 +199,6 @@ typedef struct journal_block_tag_s
         __be32          t_blocknr_high; /* most-significant high 32bits. */
 } journal_block_tag_t;
 
-#define JBD2_TAG_SIZE32 (offsetof(journal_block_tag_t, t_blocknr_high))
-#define JBD2_TAG_SIZE64 (sizeof(journal_block_tag_t))
-
 /* Tail of descriptor block, for checksumming */
 struct jbd2_journal_block_tail {
         __be32          t_checksum;     /* crc32c(uuid+descr_block) */
@@ -284,6 +293,7 @@ typedef struct journal_superblock_s
 #define JBD2_FEATURE_INCOMPAT_64BIT             0x00000002
 #define JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT      0x00000004
 #define JBD2_FEATURE_INCOMPAT_CSUM_V2           0x00000008
+#define JBD2_FEATURE_INCOMPAT_CSUM_V3           0x00000010
 
 /* Features known to this kernel version: */
 #define JBD2_KNOWN_COMPAT_FEATURES      JBD2_FEATURE_COMPAT_CHECKSUM
@@ -291,7 +301,8 @@ typedef struct journal_superblock_s
 #define JBD2_KNOWN_INCOMPAT_FEATURES    (JBD2_FEATURE_INCOMPAT_REVOKE | \
                                         JBD2_FEATURE_INCOMPAT_64BIT | \
                                         JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT | \
-                                        JBD2_FEATURE_INCOMPAT_CSUM_V2)
+                                        JBD2_FEATURE_INCOMPAT_CSUM_V2 | \
+                                        JBD2_FEATURE_INCOMPAT_CSUM_V3)
 
 #ifdef __KERNEL__
 
@@ -1296,6 +1307,15 @@ static inline int tid_geq(tid_t x, tid_t y)
 extern int jbd2_journal_blocks_per_page(struct inode *inode);
 extern size_t journal_tag_bytes(journal_t *journal);
 
+static inline int jbd2_journal_has_csum_v2or3(journal_t *journal)
+{
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2) ||
+            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V3))
+                return 1;
+
+        return 0;
+}
+
 /*
  * We reserve t_outstanding_credits >> JBD2_CONTROL_BLOCKS_SHIFT for
  * transaction control blocks.
diff --git a/drivers/staging/usbip/uapi/usbip.h b/include/uapi/linux/usbip.h
index fa5db30ede36..fa5db30ede36 100644
--- a/drivers/staging/usbip/uapi/usbip.h
+++ b/include/uapi/linux/usbip.h
diff --git a/drivers/staging/usbip/userspace/.gitignore b/tools/usb/usbip/.gitignore
index 9aad9e30a8ba..9aad9e30a8ba 100644
--- a/drivers/staging/usbip/userspace/.gitignore
+++ b/tools/usb/usbip/.gitignore
diff --git a/drivers/staging/usbip/userspace/AUTHORS b/tools/usb/usbip/AUTHORS
index a27ea8d03aec..a27ea8d03aec 100644
--- a/drivers/staging/usbip/userspace/AUTHORS
+++ b/tools/usb/usbip/AUTHORS
diff --git a/drivers/staging/usbip/userspace/COPYING b/tools/usb/usbip/COPYING
index c5611e48a8e1..c5611e48a8e1 100644
--- a/drivers/staging/usbip/userspace/COPYING
+++ b/tools/usb/usbip/COPYING
diff --git a/drivers/staging/usbip/userspace/INSTALL b/tools/usb/usbip/INSTALL
index d3c5b40a9409..d3c5b40a9409 100644
--- a/drivers/staging/usbip/userspace/INSTALL
+++ b/tools/usb/usbip/INSTALL
diff --git a/drivers/staging/usbip/userspace/Makefile.am b/tools/usb/usbip/Makefile.am
index 66f8bf038c9f..66f8bf038c9f 100644
--- a/drivers/staging/usbip/userspace/Makefile.am
+++ b/tools/usb/usbip/Makefile.am
diff --git a/drivers/staging/usbip/userspace/README b/tools/usb/usbip/README
index 831f49fea3ce..831f49fea3ce 100644
--- a/drivers/staging/usbip/userspace/README
+++ b/tools/usb/usbip/README
diff --git a/drivers/staging/usbip/userspace/autogen.sh b/tools/usb/usbip/autogen.sh
index e1112d3fcbf6..e1112d3fcbf6 100755
--- a/drivers/staging/usbip/userspace/autogen.sh
+++ b/tools/usb/usbip/autogen.sh
diff --git a/drivers/staging/usbip/userspace/cleanup.sh b/tools/usb/usbip/cleanup.sh
index 955c3ccb729a..955c3ccb729a 100755
--- a/drivers/staging/usbip/userspace/cleanup.sh
+++ b/tools/usb/usbip/cleanup.sh
diff --git a/drivers/staging/usbip/userspace/configure.ac b/tools/usb/usbip/configure.ac
index 607d05c5ccfd..607d05c5ccfd 100644
--- a/drivers/staging/usbip/userspace/configure.ac
+++ b/tools/usb/usbip/configure.ac
diff --git a/drivers/staging/usbip/userspace/doc/usbip.8 b/tools/usb/usbip/doc/usbip.8
index a6097be25d28..a6097be25d28 100644
--- a/drivers/staging/usbip/userspace/doc/usbip.8
+++ b/tools/usb/usbip/doc/usbip.8
diff --git a/drivers/staging/usbip/userspace/doc/usbipd.8 b/tools/usb/usbip/doc/usbipd.8
index ac4635db3f03..ac4635db3f03 100644
--- a/drivers/staging/usbip/userspace/doc/usbipd.8
+++ b/tools/usb/usbip/doc/usbipd.8
diff --git a/drivers/staging/usbip/userspace/libsrc/Makefile.am b/tools/usb/usbip/libsrc/Makefile.am
index 7c8f8a4d54e4..7c8f8a4d54e4 100644
--- a/drivers/staging/usbip/userspace/libsrc/Makefile.am
+++ b/tools/usb/usbip/libsrc/Makefile.am
diff --git a/drivers/staging/usbip/userspace/libsrc/list.h b/tools/usb/usbip/libsrc/list.h
index 8d0c936e184f..8d0c936e184f 100644
--- a/drivers/staging/usbip/userspace/libsrc/list.h
+++ b/tools/usb/usbip/libsrc/list.h
diff --git a/drivers/staging/usbip/userspace/libsrc/names.c b/tools/usb/usbip/libsrc/names.c
index 81ff8522405c..81ff8522405c 100644
--- a/drivers/staging/usbip/userspace/libsrc/names.c
+++ b/tools/usb/usbip/libsrc/names.c
diff --git a/drivers/staging/usbip/userspace/libsrc/names.h b/tools/usb/usbip/libsrc/names.h
index 680926512de2..680926512de2 100644
--- a/drivers/staging/usbip/userspace/libsrc/names.h
+++ b/tools/usb/usbip/libsrc/names.h
diff --git a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.c b/tools/usb/usbip/libsrc/sysfs_utils.c
index 36ac88ece0b8..36ac88ece0b8 100644
--- a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.c
+++ b/tools/usb/usbip/libsrc/sysfs_utils.c
diff --git a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.h b/tools/usb/usbip/libsrc/sysfs_utils.h
index 32ac1d105d18..32ac1d105d18 100644
--- a/drivers/staging/usbip/userspace/libsrc/sysfs_utils.h
+++ b/tools/usb/usbip/libsrc/sysfs_utils.h
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c
index ac73710473de..ac73710473de 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_common.c
+++ b/tools/usb/usbip/libsrc/usbip_common.c
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_common.h b/tools/usb/usbip/libsrc/usbip_common.h
index 5a0e95edf4df..5a0e95edf4df 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_common.h
+++ b/tools/usb/usbip/libsrc/usbip_common.h
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c b/tools/usb/usbip/libsrc/usbip_host_driver.c
index bef08d5c44e8..bef08d5c44e8 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.c
+++ b/tools/usb/usbip/libsrc/usbip_host_driver.c
diff --git a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.h b/tools/usb/usbip/libsrc/usbip_host_driver.h
index 2a31f855c616..2a31f855c616 100644
--- a/drivers/staging/usbip/userspace/libsrc/usbip_host_driver.h
+++ b/tools/usb/usbip/libsrc/usbip_host_driver.h
diff --git a/drivers/staging/usbip/userspace/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c
index ad9204773533..ad9204773533 100644
--- a/drivers/staging/usbip/userspace/libsrc/vhci_driver.c
+++ b/tools/usb/usbip/libsrc/vhci_driver.c
diff --git a/drivers/staging/usbip/userspace/libsrc/vhci_driver.h b/tools/usb/usbip/libsrc/vhci_driver.h
index fa2316cf2cac..fa2316cf2cac 100644
--- a/drivers/staging/usbip/userspace/libsrc/vhci_driver.h
+++ b/tools/usb/usbip/libsrc/vhci_driver.h
diff --git a/drivers/staging/usbip/userspace/src/Makefile.am b/tools/usb/usbip/src/Makefile.am
index e81a4ebadeff..e81a4ebadeff 100644
--- a/drivers/staging/usbip/userspace/src/Makefile.am
+++ b/tools/usb/usbip/src/Makefile.am
diff --git a/drivers/staging/usbip/userspace/src/usbip.c b/tools/usb/usbip/src/usbip.c
index d7599d943529..d7599d943529 100644
--- a/drivers/staging/usbip/userspace/src/usbip.c
+++ b/tools/usb/usbip/src/usbip.c
diff --git a/drivers/staging/usbip/userspace/src/usbip.h b/tools/usb/usbip/src/usbip.h
index 84fe66a9d8ad..84fe66a9d8ad 100644
--- a/drivers/staging/usbip/userspace/src/usbip.h
+++ b/tools/usb/usbip/src/usbip.h
diff --git a/drivers/staging/usbip/userspace/src/usbip_attach.c b/tools/usb/usbip/src/usbip_attach.c
index d58a14dfc094..d58a14dfc094 100644
--- a/drivers/staging/usbip/userspace/src/usbip_attach.c
+++ b/tools/usb/usbip/src/usbip_attach.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_bind.c b/tools/usb/usbip/src/usbip_bind.c
index fa46141ae68b..fa46141ae68b 100644
--- a/drivers/staging/usbip/userspace/src/usbip_bind.c
+++ b/tools/usb/usbip/src/usbip_bind.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_detach.c b/tools/usb/usbip/src/usbip_detach.c
index 05c6d15856eb..05c6d15856eb 100644
--- a/drivers/staging/usbip/userspace/src/usbip_detach.c
+++ b/tools/usb/usbip/src/usbip_detach.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_list.c b/tools/usb/usbip/src/usbip_list.c
index d5ce34a410e7..d5ce34a410e7 100644
--- a/drivers/staging/usbip/userspace/src/usbip_list.c
+++ b/tools/usb/usbip/src/usbip_list.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
index b4c37e76a6e0..b4c37e76a6e0 100644
--- a/drivers/staging/usbip/userspace/src/usbip_network.c
+++ b/tools/usb/usbip/src/usbip_network.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
index c1e875cf1078..c1e875cf1078 100644
--- a/drivers/staging/usbip/userspace/src/usbip_network.h
+++ b/tools/usb/usbip/src/usbip_network.h
diff --git a/drivers/staging/usbip/userspace/src/usbip_port.c b/tools/usb/usbip/src/usbip_port.c
index a2e884fd9226..a2e884fd9226 100644
--- a/drivers/staging/usbip/userspace/src/usbip_port.c
+++ b/tools/usb/usbip/src/usbip_port.c
diff --git a/drivers/staging/usbip/userspace/src/usbip_unbind.c b/tools/usb/usbip/src/usbip_unbind.c
index a4a496c9cbaf..a4a496c9cbaf 100644
--- a/drivers/staging/usbip/userspace/src/usbip_unbind.c
+++ b/tools/usb/usbip/src/usbip_unbind.c
diff --git a/drivers/staging/usbip/userspace/src/usbipd.c b/tools/usb/usbip/src/usbipd.c
index 2f87f2d348ba..2f87f2d348ba 100644
--- a/drivers/staging/usbip/userspace/src/usbipd.c
+++ b/tools/usb/usbip/src/usbipd.c
diff --git a/drivers/staging/usbip/userspace/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d235015..2b3d6d235015 100644
--- a/drivers/staging/usbip/userspace/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
diff --git a/drivers/staging/usbip/userspace/src/utils.h b/tools/usb/usbip/src/utils.h
index 5916fd3e02a6..5916fd3e02a6 100644
--- a/drivers/staging/usbip/userspace/src/utils.h
+++ b/tools/usb/usbip/src/utils.h