256 files changed, 2819 insertions, 1457 deletions
diff --git a/Documentation/devicetree/bindings/arm/exynos/power_domain.txt b/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
index f4445e5a2bbb..1e097037349c 100644
--- a/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
+++ b/Documentation/devicetree/bindings/arm/exynos/power_domain.txt
@@ -22,6 +22,8 @@ Optional Properties:
        - pclkN, clkN: Pairs of parent of input clock and input clock to the
                devices in this power domain. Maximum of 4 pairs (N = 0 to 3)
                are supported currently.
+- power-domains: phandle pointing to the parent power domain, for more details
+                 see Documentation/devicetree/bindings/power/power_domain.txt
 Node of a device using power domains must have a power-domains property
 defined with a phandle to respective power domain.
diff --git a/Documentation/devicetree/bindings/arm/sti.txt b/Documentation/devicetree/bindings/arm/sti.txt
index d70ec358736c..8d27f6b084c7 100644
--- a/Documentation/devicetree/bindings/arm/sti.txt
+++ b/Documentation/devicetree/bindings/arm/sti.txt
@@ -13,6 +13,10 @@ Boards with the ST STiH407 SoC shall have the following properties:
 Required root node property:
 compatible = "st,stih407";
+Boards with the ST STiH410 SoC shall have the following properties:
+Required root node property:
+compatible = "st,stih410";
 Boards with the ST STiH418 SoC shall have the following properties:
 Required root node property:
 compatible = "st,stih418";
diff --git a/Documentation/devicetree/bindings/net/apm-xgene-enet.txt b/Documentation/devicetree/bindings/net/apm-xgene-enet.txt
index cfcc52705ed8..6151999c5dca 100644
--- a/Documentation/devicetree/bindings/net/apm-xgene-enet.txt
+++ b/Documentation/devicetree/bindings/net/apm-xgene-enet.txt
@@ -4,7 +4,10 @@ Ethernet nodes are defined to describe on-chip ethernet interfaces in
 APM X-Gene SoC.
 Required properties for all the ethernet interfaces:
- compatible: Should be "apm,xgene-enet"
+- compatible: Should state binding information from the following list,
+  - "apm,xgene-enet":    RGMII based 1G interface
+  - "apm,xgene1-sgenet": SGMII based 1G interface
+  - "apm,xgene1-xgenet": XFI based 10G interface
 - reg: Address and length of the register set for the device. It contains the
  information of registers in the same order as described by reg-names
 - reg-names: Should contain the register set names
diff --git a/Documentation/devicetree/bindings/power/power_domain.txt b/Documentation/devicetree/bindings/power/power_domain.txt
index 98c16672ab5f..0f8ed3710c66 100644
--- a/Documentation/devicetree/bindings/power/power_domain.txt
+++ b/Documentation/devicetree/bindings/power/power_domain.txt
@@ -19,6 +19,16 @@ Required properties:
   providing multiple PM domains (e.g. power controllers), but can be any value
   as specified by device tree binding documentation of particular provider.
+Optional properties:
+ - power-domains : A phandle and PM domain specifier as defined by bindings of
+                   the power controller specified by phandle.
+   Some power domains might be powered from another power domain (or have
+   other hardware specific dependencies). For representing such dependency
+   a standard PM domain consumer binding is used. When provided, all domains
+   created by the given provider should be subdomains of the domain
+   specified by this binding. More details about power domain specifier are
+   available in the next section.
 Example:
        power: power-controller@12340000 {
@@ -30,6 +40,25 @@ Example:
 The node above defines a power controller that is a PM domain provider and
 expects one cell as its phandle argument.
+Example 2:
+        parent: power-controller@12340000 {
+                compatible = "foo,power-controller";
+                reg = <0x12340000 0x1000>;
+                #power-domain-cells = <1>;
+        };
+        child: power-controller@12340000 {
+                compatible = "foo,power-controller";
+                reg = <0x12341000 0x1000>;
+                power-domains = <&parent 0>;
+                #power-domain-cells = <1>;
+        };
+The nodes above define two power controllers: 'parent' and 'child'.
+Domains created by the 'child' power controller are subdomains of '0' power
+domain provided by the 'parent' power controller.
 ==PM domain consumers==
 Required properties:
diff --git a/Documentation/devicetree/bindings/serial/of-serial.txt b/Documentation/devicetree/bindings/serial/8250.txt
index 91d5ab0e60fc..91d5ab0e60fc 100644
--- a/Documentation/devicetree/bindings/serial/of-serial.txt
+++ b/Documentation/devicetree/bindings/serial/8250.txt
diff --git a/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt b/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt
new file mode 100644
index 000000000000..ebcbb62c0a76
--- /dev/null
+++ b/Documentation/devicetree/bindings/serial/axis,etraxfs-uart.txt
@@ -0,0 +1,19 @@
+ETRAX FS UART
+Required properties:
+- compatible : "axis,etraxfs-uart"
+- reg: offset and length of the register set for the device.
+- interrupts: device interrupt
+Optional properties:
+- {dtr,dsr,ri,cd}-gpios: specify a GPIO for DTR/DSR/RI/CD
+  line respectively.
+Example:
+serial@b00260000 {
+        compatible = "axis,etraxfs-uart";
+        reg = <0xb0026000 0x1000>;
+        interrupts = <68>;
+        status = "disabled";
+};
diff --git a/Documentation/devicetree/bindings/submitting-patches.txt b/Documentation/devicetree/bindings/submitting-patches.txt
index 56742bc70218..7d44eae7ab0b 100644
--- a/Documentation/devicetree/bindings/submitting-patches.txt
+++ b/Documentation/devicetree/bindings/submitting-patches.txt
@@ -12,6 +12,9 @@ I. For patch submitters
       devicetree@vger.kernel.org
+     and Cc: the DT maintainers. Use scripts/get_maintainer.pl to identify
+     all of the DT maintainers.
  3) The Documentation/ portion of the patch should come in the series before
     the code implementing the binding.
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 389ca1347a77..fae26d014aaf 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -20,6 +20,7 @@ amlogic	Amlogic, Inc.
 ams     AMS AG
 amstaos AMS-Taos Inc.
 apm     Applied Micro Circuits Corporation (APM)
+arasan  Arasan Chip Systems
 arm     ARM Ltd.
 armadeus        ARMadeus Systems SARL
 asahi-kasei     Asahi Kasei Corp.
@@ -27,6 +28,7 @@ atmel	Atmel Corporation
 auo     AU Optronics Corporation
 avago   Avago Technologies
 avic    Shanghai AVIC Optoelectronics Co., Ltd.
+axis    Axis Communications AB
 bosch   Bosch Sensortec GmbH
 brcm    Broadcom Corporation
 buffalo Buffalo, Inc.
diff --git a/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt b/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
index f90e294d7631..a4d869744f59 100644
--- a/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
+++ b/Documentation/devicetree/bindings/watchdog/atmel-wdt.txt
@@ -26,6 +26,11 @@ Optional properties:
 - atmel,disable : Should be present if you want to disable the watchdog.
 - atmel,idle-halt : Should be present if you want to stop the watchdog when
        entering idle state.
+        CAUTION: This property should be used with care, it actually makes the
+        watchdog not counting when the CPU is in idle state, therefore the
+        watchdog reset time depends on mean CPU usage and will not reset at all
+        if the CPU stop working while it is in idle state, which is probably
+        not what you want.
 - atmel,dbg-halt : Should be present if you want to stop the watchdog when
        entering debug state.
diff --git a/MAINTAINERS b/MAINTAINERS
index 6239a305dff0..0e1abe8cc684 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1030,6 +1030,16 @@ F:	arch/arm/mach-mxs/
 F:      arch/arm/boot/dts/imx*
 F:      arch/arm/configs/imx*_defconfig
+ARM/FREESCALE VYBRID ARM ARCHITECTURE
+M:      Shawn Guo <shawn.guo@linaro.org>
+M:      Sascha Hauer <kernel@pengutronix.de>
+R:      Stefan Agner <stefan@agner.ch>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
+F:      arch/arm/mach-imx/*vf610*
+F:      arch/arm/boot/dts/vf*
 ARM/GLOMATION GESBC9312SX MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1188,6 +1198,7 @@ ARM/Marvell Dove/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+M:      Gregory Clement <gregory.clement@free-electrons.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-dove/
@@ -2107,7 +2118,6 @@ F:	drivers/net/ethernet/broadcom/bnx2x/
 BROADCOM BCM281XX/BCM11XXX/BCM216XX ARM ARCHITECTURE
 M:      Christian Daudt <bcm@fixthebug.org>
-M:      Matt Porter <mporter@linaro.org>
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      bcm-kernel-feedback-list@broadcom.com
 T:      git git://github.com/broadcom/mach-bcm
@@ -2369,8 +2379,9 @@ F:	arch/x86/include/asm/tce.h
 CAN NETWORK LAYER
 M:      Oliver Hartkopp <socketcan@hartkopp.net>
+M:      Marc Kleine-Budde <mkl@pengutronix.de>
 L:      linux-can@vger.kernel.org
-W:      http://gitorious.org/linux-can
+W:      https://github.com/linux-can
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
 S:      Maintained
@@ -2386,7 +2397,7 @@ CAN NETWORK DRIVERS
 M:      Wolfgang Grandegger <wg@grandegger.com>
 M:      Marc Kleine-Budde <mkl@pengutronix.de>
 L:      linux-can@vger.kernel.org
-W:      http://gitorious.org/linux-can
+W:      https://github.com/linux-can
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
 S:      Maintained
diff --git a/Makefile b/Makefile
index 1100ff3c77e3..e734965b1604 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Hurr durr I'ma sheep
 # *DOCUMENTATION*
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 7f99cd652203..eb7bb511f853 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -150,6 +150,7 @@ machine-$(CONFIG_ARCH_BERLIN)		+= berlin
 machine-$(CONFIG_ARCH_CLPS711X)         += clps711x
 machine-$(CONFIG_ARCH_CNS3XXX)          += cns3xxx
 machine-$(CONFIG_ARCH_DAVINCI)          += davinci
+machine-$(CONFIG_ARCH_DIGICOLOR)        += digicolor
 machine-$(CONFIG_ARCH_DOVE)             += dove
 machine-$(CONFIG_ARCH_EBSA110)          += ebsa110
 machine-$(CONFIG_ARCH_EFM32)            += efm32
diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi
index 2c6248d9a9ef..c3255e0c90aa 100644
--- a/arch/arm/boot/dts/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi
@@ -301,3 +301,11 @@
        cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
        cd-inverted;
 };
+&aes {
+        status = "okay";
+};
+&sham {
+        status = "okay";
+};
diff --git a/arch/arm/boot/dts/am335x-bone.dts b/arch/arm/boot/dts/am335x-bone.dts
index 83d40f7655e5..6b8493720424 100644
--- a/arch/arm/boot/dts/am335x-bone.dts
+++ b/arch/arm/boot/dts/am335x-bone.dts
@@ -24,11 +24,3 @@
 &mmc1 {
        vmmc-supply = <&ldo3_reg>;
 };
-&sham {
-        status = "okay";
-};
-&aes {
-        status = "okay";
-};
diff --git a/arch/arm/boot/dts/am335x-lxm.dts b/arch/arm/boot/dts/am335x-lxm.dts
index 7266a00aab2e..5c5667a3624d 100644
--- a/arch/arm/boot/dts/am335x-lxm.dts
+++ b/arch/arm/boot/dts/am335x-lxm.dts
@@ -328,6 +328,10 @@
        dual_emac_res_vlan = <3>;
 };
+&phy_sel {
+        rmii-clock-ext;
+};
 &mac {
        pinctrl-names = "default", "sleep";
        pinctrl-0 = <&cpsw_default>;
diff --git a/arch/arm/boot/dts/am33xx-clocks.dtsi b/arch/arm/boot/dts/am33xx-clocks.dtsi
index 712edce7d6fb..071b56aa0c7e 100644
--- a/arch/arm/boot/dts/am33xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am33xx-clocks.dtsi
@@ -99,7 +99,7 @@
        ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <0>;
                reg = <0x0664>;
        };
@@ -107,7 +107,7 @@
        ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <1>;
                reg = <0x0664>;
        };
@@ -115,7 +115,7 @@
        ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <2>;
                reg = <0x0664>;
        };
diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
index c7dc9dab93a4..cfb49686ab6a 100644
--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
+++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
@@ -107,7 +107,7 @@
        ehrpwm0_tbclk: ehrpwm0_tbclk {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <0>;
                reg = <0x0664>;
        };
@@ -115,7 +115,7 @@
        ehrpwm1_tbclk: ehrpwm1_tbclk {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <1>;
                reg = <0x0664>;
        };
@@ -123,7 +123,7 @@
        ehrpwm2_tbclk: ehrpwm2_tbclk {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <2>;
                reg = <0x0664>;
        };
@@ -131,7 +131,7 @@
        ehrpwm3_tbclk: ehrpwm3_tbclk {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <4>;
                reg = <0x0664>;
        };
@@ -139,7 +139,7 @@
        ehrpwm4_tbclk: ehrpwm4_tbclk {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <5>;
                reg = <0x0664>;
        };
@@ -147,7 +147,7 @@
        ehrpwm5_tbclk: ehrpwm5_tbclk {
                #clock-cells = <0>;
                compatible = "ti,gate-clock";
-                clocks = <&dpll_per_m2_ck>;
+                clocks = <&l4ls_gclk>;
                ti,bit-shift = <6>;
                reg = <0x0664>;
        };
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index fff0ee69aab4..e7f0a4ae271c 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -494,12 +494,12 @@
                                        pinctrl_usart3_rts: usart3_rts-0 {
                                                atmel,pins =
-                                                        <AT91_PIOB 8 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PC8 periph B */
+                                                        <AT91_PIOC 8 AT91_PERIPH_B AT91_PINCTRL_NONE>;
                                        };
                                        pinctrl_usart3_cts: usart3_cts-0 {
                                                atmel,pins =
-                                                        <AT91_PIOB 10 AT91_PERIPH_B AT91_PINCTRL_NONE>; /* PC10 periph B */
+                                                        <AT91_PIOC 10 AT91_PERIPH_B AT91_PINCTRL_NONE>;
                                        };
                                };
@@ -853,7 +853,7 @@
                        };
                        usb1: gadget@fffa4000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9260-udc";
                                reg = <0xfffa4000 0x4000>;
                                interrupts = <10 IRQ_TYPE_LEVEL_HIGH 2>;
                                clocks = <&udc_clk>, <&udpck>;
@@ -976,7 +976,6 @@
                                atmel,watchdog-type = "hardware";
                                atmel,reset-type = "all";
                                atmel,dbg-halt;
-                                atmel,idle-halt;
                                status = "disabled";
                        };
diff --git a/arch/arm/boot/dts/at91sam9261.dtsi b/arch/arm/boot/dts/at91sam9261.dtsi
index e247b0b5fdab..d55fdf2487ef 100644
--- a/arch/arm/boot/dts/at91sam9261.dtsi
+++ b/arch/arm/boot/dts/at91sam9261.dtsi
@@ -124,11 +124,12 @@
                        };
                        usb1: gadget@fffa4000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9261-udc";
                                reg = <0xfffa4000 0x4000>;
                                interrupts = <10 IRQ_TYPE_LEVEL_HIGH 2>;
-                                clocks = <&usb>, <&udc_clk>, <&udpck>;
+                                clocks = <&udc_clk>, <&udpck>;
-                                clock-names = "usb_clk", "udc_clk", "udpck";
+                                clock-names = "pclk", "hclk";
+                                atmel,matrix = <&matrix>;
                                status = "disabled";
                        };
@@ -262,7 +263,7 @@
                        };
                        matrix: matrix@ffffee00 {
-                                compatible = "atmel,at91sam9260-bus-matrix";
+                                compatible = "atmel,at91sam9260-bus-matrix", "syscon";
                                reg = <0xffffee00 0x200>;
                        };
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index 1f67bb4c144e..fce301c4e9d6 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -69,7 +69,7 @@
        sram1: sram@00500000 {
                compatible = "mmio-sram";
-                reg = <0x00300000 0x4000>;
+                reg = <0x00500000 0x4000>;
        };
        ahb {
@@ -856,7 +856,7 @@
                        };
                        usb1: gadget@fff78000 {
-                                compatible = "atmel,at91rm9200-udc";
+                                compatible = "atmel,at91sam9263-udc";
                                reg = <0xfff78000 0x4000>;
                                interrupts = <24 IRQ_TYPE_LEVEL_HIGH 2>;
                                clocks = <&udc_clk>, <&udpck>;
@@ -905,7 +905,6 @@
                                atmel,watchdog-type = "hardware";
                                atmel,reset-type = "all";
                                atmel,dbg-halt;
-                                atmel,idle-halt;
                                status = "disabled";
                        };
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index ee80aa9c0759..488af63d5174 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -1116,7 +1116,6 @@
                                atmel,watchdog-type = "hardware";
                                atmel,reset-type = "all";
                                atmel,dbg-halt;
-                                atmel,idle-halt;
                                status = "disabled";
                        };
@@ -1301,7 +1300,7 @@
                        compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                        reg = <0x00800000 0x100000>;
                        interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
                        clock-names = "usb_clk", "ehci_clk", "hclk", "uhpck";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index c2666a7cb5b1..0c53a375ba99 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -894,7 +894,6 @@
                                atmel,watchdog-type = "hardware";
                                atmel,reset-type = "all";
                                atmel,dbg-halt;
-                                atmel,idle-halt;
                                status = "disabled";
                        };
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 818dabdd8c0e..d221179d0f1a 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -1066,7 +1066,7 @@
                                reg = <0x00500000 0x80000
                                       0xf803c000 0x400>;
                                interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-                                clocks = <&usb>, <&udphs_clk>;
+                                clocks = <&utmi>, <&udphs_clk>;
                                clock-names = "hclk", "pclk";
                                status = "disabled";
@@ -1130,7 +1130,6 @@
                                atmel,watchdog-type = "hardware";
                                atmel,reset-type = "all";
                                atmel,dbg-halt;
-                                atmel,idle-halt;
                                status = "disabled";
                        };
@@ -1186,7 +1185,7 @@
                        compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                        reg = <0x00700000 0x100000>;
                        interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                        clock-names = "usb_clk", "ehci_clk", "uhpck";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 3290a96ba586..7563d7ce01bb 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -263,17 +263,15 @@
        dcan1_pins_default: dcan1_pins_default {
                pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT | MUX_MODE0) /* dcan1_tx */
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
-                        0x3d4   (MUX_MODE15)            /* dcan1_rx.off */
+                        0x418   (PULL_UP | MUX_MODE1) /* wakeup0.dcan1_rx */
-                        0x418   (PULL_DIS | MUX_MODE1) /* wakeup0.dcan1_rx */
                >;
        };
        dcan1_pins_sleep: dcan1_pins_sleep {
                pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15)    /* dcan1_tx.off */
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
-                        0x3d4   (MUX_MODE15)    /* dcan1_rx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
-                        0x418   (MUX_MODE15)    /* wakeup0.off */
                >;
        };
 };
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index e0264d0bf7b9..40ed539ce474 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -119,17 +119,15 @@
        dcan1_pins_default: dcan1_pins_default {
                pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT | MUX_MODE0) /* dcan1_tx */
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
-                        0x3d4   (MUX_MODE15)            /* dcan1_rx.off */
+                        0x418   (PULL_UP | MUX_MODE1)   /* wakeup0.dcan1_rx */
-                        0x418   (PULL_DIS | MUX_MODE1) /* wakeup0.dcan1_rx */
                >;
        };
        dcan1_pins_sleep: dcan1_pins_sleep {
                pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15)    /* dcan1_tx.off */
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
-                        0x3d4   (MUX_MODE15)    /* dcan1_rx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
-                        0x418   (MUX_MODE15)    /* wakeup0.off */
                >;
        };
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index 4bdcbd61ce47..99b09a44e269 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -243,10 +243,18 @@
                ti,invert-autoidle-bit;
        };
+        dpll_core_byp_mux: dpll_core_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x012c>;
+        };
        dpll_core_ck: dpll_core_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-core-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
                reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
        };
@@ -309,10 +317,18 @@
                clock-div = <1>;
        };
+        dpll_dsp_byp_mux: dpll_dsp_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x0240>;
+        };
        dpll_dsp_ck: dpll_dsp_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
                reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
        };
@@ -335,10 +351,18 @@
                clock-div = <1>;
        };
+        dpll_iva_byp_mux: dpll_iva_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x01ac>;
+        };
        dpll_iva_ck: dpll_iva_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
                reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
        };
@@ -361,10 +385,18 @@
                clock-div = <1>;
        };
+        dpll_gpu_byp_mux: dpll_gpu_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x02e4>;
+        };
        dpll_gpu_ck: dpll_gpu_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
                reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
        };
@@ -398,10 +430,18 @@
                clock-div = <1>;
        };
+        dpll_ddr_byp_mux: dpll_ddr_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x021c>;
+        };
        dpll_ddr_ck: dpll_ddr_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
                reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
        };
@@ -416,10 +456,18 @@
                ti,invert-autoidle-bit;
        };
+        dpll_gmac_byp_mux: dpll_gmac_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x02b4>;
+        };
        dpll_gmac_ck: dpll_gmac_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
                reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
        };
@@ -482,10 +530,18 @@
                clock-div = <1>;
        };
+        dpll_eve_byp_mux: dpll_eve_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x0290>;
+        };
        dpll_eve_ck: dpll_eve_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
                reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
        };
@@ -1249,10 +1305,18 @@
                clock-div = <1>;
        };
+        dpll_per_byp_mux: dpll_per_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x014c>;
+        };
        dpll_per_ck: dpll_per_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
                reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
        };
@@ -1275,10 +1339,18 @@
                clock-div = <1>;
        };
+        dpll_usb_byp_mux: dpll_usb_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x018c>;
+        };
        dpll_usb_ck: dpll_usb_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-j-type-clock";
-                clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
+                clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
                reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
        };
diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
index 277b48b0b6f9..ac6b0ae42caf 100644
--- a/arch/arm/boot/dts/exynos3250.dtsi
+++ b/arch/arm/boot/dts/exynos3250.dtsi
@@ -18,6 +18,7 @@
 */
 #include "skeleton.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 #include <dt-bindings/clock/exynos3250.h>
 / {
@@ -193,6 +194,7 @@
                        interrupts = <0 216 0>;
                        clocks = <&cmu CLK_TMU_APBIF>;
                        clock-names = "tmu_apbif";
+                        #include "exynos4412-tmu-sensor-conf.dtsi"
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
new file mode 100644
index 000000000000..735cb2f10817
--- /dev/null
+++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi
@@ -0,0 +1,52 @@
+/*
+ * Device tree sources for Exynos4 thermal zone
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <dt-bindings/thermal/thermal.h>
+/ {
+thermal-zones {
+        cpu_thermal: cpu-thermal {
+                thermal-sensors = <&tmu 0>;
+                polling-delay-passive = <0>;
+                polling-delay = <0>;
+                trips {
+                        cpu_alert0: cpu-alert-0 {
+                                temperature = <70000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_alert1: cpu-alert-1 {
+                                temperature = <95000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_alert2: cpu-alert-2 {
+                                temperature = <110000>; /* millicelsius */
+                                hysteresis = <10000>; /* millicelsius */
+                                type = "active";
+                        };
+                        cpu_crit0: cpu-crit-0 {
+                                temperature = <120000>; /* millicelsius */
+                                hysteresis = <0>; /* millicelsius */
+                                type = "critical";
+                        };
+                };
+                cooling-maps {
+                        map0 {
+                                trip = <&cpu_alert0>;
+                        };
+                        map1 {
+                                trip = <&cpu_alert1>;
+                        };
+                };
+        };
+};
+};
diff --git a/arch/arm/boot/dts/exynos4.dtsi b/arch/arm/boot/dts/exynos4.dtsi
index 76173cacd450..77ea547768f4 100644
--- a/arch/arm/boot/dts/exynos4.dtsi
+++ b/arch/arm/boot/dts/exynos4.dtsi
@@ -38,6 +38,7 @@
                i2c5 = &i2c_5;
                i2c6 = &i2c_6;
                i2c7 = &i2c_7;
+                i2c8 = &i2c_8;
                csis0 = &csis_0;
                csis1 = &csis_1;
                fimc0 = &fimc_0;
@@ -104,6 +105,7 @@
                compatible = "samsung,exynos4210-pd";
                reg = <0x10023C20 0x20>;
                #power-domain-cells = <0>;
+                power-domains = <&pd_lcd0>;
        };
        pd_cam: cam-power-domain@10023C00 {
@@ -554,6 +556,22 @@
                status = "disabled";
        };
+        i2c_8: i2c@138E0000 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "samsung,s3c2440-hdmiphy-i2c";
+                reg = <0x138E0000 0x100>;
+                interrupts = <0 93 0>;
+                clocks = <&clock CLK_I2C_HDMI>;
+                clock-names = "i2c";
+                status = "disabled";
+                hdmi_i2c_phy: hdmiphy@38 {
+                        compatible = "exynos4210-hdmiphy";
+                        reg = <0x38>;
+                };
+        };
        spi_0: spi@13920000 {
                compatible = "samsung,exynos4210-spi";
                reg = <0x13920000 0x100>;
@@ -663,6 +681,33 @@
                status = "disabled";
        };
+        tmu: tmu@100C0000 {
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+        hdmi: hdmi@12D00000 {
+                compatible = "samsung,exynos4210-hdmi";
+                reg = <0x12D00000 0x70000>;
+                interrupts = <0 92 0>;
+                clock-names = "hdmi", "sclk_hdmi", "sclk_pixel", "sclk_hdmiphy",
+                        "mout_hdmi";
+                clocks = <&clock CLK_HDMI>, <&clock CLK_SCLK_HDMI>,
+                        <&clock CLK_SCLK_PIXEL>, <&clock CLK_SCLK_HDMIPHY>,
+                        <&clock CLK_MOUT_HDMI>;
+                phy = <&hdmi_i2c_phy>;
+                power-domains = <&pd_tv>;
+                samsung,syscon-phandle = <&pmu_system_controller>;
+                status = "disabled";
+        };
+        mixer: mixer@12C10000 {
+                compatible = "samsung,exynos4210-mixer";
+                interrupts = <0 91 0>;
+                reg = <0x12C10000 0x2100>, <0x12c00000 0x300>;
+                power-domains = <&pd_tv>;
+                status = "disabled";
+        };
        ppmu_dmc0: ppmu_dmc0@106a0000 {
                compatible = "samsung,exynos-ppmu";
                reg = <0x106a0000 0x2000>;
diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts
index 3d6652a4b6cb..32c5fd8f6269 100644
--- a/arch/arm/boot/dts/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/exynos4210-trats.dts
@@ -426,6 +426,25 @@
                status = "okay";
        };
+        tmu@100C0000 {
+                status = "okay";
+        };
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 2 2>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 4 4>;
+                               };
+                       };
+                };
+        };
        camera {
                pinctrl-names = "default";
                pinctrl-0 = <>;
diff --git a/arch/arm/boot/dts/exynos4210-universal_c210.dts b/arch/arm/boot/dts/exynos4210-universal_c210.dts
index b57e6b82ea20..d4f2b11319dd 100644
--- a/arch/arm/boot/dts/exynos4210-universal_c210.dts
+++ b/arch/arm/boot/dts/exynos4210-universal_c210.dts
@@ -505,6 +505,63 @@
                        assigned-clock-rates = <0>, <160000000>;
                };
        };
+        hdmi_en: voltage-regulator-hdmi-5v {
+                compatible = "regulator-fixed";
+                regulator-name = "HDMI_5V";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                gpio = <&gpe0 1 0>;
+                enable-active-high;
+        };
+        hdmi_ddc: i2c-ddc {
+                compatible = "i2c-gpio";
+                gpios = <&gpe4 2 0 &gpe4 3 0>;
+                i2c-gpio,delay-us = <100>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+                pinctrl-0 = <&i2c_ddc_bus>;
+                pinctrl-names = "default";
+                status = "okay";
+        };
+        mixer@12C10000 {
+                status = "okay";
+        };
+        hdmi@12D00000 {
+                hpd-gpio = <&gpx3 7 0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&hdmi_hpd>;
+                hdmi-en-supply = <&hdmi_en>;
+                vdd-supply = <&ldo3_reg>;
+                vdd_osc-supply = <&ldo4_reg>;
+                vdd_pll-supply = <&ldo3_reg>;
+                ddc = <&hdmi_ddc>;
+                status = "okay";
+        };
+        i2c@138E0000 {
+                status = "okay";
+        };
+};
+&pinctrl_1 {
+        hdmi_hpd: hdmi-hpd {
+                samsung,pins = "gpx3-7";
+                samsung,pin-pud = <0>;
+        };
+};
+&pinctrl_0 {
+        i2c_ddc_bus: i2c-ddc-bus {
+                samsung,pins = "gpe4-2", "gpe4-3";
+                samsung,pin-function = <2>;
+                samsung,pin-pud = <3>;
+                samsung,pin-drv = <0>;
+        };
 };
 &mdma1 {
diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
index 67c832c9dcf1..be89f83f70e7 100644
--- a/arch/arm/boot/dts/exynos4210.dtsi
+++ b/arch/arm/boot/dts/exynos4210.dtsi
@@ -21,6 +21,7 @@
 #include "exynos4.dtsi"
 #include "exynos4210-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 / {
        compatible = "samsung,exynos4210", "samsung,exynos4";
@@ -35,10 +36,13 @@
                #address-cells = <1>;
                #size-cells = <0>;
-                cpu@900 {
+                cpu0: cpu@900 {
                        device_type = "cpu";
                        compatible = "arm,cortex-a9";
                        reg = <0x900>;
+                        cooling-min-level = <4>;
+                        cooling-max-level = <2>;
+                        #cooling-cells = <2>; /* min followed by max */
                };
                cpu@901 {
@@ -153,16 +157,38 @@
                reg = <0x03860000 0x1000>;
        };
-        tmu@100C0000 {
+        tmu: tmu@100C0000 {
                compatible = "samsung,exynos4210-tmu";
                interrupt-parent = <&combiner>;
                reg = <0x100C0000 0x100>;
                interrupts = <2 4>;
                clocks = <&clock CLK_TMU_APBIF>;
                clock-names = "tmu_apbif";
+                samsung,tmu_gain = <15>;
+                samsung,tmu_reference_voltage = <7>;
                status = "disabled";
        };
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        polling-delay-passive = <0>;
+                        polling-delay = <0>;
+                        thermal-sensors = <&tmu 0>;
+                        trips {
+                              cpu_alert0: cpu-alert-0 {
+                                      temperature = <85000>; /* millicelsius */
+                              };
+                              cpu_alert1: cpu-alert-1 {
+                                      temperature = <100000>; /* millicelsius */
+                              };
+                              cpu_alert2: cpu-alert-2 {
+                                      temperature = <110000>; /* millicelsius */
+                              };
+                        };
+                };
+        };
        g2d@12800000 {
                compatible = "samsung,s5pv210-g2d";
                reg = <0x12800000 0x1000>;
@@ -203,6 +229,14 @@
                };
        };
+        mixer: mixer@12C10000 {
+                clock-names = "mixer", "hdmi", "sclk_hdmi", "vp", "mout_mixer",
+                        "sclk_mixer";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                        <&clock CLK_SCLK_HDMI>, <&clock CLK_VP>,
+                        <&clock CLK_MOUT_MIXER>, <&clock CLK_SCLK_MIXER>;
+        };
        ppmu_lcd1: ppmu_lcd1@12240000 {
                compatible = "samsung,exynos-ppmu";
                reg = <0x12240000 0x2000>;
diff --git a/arch/arm/boot/dts/exynos4212.dtsi b/arch/arm/boot/dts/exynos4212.dtsi
index dd0a43ec56da..5be03288f1ee 100644
--- a/arch/arm/boot/dts/exynos4212.dtsi
+++ b/arch/arm/boot/dts/exynos4212.dtsi
@@ -26,10 +26,13 @@
                #address-cells = <1>;
                #size-cells = <0>;
-                cpu@A00 {
+                cpu0: cpu@A00 {
                        device_type = "cpu";
                        compatible = "arm,cortex-a9";
                        reg = <0xA00>;
+                        cooling-min-level = <13>;
+                        cooling-max-level = <7>;
+                        #cooling-cells = <2>; /* min followed by max */
                };
                cpu@A01 {
diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
index de80b5bba204..adb4f6a97a1d 100644
--- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
+++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi
@@ -249,6 +249,20 @@
                                        regulator-always-on;
                                };
+                                ldo8_reg: ldo@8 {
+                                        regulator-compatible = "LDO8";
+                                        regulator-name = "VDD10_HDMI_1.0V";
+                                        regulator-min-microvolt = <1000000>;
+                                        regulator-max-microvolt = <1000000>;
+                                };
+                                ldo10_reg: ldo@10 {
+                                        regulator-compatible = "LDO10";
+                                        regulator-name = "VDDQ_MIPIHSI_1.8V";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                };
                                ldo11_reg: LDO11 {
                                        regulator-name = "VDD18_ABB1_1.8V";
                                        regulator-min-microvolt = <1800000>;
@@ -411,6 +425,51 @@
        ehci: ehci@12580000 {
                status = "okay";
        };
+        tmu@100C0000 {
+                vtmu-supply = <&ldo10_reg>;
+                status = "okay";
+        };
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 7 7>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 13 13>;
+                               };
+                       };
+                };
+        };
+        mixer: mixer@12C10000 {
+                status = "okay";
+        };
+        hdmi@12D00000 {
+                hpd-gpio = <&gpx3 7 0>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&hdmi_hpd>;
+                vdd-supply = <&ldo8_reg>;
+                vdd_osc-supply = <&ldo10_reg>;
+                vdd_pll-supply = <&ldo8_reg>;
+                ddc = <&hdmi_ddc>;
+                status = "okay";
+        };
+        hdmi_ddc: i2c@13880000 {
+                status = "okay";
+                pinctrl-names = "default";
+                pinctrl-0 = <&i2c2_bus>;
+        };
+        i2c@138E0000 {
+                status = "okay";
+        };
 };
 &pinctrl_1 {
@@ -425,4 +484,9 @@
                samsung,pin-pud = <0>;
                samsung,pin-drv = <0>;
        };
+        hdmi_hpd: hdmi-hpd {
+                samsung,pins = "gpx3-7";
+                samsung,pin-pud = <1>;
+        };
 };
diff --git a/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi
new file mode 100644
index 000000000000..e3f7934d19d0
--- /dev/null
+++ b/arch/arm/boot/dts/exynos4412-tmu-sensor-conf.dtsi
@@ -0,0 +1,24 @@
+/*
+ * Device tree sources for Exynos4412 TMU sensor configuration
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <dt-bindings/thermal/thermal_exynos.h>
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <8>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <55>;
+samsung,tmu_min_efuse_value = <40>;
+samsung,tmu_max_efuse_value = <100>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <85>;
+samsung,tmu_default_temp_offset = <50>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts
index 21f748083586..173ffa479ad3 100644
--- a/arch/arm/boot/dts/exynos4412-trats2.dts
+++ b/arch/arm/boot/dts/exynos4412-trats2.dts
@@ -927,6 +927,21 @@
                pulldown-ohm = <100000>; /* 100K */
                io-channels = <&adc 2>;  /* Battery temperature */
        };
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 7 7>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 13 13>;
+                               };
+                       };
+                };
+        };
 };
 &pmu_system_controller {
diff --git a/arch/arm/boot/dts/exynos4412.dtsi b/arch/arm/boot/dts/exynos4412.dtsi
index 0f6ec93bb1d8..68ad43b391ae 100644
--- a/arch/arm/boot/dts/exynos4412.dtsi
+++ b/arch/arm/boot/dts/exynos4412.dtsi
@@ -26,10 +26,13 @@
                #address-cells = <1>;
                #size-cells = <0>;
-                cpu@A00 {
+                cpu0: cpu@A00 {
                        device_type = "cpu";
                        compatible = "arm,cortex-a9";
                        reg = <0xA00>;
+                        cooling-min-level = <13>;
+                        cooling-max-level = <7>;
+                        #cooling-cells = <2>; /* min followed by max */
                };
                cpu@A01 {
diff --git a/arch/arm/boot/dts/exynos4x12.dtsi b/arch/arm/boot/dts/exynos4x12.dtsi
index f5e0ae780d6c..6a6abe14fd9b 100644
--- a/arch/arm/boot/dts/exynos4x12.dtsi
+++ b/arch/arm/boot/dts/exynos4x12.dtsi
@@ -19,6 +19,7 @@
 #include "exynos4.dtsi"
 #include "exynos4x12-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 / {
        aliases {
@@ -297,4 +298,15 @@
                clock-names = "tmu_apbif";
                status = "disabled";
        };
+        hdmi: hdmi@12D00000 {
+                compatible = "samsung,exynos4212-hdmi";
+        };
+        mixer: mixer@12C10000 {
+                compatible = "samsung,exynos4212-mixer";
+                clock-names = "mixer", "hdmi", "sclk_hdmi", "vp";
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
+                         <&clock CLK_SCLK_HDMI>, <&clock CLK_VP>;
+        };
 };
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 9bb1b0b738f5..adbde1adad95 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -20,7 +20,7 @@
 #include <dt-bindings/clock/exynos5250.h>
 #include "exynos5.dtsi"
 #include "exynos5250-pinctrl.dtsi"
+#include "exynos4-cpu-thermal.dtsi"
 #include <dt-bindings/clock/exynos-audss-clk.h>
 / {
@@ -58,11 +58,14 @@
                #address-cells = <1>;
                #size-cells = <0>;
-                cpu@0 {
+                cpu0: cpu@0 {
                        device_type = "cpu";
                        compatible = "arm,cortex-a15";
                        reg = <0>;
                        clock-frequency = <1700000000>;
+                        cooling-min-level = <15>;
+                        cooling-max-level = <9>;
+                        #cooling-cells = <2>; /* min followed by max */
                };
                cpu@1 {
                        device_type = "cpu";
@@ -102,6 +105,12 @@
                #power-domain-cells = <0>;
        };
+        pd_disp1: disp1-power-domain@100440A0 {
+                compatible = "samsung,exynos4210-pd";
+                reg = <0x100440A0 0x20>;
+                #power-domain-cells = <0>;
+        };
        clock: clock-controller@10010000 {
                compatible = "samsung,exynos5250-clock";
                reg = <0x10010000 0x30000>;
@@ -235,12 +244,32 @@
                status = "disabled";
        };
-        tmu@10060000 {
+        tmu: tmu@10060000 {
                compatible = "samsung,exynos5250-tmu";
                reg = <0x10060000 0x100>;
                interrupts = <0 65 0>;
                clocks = <&clock CLK_TMU>;
                clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+        thermal-zones {
+                cpu_thermal: cpu-thermal {
+                        polling-delay-passive = <0>;
+                        polling-delay = <0>;
+                        thermal-sensors = <&tmu 0>;
+                        cooling-maps {
+                                map0 {
+                                     /* Corresponds to 800MHz at freq_table */
+                                     cooling-device = <&cpu0 9 9>;
+                                };
+                                map1 {
+                                     /* Corresponds to 200MHz at freq_table */
+                                     cooling-device = <&cpu0 15 15>;
+                               };
+                       };
+                };
        };
        serial@12C00000 {
@@ -719,6 +748,7 @@
        hdmi: hdmi {
                compatible = "samsung,exynos4212-hdmi";
                reg = <0x14530000 0x70000>;
+                power-domains = <&pd_disp1>;
                interrupts = <0 95 0>;
                clocks = <&clock CLK_HDMI>, <&clock CLK_SCLK_HDMI>,
                         <&clock CLK_SCLK_PIXEL>, <&clock CLK_SCLK_HDMIPHY>,
@@ -731,9 +761,11 @@
        mixer {
                compatible = "samsung,exynos5250-mixer";
                reg = <0x14450000 0x10000>;
+                power-domains = <&pd_disp1>;
                interrupts = <0 94 0>;
-                clocks = <&clock CLK_MIXER>, <&clock CLK_SCLK_HDMI>;
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
-                clock-names = "mixer", "sclk_hdmi";
+                         <&clock CLK_SCLK_HDMI>;
+                clock-names = "mixer", "hdmi", "sclk_hdmi";
        };
        dp_phy: video-phy@10040720 {
@@ -743,6 +775,7 @@
        };
        dp: dp-controller@145B0000 {
+                power-domains = <&pd_disp1>;
                clocks = <&clock CLK_DP>;
                clock-names = "dp";
                phys = <&dp_phy>;
@@ -750,6 +783,7 @@
        };
        fimd: fimd@14400000 {
+                power-domains = <&pd_disp1>;
                clocks = <&clock CLK_SCLK_FIMD1>, <&clock CLK_FIMD1>;
                clock-names = "sclk_fimd", "fimd";
        };
diff --git a/arch/arm/boot/dts/exynos5420-trip-points.dtsi b/arch/arm/boot/dts/exynos5420-trip-points.dtsi
new file mode 100644
index 000000000000..5d31fc140823
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5420-trip-points.dtsi
@@ -0,0 +1,35 @@
+/*
+ * Device tree sources for default Exynos5420 thermal zone definition
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+polling-delay-passive = <0>;
+polling-delay = <0>;
+trips {
+        cpu-alert-0 {
+                temperature = <85000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-alert-1 {
+                temperature = <103000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-alert-2 {
+                temperature = <110000>; /* millicelsius */
+                hysteresis = <10000>; /* millicelsius */
+                type = "active";
+        };
+        cpu-crit-0 {
+                temperature = <1200000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "critical";
+        };
+};
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
index 9dc2e9773b30..c0e98cf3514f 100644
--- a/arch/arm/boot/dts/exynos5420.dtsi
+++ b/arch/arm/boot/dts/exynos5420.dtsi
@@ -740,8 +740,9 @@
                compatible = "samsung,exynos5420-mixer";
                reg = <0x14450000 0x10000>;
                interrupts = <0 94 0>;
-                clocks = <&clock CLK_MIXER>, <&clock CLK_SCLK_HDMI>;
+                clocks = <&clock CLK_MIXER>, <&clock CLK_HDMI>,
-                clock-names = "mixer", "sclk_hdmi";
+                         <&clock CLK_SCLK_HDMI>;
+                clock-names = "mixer", "hdmi", "sclk_hdmi";
                power-domains = <&disp_pd>;
        };
@@ -782,6 +783,7 @@
                interrupts = <0 65 0>;
                clocks = <&clock CLK_TMU>;
                clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
        };
        tmu_cpu1: tmu@10064000 {
@@ -790,6 +792,7 @@
                interrupts = <0 183 0>;
                clocks = <&clock CLK_TMU>;
                clock-names = "tmu_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
        };
        tmu_cpu2: tmu@10068000 {
@@ -798,6 +801,7 @@
                interrupts = <0 184 0>;
                clocks = <&clock CLK_TMU>, <&clock CLK_TMU>;
                clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
        };
        tmu_cpu3: tmu@1006c000 {
@@ -806,6 +810,7 @@
                interrupts = <0 185 0>;
                clocks = <&clock CLK_TMU>, <&clock CLK_TMU_GPU>;
                clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
        };
        tmu_gpu: tmu@100a0000 {
@@ -814,6 +819,30 @@
                interrupts = <0 215 0>;
                clocks = <&clock CLK_TMU_GPU>, <&clock CLK_TMU>;
                clock-names = "tmu_apbif", "tmu_triminfo_apbif";
+                #include "exynos4412-tmu-sensor-conf.dtsi"
+        };
+        thermal-zones {
+                cpu0_thermal: cpu0-thermal {
+                        thermal-sensors = <&tmu_cpu0>;
+                        #include "exynos5420-trip-points.dtsi"
+                };
+                cpu1_thermal: cpu1-thermal {
+                       thermal-sensors = <&tmu_cpu1>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                cpu2_thermal: cpu2-thermal {
+                       thermal-sensors = <&tmu_cpu2>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                cpu3_thermal: cpu3-thermal {
+                       thermal-sensors = <&tmu_cpu3>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
+                gpu_thermal: gpu-thermal {
+                       thermal-sensors = <&tmu_gpu>;
+                       #include "exynos5420-trip-points.dtsi"
+                };
        };
        watchdog: watchdog@101D0000 {
diff --git a/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi b/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi
new file mode 100644
index 000000000000..7b2fba0ae92b
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5440-tmu-sensor-conf.dtsi
@@ -0,0 +1,24 @@
+/*
+ * Device tree sources for Exynos5440 TMU sensor configuration
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <dt-bindings/thermal/thermal_exynos.h>
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <5>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <0x5d2d>;
+samsung,tmu_min_efuse_value = <16>;
+samsung,tmu_max_efuse_value = <76>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <70>;
+samsung,tmu_default_temp_offset = <25>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff --git a/arch/arm/boot/dts/exynos5440-trip-points.dtsi b/arch/arm/boot/dts/exynos5440-trip-points.dtsi
new file mode 100644
index 000000000000..48adfa8f4300
--- /dev/null
+++ b/arch/arm/boot/dts/exynos5440-trip-points.dtsi
@@ -0,0 +1,25 @@
+/*
+ * Device tree sources for default Exynos5440 thermal zone definition
+ *
+ * Copyright (c) 2014 Lukasz Majewski <l.majewski@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+polling-delay-passive = <0>;
+polling-delay = <0>;
+trips {
+        cpu-alert-0 {
+                temperature = <100000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "active";
+        };
+        cpu-crit-0 {
+                temperature = <1050000>; /* millicelsius */
+                hysteresis = <0>; /* millicelsius */
+                type = "critical";
+        };
+};
diff --git a/arch/arm/boot/dts/exynos5440.dtsi b/arch/arm/boot/dts/exynos5440.dtsi
index 8f3373cd7b87..59d9416b3b03 100644
--- a/arch/arm/boot/dts/exynos5440.dtsi
+++ b/arch/arm/boot/dts/exynos5440.dtsi
@@ -219,6 +219,7 @@
                interrupts = <0 58 0>;
                clocks = <&clock CLK_B_125>;
                clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
        };
        tmuctrl_1: tmuctrl@16011C {
@@ -227,6 +228,7 @@
                interrupts = <0 58 0>;
                clocks = <&clock CLK_B_125>;
                clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
        };
        tmuctrl_2: tmuctrl@160120 {
@@ -235,6 +237,22 @@
                interrupts = <0 58 0>;
                clocks = <&clock CLK_B_125>;
                clock-names = "tmu_apbif";
+                #include "exynos5440-tmu-sensor-conf.dtsi"
+        };
+        thermal-zones {
+                cpu0_thermal: cpu0-thermal {
+                        thermal-sensors = <&tmuctrl_0>;
+                        #include "exynos5440-trip-points.dtsi"
+                };
+                cpu1_thermal: cpu1-thermal {
+                       thermal-sensors = <&tmuctrl_1>;
+                       #include "exynos5440-trip-points.dtsi"
+                };
+                cpu2_thermal: cpu2-thermal {
+                       thermal-sensors = <&tmuctrl_2>;
+                       #include "exynos5440-trip-points.dtsi"
+                };
        };
        sata@210000 {
diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
index f1cd2147421d..a626e6dd8022 100644
--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@@ -35,6 +35,7 @@
                        regulator-max-microvolt = <5000000>;
                        gpio = <&gpio3 22 0>;
                        enable-active-high;
+                        vin-supply = <&swbst_reg>;
                };
                reg_usb_h1_vbus: regulator@1 {
@@ -45,6 +46,7 @@
                        regulator-max-microvolt = <5000000>;
                        gpio = <&gpio1 29 0>;
                        enable-active-high;
+                        vin-supply = <&swbst_reg>;
                };
                reg_audio: regulator@2 {
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index fda4932faefd..945887d3fdb3 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -52,6 +52,7 @@
                        regulator-max-microvolt = <5000000>;
                        gpio = <&gpio4 0 0>;
                        enable-active-high;
+                        vin-supply = <&swbst_reg>;
                };
                reg_usb_otg2_vbus: regulator@1 {
@@ -62,6 +63,7 @@
                        regulator-max-microvolt = <5000000>;
                        gpio = <&gpio4 2 0>;
                        enable-active-high;
+                        vin-supply = <&swbst_reg>;
                };
                reg_aud3v: regulator@2 {
diff --git a/arch/arm/boot/dts/omap5-core-thermal.dtsi b/arch/arm/boot/dts/omap5-core-thermal.dtsi
index 19212ac6eef0..de8a3d456cf7 100644
--- a/arch/arm/boot/dts/omap5-core-thermal.dtsi
+++ b/arch/arm/boot/dts/omap5-core-thermal.dtsi
@@ -13,7 +13,7 @@
 core_thermal: core_thermal {
        polling-delay-passive = <250>; /* milliseconds */
-        polling-delay = <1000>; /* milliseconds */
+        polling-delay = <500>; /* milliseconds */
                        /* sensor       ID */
        thermal-sensors = <&bandgap     2>;
diff --git a/arch/arm/boot/dts/omap5-gpu-thermal.dtsi b/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
index 1b87aca88b77..bc3090f2e84b 100644
--- a/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
+++ b/arch/arm/boot/dts/omap5-gpu-thermal.dtsi
@@ -13,7 +13,7 @@
 gpu_thermal: gpu_thermal {
        polling-delay-passive = <250>; /* milliseconds */
-        polling-delay = <1000>; /* milliseconds */
+        polling-delay = <500>; /* milliseconds */
                        /* sensor       ID */
        thermal-sensors = <&bandgap     1>;
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index ddff674bd05e..4a485b63a141 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -1079,4 +1079,8 @@
        };
 };
+&cpu_thermal {
+        polling-delay = <500>; /* milliseconds */
+};
 /include/ "omap54xx-clocks.dtsi"
diff --git a/arch/arm/boot/dts/omap54xx-clocks.dtsi b/arch/arm/boot/dts/omap54xx-clocks.dtsi
index 58c27466f012..83b425fb3ac2 100644
--- a/arch/arm/boot/dts/omap54xx-clocks.dtsi
+++ b/arch/arm/boot/dts/omap54xx-clocks.dtsi
@@ -167,10 +167,18 @@
                ti,index-starts-at-one;
        };
+        dpll_core_byp_mux: dpll_core_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&dpll_abe_m3x2_ck>;
+                ti,bit-shift = <23>;
+                reg = <0x012c>;
+        };
        dpll_core_ck: dpll_core_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-core-clock";
-                clocks = <&sys_clkin>, <&dpll_abe_m3x2_ck>;
+                clocks = <&sys_clkin>, <&dpll_core_byp_mux>;
                reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
        };
@@ -294,10 +302,18 @@
                clock-div = <1>;
        };
+        dpll_iva_byp_mux: dpll_iva_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&iva_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x01ac>;
+        };
        dpll_iva_ck: dpll_iva_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin>, <&iva_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_iva_byp_mux>;
                reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
        };
@@ -599,10 +615,19 @@
        };
 };
 &cm_core_clocks {
+        dpll_per_byp_mux: dpll_per_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&per_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x014c>;
+        };
        dpll_per_ck: dpll_per_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-clock";
-                clocks = <&sys_clkin>, <&per_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_per_byp_mux>;
                reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
        };
@@ -714,10 +739,18 @@
                ti,index-starts-at-one;
        };
+        dpll_usb_byp_mux: dpll_usb_byp_mux {
+                #clock-cells = <0>;
+                compatible = "ti,mux-clock";
+                clocks = <&sys_clkin>, <&usb_dpll_hs_clk_div>;
+                ti,bit-shift = <23>;
+                reg = <0x018c>;
+        };
        dpll_usb_ck: dpll_usb_ck {
                #clock-cells = <0>;
                compatible = "ti,omap4-dpll-j-type-clock";
-                clocks = <&sys_clkin>, <&usb_dpll_hs_clk_div>;
+                clocks = <&sys_clkin>, <&dpll_usb_byp_mux>;
                reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
        };
diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
index 261311bdf65b..367af53c1b84 100644
--- a/arch/arm/boot/dts/sama5d3.dtsi
+++ b/arch/arm/boot/dts/sama5d3.dtsi
@@ -1248,7 +1248,6 @@
                                atmel,watchdog-type = "hardware";
                                atmel,reset-type = "all";
                                atmel,dbg-halt;
-                                atmel,idle-halt;
                                status = "disabled";
                        };
@@ -1416,7 +1415,7 @@
                        compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                        reg = <0x00700000 0x100000>;
                        interrupts = <32 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                        clock-names = "usb_clk", "ehci_clk", "uhpck";
                        status = "disabled";
                };
diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
index d986b41b9654..4303874889c6 100644
--- a/arch/arm/boot/dts/sama5d4.dtsi
+++ b/arch/arm/boot/dts/sama5d4.dtsi
@@ -66,6 +66,7 @@
                gpio4 = &pioE;
                tcb0 = &tcb0;
                tcb1 = &tcb1;
+                i2c0 = &i2c0;
                i2c2 = &i2c2;
        };
        cpus {
@@ -259,7 +260,7 @@
                        compatible = "atmel,at91sam9g45-ehci", "usb-ehci";
                        reg = <0x00600000 0x100000>;
                        interrupts = <46 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&uhpck>;
+                        clocks = <&utmi>, <&uhphs_clk>, <&uhpck>;
                        clock-names = "usb_clk", "ehci_clk", "uhpck";
                        status = "disabled";
                };
@@ -461,8 +462,8 @@
                                        lcdck: lcdck {
                                                #clock-cells = <0>;
-                                                reg = <4>;
+                                                reg = <3>;
-                                                clocks = <&smd>;
+                                                clocks = <&mck>;
                                        };
                                        smdck: smdck {
@@ -770,7 +771,7 @@
                                                reg = <50>;
                                        };
-                                        lcd_clk: lcd_clk {
+                                        lcdc_clk: lcdc_clk {
                                                #clock-cells = <0>;
                                                reg = <51>;
                                        };
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 252c3d1bda50..9d8760956752 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -713,6 +713,9 @@
                        reg-shift = <2>;
                        reg-io-width = <4>;
                        clocks = <&l4_sp_clk>;
+                        dmas = <&pdma 28>,
+                               <&pdma 29>;
+                        dma-names = "tx", "rx";
                };
                uart1: serial1@ffc03000 {
@@ -722,6 +725,9 @@
                        reg-shift = <2>;
                        reg-io-width = <4>;
                        clocks = <&l4_sp_clk>;
+                        dmas = <&pdma 30>,
+                               <&pdma 31>;
+                        dma-names = "tx", "rx";
                };
                rst: rstmgr@ffd05000 {
diff --git a/arch/arm/configs/at91_dt_defconfig b/arch/arm/configs/at91_dt_defconfig
index f2670f638e97..811e72bbe642 100644
--- a/arch/arm/configs/at91_dt_defconfig
+++ b/arch/arm/configs/at91_dt_defconfig
@@ -70,6 +70,7 @@ CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
+CONFIG_ARM_AT91_ETHER=y
 CONFIG_MACB=y
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_DM9000=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index b7e6b6fba5e0..06075b6d2463 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -99,7 +99,7 @@ CONFIG_PCI_RCAR_GEN2=y
 CONFIG_PCI_RCAR_GEN2_PCIE=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=8
+CONFIG_NR_CPUS=16
 CONFIG_HIGHPTE=y
 CONFIG_CMA=y
 CONFIG_ARM_APPENDED_DTB=y
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index a097cffa1231..8e108599e1af 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -377,6 +377,7 @@ CONFIG_PWM_TWL=m
 CONFIG_PWM_TWL_LED=m
 CONFIG_OMAP_USB2=m
 CONFIG_TI_PIPE3=y
+CONFIG_TWL4030_USB=m
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
diff --git a/arch/arm/configs/sama5_defconfig b/arch/arm/configs/sama5_defconfig
index 41d856effe6c..510c747c65b4 100644
--- a/arch/arm/configs/sama5_defconfig
+++ b/arch/arm/configs/sama5_defconfig
@@ -3,8 +3,6 @@
 CONFIG_SYSVIPC=y
 CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EMBEDDED=y
 CONFIG_SLAB=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index 38840a812924..8f6a5702b696 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -4,6 +4,7 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_PERF_EVENTS=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_SMP=y
+CONFIG_NR_CPUS=8
 CONFIG_AEABI=y
 CONFIG_HIGHMEM=y
 CONFIG_HIGHPTE=y
diff --git a/arch/arm/configs/vexpress_defconfig b/arch/arm/configs/vexpress_defconfig
index f489fdaa19b8..37fe607a4ede 100644
--- a/arch/arm/configs/vexpress_defconfig
+++ b/arch/arm/configs/vexpress_defconfig
@@ -118,8 +118,8 @@ CONFIG_HID_ZEROPLUS=y
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_MON=y
-CONFIG_USB_ISP1760_HCD=y
 CONFIG_USB_STORAGE=y
+CONFIG_USB_ISP1760=y
 CONFIG_MMC=y
 CONFIG_MMC_ARMMMCI=y
 CONFIG_NEW_LEDS=y
diff --git a/arch/arm/include/debug/at91.S b/arch/arm/include/debug/at91.S
index 80a6501b4d50..c3c45e628e33 100644
--- a/arch/arm/include/debug/at91.S
+++ b/arch/arm/include/debug/at91.S
@@ -18,8 +18,11 @@
 #define AT91_DBGU 0xfc00c000 /* SAMA5D4_BASE_USART3 */
 #endif
-/* Keep in sync with mach-at91/include/mach/hardware.h */
+#ifdef CONFIG_MMU
 #define AT91_IO_P2V(x) ((x) - 0x01000000)
+#else
+#define AT91_IO_P2V(x) (x)
+#endif
 #define AT91_DBGU_SR            (0x14)  /* Status Register */
 #define AT91_DBGU_THR           (0x1c)  /* Transmitter Holding Register */
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 5e34fb143309..aa4116e9452f 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -270,37 +270,35 @@ static void __init at91_pm_sram_init(void)
        phys_addr_t sram_pbase;
        unsigned long sram_base;
        struct device_node *node;
-        struct platform_device *pdev;
+        struct platform_device *pdev = NULL;
-        node = of_find_compatible_node(NULL, NULL, "mmio-sram");
+        for_each_compatible_node(node, NULL, "mmio-sram") {
-        if (!node) {
+                pdev = of_find_device_by_node(node);
-                pr_warn("%s: failed to find sram node!\n", __func__);
+                if (pdev) {
-                return;
+                        of_node_put(node);
+                        break;
+                }
        }
-        pdev = of_find_device_by_node(node);
        if (!pdev) {
                pr_warn("%s: failed to find sram device!\n", __func__);
-                goto put_node;
+                return;
        }
        sram_pool = dev_get_gen_pool(&pdev->dev);
        if (!sram_pool) {
                pr_warn("%s: sram pool unavailable!\n", __func__);
-                goto put_node;
+                return;
        }
        sram_base = gen_pool_alloc(sram_pool, at91_slow_clock_sz);
        if (!sram_base) {
                pr_warn("%s: unable to alloc ocram!\n", __func__);
-                goto put_node;
+                return;
        }
        sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base);
        slow_clock = __arm_ioremap_exec(sram_pbase, at91_slow_clock_sz, false);
-put_node:
-        of_node_put(node);
 }
 #endif
diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
index d2c89963af2d..86c0aa819d25 100644
--- a/arch/arm/mach-at91/pm.h
+++ b/arch/arm/mach-at91/pm.h
@@ -44,7 +44,7 @@ static inline void at91rm9200_standby(void)
                "    mcr    p15, 0, %0, c7, c0, 4\n\t"
                "    str    %5, [%1, %2]"
                :
-                : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
+                : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
                  "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
                  "r" (lpr));
 }
diff --git a/arch/arm/mach-at91/pm_slowclock.S b/arch/arm/mach-at91/pm_slowclock.S
index 556151e85ec4..931f0e302c03 100644
--- a/arch/arm/mach-at91/pm_slowclock.S
+++ b/arch/arm/mach-at91/pm_slowclock.S
@@ -25,11 +25,6 @@
 */
 #undef SLOWDOWN_MASTER_CLOCK
-#define MCKRDY_TIMEOUT          1000
-#define MOSCRDY_TIMEOUT         1000
-#define PLLALOCK_TIMEOUT        1000
-#define PLLBLOCK_TIMEOUT        1000
 pmc     .req    r0
 sdramc  .req    r1
 ramc1   .req    r2
@@ -41,60 +36,42 @@ tmp2	.req	r5
 * Wait until master clock is ready (after switching master clock source)
 */
        .macro wait_mckrdy
-        mov     tmp2, #MCKRDY_TIMEOUT
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
        tst     tmp1, #AT91_PMC_MCKRDY
        beq     1b
-2:
        .endm
 /*
 * Wait until master oscillator has stabilized.
 */
        .macro wait_moscrdy
-        mov     tmp2, #MOSCRDY_TIMEOUT
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
        tst     tmp1, #AT91_PMC_MOSCS
        beq     1b
-2:
        .endm
 /*
 * Wait until PLLA has locked.
 */
        .macro wait_pllalock
-        mov     tmp2, #PLLALOCK_TIMEOUT
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
        tst     tmp1, #AT91_PMC_LOCKA
        beq     1b
-2:
        .endm
 /*
 * Wait until PLLB has locked.
 */
        .macro wait_pllblock
-        mov     tmp2, #PLLBLOCK_TIMEOUT
+1:      ldr     tmp1, [pmc, #AT91_PMC_SR]
-1:      sub     tmp2, tmp2, #1
-        cmp     tmp2, #0
-        beq     2f
-        ldr     tmp1, [pmc, #AT91_PMC_SR]
        tst     tmp1, #AT91_PMC_LOCKB
        beq     1b
-2:
        .endm
        .text
+        .arm
 /* void at91_slow_clock(void __iomem *pmc, void __iomem *sdramc,
 *                      void __iomem *ramc1, int memctrl)
 */
@@ -134,6 +111,16 @@ ddr_sr_enable:
        cmp     memctrl, #AT91_MEMCTRL_DDRSDR
        bne     sdr_sr_enable
+        /* LPDDR1 --> force DDR2 mode during self-refresh */
+        ldr     tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+        str     tmp1, .saved_sam9_mdr
+        bic     tmp1, tmp1, #~AT91_DDRSDRC_MD
+        cmp     tmp1, #AT91_DDRSDRC_MD_LOW_POWER_DDR
+        ldreq   tmp1, [sdramc, #AT91_DDRSDRC_MDR]
+        biceq   tmp1, tmp1, #AT91_DDRSDRC_MD
+        orreq   tmp1, tmp1, #AT91_DDRSDRC_MD_DDR2
+        streq   tmp1, [sdramc, #AT91_DDRSDRC_MDR]
        /* prepare for DDRAM self-refresh mode */
        ldr     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
        str     tmp1, .saved_sam9_lpr
@@ -142,14 +129,26 @@ ddr_sr_enable:
        /* figure out if we use the second ram controller */
        cmp     ramc1, #0
-        ldrne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+        beq     ddr_no_2nd_ctrl
-        strne   tmp2, .saved_sam9_lpr1
-        bicne   tmp2, #AT91_DDRSDRC_LPCB
+        ldr     tmp2, [ramc1, #AT91_DDRSDRC_MDR]
-        orrne   tmp2, #AT91_DDRSDRC_LPCB_SELF_REFRESH
+        str     tmp2, .saved_sam9_mdr1
+        bic     tmp2, tmp2, #~AT91_DDRSDRC_MD
+        cmp     tmp2, #AT91_DDRSDRC_MD_LOW_POWER_DDR
+        ldreq   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+        biceq   tmp2, tmp2, #AT91_DDRSDRC_MD
+        orreq   tmp2, tmp2, #AT91_DDRSDRC_MD_DDR2
+        streq   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
+        ldr     tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+        str     tmp2, .saved_sam9_lpr1
+        bic     tmp2, #AT91_DDRSDRC_LPCB
+        orr     tmp2, #AT91_DDRSDRC_LPCB_SELF_REFRESH
        /* Enable DDRAM self-refresh mode */
+        str     tmp2, [ramc1, #AT91_DDRSDRC_LPR]
+ddr_no_2nd_ctrl:
        str     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
-        strne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
        b       sdr_sr_done
@@ -208,6 +207,7 @@ sdr_sr_done:
        /* Turn off the main oscillator */
        ldr     tmp1, [pmc, #AT91_CKGR_MOR]
        bic     tmp1, tmp1, #AT91_PMC_MOSCEN
+        orr     tmp1, tmp1, #AT91_PMC_KEY
        str     tmp1, [pmc, #AT91_CKGR_MOR]
        /* Wait for interrupt */
@@ -216,6 +216,7 @@ sdr_sr_done:
        /* Turn on the main oscillator */
        ldr     tmp1, [pmc, #AT91_CKGR_MOR]
        orr     tmp1, tmp1, #AT91_PMC_MOSCEN
+        orr     tmp1, tmp1, #AT91_PMC_KEY
        str     tmp1, [pmc, #AT91_CKGR_MOR]
        wait_moscrdy
@@ -280,12 +281,17 @@ sdr_sr_done:
         */
        cmp     memctrl, #AT91_MEMCTRL_DDRSDR
        bne     sdr_en_restore
+        /* Restore MDR in case of LPDDR1 */
+        ldr     tmp1, .saved_sam9_mdr
+        str     tmp1, [sdramc, #AT91_DDRSDRC_MDR]
        /* Restore LPR on AT91 with DDRAM */
        ldr     tmp1, .saved_sam9_lpr
        str     tmp1, [sdramc, #AT91_DDRSDRC_LPR]
        /* if we use the second ram controller */
        cmp     ramc1, #0
+        ldrne   tmp2, .saved_sam9_mdr1
+        strne   tmp2, [ramc1, #AT91_DDRSDRC_MDR]
        ldrne   tmp2, .saved_sam9_lpr1
        strne   tmp2, [ramc1, #AT91_DDRSDRC_LPR]
@@ -319,5 +325,11 @@ ram_restored:
 .saved_sam9_lpr1:
        .word 0
+.saved_sam9_mdr:
+        .word 0
+.saved_sam9_mdr1:
+        .word 0
 ENTRY(at91_slow_clock_sz)
        .word .-at91_slow_clock
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 3f32c47a6d74..d2e9f12d12f1 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -126,8 +126,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
 */
 void exynos_cpu_power_down(int cpu)
 {
-        if (cpu == 0 && (of_machine_is_compatible("samsung,exynos5420") ||
+        if (cpu == 0 && (soc_is_exynos5420() || soc_is_exynos5800())) {
-                of_machine_is_compatible("samsung,exynos5800"))) {
                /*
                 * Bypass power down for CPU0 during suspend. Check for
                 * the SYS_PWR_REG value to decide if we are suspending
diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c
index 20f267121b3e..37266a826437 100644
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -161,6 +161,34 @@ no_clk:
                of_genpd_add_provider_simple(np, &pd->pd);
        }
+        /* Assign the child power domains to their parents */
+        for_each_compatible_node(np, NULL, "samsung,exynos4210-pd") {
+                struct generic_pm_domain *child_domain, *parent_domain;
+                struct of_phandle_args args;
+                args.np = np;
+                args.args_count = 0;
+                child_domain = of_genpd_get_from_provider(&args);
+                if (!child_domain)
+                        continue;
+                if (of_parse_phandle_with_args(np, "power-domains",
+                                         "#power-domain-cells", 0, &args) != 0)
+                        continue;
+                parent_domain = of_genpd_get_from_provider(&args);
+                if (!parent_domain)
+                        continue;
+                if (pm_genpd_add_subdomain(parent_domain, child_domain))
+                        pr_warn("%s failed to add subdomain: %s\n",
+                                parent_domain->name, child_domain->name);
+                else
+                        pr_info("%s has as child subdomain: %s.\n",
+                                parent_domain->name, child_domain->name);
+                of_node_put(np);
+        }
        return 0;
 }
 arch_initcall(exynos4_pm_init_power_domain);
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
index 52e2b1a2fddb..318d127df147 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
@@ -87,8 +87,8 @@ static unsigned int exynos_pmu_spare3;
 static u32 exynos_irqwake_intmask = 0xffffffff;
 static const struct exynos_wkup_irq exynos3250_wkup_irq[] = {
-        { 73, BIT(1) }, /* RTC alarm */
+        { 105, BIT(1) }, /* RTC alarm */
-        { 74, BIT(2) }, /* RTC tick */
+        { 106, BIT(2) }, /* RTC tick */
        { /* sentinel */ },
 };
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 4ad6e473cf83..9de3412af406 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -211,8 +211,9 @@ static void __init imx6q_1588_init(void)
         * set bit IOMUXC_GPR1[21].  Or the PTP clock must be from pad
         * (external OSC), and we need to clear the bit.
         */
-        clksel = ptp_clk == enet_ref ? IMX6Q_GPR1_ENET_CLK_SEL_ANATOP :
+        clksel = clk_is_match(ptp_clk, enet_ref) ?
-                                       IMX6Q_GPR1_ENET_CLK_SEL_PAD;
+                                IMX6Q_GPR1_ENET_CLK_SEL_ANATOP :
+                                IMX6Q_GPR1_ENET_CLK_SEL_PAD;
        gpr = syscon_regmap_lookup_by_compatible("fsl,imx6q-iomuxc-gpr");
        if (!IS_ERR(gpr))
                regmap_update_bits(gpr, IOMUXC_GPR1,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 92afb723dcfc..355b08936871 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1692,16 +1692,15 @@ static int _deassert_hardreset(struct omap_hwmod *oh, const char *name)
        if (ret == -EBUSY)
                pr_warn("omap_hwmod: %s: failed to hardreset\n", oh->name);
-        if (!ret) {
+        if (oh->clkdm) {
                /*
                 * Set the clockdomain to HW_AUTO, assuming that the
                 * previous state was HW_AUTO.
                 */
-                if (oh->clkdm && hwsup)
+                if (hwsup)
                        clkdm_allow_idle(oh->clkdm);
-        } else {
-                if (oh->clkdm)
+                clkdm_hwmod_disable(oh->clkdm, oh);
-                        clkdm_hwmod_disable(oh->clkdm, oh);
        }
        return ret;
@@ -2698,6 +2697,7 @@ static int __init _register(struct omap_hwmod *oh)
        INIT_LIST_HEAD(&oh->master_ports);
        INIT_LIST_HEAD(&oh->slave_ports);
        spin_lock_init(&oh->_lock);
+        lockdep_set_class(&oh->_lock, &oh->hwmod_key);
        oh->_state = _HWMOD_STATE_REGISTERED;
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 9d4bec6ee742..9611c91d9b82 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -674,6 +674,7 @@ struct omap_hwmod {
        u32                             _sysc_cache;
        void __iomem                    *_mpu_rt_va;
        spinlock_t                      _lock;
+        struct lock_class_key           hwmod_key; /* unique lock class */
        struct list_head                node;
        struct omap_hwmod_ocp_if        *_mpu_port;
        unsigned int                    (*xlate_irq)(unsigned int);
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index e8692e7675b8..16fe7a1b7a35 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1466,55 +1466,18 @@ static struct omap_hwmod dra7xx_ocp2scp3_hwmod = {
 *
 */
-static struct omap_hwmod_class dra7xx_pcie_hwmod_class = {
+static struct omap_hwmod_class dra7xx_pciess_hwmod_class = {
        .name   = "pcie",
 };
 /* pcie1 */
-static struct omap_hwmod dra7xx_pcie1_hwmod = {
+static struct omap_hwmod dra7xx_pciess1_hwmod = {
        .name           = "pcie1",
-        .class          = &dra7xx_pcie_hwmod_class,
+        .class          = &dra7xx_pciess_hwmod_class,
        .clkdm_name     = "pcie_clkdm",
        .main_clk       = "l4_root_clk_div",
        .prcm = {
                .omap4 = {
-                        .clkctrl_offs   = DRA7XX_CM_PCIE_CLKSTCTRL_OFFSET,
-                        .modulemode     = MODULEMODE_SWCTRL,
-                },
-        },
-};
-/* pcie2 */
-static struct omap_hwmod dra7xx_pcie2_hwmod = {
-        .name           = "pcie2",
-        .class          = &dra7xx_pcie_hwmod_class,
-        .clkdm_name     = "pcie_clkdm",
-        .main_clk       = "l4_root_clk_div",
-        .prcm = {
-                .omap4 = {
-                        .clkctrl_offs = DRA7XX_CM_PCIE_CLKSTCTRL_OFFSET,
-                        .modulemode   = MODULEMODE_SWCTRL,
-                },
-        },
-};
-/*
- * 'PCIE PHY' class
- *
- */
-static struct omap_hwmod_class dra7xx_pcie_phy_hwmod_class = {
-        .name   = "pcie-phy",
-};
-/* pcie1 phy */
-static struct omap_hwmod dra7xx_pcie1_phy_hwmod = {
-        .name           = "pcie1-phy",
-        .class          = &dra7xx_pcie_phy_hwmod_class,
-        .clkdm_name     = "l3init_clkdm",
-        .main_clk       = "l4_root_clk_div",
-        .prcm = {
-                .omap4 = {
                        .clkctrl_offs = DRA7XX_CM_L3INIT_PCIESS1_CLKCTRL_OFFSET,
                        .context_offs = DRA7XX_RM_L3INIT_PCIESS1_CONTEXT_OFFSET,
                        .modulemode   = MODULEMODE_SWCTRL,
@@ -1522,11 +1485,11 @@ static struct omap_hwmod dra7xx_pcie1_phy_hwmod = {
        },
 };
-/* pcie2 phy */
+/* pcie2 */
-static struct omap_hwmod dra7xx_pcie2_phy_hwmod = {
+static struct omap_hwmod dra7xx_pciess2_hwmod = {
-        .name           = "pcie2-phy",
+        .name           = "pcie2",
-        .class          = &dra7xx_pcie_phy_hwmod_class,
+        .class          = &dra7xx_pciess_hwmod_class,
-        .clkdm_name     = "l3init_clkdm",
+        .clkdm_name     = "pcie_clkdm",
        .main_clk       = "l4_root_clk_div",
        .prcm = {
                .omap4 = {
@@ -2877,50 +2840,34 @@ static struct omap_hwmod_ocp_if dra7xx_l4_cfg__ocp2scp3 = {
        .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
-/* l3_main_1 -> pcie1 */
+/* l3_main_1 -> pciess1 */
-static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pcie1 = {
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pciess1 = {
        .master         = &dra7xx_l3_main_1_hwmod,
-        .slave          = &dra7xx_pcie1_hwmod,
+        .slave          = &dra7xx_pciess1_hwmod,
        .clk            = "l3_iclk_div",
        .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
-/* l4_cfg -> pcie1 */
+/* l4_cfg -> pciess1 */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie1 = {
+static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pciess1 = {
        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie1_hwmod,
+        .slave          = &dra7xx_pciess1_hwmod,
        .clk            = "l4_root_clk_div",
        .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
-/* l3_main_1 -> pcie2 */
+/* l3_main_1 -> pciess2 */
-static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pcie2 = {
+static struct omap_hwmod_ocp_if dra7xx_l3_main_1__pciess2 = {
        .master         = &dra7xx_l3_main_1_hwmod,
-        .slave          = &dra7xx_pcie2_hwmod,
+        .slave          = &dra7xx_pciess2_hwmod,
        .clk            = "l3_iclk_div",
        .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
-/* l4_cfg -> pcie2 */
+/* l4_cfg -> pciess2 */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie2 = {
+static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pciess2 = {
-        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie2_hwmod,
-        .clk            = "l4_root_clk_div",
-        .user           = OCP_USER_MPU | OCP_USER_SDMA,
-};
-/* l4_cfg -> pcie1 phy */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie1_phy = {
-        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie1_phy_hwmod,
-        .clk            = "l4_root_clk_div",
-        .user           = OCP_USER_MPU | OCP_USER_SDMA,
-};
-/* l4_cfg -> pcie2 phy */
-static struct omap_hwmod_ocp_if dra7xx_l4_cfg__pcie2_phy = {
        .master         = &dra7xx_l4_cfg_hwmod,
-        .slave          = &dra7xx_pcie2_phy_hwmod,
+        .slave          = &dra7xx_pciess2_hwmod,
        .clk            = "l4_root_clk_div",
        .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
@@ -3327,12 +3274,10 @@ static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
        &dra7xx_l4_cfg__mpu,
        &dra7xx_l4_cfg__ocp2scp1,
        &dra7xx_l4_cfg__ocp2scp3,
-        &dra7xx_l3_main_1__pcie1,
+        &dra7xx_l3_main_1__pciess1,
-        &dra7xx_l4_cfg__pcie1,
+        &dra7xx_l4_cfg__pciess1,
-        &dra7xx_l3_main_1__pcie2,
+        &dra7xx_l3_main_1__pciess2,
-        &dra7xx_l4_cfg__pcie2,
+        &dra7xx_l4_cfg__pciess2,
-        &dra7xx_l4_cfg__pcie1_phy,
-        &dra7xx_l4_cfg__pcie2_phy,
        &dra7xx_l3_main_1__qspi,
        &dra7xx_l4_per3__rtcss,
        &dra7xx_l4_cfg__sata,
diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
index 190fa43e7479..e642b079e9f3 100644
--- a/arch/arm/mach-omap2/pdata-quirks.c
+++ b/arch/arm/mach-omap2/pdata-quirks.c
@@ -173,6 +173,7 @@ static void __init omap3_igep0030_rev_g_legacy_init(void)
 static void __init omap3_evm_legacy_init(void)
 {
+        hsmmc2_internal_input_clk();
        legacy_init_wl12xx(WL12XX_REFCLOCK_38, 0, 149);
 }
diff --git a/arch/arm/mach-omap2/prm44xx.c b/arch/arm/mach-omap2/prm44xx.c
index a08a617a6c11..d6d6bc39e05c 100644
--- a/arch/arm/mach-omap2/prm44xx.c
+++ b/arch/arm/mach-omap2/prm44xx.c
@@ -252,10 +252,10 @@ static void omap44xx_prm_save_and_clear_irqen(u32 *saved_mask)
 {
        saved_mask[0] =
                omap4_prm_read_inst_reg(OMAP4430_PRM_OCP_SOCKET_INST,
-                                        OMAP4_PRM_IRQSTATUS_MPU_OFFSET);
+                                        OMAP4_PRM_IRQENABLE_MPU_OFFSET);
        saved_mask[1] =
                omap4_prm_read_inst_reg(OMAP4430_PRM_OCP_SOCKET_INST,
-                                        OMAP4_PRM_IRQSTATUS_MPU_2_OFFSET);
+                                        OMAP4_PRM_IRQENABLE_MPU_2_OFFSET);
        omap4_prm_write_inst_reg(0, OMAP4430_PRM_OCP_SOCKET_INST,
                                 OMAP4_PRM_IRQENABLE_MPU_OFFSET);
diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c
index 7d8eab857a93..f6d02e4cbcda 100644
--- a/arch/arm/mach-pxa/idp.c
+++ b/arch/arm/mach-pxa/idp.c
@@ -36,6 +36,7 @@
 #include <linux/platform_data/video-pxafb.h>
 #include <mach/bitfield.h>
 #include <linux/platform_data/mmc-pxamci.h>
+#include <linux/smc91x.h>
 #include "generic.h"
 #include "devices.h"
diff --git a/arch/arm/mach-pxa/lpd270.c b/arch/arm/mach-pxa/lpd270.c
index 28da319d389f..eaee2c20b189 100644
--- a/arch/arm/mach-pxa/lpd270.c
+++ b/arch/arm/mach-pxa/lpd270.c
@@ -195,7 +195,7 @@ static struct resource smc91x_resources[] = {
 };
 struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT;
+        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
 };
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-sa1100/neponset.c b/arch/arm/mach-sa1100/neponset.c
index 7b0cd3172354..af868d258e66 100644
--- a/arch/arm/mach-sa1100/neponset.c
+++ b/arch/arm/mach-sa1100/neponset.c
@@ -268,8 +268,8 @@ static int neponset_probe(struct platform_device *dev)
                .id = 0,
                .res = smc91x_resources,
                .num_res = ARRAY_SIZE(smc91x_resources),
-                .data = &smc91c_platdata,
+                .data = &smc91x_platdata,
-                .size_data = sizeof(smc91c_platdata),
+                .size_data = sizeof(smc91x_platdata),
        };
        int ret, irq;
diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c
index 696fd0fe4806..1525d7b5f1b7 100644
--- a/arch/arm/mach-sa1100/pleb.c
+++ b/arch/arm/mach-sa1100/pleb.c
@@ -54,7 +54,7 @@ static struct platform_device smc91x_device = {
        .num_resources  = ARRAY_SIZE(smc91x_resources),
        .resource       = smc91x_resources,
        .dev = {
-                .platform_data  = &smc91c_platdata,
+                .platform_data  = &smc91x_platdata,
        },
 };
diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h
index 483cb467bf65..a0f3b1cd497c 100644
--- a/arch/arm/mach-socfpga/core.h
+++ b/arch/arm/mach-socfpga/core.h
@@ -45,6 +45,6 @@ extern char secondary_trampoline, secondary_trampoline_end;
 extern unsigned long socfpga_cpu1start_addr;
-#define SOCFPGA_SCU_VIRT_BASE   0xfffec000
+#define SOCFPGA_SCU_VIRT_BASE   0xfee00000
 #endif
diff --git a/arch/arm/mach-socfpga/socfpga.c b/arch/arm/mach-socfpga/socfpga.c
index 383d61e138af..f5e597c207b9 100644
--- a/arch/arm/mach-socfpga/socfpga.c
+++ b/arch/arm/mach-socfpga/socfpga.c
@@ -23,6 +23,7 @@
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
+#include <asm/cacheflush.h>
 #include "core.h"
@@ -73,6 +74,10 @@ void __init socfpga_sysmgr_init(void)
                        (u32 *) &socfpga_cpu1start_addr))
                pr_err("SMP: Need cpu1-start-addr in device tree.\n");
+        /* Ensure that socfpga_cpu1start_addr is visible to other CPUs */
+        smp_wmb();
+        sync_cache_w(&socfpga_cpu1start_addr);
        sys_manager_base_addr = of_iomap(np, 0);
        np = of_find_compatible_node(NULL, NULL, "altr,rst-mgr");
diff --git a/arch/arm/mach-sti/board-dt.c b/arch/arm/mach-sti/board-dt.c
index b067390cef4e..b373acade338 100644
--- a/arch/arm/mach-sti/board-dt.c
+++ b/arch/arm/mach-sti/board-dt.c
@@ -18,6 +18,7 @@ static const char *stih41x_dt_match[] __initdata = {
        "st,stih415",
        "st,stih416",
        "st,stih407",
+        "st,stih410",
        "st,stih418",
        NULL
 };
diff --git a/arch/arm64/boot/dts/apm/apm-storm.dtsi b/arch/arm64/boot/dts/apm/apm-storm.dtsi
index f1ad9c2ab2e9..a857794432d6 100644
--- a/arch/arm64/boot/dts/apm/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm/apm-storm.dtsi
@@ -622,7 +622,7 @@
                };
                sgenet0: ethernet@1f210000 {
-                        compatible = "apm,xgene-enet";
+                        compatible = "apm,xgene1-sgenet";
                        status = "disabled";
                        reg = <0x0 0x1f210000 0x0 0xd100>,
                              <0x0 0x1f200000 0x0 0Xc300>,
@@ -636,7 +636,7 @@
                };
                xgenet: ethernet@1f610000 {
-                        compatible = "apm,xgene-enet";
+                        compatible = "apm,xgene1-xgenet";
                        status = "disabled";
                        reg = <0x0 0x1f610000 0x0 0xd100>,
                              <0x0 0x1f600000 0x0 0Xc300>,
diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
index c028fe37456f..53d9c354219f 100644
--- a/arch/arm64/include/asm/tlb.h
+++ b/arch/arm64/include/asm/tlb.h
@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_gather *tlb)
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
                                  unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
        pgtable_page_dtor(pte);
        tlb_remove_entry(tlb, pte);
 }
@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
                                  unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
        tlb_remove_entry(tlb, virt_to_page(pmdp));
 }
 #endif
@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
 static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
                                  unsigned long addr)
 {
+        __flush_tlb_pgtable(tlb->mm, addr);
        tlb_remove_entry(tlb, virt_to_page(pudp));
 }
 #endif
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index 4abe9b945f77..c3bb05b98616 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -144,6 +144,19 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end
 }
 /*
+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
+ * table levels (pgd/pud/pmd).
+ */
+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
+                                       unsigned long uaddr)
+{
+        unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
+        dsb(ishst);
+        asm("tlbi       vae1is, %0" : : "r" (addr));
+        dsb(ish);
+}
+/*
 * On AArch64, the cache coherency is handled via the set_pte_at() function.
 */
 static inline void update_mmu_cache(struct vm_area_struct *vma,
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index b42c7b480e1e..2b8d70164428 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -354,3 +354,12 @@ void efi_virtmap_unload(void)
        efi_set_pgd(current->active_mm);
        preempt_enable();
 }
+/*
+ * UpdateCapsule() depends on the system being shutdown via
+ * ResetSystem().
+ */
+bool efi_poweroff_required(void)
+{
+        return efi_enabled(EFI_RUNTIME_SERVICES);
+}
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 8ce88e08c030..07f930540f4a 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -585,8 +585,8 @@ ENDPROC(set_cpu_boot_mode_flag)
 * zeroing of .bss would clobber it.
 */
        .pushsection    .data..cacheline_aligned
-ENTRY(__boot_cpu_mode)
        .align  L1_CACHE_SHIFT
+ENTRY(__boot_cpu_mode)
        .long   BOOT_CPU_MODE_EL2
        .long   0
        .popsection
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index fde9923af859..c6b1f3b96f45 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -21,6 +21,7 @@
 #include <stdarg.h>
 #include <linux/compat.h>
+#include <linux/efi.h>
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
@@ -150,6 +151,13 @@ void machine_restart(char *cmd)
        local_irq_disable();
        smp_send_stop();
+        /*
+         * UpdateCapsule() depends on the system being reset via
+         * ResetSystem().
+         */
+        if (efi_enabled(EFI_RUNTIME_SERVICES))
+                efi_reboot(reboot_mode, NULL);
        /* Now call the architecture specific reboot code. */
        if (arm_pm_restart)
                arm_pm_restart(reboot_mode, cmd);
diff --git a/arch/c6x/include/asm/pgtable.h b/arch/c6x/include/asm/pgtable.h
index 78d4483ba40c..ec4db6df5e0d 100644
--- a/arch/c6x/include/asm/pgtable.h
+++ b/arch/c6x/include/asm/pgtable.h
@@ -67,6 +67,11 @@ extern unsigned long empty_zero_page;
 */
 #define pgtable_cache_init()   do { } while (0)
+/*
+ * c6x is !MMU, so define the simpliest implementation
+ */
+#define pgprot_writecombine pgprot_noncached
 #include <asm-generic/pgtable.h>
 #endif /* _ASM_C6X_PGTABLE_H */
diff --git a/arch/microblaze/kernel/entry.S b/arch/microblaze/kernel/entry.S
index 0536bc021cc6..ef548510b951 100644
--- a/arch/microblaze/kernel/entry.S
+++ b/arch/microblaze/kernel/entry.S
@@ -348,8 +348,9 @@ C_ENTRY(_user_exception):
 * The LP register should point to the location where the called function
 * should return.  [note that MAKE_SYS_CALL uses label 1] */
        /* See if the system call number is valid */
+        blti    r12, 5f
        addi    r11, r12, -__NR_syscalls;
-        bgei    r11,5f;
+        bgei    r11, 5f;
        /* Figure out which function to use for this system call.  */
        /* Note Microblaze barrel shift is optional, so don't rely on it */
        add     r12, r12, r12;                  /* convert num -> ptr */
@@ -375,7 +376,7 @@ C_ENTRY(_user_exception):
        /* The syscall number is invalid, return an error.  */
 5:
-        rtsd    r15, 8;         /* looks like a normal subroutine return */
+        braid   ret_from_trap
        addi    r3, r0, -ENOSYS;
 /* Entry point used to return from a syscall/trap */
@@ -411,7 +412,7 @@ C_ENTRY(ret_from_trap):
        bri     1b
        /* Maybe handle a signal */
-5:      
+5:
        andi    r11, r19, _TIF_SIGPENDING | _TIF_NOTIFY_RESUME;
        beqi    r11, 4f;                /* Signals to handle, handle them */
diff --git a/arch/nios2/include/asm/ptrace.h b/arch/nios2/include/asm/ptrace.h
index 20fb1cf2dab6..642462144872 100644
--- a/arch/nios2/include/asm/ptrace.h
+++ b/arch/nios2/include/asm/ptrace.h
@@ -15,7 +15,54 @@
 #include <uapi/asm/ptrace.h>
+/* This struct defines the way the registers are stored on the
+   stack during a system call.  */
 #ifndef __ASSEMBLY__
+struct pt_regs {
+        unsigned long  r8;      /* r8-r15 Caller-saved GP registers */
+        unsigned long  r9;
+        unsigned long  r10;
+        unsigned long  r11;
+        unsigned long  r12;
+        unsigned long  r13;
+        unsigned long  r14;
+        unsigned long  r15;
+        unsigned long  r1;      /* Assembler temporary */
+        unsigned long  r2;      /* Retval LS 32bits */
+        unsigned long  r3;      /* Retval MS 32bits */
+        unsigned long  r4;      /* r4-r7 Register arguments */
+        unsigned long  r5;
+        unsigned long  r6;
+        unsigned long  r7;
+        unsigned long  orig_r2; /* Copy of r2 ?? */
+        unsigned long  ra;      /* Return address */
+        unsigned long  fp;      /* Frame pointer */
+        unsigned long  sp;      /* Stack pointer */
+        unsigned long  gp;      /* Global pointer */
+        unsigned long  estatus;
+        unsigned long  ea;      /* Exception return address (pc) */
+        unsigned long  orig_r7;
+};
+/*
+ * This is the extended stack used by signal handlers and the context
+ * switcher: it's pushed after the normal "struct pt_regs".
+ */
+struct switch_stack {
+        unsigned long  r16;     /* r16-r23 Callee-saved GP registers */
+        unsigned long  r17;
+        unsigned long  r18;
+        unsigned long  r19;
+        unsigned long  r20;
+        unsigned long  r21;
+        unsigned long  r22;
+        unsigned long  r23;
+        unsigned long  fp;
+        unsigned long  gp;
+        unsigned long  ra;
+};
 #define user_mode(regs) (((regs)->estatus & ESTATUS_EU))
 #define instruction_pointer(regs)       ((regs)->ra)
diff --git a/arch/nios2/include/asm/ucontext.h b/arch/nios2/include/asm/ucontext.h
deleted file mode 100644
index 2c87614b0f6e..000000000000
--- a/arch/nios2/include/asm/ucontext.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) 2010 Tobias Klauser <tklauser@distanz.ch>
- * Copyright (C) 2004 Microtronix Datacom Ltd
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-#ifndef _ASM_NIOS2_UCONTEXT_H
-#define _ASM_NIOS2_UCONTEXT_H
-typedef int greg_t;
-#define NGREG 32
-typedef greg_t gregset_t[NGREG];
-struct mcontext {
-        int version;
-        gregset_t gregs;
-};
-#define MCONTEXT_VERSION 2
-struct ucontext {
-        unsigned long     uc_flags;
-        struct ucontext  *uc_link;
-        stack_t           uc_stack;
-        struct mcontext   uc_mcontext;
-        sigset_t          uc_sigmask;   /* mask last for extensibility */
-};
-#endif
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 4f07ca3f8d10..376131194cc3 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -2,3 +2,5 @@ include include/uapi/asm-generic/Kbuild.asm
 header-y += elf.h
 header-y += ucontext.h
+generic-y += ucontext.h
diff --git a/arch/nios2/include/uapi/asm/elf.h b/arch/nios2/include/uapi/asm/elf.h
index a5b91ae5cf56..6f06d3b2949e 100644
--- a/arch/nios2/include/uapi/asm/elf.h
+++ b/arch/nios2/include/uapi/asm/elf.h
@@ -50,9 +50,7 @@
 typedef unsigned long elf_greg_t;
-#define ELF_NGREG       \
+#define ELF_NGREG               49
-        ((sizeof(struct pt_regs) + sizeof(struct switch_stack)) /       \
-                sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 typedef unsigned long elf_fpregset_t;
diff --git a/arch/nios2/include/uapi/asm/ptrace.h b/arch/nios2/include/uapi/asm/ptrace.h
index e83a7c9d1c36..71a330597adf 100644
--- a/arch/nios2/include/uapi/asm/ptrace.h
+++ b/arch/nios2/include/uapi/asm/ptrace.h
@@ -67,53 +67,9 @@
 #define NUM_PTRACE_REG (PTR_TLBMISC + 1)
-/* this struct defines the way the registers are stored on the
+/* User structures for general purpose registers.  */
-   stack during a system call.
+struct user_pt_regs {
+        __u32           regs[49];
-   There is a fake_regs in setup.c that has to match pt_regs.*/
-struct pt_regs {
-        unsigned long  r8;              /* r8-r15 Caller-saved GP registers */
-        unsigned long  r9;
-        unsigned long  r10;
-        unsigned long  r11;
-        unsigned long  r12;
-        unsigned long  r13;
-        unsigned long  r14;
-        unsigned long  r15;
-        unsigned long  r1;              /* Assembler temporary */
-        unsigned long  r2;              /* Retval LS 32bits */
-        unsigned long  r3;              /* Retval MS 32bits */
-        unsigned long  r4;              /* r4-r7 Register arguments */
-        unsigned long  r5;
-        unsigned long  r6;
-        unsigned long  r7;
-        unsigned long  orig_r2;         /* Copy of r2 ?? */
-        unsigned long  ra;              /* Return address */
-        unsigned long  fp;              /* Frame pointer */
-        unsigned long  sp;              /* Stack pointer */
-        unsigned long  gp;              /* Global pointer */
-        unsigned long  estatus;
-        unsigned long  ea;              /* Exception return address (pc) */
-        unsigned long  orig_r7;
-};
-/*
- * This is the extended stack used by signal handlers and the context
- * switcher: it's pushed after the normal "struct pt_regs".
- */
-struct switch_stack {
-        unsigned long  r16;             /* r16-r23 Callee-saved GP registers */
-        unsigned long  r17;
-        unsigned long  r18;
-        unsigned long  r19;
-        unsigned long  r20;
-        unsigned long  r21;
-        unsigned long  r22;
-        unsigned long  r23;
-        unsigned long  fp;
-        unsigned long  gp;
-        unsigned long  ra;
 };
 #endif /* __ASSEMBLY__ */
diff --git a/arch/nios2/include/uapi/asm/sigcontext.h b/arch/nios2/include/uapi/asm/sigcontext.h
index 7b8bb41867d4..b67944a50927 100644
--- a/arch/nios2/include/uapi/asm/sigcontext.h
+++ b/arch/nios2/include/uapi/asm/sigcontext.h
@@ -15,14 +15,16 @@
 * details.
 */
-#ifndef _ASM_NIOS2_SIGCONTEXT_H
+#ifndef _UAPI__ASM_SIGCONTEXT_H
-#define _ASM_NIOS2_SIGCONTEXT_H
+#define _UAPI__ASM_SIGCONTEXT_H
-#include <asm/ptrace.h>
+#include <linux/types.h>
+#define MCONTEXT_VERSION 2
 struct sigcontext {
-        struct pt_regs regs;
+        int version;
-        unsigned long  sc_mask; /* old sigmask */
+        unsigned long gregs[32];
 };
 #endif
diff --git a/arch/nios2/kernel/signal.c b/arch/nios2/kernel/signal.c
index 2d0ea25be171..dda41e4fe707 100644
--- a/arch/nios2/kernel/signal.c
+++ b/arch/nios2/kernel/signal.c
@@ -39,7 +39,7 @@ static inline int rt_restore_ucontext(struct pt_regs *regs,
                                        struct ucontext *uc, int *pr2)
 {
        int temp;
-        greg_t *gregs = uc->uc_mcontext.gregs;
+        unsigned long *gregs = uc->uc_mcontext.gregs;
        int err;
        /* Always make any pending restarted system calls return -EINTR */
@@ -127,7 +127,7 @@ badframe:
 static inline int rt_setup_ucontext(struct ucontext *uc, struct pt_regs *regs)
 {
        struct switch_stack *sw = (struct switch_stack *)regs - 1;
-        greg_t *gregs = uc->uc_mcontext.gregs;
+        unsigned long *gregs = uc->uc_mcontext.gregs;
        int err = 0;
        err |= __put_user(MCONTEXT_VERSION, &uc->uc_mcontext.version);
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index d84559e31f32..f407bbf5ee94 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -515,15 +515,15 @@ struct s390_io_adapter {
 #define S390_ARCH_FAC_MASK_SIZE_U64 \
        (S390_ARCH_FAC_MASK_SIZE_BYTE / sizeof(u64))
-struct s390_model_fac {
+struct kvm_s390_fac {
-        /* facilities used in SIE context */
+        /* facility list requested by guest */
-        __u64 sie[S390_ARCH_FAC_LIST_SIZE_U64];
+        __u64 list[S390_ARCH_FAC_LIST_SIZE_U64];
-        /* subset enabled by kvm */
+        /* facility mask supported by kvm & hosting machine */
-        __u64 kvm[S390_ARCH_FAC_LIST_SIZE_U64];
+        __u64 mask[S390_ARCH_FAC_LIST_SIZE_U64];
 };
 struct kvm_s390_cpu_model {
-        struct s390_model_fac *fac;
+        struct kvm_s390_fac *fac;
        struct cpuid cpu_id;
        unsigned short ibc;
 };
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index f49b71954654..8fb3802f8fad 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -62,6 +62,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
        int cpu = smp_processor_id();
+        S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);
        if (prev == next)
                return;
        if (MACHINE_HAS_TLB_LC)
@@ -73,7 +74,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
        atomic_dec(&prev->context.attach_count);
        if (MACHINE_HAS_TLB_LC)
                cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
-        S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);
 }
 #define finish_arch_post_lock_switch finish_arch_post_lock_switch
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 7b2ac6e44166..53eacbd4f09b 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -37,16 +37,7 @@ static inline void storage_key_init_range(unsigned long start, unsigned long end
 #endif
 }
-static inline void clear_page(void *page)
+#define clear_page(page)        memset((page), 0, PAGE_SIZE)
-{
-        register unsigned long reg1 asm ("1") = 0;
-        register void *reg2 asm ("2") = page;
-        register unsigned long reg3 asm ("3") = 4096;
-        asm volatile(
-                "       mvcl    2,0"
-                : "+d" (reg2), "+d" (reg3) : "d" (reg1)
-                : "memory", "cc");
-}
 /*
 * copy_page uses the mvcl instruction with 0xb0 padding byte in order to
diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
index cb2d51e779df..830066f936c8 100644
--- a/arch/s390/kernel/jump_label.c
+++ b/arch/s390/kernel/jump_label.c
@@ -36,16 +36,20 @@ static void jump_label_make_branch(struct jump_entry *entry, struct insn *insn)
        insn->offset = (entry->target - entry->code) >> 1;
 }
-static void jump_label_bug(struct jump_entry *entry, struct insn *insn)
+static void jump_label_bug(struct jump_entry *entry, struct insn *expected,
+                           struct insn *new)
 {
        unsigned char *ipc = (unsigned char *)entry->code;
-        unsigned char *ipe = (unsigned char *)insn;
+        unsigned char *ipe = (unsigned char *)expected;
+        unsigned char *ipn = (unsigned char *)new;
        pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc);
        pr_emerg("Found:    %02x %02x %02x %02x %02x %02x\n",
                 ipc[0], ipc[1], ipc[2], ipc[3], ipc[4], ipc[5]);
        pr_emerg("Expected: %02x %02x %02x %02x %02x %02x\n",
                 ipe[0], ipe[1], ipe[2], ipe[3], ipe[4], ipe[5]);
+        pr_emerg("New:      %02x %02x %02x %02x %02x %02x\n",
+                 ipn[0], ipn[1], ipn[2], ipn[3], ipn[4], ipn[5]);
        panic("Corrupted kernel text");
 }
@@ -69,10 +73,10 @@ static void __jump_label_transform(struct jump_entry *entry,
        }
        if (init) {
                if (memcmp((void *)entry->code, &orignop, sizeof(orignop)))
-                        jump_label_bug(entry, &old);
+                        jump_label_bug(entry, &orignop, &new);
        } else {
                if (memcmp((void *)entry->code, &old, sizeof(old)))
-                        jump_label_bug(entry, &old);
+                        jump_label_bug(entry, &old, &new);
        }
        probe_kernel_write((void *)entry->code, &new, sizeof(new));
 }
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 36154a2f1814..2ca95862e336 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -436,6 +436,7 @@ int module_finalize(const Elf_Ehdr *hdr,
                    const Elf_Shdr *sechdrs,
                    struct module *me)
 {
+        jump_label_apply_nops(me);
        vfree(me->arch.syminfo);
        me->arch.syminfo = NULL;
        return 0;
diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
index 26108232fcaa..dc488e13b7e3 100644
--- a/arch/s390/kernel/processor.c
+++ b/arch/s390/kernel/processor.c
@@ -18,7 +18,7 @@
 static DEFINE_PER_CPU(struct cpuid, cpu_id);
-void cpu_relax(void)
+void notrace cpu_relax(void)
 {
        if (!smp_cpu_mtid && MACHINE_HAS_DIAG44)
                asm volatile("diag 0,0,0x44");
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 0c3623927563..f6579cfde2df 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -522,7 +522,7 @@ static int kvm_s390_set_processor(struct kvm *kvm, struct kvm_device_attr *attr)
                memcpy(&kvm->arch.model.cpu_id, &proc->cpuid,
                       sizeof(struct cpuid));
                kvm->arch.model.ibc = proc->ibc;
-                memcpy(kvm->arch.model.fac->kvm, proc->fac_list,
+                memcpy(kvm->arch.model.fac->list, proc->fac_list,
                       S390_ARCH_FAC_LIST_SIZE_BYTE);
        } else
                ret = -EFAULT;
@@ -556,7 +556,7 @@ static int kvm_s390_get_processor(struct kvm *kvm, struct kvm_device_attr *attr)
        }
        memcpy(&proc->cpuid, &kvm->arch.model.cpu_id, sizeof(struct cpuid));
        proc->ibc = kvm->arch.model.ibc;
-        memcpy(&proc->fac_list, kvm->arch.model.fac->kvm, S390_ARCH_FAC_LIST_SIZE_BYTE);
+        memcpy(&proc->fac_list, kvm->arch.model.fac->list, S390_ARCH_FAC_LIST_SIZE_BYTE);
        if (copy_to_user((void __user *)attr->addr, proc, sizeof(*proc)))
                ret = -EFAULT;
        kfree(proc);
@@ -576,10 +576,10 @@ static int kvm_s390_get_machine(struct kvm *kvm, struct kvm_device_attr *attr)
        }
        get_cpu_id((struct cpuid *) &mach->cpuid);
        mach->ibc = sclp_get_ibc();
-        memcpy(&mach->fac_mask, kvm_s390_fac_list_mask,
+        memcpy(&mach->fac_mask, kvm->arch.model.fac->mask,
-               kvm_s390_fac_list_mask_size() * sizeof(u64));
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
        memcpy((unsigned long *)&mach->fac_list, S390_lowcore.stfle_fac_list,
-               S390_ARCH_FAC_LIST_SIZE_U64);
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
        if (copy_to_user((void __user *)attr->addr, mach, sizeof(*mach)))
                ret = -EFAULT;
        kfree(mach);
@@ -778,15 +778,18 @@ long kvm_arch_vm_ioctl(struct file *filp,
 static int kvm_s390_query_ap_config(u8 *config)
 {
        u32 fcn_code = 0x04000000UL;
-        u32 cc;
+        u32 cc = 0;
+        memset(config, 0, 128);
        asm volatile(
                "lgr 0,%1\n"
                "lgr 2,%2\n"
                ".long 0xb2af0000\n"            /* PQAP(QCI) */
-                "ipm %0\n"
+                "0: ipm %0\n"
                "srl %0,28\n"
-                : "=r" (cc)
+                "1:\n"
+                EX_TABLE(0b, 1b)
+                : "+r" (cc)
                : "r" (fcn_code), "r" (config)
                : "cc", "0", "2", "memory"
        );
@@ -839,9 +842,13 @@ static int kvm_s390_crypto_init(struct kvm *kvm)
        kvm_s390_set_crycb_format(kvm);
-        /* Disable AES/DEA protected key functions by default */
+        /* Enable AES/DEA protected key functions by default */
-        kvm->arch.crypto.aes_kw = 0;
+        kvm->arch.crypto.aes_kw = 1;
-        kvm->arch.crypto.dea_kw = 0;
+        kvm->arch.crypto.dea_kw = 1;
+        get_random_bytes(kvm->arch.crypto.crycb->aes_wrapping_key_mask,
+                         sizeof(kvm->arch.crypto.crycb->aes_wrapping_key_mask));
+        get_random_bytes(kvm->arch.crypto.crycb->dea_wrapping_key_mask,
+                         sizeof(kvm->arch.crypto.crycb->dea_wrapping_key_mask));
        return 0;
 }
@@ -886,40 +893,29 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
        /*
         * The architectural maximum amount of facilities is 16 kbit. To store
         * this amount, 2 kbyte of memory is required. Thus we need a full
-         * page to hold the active copy (arch.model.fac->sie) and the current
+         * page to hold the guest facility list (arch.model.fac->list) and the
-         * facilities set (arch.model.fac->kvm). Its address size has to be
+         * facility mask (arch.model.fac->mask). Its address size has to be
         * 31 bits and word aligned.
         */
        kvm->arch.model.fac =
-                (struct s390_model_fac *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+                (struct kvm_s390_fac *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
        if (!kvm->arch.model.fac)
                goto out_nofac;
-        memcpy(kvm->arch.model.fac->kvm, S390_lowcore.stfle_fac_list,
+        /* Populate the facility mask initially. */
-               S390_ARCH_FAC_LIST_SIZE_U64);
+        memcpy(kvm->arch.model.fac->mask, S390_lowcore.stfle_fac_list,
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
-        /*
-         * If this KVM host runs *not* in a LPAR, relax the facility bits
-         * of the kvm facility mask by all missing facilities. This will allow
-         * to determine the right CPU model by means of the remaining facilities.
-         * Live guest migration must prohibit the migration of KVMs running in
-         * a LPAR to non LPAR hosts.
-         */
-        if (!MACHINE_IS_LPAR)
-                for (i = 0; i < kvm_s390_fac_list_mask_size(); i++)
-                        kvm_s390_fac_list_mask[i] &= kvm->arch.model.fac->kvm[i];
-        /*
-         * Apply the kvm facility mask to limit the kvm supported/tolerated
-         * facility list.
-         */
        for (i = 0; i < S390_ARCH_FAC_LIST_SIZE_U64; i++) {
                if (i < kvm_s390_fac_list_mask_size())
-                        kvm->arch.model.fac->kvm[i] &= kvm_s390_fac_list_mask[i];
+                        kvm->arch.model.fac->mask[i] &= kvm_s390_fac_list_mask[i];
                else
-                        kvm->arch.model.fac->kvm[i] = 0UL;
+                        kvm->arch.model.fac->mask[i] = 0UL;
        }
+        /* Populate the facility list initially. */
+        memcpy(kvm->arch.model.fac->list, kvm->arch.model.fac->mask,
+               S390_ARCH_FAC_LIST_SIZE_BYTE);
        kvm_s390_get_cpu_id(&kvm->arch.model.cpu_id);
        kvm->arch.model.ibc = sclp_get_ibc() & 0x0fff;
@@ -1165,8 +1161,6 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
        mutex_lock(&vcpu->kvm->lock);
        vcpu->arch.cpu_id = vcpu->kvm->arch.model.cpu_id;
-        memcpy(vcpu->kvm->arch.model.fac->sie, vcpu->kvm->arch.model.fac->kvm,
-               S390_ARCH_FAC_LIST_SIZE_BYTE);
        vcpu->arch.sie_block->ibc = vcpu->kvm->arch.model.ibc;
        mutex_unlock(&vcpu->kvm->lock);
@@ -1212,7 +1206,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
                vcpu->arch.sie_block->scaol = (__u32)(__u64)kvm->arch.sca;
                set_bit(63 - id, (unsigned long *) &kvm->arch.sca->mcn);
        }
-        vcpu->arch.sie_block->fac = (int) (long) kvm->arch.model.fac->sie;
+        vcpu->arch.sie_block->fac = (int) (long) kvm->arch.model.fac->list;
        spin_lock_init(&vcpu->arch.local_int.lock);
        vcpu->arch.local_int.float_int = &kvm->arch.float_int;
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index 985c2114d7ef..c34109aa552d 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -128,7 +128,8 @@ static inline void kvm_s390_set_psw_cc(struct kvm_vcpu *vcpu, unsigned long cc)
 /* test availability of facility in a kvm intance */
 static inline int test_kvm_facility(struct kvm *kvm, unsigned long nr)
 {
-        return __test_facility(nr, kvm->arch.model.fac->kvm);
+        return __test_facility(nr, kvm->arch.model.fac->mask) &&
+                __test_facility(nr, kvm->arch.model.fac->list);
 }
 /* are cpu states controlled by user space */
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index bdd9b5b17e03..351116939ea2 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -348,7 +348,7 @@ static int handle_stfl(struct kvm_vcpu *vcpu)
         * We need to shift the lower 32 facility bits (bit 0-31) from a u64
         * into a u32 memory representation. They will remain bits 0-31.
         */
-        fac = *vcpu->kvm->arch.model.fac->sie >> 32;
+        fac = *vcpu->kvm->arch.model.fac->list >> 32;
        rc = write_guest_lc(vcpu, offsetof(struct _lowcore, stfl_fac_list),
                            &fac, sizeof(fac));
        if (rc)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 753a56731951..f0b85443e060 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -287,7 +287,7 @@ void __iomem *pci_iomap_range(struct pci_dev *pdev,
        addr = ZPCI_IOMAP_ADDR_BASE | ((u64) idx << 48);
        return (void __iomem *) addr + offset;
 }
-EXPORT_SYMBOL_GPL(pci_iomap_range);
+EXPORT_SYMBOL(pci_iomap_range);
 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
 {
@@ -309,7 +309,7 @@ void pci_iounmap(struct pci_dev *pdev, void __iomem *addr)
        }
        spin_unlock(&zpci_iomap_lock);
 }
-EXPORT_SYMBOL_GPL(pci_iounmap);
+EXPORT_SYMBOL(pci_iounmap);
 static int pci_read(struct pci_bus *bus, unsigned int devfn, int where,
                    int size, u32 *val)
@@ -483,9 +483,8 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)
        airq_iv_free_bit(zpci_aisb_iv, zdev->aisb);
 }
-static void zpci_map_resources(struct zpci_dev *zdev)
+static void zpci_map_resources(struct pci_dev *pdev)
 {
-        struct pci_dev *pdev = zdev->pdev;
        resource_size_t len;
        int i;
@@ -499,9 +498,8 @@ static void zpci_map_resources(struct zpci_dev *zdev)
        }
 }
-static void zpci_unmap_resources(struct zpci_dev *zdev)
+static void zpci_unmap_resources(struct pci_dev *pdev)
 {
-        struct pci_dev *pdev = zdev->pdev;
        resource_size_t len;
        int i;
@@ -651,7 +649,7 @@ int pcibios_add_device(struct pci_dev *pdev)
        zdev->pdev = pdev;
        pdev->dev.groups = zpci_attr_groups;
-        zpci_map_resources(zdev);
+        zpci_map_resources(pdev);
        for (i = 0; i < PCI_BAR_COUNT; i++) {
                res = &pdev->resource[i];
@@ -663,6 +661,11 @@ int pcibios_add_device(struct pci_dev *pdev)
        return 0;
 }
+void pcibios_release_device(struct pci_dev *pdev)
+{
+        zpci_unmap_resources(pdev);
+}
 int pcibios_enable_device(struct pci_dev *pdev, int mask)
 {
        struct zpci_dev *zdev = get_zdev(pdev);
@@ -670,7 +673,6 @@ int pcibios_enable_device(struct pci_dev *pdev, int mask)
        zdev->pdev = pdev;
        zpci_debug_init_device(zdev);
        zpci_fmb_enable_device(zdev);
-        zpci_map_resources(zdev);
        return pci_enable_resources(pdev, mask);
 }
@@ -679,7 +681,6 @@ void pcibios_disable_device(struct pci_dev *pdev)
 {
        struct zpci_dev *zdev = get_zdev(pdev);
-        zpci_unmap_resources(zdev);
        zpci_fmb_disable_device(zdev);
        zpci_debug_exit_device(zdev);
        zdev->pdev = NULL;
@@ -688,7 +689,8 @@ void pcibios_disable_device(struct pci_dev *pdev)
 #ifdef CONFIG_HIBERNATE_CALLBACKS
 static int zpci_restore(struct device *dev)
 {
-        struct zpci_dev *zdev = get_zdev(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct zpci_dev *zdev = get_zdev(pdev);
        int ret = 0;
        if (zdev->state != ZPCI_FN_STATE_ONLINE)
@@ -698,7 +700,7 @@ static int zpci_restore(struct device *dev)
        if (ret)
                goto out;
-        zpci_map_resources(zdev);
+        zpci_map_resources(pdev);
        zpci_register_ioat(zdev, 0, zdev->start_dma + PAGE_OFFSET,
                           zdev->start_dma + zdev->iommu_size - 1,
                           (u64) zdev->dma_table);
@@ -709,12 +711,14 @@ out:
 static int zpci_freeze(struct device *dev)
 {
-        struct zpci_dev *zdev = get_zdev(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct zpci_dev *zdev = get_zdev(pdev);
        if (zdev->state != ZPCI_FN_STATE_ONLINE)
                return 0;
        zpci_unregister_ioat(zdev, 0);
+        zpci_unmap_resources(pdev);
        return clp_disable_fh(zdev);
 }
diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
index 8aa271b3d1ad..b1bb2b72302c 100644
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
        if (copy_from_user(buf, user_buffer, length))
                goto out;
-        memcpy_toio(io_addr, buf, length);
+        ret = zpci_memcpy_toio(io_addr, buf, length);
-        ret = 0;
 out:
        if (buf != local_buf)
                kfree(buf);
@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
                goto out;
        io_addr = (void __iomem *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
-        ret = -EFAULT;
+        if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
-        if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
+                ret = -EFAULT;
                goto out;
+        }
-        memcpy_fromio(buf, io_addr, length);
+        ret = zpci_memcpy_fromio(buf, io_addr, length);
+        if (ret)
-        if (copy_to_user(user_buffer, buf, length))
                goto out;
+        if (copy_to_user(user_buffer, buf, length))
+                ret = -EFAULT;
-        ret = 0;
 out:
        if (buf != local_buf)
                kfree(buf);
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 740ae3026a14..9f93af56a5fc 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -563,7 +563,7 @@ static bool alloc_p2m(unsigned long pfn)
                if (p2m_pfn == PFN_DOWN(__pa(p2m_missing)))
                        p2m_init(p2m);
                else
-                        p2m_init_identity(p2m, pfn);
+                        p2m_init_identity(p2m, pfn & ~(P2M_PER_PAGE - 1));
                spin_lock_irqsave(&p2m_update_lock, flags);
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 657964e8ab7e..37fb19047603 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -65,6 +65,7 @@ struct lpss_private_data;
 struct lpss_device_desc {
        unsigned int flags;
+        const char *clk_con_id;
        unsigned int prv_offset;
        size_t prv_size_override;
        void (*setup)(struct lpss_private_data *pdata);
@@ -140,6 +141,7 @@ static struct lpss_device_desc lpt_i2c_dev_desc = {
 static struct lpss_device_desc lpt_uart_dev_desc = {
        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_LTR,
+        .clk_con_id = "baudclk",
        .prv_offset = 0x800,
        .setup = lpss_uart_setup,
 };
@@ -156,6 +158,7 @@ static struct lpss_device_desc byt_pwm_dev_desc = {
 static struct lpss_device_desc byt_uart_dev_desc = {
        .flags = LPSS_CLK | LPSS_CLK_GATE | LPSS_CLK_DIVIDER | LPSS_SAVE_CTX,
+        .clk_con_id = "baudclk",
        .prv_offset = 0x800,
        .setup = lpss_uart_setup,
 };
@@ -313,7 +316,7 @@ out:
                return PTR_ERR(clk);
        pdata->clk = clk;
-        clk_register_clkdev(clk, NULL, devname);
+        clk_register_clkdev(clk, dev_desc->clk_con_id, devname);
        return 0;
 }
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index f9054cd36a72..5389579c5120 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -869,6 +869,8 @@ try_offline_again:
         */
        ata_msleep(ap, 1);
+        sata_set_spd(link);
        /*
         * Now, bring the host controller online again, this can take time
         * as PHY reset and communication establishment, 1st D2H FIS and
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 1d278ccd751f..e096e9cddb40 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -140,24 +140,24 @@ static int tpm_dev_add_device(struct tpm_chip *chip)
 {
        int rc;
-        rc = device_add(&chip->dev);
+        rc = cdev_add(&chip->cdev, chip->dev.devt, 1);
        if (rc) {
                dev_err(&chip->dev,
-                        "unable to device_register() %s, major %d, minor %d, err=%d\n",
+                        "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
                        chip->devname, MAJOR(chip->dev.devt),
                        MINOR(chip->dev.devt), rc);
+                device_unregister(&chip->dev);
                return rc;
        }
-        rc = cdev_add(&chip->cdev, chip->dev.devt, 1);
+        rc = device_add(&chip->dev);
        if (rc) {
                dev_err(&chip->dev,
-                        "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
+                        "unable to device_register() %s, major %d, minor %d, err=%d\n",
                        chip->devname, MAJOR(chip->dev.devt),
                        MINOR(chip->dev.devt), rc);
-                device_unregister(&chip->dev);
                return rc;
        }
@@ -174,27 +174,17 @@ static void tpm_dev_del_device(struct tpm_chip *chip)
 * tpm_chip_register() - create a character device for the TPM chip
 * @chip: TPM chip to use.
 *
- * Creates a character device for the TPM chip and adds sysfs interfaces for
+ * Creates a character device for the TPM chip and adds sysfs attributes for
- * the device, PPI and TCPA. As the last step this function adds the
+ * the device. As the last step this function adds the chip to the list of TPM
- * chip to the list of TPM chips available for use.
+ * chips available for in-kernel use.
 *
- * NOTE: This function should be only called after the chip initialization
+ * This function should be only called after the chip initialization is
- * is complete.
+ * complete.
- *
- * Called from tpm_<specific>.c probe function only for devices
- * the driver has determined it should claim.  Prior to calling
- * this function the specific probe function has called pci_enable_device
- * upon errant exit from this function specific probe function should call
- * pci_disable_device
 */
 int tpm_chip_register(struct tpm_chip *chip)
 {
        int rc;
-        rc = tpm_dev_add_device(chip);
-        if (rc)
-                return rc;
        /* Populate sysfs for TPM1 devices. */
        if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
                rc = tpm_sysfs_add_device(chip);
@@ -208,6 +198,10 @@ int tpm_chip_register(struct tpm_chip *chip)
                chip->bios_dir = tpm_bios_log_setup(chip->devname);
        }
+        rc = tpm_dev_add_device(chip);
+        if (rc)
+                return rc;
        /* Make the chip available. */
        spin_lock(&driver_lock);
        list_add_rcu(&chip->list, &tpm_chip_list);
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index b1e53e3aece5..42ffa5e7a1e0 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
 {
        struct ibmvtpm_dev *ibmvtpm;
        struct ibmvtpm_crq crq;
-        u64 *word = (u64 *) &crq;
+        __be64 *word = (__be64 *)&crq;
        int rc;
        ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
        memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
        crq.valid = (u8)IBMVTPM_VALID_CMD;
        crq.msg = (u8)VTPM_TPM_COMMAND;
-        crq.len = (u16)count;
+        crq.len = cpu_to_be16(count);
-        crq.data = ibmvtpm->rtce_dma_handle;
+        crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-                              cpu_to_be64(word[1]));
+                              be64_to_cpu(word[1]));
        if (rc != H_SUCCESS) {
                dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
                rc = 0;
diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
index f595f14426bf..6af92890518f 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.h
+++ b/drivers/char/tpm/tpm_ibmvtpm.h
@@ -22,9 +22,9 @@
 struct ibmvtpm_crq {
        u8 valid;
        u8 msg;
-        u16 len;
+        __be16 len;
-        u32 data;
+        __be32 data;
-        u64 reserved;
+        __be64 reserved;
 } __attribute__((packed, aligned(8)));
 struct ibmvtpm_crq_queue {
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index db7f8bce7467..25006a8bb8e6 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -144,12 +144,6 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw,
                                   divider->flags);
 }
-/*
- * The reverse of DIV_ROUND_UP: The maximum number which
- * divided by m is r
- */
-#define MULT_ROUND_UP(r, m) ((r) * (m) + (m) - 1)
 static bool _is_valid_table_div(const struct clk_div_table *table,
                                                         unsigned int div)
 {
@@ -225,19 +219,24 @@ static int _div_round_closest(const struct clk_div_table *table,
                              unsigned long parent_rate, unsigned long rate,
                              unsigned long flags)
 {
-        int up, down, div;
+        int up, down;
+        unsigned long up_rate, down_rate;
-        up = down = div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        up = DIV_ROUND_UP(parent_rate, rate);
+        down = parent_rate / rate;
        if (flags & CLK_DIVIDER_POWER_OF_TWO) {
-                up = __roundup_pow_of_two(div);
+                up = __roundup_pow_of_two(up);
-                down = __rounddown_pow_of_two(div);
+                down = __rounddown_pow_of_two(down);
        } else if (table) {
-                up = _round_up_table(table, div);
+                up = _round_up_table(table, up);
-                down = _round_down_table(table, div);
+                down = _round_down_table(table, down);
        }
-        return (up - div) <= (div - down) ? up : down;
+        up_rate = DIV_ROUND_UP(parent_rate, up);
+        down_rate = DIV_ROUND_UP(parent_rate, down);
+        return (rate - up_rate) <= (down_rate - rate) ? up : down;
 }
 static int _div_round(const struct clk_div_table *table,
@@ -313,7 +312,7 @@ static int clk_divider_bestdiv(struct clk_hw *hw, unsigned long rate,
                        return i;
                }
                parent_rate = __clk_round_rate(__clk_get_parent(hw->clk),
-                                MULT_ROUND_UP(rate, i));
+                                               rate * i);
                now = DIV_ROUND_UP(parent_rate, i);
                if (_is_best_div(rate, now, best, flags)) {
                        bestdiv = i;
@@ -353,7 +352,7 @@ static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate,
                bestdiv = readl(divider->reg) >> divider->shift;
                bestdiv &= div_mask(divider->width);
                bestdiv = _get_div(divider->table, bestdiv, divider->flags);
-                return bestdiv;
+                return DIV_ROUND_UP(*prate, bestdiv);
        }
        return divider_round_rate(hw, rate, prate, divider->table,
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index eb0152961d3c..237f23f68bfc 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1350,7 +1350,6 @@ static unsigned long clk_core_get_rate(struct clk_core *clk)
        return rate;
 }
-EXPORT_SYMBOL_GPL(clk_core_get_rate);
 /**
 * clk_get_rate - return the rate of clk
@@ -2171,6 +2170,32 @@ int clk_get_phase(struct clk *clk)
 }
 /**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        /* trivial case: identical struct clk's or both NULL */
+        if (p == q)
+                return true;
+        /* true if clk->core pointers match. Avoid derefing garbage */
+        if (!IS_ERR_OR_NULL(p) && !IS_ERR_OR_NULL(q))
+                if (p->core == q->core)
+                        return true;
+        return false;
+}
+EXPORT_SYMBOL_GPL(clk_is_match);
+/**
 * __clk_init - initialize the data structures in a struct clk
 * @dev:        device initializing this clk, placeholder for now
 * @clk:        clk being initialized
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index b0b562b9ce0e..e60feffc10a1 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -48,6 +48,17 @@ static struct clk_pll pll3 = {
        },
 };
+static struct clk_regmap pll4_vote = {
+        .enable_reg = 0x34c0,
+        .enable_mask = BIT(4),
+        .hw.init = &(struct clk_init_data){
+                .name = "pll4_vote",
+                .parent_names = (const char *[]){ "pll4" },
+                .num_parents = 1,
+                .ops = &clk_pll_vote_ops,
+        },
+};
 static struct clk_pll pll8 = {
        .l_reg = 0x3144,
        .m_reg = 0x3148,
@@ -3023,6 +3034,7 @@ static struct clk_branch rpm_msg_ram_h_clk = {
 static struct clk_regmap *gcc_msm8960_clks[] = {
        [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
        [PLL8] = &pll8.clkr,
        [PLL8_VOTE] = &pll8_vote,
        [PLL14] = &pll14.clkr,
@@ -3247,6 +3259,7 @@ static const struct qcom_reset_map gcc_msm8960_resets[] = {
 static struct clk_regmap *gcc_apq8064_clks[] = {
        [PLL3] = &pll3.clkr,
+        [PLL4_VOTE] = &pll4_vote,
        [PLL8] = &pll8.clkr,
        [PLL8_VOTE] = &pll8_vote,
        [PLL14] = &pll14.clkr,
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 121ffde25dc3..c9ff27b4648b 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -462,7 +462,6 @@ static struct platform_driver lcc_ipq806x_driver = {
        .remove         = lcc_ipq806x_remove,
        .driver         = {
                .name   = "lcc-ipq806x",
-                .owner  = THIS_MODULE,
                .of_match_table = lcc_ipq806x_match_table,
        },
 };
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index a75a408cfccd..e2c863295f00 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -417,8 +417,8 @@ static struct clk_rcg slimbus_src = {
                .mnctr_en_bit = 8,
                .mnctr_reset_bit = 7,
                .mnctr_mode_shift = 5,
-                .n_val_shift = 16,
+                .n_val_shift = 24,
-                .m_val_shift = 16,
+                .m_val_shift = 8,
                .width = 8,
        },
        .p = {
@@ -547,7 +547,7 @@ static int lcc_msm8960_probe(struct platform_device *pdev)
                return PTR_ERR(regmap);
        /* Use the correct frequency plan depending on speed of PLL4 */
-        val = regmap_read(regmap, 0x4, &val);
+        regmap_read(regmap, 0x4, &val);
        if (val == 0x12) {
                slimbus_src.freq_tbl = clk_tbl_aif_osr_492;
                mi2s_osr_src.freq_tbl = clk_tbl_aif_osr_492;
@@ -574,7 +574,6 @@ static struct platform_driver lcc_msm8960_driver = {
        .remove         = lcc_msm8960_remove,
        .driver         = {
                .name   = "lcc-msm8960",
-                .owner  = THIS_MODULE,
                .of_match_table = lcc_msm8960_match_table,
        },
 };
diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
index 6ef89639a9f6..d21640634adf 100644
--- a/drivers/clk/ti/fapll.c
+++ b/drivers/clk/ti/fapll.c
@@ -84,7 +84,7 @@ static int ti_fapll_enable(struct clk_hw *hw)
        struct fapll_data *fd = to_fapll(hw);
        u32 v = readl_relaxed(fd->base);
-        v |= (1 << FAPLL_MAIN_PLLEN);
+        v |= FAPLL_MAIN_PLLEN;
        writel_relaxed(v, fd->base);
        return 0;
@@ -95,7 +95,7 @@ static void ti_fapll_disable(struct clk_hw *hw)
        struct fapll_data *fd = to_fapll(hw);
        u32 v = readl_relaxed(fd->base);
-        v &= ~(1 << FAPLL_MAIN_PLLEN);
+        v &= ~FAPLL_MAIN_PLLEN;
        writel_relaxed(v, fd->base);
 }
@@ -104,7 +104,7 @@ static int ti_fapll_is_enabled(struct clk_hw *hw)
        struct fapll_data *fd = to_fapll(hw);
        u32 v = readl_relaxed(fd->base);
-        return v & (1 << FAPLL_MAIN_PLLEN);
+        return v & FAPLL_MAIN_PLLEN;
 }
 static unsigned long ti_fapll_recalc_rate(struct clk_hw *hw,
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 6b6b07ff720b..f6d04c7b5115 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -43,9 +43,10 @@
 #include "drm_crtc_internal.h"
 #include "drm_internal.h"
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+static struct drm_framebuffer *
-                                                        struct drm_mode_fb_cmd2 *r,
+internal_framebuffer_create(struct drm_device *dev,
-                                                        struct drm_file *file_priv);
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv);
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
@@ -2908,13 +2909,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
         */
        if (req->flags & DRM_MODE_CURSOR_BO) {
                if (req->handle) {
-                        fb = add_framebuffer_internal(dev, &fbreq, file_priv);
+                        fb = internal_framebuffer_create(dev, &fbreq, file_priv);
                        if (IS_ERR(fb)) {
                                DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
                                return PTR_ERR(fb);
                        }
-                        drm_framebuffer_reference(fb);
                } else {
                        fb = NULL;
                }
@@ -3267,9 +3266,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
        return 0;
 }
-static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
+static struct drm_framebuffer *
-                                                        struct drm_mode_fb_cmd2 *r,
+internal_framebuffer_create(struct drm_device *dev,
-                                                        struct drm_file *file_priv)
+                            struct drm_mode_fb_cmd2 *r,
+                            struct drm_file *file_priv)
 {
        struct drm_mode_config *config = &dev->mode_config;
        struct drm_framebuffer *fb;
@@ -3301,12 +3301,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
                return fb;
        }
-        mutex_lock(&file_priv->fbs_lock);
-        r->fb_id = fb->base.id;
-        list_add(&fb->filp_head, &file_priv->fbs);
-        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-        mutex_unlock(&file_priv->fbs_lock);
        return fb;
 }
@@ -3328,15 +3322,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
 int drm_mode_addfb2(struct drm_device *dev,
                    void *data, struct drm_file *file_priv)
 {
+        struct drm_mode_fb_cmd2 *r = data;
        struct drm_framebuffer *fb;
        if (!drm_core_check_feature(dev, DRIVER_MODESET))
                return -EINVAL;
-        fb = add_framebuffer_internal(dev, data, file_priv);
+        fb = internal_framebuffer_create(dev, r, file_priv);
        if (IS_ERR(fb))
                return PTR_ERR(fb);
+        /* Transfer ownership to the filp for reaping on close */
+        DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_lock(&file_priv->fbs_lock);
+        r->fb_id = fb->base.id;
+        list_add(&fb->filp_head, &file_priv->fbs);
+        mutex_unlock(&file_priv->fbs_lock);
        return 0;
 }
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 9a5b68717ec8..379ab4555756 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -733,10 +733,14 @@ static bool check_txmsg_state(struct drm_dp_mst_topology_mgr *mgr,
                              struct drm_dp_sideband_msg_tx *txmsg)
 {
        bool ret;
-        mutex_lock(&mgr->qlock);
+        /*
+         * All updates to txmsg->state are protected by mgr->qlock, and the two
+         * cases we check here are terminal states. For those the barriers
+         * provided by the wake_up/wait_event pair are enough.
+         */
        ret = (txmsg->state == DRM_DP_SIDEBAND_TX_RX ||
               txmsg->state == DRM_DP_SIDEBAND_TX_TIMEOUT);
-        mutex_unlock(&mgr->qlock);
        return ret;
 }
@@ -1363,12 +1367,13 @@ static int process_single_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
        return 0;
 }
-/* must be called holding qlock */
 static void process_single_down_tx_qlock(struct drm_dp_mst_topology_mgr *mgr)
 {
        struct drm_dp_sideband_msg_tx *txmsg;
        int ret;
+        WARN_ON(!mutex_is_locked(&mgr->qlock));
        /* construct a chunk from the first msg in the tx_msg queue */
        if (list_empty(&mgr->tx_msg_downq)) {
                mgr->tx_down_in_progress = false;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 7fc6f8bd4821..1134526286c8 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -403,7 +403,7 @@ static int check_free_hole(u64 start, u64 end, u64 size, unsigned alignment)
                unsigned rem;
                rem = do_div(tmp, alignment);
-                if (tmp)
+                if (rem)
                        start += alignment - rem;
        }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e5daad5f75fb..5b205863b659 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2936,9 +2936,9 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        req = obj->last_read_req;
        /* Do this after OLR check to make sure we make forward progress polling
-         * on this IOCTL with a timeout <=0 (like busy ioctl)
+         * on this IOCTL with a timeout == 0 (like busy ioctl)
         */
-        if (args->timeout_ns <= 0) {
+        if (args->timeout_ns == 0) {
                ret = -ETIME;
                goto out;
        }
@@ -2948,7 +2948,8 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
        i915_gem_request_reference(req);
        mutex_unlock(&dev->struct_mutex);
-        ret = __i915_wait_request(req, reset_counter, true, &args->timeout_ns,
+        ret = __i915_wait_request(req, reset_counter, true,
+                                  args->timeout_ns > 0 ? &args->timeout_ns : NULL,
                                  file->driver_priv);
        mutex_lock(&dev->struct_mutex);
        i915_gem_request_unreference(req);
@@ -4792,6 +4793,9 @@ i915_gem_init_hw(struct drm_device *dev)
        if (INTEL_INFO(dev)->gen < 6 && !intel_enable_gtt())
                return -EIO;
+        /* Double layer security blanket, see i915_gem_init() */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
        if (dev_priv->ellc_size)
                I915_WRITE(HSW_IDICR, I915_READ(HSW_IDICR) | IDIHASHMSK(0xf));
@@ -4824,7 +4828,7 @@ i915_gem_init_hw(struct drm_device *dev)
        for_each_ring(ring, dev_priv, i) {
                ret = ring->init_hw(ring);
                if (ret)
-                        return ret;
+                        goto out;
        }
        for (i = 0; i < NUM_L3_SLICES(dev); i++)
@@ -4841,9 +4845,11 @@ i915_gem_init_hw(struct drm_device *dev)
                DRM_ERROR("Context enable failed %d\n", ret);
                i915_gem_cleanup_ringbuffer(dev);
-                return ret;
+                goto out;
        }
+out:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
        return ret;
 }
@@ -4877,6 +4883,14 @@ int i915_gem_init(struct drm_device *dev)
                dev_priv->gt.stop_ring = intel_logical_ring_stop;
        }
+        /* This is just a security blanket to placate dragons.
+         * On some systems, we very sporadically observe that the first TLBs
+         * used by the CS may be stale, despite us poking the TLB reset. If
+         * we hold the forcewake during initialisation these problems
+         * just magically go away.
+         */
+        intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
        ret = i915_gem_init_userptr(dev);
        if (ret)
                goto out_unlock;
@@ -4903,6 +4917,7 @@ int i915_gem_init(struct drm_device *dev)
        }
 out_unlock:
+        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
        mutex_unlock(&dev->struct_mutex);
        return ret;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e730789b53b7..9943c20a741d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -9716,7 +9716,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        WARN_ON(!in_irq());
+        WARN_ON(!in_interrupt());
        if (crtc == NULL)
                return;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index c47a3baa53d5..4e8fb891d4ea 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1048,8 +1048,14 @@ static void intel_uncore_fw_domains_init(struct drm_device *dev)
                /* We need to init first for ECOBUS access and then
                 * determine later if we want to reinit, in case of MT access is
-                 * not working
+                 * not working. In this stage we don't know which flavour this
+                 * ivb is, so it is better to reset also the gen6 fw registers
+                 * before the ecobus check.
                 */
+                __raw_i915_write32(dev_priv, FORCEWAKE, 0);
+                __raw_posting_read(dev_priv, ECOBUS);
                fw_domain_init(dev_priv, FW_DOMAIN_ID_RENDER,
                               FORCEWAKE_MT, FORCEWAKE_MT_ACK);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index d13d1b5a859f..df09ca7c4889 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
        return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
 }
+struct radeon_wait_cb {
+        struct fence_cb base;
+        struct task_struct *task;
+};
+static void
+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
+{
+        struct radeon_wait_cb *wait =
+                container_of(cb, struct radeon_wait_cb, base);
+        wake_up_process(wait->task);
+}
 static signed long radeon_fence_default_wait(struct fence *f, bool intr,
                                             signed long t)
 {
        struct radeon_fence *fence = to_radeon_fence(f);
        struct radeon_device *rdev = fence->rdev;
-        bool signaled;
+        struct radeon_wait_cb cb;
-        fence_enable_sw_signaling(&fence->base);
+        cb.task = current;
-        /*
+        if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
-         * This function has to return -EDEADLK, but cannot hold
+                return t;
-         * exclusive_lock during the wait because some callers
-         * may already hold it. This means checking needs_reset without
+        while (t > 0) {
-         * lock, and not fiddling with any gpu internals.
+                if (intr)
-         *
+                        set_current_state(TASK_INTERRUPTIBLE);
-         * The callback installed with fence_enable_sw_signaling will
+                else
-         * run before our wait_event_*timeout call, so we will see
+                        set_current_state(TASK_UNINTERRUPTIBLE);
-         * both the signaled fence and the changes to needs_reset.
-         */
+                /*
+                 * radeon_test_signaled must be called after
+                 * set_current_state to prevent a race with wake_up_process
+                 */
+                if (radeon_test_signaled(fence))
+                        break;
+                if (rdev->needs_reset) {
+                        t = -EDEADLK;
+                        break;
+                }
+                t = schedule_timeout(t);
+                if (t > 0 && intr && signal_pending(current))
+                        t = -ERESTARTSYS;
+        }
+        __set_current_state(TASK_RUNNING);
+        fence_remove_callback(f, &cb.base);
-        if (intr)
-                t = wait_event_interruptible_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        else
-                t = wait_event_timeout(rdev->fence_queue,
-                        ((signaled = radeon_test_signaled(fence)) ||
-                         rdev->needs_reset), t);
-        if (t > 0 && !signaled)
-                return -EDEADLK;
        return t;
 }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index e088e5558da0..a7fb2735d4a9 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -7130,8 +7130,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
        if (!vclk || !dclk) {
-                /* keep the Bypass mode, put PLL to sleep */
+                /* keep the Bypass mode */
-                WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
                return 0;
        }
@@ -7147,8 +7146,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
        /* set VCO_MODE to 1 */
        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
-        /* toggle UPLL_SLEEP to 1 then back to 0 */
+        /* disable sleep mode */
-        WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
        WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
        /* deassert UPLL_RESET */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 6c6b655defcf..e13b9cbc304e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                goto out_err1;
        }
-        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-                             (dev_priv->vram_size >> PAGE_SHIFT));
-        if (unlikely(ret != 0)) {
-                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-                goto out_err2;
-        }
-        dev_priv->has_gmr = true;
-        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-                                         VMW_PL_GMR) != 0) {
-                DRM_INFO("No GMR memory available. "
-                         "Graphics memory resources are very limited.\n");
-                dev_priv->has_gmr = false;
-        }
-        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-                dev_priv->has_mob = true;
-                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-                                   VMW_PL_MOB) != 0) {
-                        DRM_INFO("No MOB memory available. "
-                                 "3D will be disabled.\n");
-                        dev_priv->has_mob = false;
-                }
-        }
        dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
                                               dev_priv->mmio_size);
@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                goto out_no_fman;
        }
+        ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+                             (dev_priv->vram_size >> PAGE_SHIFT));
+        if (unlikely(ret != 0)) {
+                DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+                goto out_no_vram;
+        }
+        dev_priv->has_gmr = true;
+        if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
+            refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+                                         VMW_PL_GMR) != 0) {
+                DRM_INFO("No GMR memory available. "
+                         "Graphics memory resources are very limited.\n");
+                dev_priv->has_gmr = false;
+        }
+        if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
+                dev_priv->has_mob = true;
+                if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
+                                   VMW_PL_MOB) != 0) {
+                        DRM_INFO("No MOB memory available. "
+                                 "3D will be disabled.\n");
+                        dev_priv->has_mob = false;
+                }
+        }
        vmw_kms_save_vga(dev_priv);
        /* Start kms and overlay systems, needs fifo. */
@@ -838,6 +839,12 @@ out_no_fifo:
        vmw_kms_close(dev_priv);
 out_no_kms:
        vmw_kms_restore_vga(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_no_vram:
        vmw_fence_manager_takedown(dev_priv->fman);
 out_no_fman:
        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
@@ -853,12 +860,6 @@ out_err4:
        iounmap(dev_priv->mmio_virt);
 out_err3:
        arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-out_err2:
        (void)ttm_bo_device_release(&dev_priv->bdev);
 out_err1:
        vmw_ttm_global_release(dev_priv);
@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
        }
        vmw_kms_close(dev_priv);
        vmw_overlay_close(dev_priv);
+        if (dev_priv->has_mob)
+                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
+        if (dev_priv->has_gmr)
+                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
        vmw_fence_manager_takedown(dev_priv->fman);
        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                drm_irq_uninstall(dev_priv->dev);
@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
        ttm_object_device_release(&dev_priv->tdev);
        iounmap(dev_priv->mmio_virt);
        arch_phys_wc_del(dev_priv->mmio_mtrr);
-        if (dev_priv->has_mob)
-                (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-        if (dev_priv->has_gmr)
-                (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-        (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
        (void)ttm_bo_device_release(&dev_priv->bdev);
        vmw_ttm_global_release(dev_priv);
@@ -1235,6 +1238,7 @@ static void vmw_remove(struct pci_dev *pdev)
 {
        struct drm_device *dev = pci_get_drvdata(pdev);
+        pci_disable_device(pdev);
        drm_put_dev(dev);
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 33176d05db35..654c8daeb5ab 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -890,7 +890,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
        if (unlikely(ret != 0)) {
                DRM_ERROR("Could not find or use MOB buffer.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
        }
        bo = &vmw_bo->base;
@@ -914,7 +915,7 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 out_no_reloc:
        vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
        return ret;
 }
@@ -951,7 +952,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
        if (unlikely(ret != 0)) {
                DRM_ERROR("Could not find or use GMR region.\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_no_reloc;
        }
        bo = &vmw_bo->base;
@@ -974,7 +976,7 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 out_no_reloc:
        vmw_dmabuf_unreference(&vmw_bo);
-        vmw_bo_p = NULL;
+        *vmw_bo_p = NULL;
        return ret;
 }
@@ -2780,13 +2782,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
                                  NULL, arg->command_size, arg->throttle_us,
                                  (void __user *)(unsigned long)arg->fence_rep,
                                  NULL);
+        ttm_read_unlock(&dev_priv->reservation_sem);
        if (unlikely(ret != 0))
-                goto out_unlock;
+                return ret;
        vmw_kms_cursor_post_execbuf(dev_priv);
-out_unlock:
+        return 0;
-        ttm_read_unlock(&dev_priv->reservation_sem);
-        return ret;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 8725b79e7847..07cda8cbbddb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
        int i;
        struct drm_mode_config *mode_config = &dev->mode_config;
-        ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-        if (unlikely(ret != 0))
-                return ret;
        if (!arg->num_outputs) {
                struct drm_vmw_rect def_rect = {0, 0, 800, 600};
                vmw_du_update_layout(dev_priv, 1, &def_rect);
-                goto out_unlock;
+                return 0;
        }
        rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
        rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
                        GFP_KERNEL);
-        if (unlikely(!rects)) {
+        if (unlikely(!rects))
-                ret = -ENOMEM;
+                return -ENOMEM;
-                goto out_unlock;
-        }
        user_rects = (void __user *)(unsigned long)arg->rects;
        ret = copy_from_user(rects, user_rects, rects_size);
@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
 out_free:
        kfree(rects);
-out_unlock:
-        ttm_read_unlock(&dev_priv->reservation_sem);
        return ret;
 }
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 210cf4874cb7..edf274cabe81 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
                status = driver->remove(client);
        }
-        if (dev->of_node)
-                irq_dispose_mapping(client->irq);
        dev_pm_domain_detach(&client->dev, true);
        return status;
 }
diff --git a/drivers/input/keyboard/tc3589x-keypad.c b/drivers/input/keyboard/tc3589x-keypad.c
index 8ff612d160b0..563932500ff1 100644
--- a/drivers/input/keyboard/tc3589x-keypad.c
+++ b/drivers/input/keyboard/tc3589x-keypad.c
@@ -411,9 +411,9 @@ static int tc3589x_keypad_probe(struct platform_device *pdev)
        input_set_drvdata(input, keypad);
-        error = request_threaded_irq(irq, NULL,
+        error = request_threaded_irq(irq, NULL, tc3589x_keypad_irq,
-                        tc3589x_keypad_irq, plat->irqtype,
+                                     plat->irqtype | IRQF_ONESHOT,
-                        "tc3589x-keypad", keypad);
+                                     "tc3589x-keypad", keypad);
        if (error < 0) {
                dev_err(&pdev->dev,
                                "Could not allocate irq %d,error %d\n",
diff --git a/drivers/input/misc/mma8450.c b/drivers/input/misc/mma8450.c
index 59d4dcddf6de..98228773a111 100644
--- a/drivers/input/misc/mma8450.c
+++ b/drivers/input/misc/mma8450.c
@@ -187,6 +187,7 @@ static int mma8450_probe(struct i2c_client *c,
        idev->private           = m;
        idev->input->name       = MMA8450_DRV_NAME;
        idev->input->id.bustype = BUS_I2C;
+        idev->input->dev.parent = &c->dev;
        idev->poll              = mma8450_poll;
        idev->poll_interval     = POLL_INTERVAL;
        idev->poll_interval_max = POLL_INTERVAL_MAX;
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index d28726a0ef85..1bd15ebc01f2 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -2605,8 +2605,10 @@ int alps_detect(struct psmouse *psmouse, bool set_properties)
                return -ENOMEM;
        error = alps_identify(psmouse, priv);
-        if (error)
+        if (error) {
+                kfree(priv);
                return error;
+        }
        if (set_properties) {
                psmouse->vendor = "ALPS";
diff --git a/drivers/input/mouse/cyapa_gen3.c b/drivers/input/mouse/cyapa_gen3.c
index 77e9d70a986b..1e2291c378fe 100644
--- a/drivers/input/mouse/cyapa_gen3.c
+++ b/drivers/input/mouse/cyapa_gen3.c
@@ -20,7 +20,7 @@
 #include <linux/input/mt.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/unaligned/access_ok.h>
+#include <asm/unaligned.h>
 #include "cyapa.h"
diff --git a/drivers/input/mouse/cyapa_gen5.c b/drivers/input/mouse/cyapa_gen5.c
index ddf5393a1180..5b611dd71e79 100644
--- a/drivers/input/mouse/cyapa_gen5.c
+++ b/drivers/input/mouse/cyapa_gen5.c
@@ -17,7 +17,7 @@
 #include <linux/mutex.h>
 #include <linux/completion.h>
 #include <linux/slab.h>
-#include <linux/unaligned/access_ok.h>
+#include <asm/unaligned.h>
 #include <linux/crc-itu-t.h>
 #include "cyapa.h"
@@ -1926,7 +1926,7 @@ static int cyapa_gen5_read_idac_data(struct cyapa *cyapa,
                                electrodes_tx = cyapa->electrodes_x;
                        max_element_cnt = ((cyapa->aligned_electrodes_rx + 7) &
                                                ~7u) * electrodes_tx;
-                } else if (idac_data_type == GEN5_RETRIEVE_SELF_CAP_PWC_DATA) {
+                } else {
                        offset = 2;
                        max_element_cnt = cyapa->electrodes_x +
                                                cyapa->electrodes_y;
diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c
index 757f78a94aec..23d259416f2f 100644
--- a/drivers/input/mouse/focaltech.c
+++ b/drivers/input/mouse/focaltech.c
@@ -67,9 +67,6 @@ static void focaltech_reset(struct psmouse *psmouse)
 #define FOC_MAX_FINGERS 5
-#define FOC_MAX_X 2431
-#define FOC_MAX_Y 1663
 /*
 * Current state of a single finger on the touchpad.
 */
@@ -129,9 +126,17 @@ static void focaltech_report_state(struct psmouse *psmouse)
                input_mt_slot(dev, i);
                input_mt_report_slot_state(dev, MT_TOOL_FINGER, active);
                if (active) {
-                        input_report_abs(dev, ABS_MT_POSITION_X, finger->x);
+                        unsigned int clamped_x, clamped_y;
+                        /*
+                         * The touchpad might report invalid data, so we clamp
+                         * the resulting values so that we do not confuse
+                         * userspace.
+                         */
+                        clamped_x = clamp(finger->x, 0U, priv->x_max);
+                        clamped_y = clamp(finger->y, 0U, priv->y_max);
+                        input_report_abs(dev, ABS_MT_POSITION_X, clamped_x);
                        input_report_abs(dev, ABS_MT_POSITION_Y,
-                                         FOC_MAX_Y - finger->y);
+                                         priv->y_max - clamped_y);
                }
        }
        input_mt_report_pointer_emulation(dev, true);
@@ -180,16 +185,6 @@ static void focaltech_process_abs_packet(struct psmouse *psmouse,
        state->pressed = (packet[0] >> 4) & 1;
-        /*
-         * packet[5] contains some kind of tool size in the most
-         * significant nibble. 0xff is a special value (latching) that
-         * signals a large contact area.
-         */
-        if (packet[5] == 0xff) {
-                state->fingers[finger].valid = false;
-                return;
-        }
        state->fingers[finger].x = ((packet[1] & 0xf) << 8) | packet[2];
        state->fingers[finger].y = (packet[3] << 8) | packet[4];
        state->fingers[finger].valid = true;
@@ -381,6 +376,23 @@ static int focaltech_read_size(struct psmouse *psmouse)
        return 0;
 }
+void focaltech_set_resolution(struct psmouse *psmouse, unsigned int resolution)
+{
+        /* not supported yet */
+}
+static void focaltech_set_rate(struct psmouse *psmouse, unsigned int rate)
+{
+        /* not supported yet */
+}
+static void focaltech_set_scale(struct psmouse *psmouse,
+                                enum psmouse_scale scale)
+{
+        /* not supported yet */
+}
 int focaltech_init(struct psmouse *psmouse)
 {
        struct focaltech_data *priv;
@@ -415,6 +427,14 @@ int focaltech_init(struct psmouse *psmouse)
        psmouse->cleanup = focaltech_reset;
        /* resync is not supported yet */
        psmouse->resync_time = 0;
+        /*
+         * rate/resolution/scale changes are not supported yet, and
+         * the generic implementations of these functions seem to
+         * confuse some touchpads
+         */
+        psmouse->set_resolution = focaltech_set_resolution;
+        psmouse->set_rate = focaltech_set_rate;
+        psmouse->set_scale = focaltech_set_scale;
        return 0;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 4ccd01d7a48d..8bc61237bc1b 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -454,6 +454,17 @@ static void psmouse_set_rate(struct psmouse *psmouse, unsigned int rate)
 }
 /*
+ * Here we set the mouse scaling.
+ */
+static void psmouse_set_scale(struct psmouse *psmouse, enum psmouse_scale scale)
+{
+        ps2_command(&psmouse->ps2dev, NULL,
+                    scale == PSMOUSE_SCALE21 ? PSMOUSE_CMD_SETSCALE21 :
+                                               PSMOUSE_CMD_SETSCALE11);
+}
+/*
 * psmouse_poll() - default poll handler. Everyone except for ALPS uses it.
 */
@@ -689,6 +700,7 @@ static void psmouse_apply_defaults(struct psmouse *psmouse)
        psmouse->set_rate = psmouse_set_rate;
        psmouse->set_resolution = psmouse_set_resolution;
+        psmouse->set_scale = psmouse_set_scale;
        psmouse->poll = psmouse_poll;
        psmouse->protocol_handler = psmouse_process_byte;
        psmouse->pktsize = 3;
@@ -1160,7 +1172,7 @@ static void psmouse_initialize(struct psmouse *psmouse)
        if (psmouse_max_proto != PSMOUSE_PS2) {
                psmouse->set_rate(psmouse, psmouse->rate);
                psmouse->set_resolution(psmouse, psmouse->resolution);
-                ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_SETSCALE11);
+                psmouse->set_scale(psmouse, PSMOUSE_SCALE11);
        }
 }
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index c2ff137ecbdb..d02e1bdc9ae4 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -36,6 +36,11 @@ typedef enum {
        PSMOUSE_FULL_PACKET
 } psmouse_ret_t;
+enum psmouse_scale {
+        PSMOUSE_SCALE11,
+        PSMOUSE_SCALE21
+};
 struct psmouse {
        void *private;
        struct input_dev *dev;
@@ -67,6 +72,7 @@ struct psmouse {
        psmouse_ret_t (*protocol_handler)(struct psmouse *psmouse);
        void (*set_rate)(struct psmouse *psmouse, unsigned int rate);
        void (*set_resolution)(struct psmouse *psmouse, unsigned int resolution);
+        void (*set_scale)(struct psmouse *psmouse, enum psmouse_scale scale);
        int (*reconnect)(struct psmouse *psmouse);
        void (*disconnect)(struct psmouse *psmouse);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 58917525126e..6261fd6d7c3c 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -943,6 +943,7 @@ config TOUCHSCREEN_SUN4I
        tristate "Allwinner sun4i resistive touchscreen controller support"
        depends on ARCH_SUNXI || COMPILE_TEST
        depends on HWMON
+        depends on THERMAL || !THERMAL_OF
        help
          This selects support for the resistive touchscreen controller
          found on Allwinner sunxi SoCs.
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index baa0d9786f50..1ae4e547b419 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -23,6 +23,7 @@ config IOMMU_IO_PGTABLE
 config IOMMU_IO_PGTABLE_LPAE
        bool "ARMv7/v8 Long Descriptor Format"
        select IOMMU_IO_PGTABLE
+        depends on ARM || ARM64 || COMPILE_TEST
        help
          Enable support for the ARM long descriptor pagetable format.
          This allocator supports 4K/2M/1G, 16K/32M and 64K/512M page
@@ -63,6 +64,7 @@ config MSM_IOMMU
        bool "MSM IOMMU Support"
        depends on ARM
        depends on ARCH_MSM8X60 || ARCH_MSM8960 || COMPILE_TEST
+        depends on BROKEN
        select IOMMU_API
        help
          Support for the IOMMUs found on certain Qualcomm SOCs.
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index 7ce52737c7a1..dc14fec4ede1 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -1186,8 +1186,15 @@ static const struct iommu_ops exynos_iommu_ops = {
 static int __init exynos_iommu_init(void)
 {
+        struct device_node *np;
        int ret;
+        np = of_find_matching_node(NULL, sysmmu_of_match);
+        if (!np)
+                return 0;
+        of_node_put(np);
        lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table",
                                LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL);
        if (!lv2table_kmem_cache) {
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 5a500edf00cc..b610a8dee238 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -56,7 +56,8 @@
        ((((d)->levels - ((l) - ARM_LPAE_START_LVL(d) + 1))             \
          * (d)->bits_per_level) + (d)->pg_shift)
-#define ARM_LPAE_PAGES_PER_PGD(d)       ((d)->pgd_size >> (d)->pg_shift)
+#define ARM_LPAE_PAGES_PER_PGD(d)                                       \
+        DIV_ROUND_UP((d)->pgd_size, 1UL << (d)->pg_shift)
 /*
 * Calculate the index at level l used to map virtual address a using the
@@ -66,7 +67,7 @@
        ((l) == ARM_LPAE_START_LVL(d) ? ilog2(ARM_LPAE_PAGES_PER_PGD(d)) : 0)
 #define ARM_LPAE_LVL_IDX(a,l,d)                                         \
-        (((a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                             \
+        (((u64)(a) >> ARM_LPAE_LVL_SHIFT(l,d)) &                        \
         ((1 << ((d)->bits_per_level + ARM_LPAE_PGD_IDX(l,d))) - 1))
 /* Calculate the block/page mapping size at level l for pagetable in d. */
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index f59f857b702e..a4ba851825c2 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1376,6 +1376,13 @@ static int __init omap_iommu_init(void)
        struct kmem_cache *p;
        const unsigned long flags = SLAB_HWCACHE_ALIGN;
        size_t align = 1 << 10; /* L2 pagetable alignement */
+        struct device_node *np;
+        np = of_find_matching_node(NULL, omap_iommu_of_match);
+        if (!np)
+                return 0;
+        of_node_put(np);
        p = kmem_cache_create("iopte_cache", IOPTE_TABLE_SIZE, align, flags,
                              iopte_cachep_ctor);
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 6a8b1ec4a48a..9f74fddcd304 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1015,8 +1015,15 @@ static struct platform_driver rk_iommu_driver = {
 static int __init rk_iommu_init(void)
 {
+        struct device_node *np;
        int ret;
+        np = of_find_matching_node(NULL, rk_iommu_dt_ids);
+        if (!np)
+                return 0;
+        of_node_put(np);
        ret = bus_set_iommu(&platform_bus_type, &rk_iommu_ops);
        if (ret)
                return ret;
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 463c235acbdc..4387dae14e45 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
 static void __iomem *main_int_base;
 static struct irq_domain *armada_370_xp_mpic_domain;
 static u32 doorbell_mask_reg;
+static int parent_irq;
 #ifdef CONFIG_PCI_MSI
 static struct irq_domain *armada_370_xp_msi_domain;
 static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
 {
        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
                armada_xp_mpic_smp_cpu_init();
        return NOTIFY_OK;
 }
@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
        .priority = 100,
 };
+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
+                                        unsigned long action, void *hcpu)
+{
+        if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
+                enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
+        return NOTIFY_OK;
+}
+static struct notifier_block mpic_cascaded_cpu_notifier = {
+        .notifier_call = mpic_cascaded_secondary_init,
+        .priority = 100,
+};
 #endif /* CONFIG_SMP */
 static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                                             struct device_node *parent)
 {
        struct resource main_int_res, per_cpu_int_res;
-        int parent_irq, nr_irqs, i;
+        int nr_irqs, i;
        u32 control;
        BUG_ON(of_address_to_resource(node, 0, &main_int_res));
@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
                register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
 #endif
        } else {
+#ifdef CONFIG_SMP
+                register_cpu_notifier(&mpic_cascaded_cpu_notifier);
+#endif
                irq_set_chained_handler(parent_irq,
                                        armada_370_xp_mpic_handle_cascade_irq);
        }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d8996bdf0f61..596b0a9eee99 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -416,13 +416,14 @@ static void its_send_single_command(struct its_node *its,
 {
        struct its_cmd_block *cmd, *sync_cmd, *next_cmd;
        struct its_collection *sync_col;
+        unsigned long flags;
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
        cmd = its_allocate_entry(its);
        if (!cmd) {             /* We're soooooo screewed... */
                pr_err_ratelimited("ITS can't allocate, dropping command\n");
-                raw_spin_unlock(&its->lock);
+                raw_spin_unlock_irqrestore(&its->lock, flags);
                return;
        }
        sync_col = builder(cmd, desc);
@@ -442,7 +443,7 @@ static void its_send_single_command(struct its_node *its,
 post:
        next_cmd = its_post_commands(its);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
        its_wait_for_range_completion(its, cmd, next_cmd);
 }
@@ -799,21 +800,43 @@ static int its_alloc_tables(struct its_node *its)
 {
        int err;
        int i;
-        int psz = PAGE_SIZE;
+        int psz = SZ_64K;
        u64 shr = GITS_BASER_InnerShareable;
        for (i = 0; i < GITS_BASER_NR_REGS; i++) {
                u64 val = readq_relaxed(its->base + GITS_BASER + i * 8);
                u64 type = GITS_BASER_TYPE(val);
                u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
+                int order = get_order(psz);
+                int alloc_size;
                u64 tmp;
                void *base;
                if (type == GITS_BASER_TYPE_NONE)
                        continue;
-                /* We're lazy and only allocate a single page for now */
+                /*
-                base = (void *)get_zeroed_page(GFP_KERNEL);
+                 * Allocate as many entries as required to fit the
+                 * range of device IDs that the ITS can grok... The ID
+                 * space being incredibly sparse, this results in a
+                 * massive waste of memory.
+                 *
+                 * For other tables, only allocate a single page.
+                 */
+                if (type == GITS_BASER_TYPE_DEVICE) {
+                        u64 typer = readq_relaxed(its->base + GITS_TYPER);
+                        u32 ids = GITS_TYPER_DEVBITS(typer);
+                        order = get_order((1UL << ids) * entry_size);
+                        if (order >= MAX_ORDER) {
+                                order = MAX_ORDER - 1;
+                                pr_warn("%s: Device Table too large, reduce its page order to %u\n",
+                                        its->msi_chip.of_node->full_name, order);
+                        }
+                }
+                alloc_size = (1 << order) * PAGE_SIZE;
+                base = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
                if (!base) {
                        err = -ENOMEM;
                        goto out_free;
@@ -841,7 +864,7 @@ retry_baser:
                        break;
                }
-                val |= (PAGE_SIZE / psz) - 1;
+                val |= (alloc_size / psz) - 1;
                writeq_relaxed(val, its->base + GITS_BASER + i * 8);
                tmp = readq_relaxed(its->base + GITS_BASER + i * 8);
@@ -882,7 +905,7 @@ retry_baser:
                }
                pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
-                        (int)(PAGE_SIZE / entry_size),
+                        (int)(alloc_size / entry_size),
                        its_base_type_string[type],
                        (unsigned long)virt_to_phys(base),
                        psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
@@ -1020,8 +1043,9 @@ static void its_cpu_init_collection(void)
 static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
 {
        struct its_device *its_dev = NULL, *tmp;
+        unsigned long flags;
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
        list_for_each_entry(tmp, &its->its_device_list, entry) {
                if (tmp->device_id == dev_id) {
@@ -1030,7 +1054,7 @@ static struct its_device *its_find_device(struct its_node *its, u32 dev_id)
                }
        }
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
        return its_dev;
 }
@@ -1040,6 +1064,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 {
        struct its_device *dev;
        unsigned long *lpi_map;
+        unsigned long flags;
        void *itt;
        int lpi_base;
        int nr_lpis;
@@ -1056,7 +1081,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        nr_ites = max(2UL, roundup_pow_of_two(nvecs));
        sz = nr_ites * its->ite_size;
        sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
-        itt = kmalloc(sz, GFP_KERNEL);
+        itt = kzalloc(sz, GFP_KERNEL);
        lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
        if (!dev || !itt || !lpi_map) {
@@ -1075,9 +1100,9 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
        dev->device_id = dev_id;
        INIT_LIST_HEAD(&dev->entry);
-        raw_spin_lock(&its->lock);
+        raw_spin_lock_irqsave(&its->lock, flags);
        list_add(&dev->entry, &its->its_device_list);
-        raw_spin_unlock(&its->lock);
+        raw_spin_unlock_irqrestore(&its->lock, flags);
        /* Bind the device to the first possible CPU */
        cpu = cpumask_first(cpu_online_mask);
@@ -1091,9 +1116,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 static void its_free_device(struct its_device *its_dev)
 {
-        raw_spin_lock(&its_dev->its->lock);
+        unsigned long flags;
+        raw_spin_lock_irqsave(&its_dev->its->lock, flags);
        list_del(&its_dev->entry);
-        raw_spin_unlock(&its_dev->its->lock);
+        raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
        kfree(its_dev->itt);
        kfree(its_dev);
 }
@@ -1112,31 +1139,69 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
        return 0;
 }
+struct its_pci_alias {
+        struct pci_dev  *pdev;
+        u32             dev_id;
+        u32             count;
+};
+static int its_pci_msi_vec_count(struct pci_dev *pdev)
+{
+        int msi, msix;
+        msi = max(pci_msi_vec_count(pdev), 0);
+        msix = max(pci_msix_vec_count(pdev), 0);
+        return max(msi, msix);
+}
+static int its_get_pci_alias(struct pci_dev *pdev, u16 alias, void *data)
+{
+        struct its_pci_alias *dev_alias = data;
+        dev_alias->dev_id = alias;
+        if (pdev != dev_alias->pdev)
+                dev_alias->count += its_pci_msi_vec_count(dev_alias->pdev);
+        return 0;
+}
 static int its_msi_prepare(struct irq_domain *domain, struct device *dev,
                           int nvec, msi_alloc_info_t *info)
 {
        struct pci_dev *pdev;
        struct its_node *its;
-        u32 dev_id;
        struct its_device *its_dev;
+        struct its_pci_alias dev_alias;
        if (!dev_is_pci(dev))
                return -EINVAL;
        pdev = to_pci_dev(dev);
-        dev_id = PCI_DEVID(pdev->bus->number, pdev->devfn);
+        dev_alias.pdev = pdev;
+        dev_alias.count = nvec;
+        pci_for_each_dma_alias(pdev, its_get_pci_alias, &dev_alias);
        its = domain->parent->host_data;
-        its_dev = its_find_device(its, dev_id);
+        its_dev = its_find_device(its, dev_alias.dev_id);
-        if (WARN_ON(its_dev))
+        if (its_dev) {
-                return -EINVAL;
+                /*
+                 * We already have seen this ID, probably through
+                 * another alias (PCI bridge of some sort). No need to
+                 * create the device.
+                 */
+                dev_dbg(dev, "Reusing ITT for devID %x\n", dev_alias.dev_id);
+                goto out;
+        }
-        its_dev = its_create_device(its, dev_id, nvec);
+        its_dev = its_create_device(its, dev_alias.dev_id, dev_alias.count);
        if (!its_dev)
                return -ENOMEM;
-        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n", nvec, ilog2(nvec));
+        dev_dbg(&pdev->dev, "ITT %d entries, %d bits\n",
+                dev_alias.count, ilog2(dev_alias.count));
+out:
        info->scratchpad[0].ptr = its_dev;
        info->scratchpad[1].ptr = dev;
        return 0;
@@ -1255,6 +1320,34 @@ static const struct irq_domain_ops its_domain_ops = {
        .deactivate             = its_irq_domain_deactivate,
 };
+static int its_force_quiescent(void __iomem *base)
+{
+        u32 count = 1000000;    /* 1s */
+        u32 val;
+        val = readl_relaxed(base + GITS_CTLR);
+        if (val & GITS_CTLR_QUIESCENT)
+                return 0;
+        /* Disable the generation of all interrupts to this ITS */
+        val &= ~GITS_CTLR_ENABLE;
+        writel_relaxed(val, base + GITS_CTLR);
+        /* Poll GITS_CTLR and wait until ITS becomes quiescent */
+        while (1) {
+                val = readl_relaxed(base + GITS_CTLR);
+                if (val & GITS_CTLR_QUIESCENT)
+                        return 0;
+                count--;
+                if (!count)
+                        return -EBUSY;
+                cpu_relax();
+                udelay(1);
+        }
+}
 static int its_probe(struct device_node *node, struct irq_domain *parent)
 {
        struct resource res;
@@ -1283,6 +1376,13 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
                goto out_unmap;
        }
+        err = its_force_quiescent(its_base);
+        if (err) {
+                pr_warn("%s: failed to quiesce, giving up\n",
+                        node->full_name);
+                goto out_unmap;
+        }
        pr_info("ITS: %s\n", node->full_name);
        its = kzalloc(sizeof(*its), GFP_KERNEL);
@@ -1323,7 +1423,7 @@ static int its_probe(struct device_node *node, struct irq_domain *parent)
        writeq_relaxed(baser, its->base + GITS_CBASER);
        tmp = readq_relaxed(its->base + GITS_CBASER);
        writeq_relaxed(0, its->base + GITS_CWRITER);
-        writel_relaxed(1, its->base + GITS_CTLR);
+        writel_relaxed(GITS_CTLR_ENABLE, its->base + GITS_CTLR);
        if ((tmp ^ baser) & GITS_BASER_SHAREABILITY_MASK) {
                pr_info("ITS: using cache flushing for cmd queue\n");
@@ -1382,12 +1482,11 @@ static bool gic_rdists_supports_plpis(void)
 int its_cpu_init(void)
 {
-        if (!gic_rdists_supports_plpis()) {
-                pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
-                return -ENXIO;
-        }
        if (!list_empty(&its_nodes)) {
+                if (!gic_rdists_supports_plpis()) {
+                        pr_info("CPU%d: LPIs not supported\n", smp_processor_id());
+                        return -ENXIO;
+                }
                its_cpu_init_lpis();
                its_cpu_init_collection();
        }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 1c6dea2fbc34..fd8850def1b8 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -466,7 +466,7 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                tlist |= 1 << (mpidr & 0xf);
                cpu = cpumask_next(cpu, mask);
-                if (cpu == nr_cpu_ids)
+                if (cpu >= nr_cpu_ids)
                        goto out;
                mpidr = cpu_logical_map(cpu);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 4634cf7d0ec3..471e1cdc1933 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -154,23 +154,25 @@ static inline unsigned int gic_irq(struct irq_data *d)
 static void gic_mask_irq(struct irq_data *d)
 {
        u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_CLEAR + (gic_irq(d) / 32) * 4);
        if (gic_arch_extn.irq_mask)
                gic_arch_extn.irq_mask(d);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 static void gic_unmask_irq(struct irq_data *d)
 {
        u32 mask = 1 << (gic_irq(d) % 32);
+        unsigned long flags;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        if (gic_arch_extn.irq_unmask)
                gic_arch_extn.irq_unmask(d);
        writel_relaxed(mask, gic_dist_base(d) + GIC_DIST_ENABLE_SET + (gic_irq(d) / 32) * 4);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
 }
 static void gic_eoi_irq(struct irq_data *d)
@@ -188,6 +190,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
 {
        void __iomem *base = gic_dist_base(d);
        unsigned int gicirq = gic_irq(d);
+        unsigned long flags;
        int ret;
        /* Interrupt configuration for SGIs can't be changed */
@@ -199,14 +202,14 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
                            type != IRQ_TYPE_EDGE_RISING)
                return -EINVAL;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        if (gic_arch_extn.irq_set_type)
                gic_arch_extn.irq_set_type(d, type);
        ret = gic_configure_irq(gicirq, type, base, NULL);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
        return ret;
 }
@@ -227,6 +230,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
        void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
        unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
        u32 val, mask, bit;
+        unsigned long flags;
        if (!force)
                cpu = cpumask_any_and(mask_val, cpu_online_mask);
@@ -236,12 +240,12 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
        if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
                return -EINVAL;
-        raw_spin_lock(&irq_controller_lock);
+        raw_spin_lock_irqsave(&irq_controller_lock, flags);
        mask = 0xff << shift;
        bit = gic_cpu_map[cpu] << shift;
        val = readl_relaxed(reg) & ~mask;
        writel_relaxed(val | bit, reg);
-        raw_spin_unlock(&irq_controller_lock);
+        raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
        return IRQ_SET_MASK_OK;
 }
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 5b76a173cd95..5897d8d8fa5a 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -526,6 +526,7 @@ config MTD_NAND_SUNXI
 config MTD_NAND_HISI504
        tristate "Support for NAND controller on Hisilicon SoC Hip04"
+        depends on HAS_DMA
        help
          Enables support for NAND controller on Hisilicon SoC Hip04.
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 96b0b1d27df1..10b1f7a4fe50 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
        nand_writel(info, NDCR, ndcr | int_mask);
 }
+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
+{
+        if (info->ecc_bch) {
+                int timeout;
+                /*
+                 * According to the datasheet, when reading from NDDB
+                 * with BCH enabled, after each 32 bytes reads, we
+                 * have to make sure that the NDSR.RDDREQ bit is set.
+                 *
+                 * Drain the FIFO 8 32 bits reads at a time, and skip
+                 * the polling on the last read.
+                 */
+                while (len > 8) {
+                        __raw_readsl(info->mmio_base + NDDB, data, 8);
+                        for (timeout = 0;
+                             !(nand_readl(info, NDSR) & NDSR_RDDREQ);
+                             timeout++) {
+                                if (timeout >= 5) {
+                                        dev_err(&info->pdev->dev,
+                                                "Timeout on RDDREQ while draining the FIFO\n");
+                                        return;
+                                }
+                                mdelay(1);
+                        }
+                        data += 32;
+                        len -= 8;
+                }
+        }
+        __raw_readsl(info->mmio_base + NDDB, data, len);
+}
 static void handle_data_pio(struct pxa3xx_nand_info *info)
 {
        unsigned int do_bytes = min(info->data_size, info->chunk_size);
@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
                                      DIV_ROUND_UP(info->oob_size, 4));
                break;
        case STATE_PIO_READING:
-                __raw_readsl(info->mmio_base + NDDB,
+                drain_fifo(info,
-                             info->data_buff + info->data_buff_pos,
+                           info->data_buff + info->data_buff_pos,
-                             DIV_ROUND_UP(do_bytes, 4));
+                           DIV_ROUND_UP(do_bytes, 4));
                if (info->oob_size > 0)
-                        __raw_readsl(info->mmio_base + NDDB,
+                        drain_fifo(info,
-                                     info->oob_buff + info->oob_buff_pos,
+                                   info->oob_buff + info->oob_buff_pos,
-                                     DIV_ROUND_UP(info->oob_size, 4));
+                                   DIV_ROUND_UP(info->oob_size, 4));
                break;
        default:
                dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
@@ -1572,6 +1608,8 @@ static int alloc_nand_resource(struct platform_device *pdev)
        int ret, irq, cs;
        pdata = dev_get_platdata(&pdev->dev);
+        if (pdata->num_cs <= 0)
+                return -ENODEV;
        info = devm_kzalloc(&pdev->dev, sizeof(*info) + (sizeof(*mtd) +
                            sizeof(*host)) * pdata->num_cs, GFP_KERNEL);
        if (!info)
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3c82e02e3dae..b0f69248cb71 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -579,6 +579,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
        skb->pkt_type = PACKET_BROADCAST;
        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = dev->ifindex;
@@ -603,6 +607,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
        skb->pkt_type = PACKET_BROADCAST;
        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
        can_skb_reserve(skb);
        can_skb_prv(skb)->ifindex = dev->ifindex;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 2928f7003041..a316fa4b91ab 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
 * Copyright (C) 2015 Valeo S.A.
 */
+#include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -584,8 +585,15 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
                while (pos <= actual_len - MSG_HEADER_LEN) {
                        tmp = buf + pos;
-                        if (!tmp->len)
+                        /* Handle messages crossing the USB endpoint max packet
-                                break;
+                         * size boundary. Check kvaser_usb_read_bulk_callback()
+                         * for further details.
+                         */
+                        if (tmp->len == 0) {
+                                pos = round_up(pos,
+                                               dev->bulk_in->wMaxPacketSize);
+                                continue;
+                        }
                        if (pos + tmp->len > actual_len) {
                                dev_err(dev->udev->dev.parent,
@@ -787,7 +795,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
                netdev_err(netdev, "Error transmitting URB\n");
                usb_unanchor_urb(urb);
                usb_free_urb(urb);
-                kfree(buf);
                return err;
        }
@@ -1317,8 +1324,19 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
        while (pos <= urb->actual_length - MSG_HEADER_LEN) {
                msg = urb->transfer_buffer + pos;
-                if (!msg->len)
+                /* The Kvaser firmware can only read and write messages that
-                        break;
+                 * does not cross the USB's endpoint wMaxPacketSize boundary.
+                 * If a follow-up command crosses such boundary, firmware puts
+                 * a placeholder zero-length command in its place then aligns
+                 * the real command to the next max packet size.
+                 *
+                 * Handle such cases or we're going to miss a significant
+                 * number of events in case of a heavy rx load on the bus.
+                 */
+                if (msg->len == 0) {
+                        pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
+                        continue;
+                }
                if (pos + msg->len > urb->actual_length) {
                        dev_err(dev->udev->dev.parent, "Format error\n");
@@ -1326,7 +1344,6 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                }
                kvaser_usb_handle_message(dev, msg);
                pos += msg->len;
        }
@@ -1615,8 +1632,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        struct urb *urb;
        void *buf;
        struct kvaser_msg *msg;
-        int i, err;
+        int i, err, ret = NETDEV_TX_OK;
-        int ret = NETDEV_TX_OK;
        u8 *msg_tx_can_flags = NULL;            /* GCC */
        if (can_dropped_invalid_skb(netdev, skb))
@@ -1634,7 +1650,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        if (!buf) {
                stats->tx_dropped++;
                dev_kfree_skb(skb);
-                goto nobufmem;
+                goto freeurb;
        }
        msg = buf;
@@ -1681,8 +1697,10 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        /* This should never happen; it implies a flow control bug */
        if (!context) {
                netdev_warn(netdev, "cannot find free context\n");
+                kfree(buf);
                ret =  NETDEV_TX_BUSY;
-                goto releasebuf;
+                goto freeurb;
        }
        context->priv = priv;
@@ -1719,16 +1737,12 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                else
                        netdev_warn(netdev, "Failed tx_urb %d\n", err);
-                goto releasebuf;
+                goto freeurb;
        }
-        usb_free_urb(urb);
+        ret = NETDEV_TX_OK;
-        return NETDEV_TX_OK;
-releasebuf:
+freeurb:
-        kfree(buf);
-nobufmem:
        usb_free_urb(urb);
        return ret;
 }
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 962c3f027383..0bac0f14edc3 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -879,6 +879,10 @@ static int pcan_usb_fd_init(struct peak_usb_device *dev)
                pdev->usb_if = ppdev->usb_if;
                pdev->cmd_buffer_addr = ppdev->cmd_buffer_addr;
+                /* do a copy of the ctrlmode[_supported] too */
+                dev->can.ctrlmode = ppdev->dev.can.ctrlmode;
+                dev->can.ctrlmode_supported = ppdev->dev.can.ctrlmode_supported;
        }
        pdev->usb_if->dev[dev->ctrl_idx] = dev;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 869d97fcf781..b927021c6c40 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -593,7 +593,7 @@ static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
        if (!xgene_ring_mgr_init(pdata))
                return -ENODEV;
-        if (!efi_enabled(EFI_BOOT)) {
+        if (pdata->clk) {
                clk_prepare_enable(pdata->clk);
                clk_disable_unprepare(pdata->clk);
                clk_prepare_enable(pdata->clk);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 4de62b210c85..635a83be7e5e 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1025,6 +1025,8 @@ static int xgene_enet_remove(struct platform_device *pdev)
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xgene_enet_acpi_match[] = {
        { "APMC0D05", },
+        { "APMC0D30", },
+        { "APMC0D31", },
        { }
 };
 MODULE_DEVICE_TABLE(acpi, xgene_enet_acpi_match);
@@ -1033,6 +1035,8 @@ MODULE_DEVICE_TABLE(acpi, xgene_enet_acpi_match);
 #ifdef CONFIG_OF
 static struct of_device_id xgene_enet_of_match[] = {
        {.compatible = "apm,xgene-enet",},
+        {.compatible = "apm,xgene1-sgenet",},
+        {.compatible = "apm,xgene1-xgenet",},
        {},
 };
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 21206d33b638..a7f2cc3e485e 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -486,7 +486,7 @@ static int bcm_enet_poll(struct napi_struct *napi, int budget)
 {
        struct bcm_enet_priv *priv;
        struct net_device *dev;
-        int tx_work_done, rx_work_done;
+        int rx_work_done;
        priv = container_of(napi, struct bcm_enet_priv, napi);
        dev = priv->net_dev;
@@ -498,14 +498,14 @@ static int bcm_enet_poll(struct napi_struct *napi, int budget)
                         ENETDMAC_IR, priv->tx_chan);
        /* reclaim sent skb */
-        tx_work_done = bcm_enet_tx_reclaim(dev, 0);
+        bcm_enet_tx_reclaim(dev, 0);
        spin_lock(&priv->rx_lock);
        rx_work_done = bcm_enet_receive_queue(dev, budget);
        spin_unlock(&priv->rx_lock);
-        if (rx_work_done >= budget || tx_work_done > 0) {
+        if (rx_work_done >= budget) {
-                /* rx/tx queue is not yet empty/clean */
+                /* rx queue is not yet empty/clean */
                return rx_work_done;
        }
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 676ffe093180..0469f72c6e7e 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -302,9 +302,6 @@ static int bgmac_dma_rx_skb_for_slot(struct bgmac *bgmac,
        slot->skb = skb;
        slot->dma_addr = dma_addr;
-        if (slot->dma_addr & 0xC0000000)
-                bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
        return 0;
 }
@@ -505,8 +502,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                                  ring->mmio_base);
                        goto err_dma_free;
                }
-                if (ring->dma_base & 0xC0000000)
-                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
                ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
                                                      BGMAC_DMA_RING_TX);
@@ -536,8 +531,6 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
                        err = -ENOMEM;
                        goto err_dma_free;
                }
-                if (ring->dma_base & 0xC0000000)
-                        bgmac_warn(bgmac, "DMA address using 0xC0000000 bit(s), it may need translation trick\n");
                ring->unaligned = bgmac_dma_unaligned(bgmac, ring,
                                                      BGMAC_DMA_RING_RX);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 7155e1d2c208..bef750a09027 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12722,6 +12722,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
        pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                               PCICFG_VENDOR_ID_OFFSET);
+        /* Set PCIe reset type to fundamental for EEH recovery */
+        pdev->needs_freset = 1;
        /* AER (Advanced Error reporting) configuration */
        rc = pci_enable_pcie_error_reporting(pdev);
        if (!rc)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
index 149a0d70c108..b97122926d3a 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -73,15 +73,17 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
        if (wol->wolopts & ~(WAKE_MAGIC | WAKE_MAGICSECURE))
                return -EINVAL;
+        reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
        if (wol->wolopts & WAKE_MAGICSECURE) {
                bcmgenet_umac_writel(priv, get_unaligned_be16(&wol->sopass[0]),
                                     UMAC_MPD_PW_MS);
                bcmgenet_umac_writel(priv, get_unaligned_be32(&wol->sopass[2]),
                                     UMAC_MPD_PW_LS);
-                reg = bcmgenet_umac_readl(priv, UMAC_MPD_CTRL);
                reg |= MPD_PW_EN;
-                bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
+        } else {
+                reg &= ~MPD_PW_EN;
        }
+        bcmgenet_umac_writel(priv, reg, UMAC_MPD_CTRL);
        /* Flag the device and relevant IRQ as wakeup capable */
        if (wol->wolopts) {
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index ad76b8e35a00..81d41539fcba 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -2113,17 +2113,17 @@ static const struct net_device_ops macb_netdev_ops = {
 };
 #if defined(CONFIG_OF)
-static struct macb_config pc302gem_config = {
+static const struct macb_config pc302gem_config = {
        .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
        .dma_burst_length = 16,
 };
-static struct macb_config sama5d3_config = {
+static const struct macb_config sama5d3_config = {
        .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE,
        .dma_burst_length = 16,
 };
-static struct macb_config sama5d4_config = {
+static const struct macb_config sama5d4_config = {
        .caps = 0,
        .dma_burst_length = 4,
 };
@@ -2154,7 +2154,7 @@ static void macb_configure_caps(struct macb *bp)
        if (bp->pdev->dev.of_node) {
                match = of_match_node(macb_dt_ids, bp->pdev->dev.of_node);
                if (match && match->data) {
-                        config = (const struct macb_config *)match->data;
+                        config = match->data;
                        bp->caps = config->caps;
                        /*
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 31dc080f2437..ff85619a9732 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -351,7 +351,7 @@
 /* Bitfields in MID */
 #define MACB_IDNUM_OFFSET                       16
-#define MACB_IDNUM_SIZE                         16
+#define MACB_IDNUM_SIZE                         12
 #define MACB_REV_OFFSET                         0
 #define MACB_REV_SIZE                           16
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 9bb6220663b2..99492b7e3713 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1597,7 +1597,7 @@ fec_enet_interrupt(int irq, void *dev_id)
        writel(int_events, fep->hwp + FEC_IEVENT);
        fec_enet_collect_events(fep, int_events);
-        if (fep->work_tx || fep->work_rx) {
+        if ((fep->work_tx || fep->work_rx) && fep->link) {
                ret = IRQ_HANDLED;
                if (napi_schedule_prep(&fep->napi)) {
@@ -3383,7 +3383,6 @@ fec_drv_remove(struct platform_device *pdev)
                regulator_disable(fep->reg_phy);
        if (fep->ptp_clock)
                ptp_clock_unregister(fep->ptp_clock);
-        fec_enet_clk_enable(ndev, false);
        of_node_put(fep->phy_node);
        free_netdev(ndev);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 178e54028d10..7bf3682cdf47 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -747,6 +747,18 @@ static int gfar_parse_group(struct device_node *np,
        return 0;
 }
+static int gfar_of_group_count(struct device_node *np)
+{
+        struct device_node *child;
+        int num = 0;
+        for_each_available_child_of_node(np, child)
+                if (!of_node_cmp(child->name, "queue-group"))
+                        num++;
+        return num;
+}
 static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 {
        const char *model;
@@ -784,7 +796,7 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
                num_rx_qs = 1;
        } else { /* MQ_MG_MODE */
                /* get the actual number of supported groups */
-                unsigned int num_grps = of_get_available_child_count(np);
+                unsigned int num_grps = gfar_of_group_count(np);
                if (num_grps == 0 || num_grps > MAXGROUPS) {
                        dev_err(&ofdev->dev, "Invalid # of int groups(%d)\n",
@@ -851,7 +863,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
        /* Parse and initialize group specific information */
        if (priv->mode == MQ_MG_MODE) {
-                for_each_child_of_node(np, child) {
+                for_each_available_child_of_node(np, child) {
+                        if (of_node_cmp(child->name, "queue-group"))
+                                continue;
                        err = gfar_parse_group(child, priv, model);
                        if (err)
                                goto err_grp_init;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 209ee1b27f8d..5d093dc0f5f5 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -92,6 +92,7 @@ static const char version[] =
 #include "smc91x.h"
 #if defined(CONFIG_ASSABET_NEPONSET)
+#include <mach/assabet.h>
 #include <mach/neponset.h>
 #endif
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index fb846ebba1d9..f9b42f11950f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -272,6 +272,37 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
        struct stmmac_priv *priv = NULL;
        struct plat_stmmacenet_data *plat_dat = NULL;
        const char *mac = NULL;
+        int irq, wol_irq, lpi_irq;
+        /* Get IRQ information early to have an ability to ask for deferred
+         * probe if needed before we went too far with resource allocation.
+         */
+        irq = platform_get_irq_byname(pdev, "macirq");
+        if (irq < 0) {
+                if (irq != -EPROBE_DEFER) {
+                        dev_err(dev,
+                                "MAC IRQ configuration information not found\n");
+                }
+                return irq;
+        }
+        /* On some platforms e.g. SPEAr the wake up irq differs from the mac irq
+         * The external wake up irq can be passed through the platform code
+         * named as "eth_wake_irq"
+         *
+         * In case the wake up interrupt is not passed from the platform
+         * so the driver will continue to use the mac irq (ndev->irq)
+         */
+        wol_irq = platform_get_irq_byname(pdev, "eth_wake_irq");
+        if (wol_irq < 0) {
+                if (wol_irq == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+                wol_irq = irq;
+        }
+        lpi_irq = platform_get_irq_byname(pdev, "eth_lpi");
+        if (lpi_irq == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        addr = devm_ioremap_resource(dev, res);
@@ -323,39 +354,15 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                return PTR_ERR(priv);
        }
+        /* Copy IRQ values to priv structure which is now avaialble */
+        priv->dev->irq = irq;
+        priv->wol_irq = wol_irq;
+        priv->lpi_irq = lpi_irq;
        /* Get MAC address if available (DT) */
        if (mac)
                memcpy(priv->dev->dev_addr, mac, ETH_ALEN);
-        /* Get the MAC information */
-        priv->dev->irq = platform_get_irq_byname(pdev, "macirq");
-        if (priv->dev->irq < 0) {
-                if (priv->dev->irq != -EPROBE_DEFER) {
-                        netdev_err(priv->dev,
-                                   "MAC IRQ configuration information not found\n");
-                }
-                return priv->dev->irq;
-        }
-        /*
-         * On some platforms e.g. SPEAr the wake up irq differs from the mac irq
-         * The external wake up irq can be passed through the platform code
-         * named as "eth_wake_irq"
-         *
-         * In case the wake up interrupt is not passed from the platform
-         * so the driver will continue to use the mac irq (ndev->irq)
-         */
-        priv->wol_irq = platform_get_irq_byname(pdev, "eth_wake_irq");
-        if (priv->wol_irq < 0) {
-                if (priv->wol_irq == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                priv->wol_irq = priv->dev->irq;
-        }
-        priv->lpi_irq = platform_get_irq_byname(pdev, "eth_lpi");
-        if (priv->lpi_irq == -EPROBE_DEFER)
-                return -EPROBE_DEFER;
        platform_set_drvdata(pdev, priv->dev);
        pr_debug("STMMAC platform driver registration completed");
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index f1ee71e22241..7d394846afc2 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1730,11 +1730,11 @@ static int team_set_mac_address(struct net_device *dev, void *p)
        if (dev->type == ARPHRD_ETHER && !is_valid_ether_addr(addr->sa_data))
                return -EADDRNOTAVAIL;
        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-        rcu_read_lock();
+        mutex_lock(&team->lock);
-        list_for_each_entry_rcu(port, &team->port_list, list)
+        list_for_each_entry(port, &team->port_list, list)
                if (team->ops.port_change_dev_addr)
                        team->ops.port_change_dev_addr(team, port);
-        rcu_read_unlock();
+        mutex_unlock(&team->lock);
        return 0;
 }
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f38227afe099..3aa8648080c8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -340,12 +340,11 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
        unsigned int num_queues = vif->num_queues;
        int i;
        unsigned int queue_index;
-        struct xenvif_stats *vif_stats;
        for (i = 0; i < ARRAY_SIZE(xenvif_stats); i++) {
                unsigned long accum = 0;
                for (queue_index = 0; queue_index < num_queues; ++queue_index) {
-                        vif_stats = &vif->queues[queue_index].stats;
+                        void *vif_stats = &vif->queues[queue_index].stats;
                        accum += *(unsigned long *)(vif_stats + xenvif_stats[i].offset);
                }
                data[i] = accum;
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index c4d68d768408..cab9f5257f57 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1349,7 +1349,7 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
 {
        unsigned int offset = skb_headlen(skb);
        skb_frag_t frags[MAX_SKB_FRAGS];
-        int i;
+        int i, f;
        struct ubuf_info *uarg;
        struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
@@ -1389,23 +1389,25 @@ static int xenvif_handle_frag_list(struct xenvif_queue *queue, struct sk_buff *s
                frags[i].page_offset = 0;
                skb_frag_size_set(&frags[i], len);
        }
-        /* swap out with old one */
-        memcpy(skb_shinfo(skb)->frags,
-               frags,
-               i * sizeof(skb_frag_t));
-        skb_shinfo(skb)->nr_frags = i;
-        skb->truesize += i * PAGE_SIZE;
-        /* remove traces of mapped pages and frag_list */
+        /* Copied all the bits from the frag list -- free it. */
        skb_frag_list_init(skb);
+        xenvif_skb_zerocopy_prepare(queue, nskb);
+        kfree_skb(nskb);
+        /* Release all the original (foreign) frags. */
+        for (f = 0; f < skb_shinfo(skb)->nr_frags; f++)
+                skb_frag_unref(skb, f);
        uarg = skb_shinfo(skb)->destructor_arg;
        /* increase inflight counter to offset decrement in callback */
        atomic_inc(&queue->inflight_packets);
        uarg->callback(uarg, true);
        skb_shinfo(skb)->destructor_arg = NULL;
-        xenvif_skb_zerocopy_prepare(queue, nskb);
+        /* Fill the skb with the new (local) frags. */
-        kfree_skb(nskb);
+        memcpy(skb_shinfo(skb)->frags, frags, i * sizeof(skb_frag_t));
+        skb_shinfo(skb)->nr_frags = i;
+        skb->truesize += i * PAGE_SIZE;
        return 0;
 }
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 38d1c51f58b1..7bcaeec876c0 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -84,8 +84,7 @@ config OF_RESOLVE
        bool
 config OF_OVERLAY
-        bool
+        bool "Device Tree overlays"
-        depends on OF
        select OF_DYNAMIC
        select OF_RESOLVE
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 0a8aeb8523fe..adb8764861c0 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -714,16 +714,17 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
                                                const char *path)
 {
        struct device_node *child;
-        int len = strchrnul(path, '/') - path;
+        int len;
-        int term;
+        const char *end;
+        end = strchr(path, ':');
+        if (!end)
+                end = strchrnul(path, '/');
+        len = end - path;
        if (!len)
                return NULL;
-        term = strchrnul(path, ':') - path;
-        if (term < len)
-                len = term;
        __for_each_child_of_node(parent, child) {
                const char *name = strrchr(child->full_name, '/');
                if (WARN(!name, "malformed device_node %s\n", child->full_name))
@@ -768,8 +769,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
        /* The path could begin with an alias */
        if (*path != '/') {
-                char *p = strchrnul(path, '/');
+                int len;
-                int len = separator ? separator - path : p - path;
+                const char *p = separator;
+                if (!p)
+                        p = strchrnul(path, '/');
+                len = p - path;
                /* of_aliases must not be NULL */
                if (!of_aliases)
@@ -794,6 +799,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
                path++; /* Increment past '/' delimiter */
                np = __of_find_node_by_path(np, path);
                path = strchrnul(path, '/');
+                if (separator && separator < path)
+                        break;
        }
        raw_spin_unlock_irqrestore(&devtree_lock, flags);
        return np;
@@ -1886,8 +1893,10 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
                        name = of_get_property(of_chosen, "linux,stdout-path", NULL);
                if (IS_ENABLED(CONFIG_PPC) && !name)
                        name = of_get_property(of_aliases, "stdout", NULL);
-                if (name)
+                if (name) {
                        of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
+                        add_preferred_console("stdout-path", 0, NULL);
+                }
        }
        if (!of_aliases)
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 352b4f28f82c..dee9270ba547 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -19,6 +19,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/idr.h>
 #include "of_private.h"
@@ -85,7 +86,7 @@ static int of_overlay_apply_single_device_node(struct of_overlay *ov,
                struct device_node *target, struct device_node *child)
 {
        const char *cname;
-        struct device_node *tchild, *grandchild;
+        struct device_node *tchild;
        int ret = 0;
        cname = kbasename(child->full_name);
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 0cf9a236d438..aba8946cac46 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -92,6 +92,11 @@ static void __init of_selftest_find_node_by_name(void)
                 "option path test failed\n");
        of_node_put(np);
+        np = of_find_node_opts_by_path("/testcase-data:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #1 failed\n");
+        of_node_put(np);
        np = of_find_node_opts_by_path("/testcase-data:testoption", NULL);
        selftest(np, "NULL option path test failed\n");
        of_node_put(np);
@@ -102,6 +107,12 @@ static void __init of_selftest_find_node_by_name(void)
                 "option alias path test failed\n");
        of_node_put(np);
+        np = of_find_node_opts_by_path("testcase-alias:test/alias/option",
+                                       &options);
+        selftest(np && !strcmp("test/alias/option", options),
+                 "option alias path test, subcase #1 failed\n");
+        of_node_put(np);
        np = of_find_node_opts_by_path("testcase-alias:testaliasoption", NULL);
        selftest(np, "NULL option alias path test failed\n");
        of_node_put(np);
@@ -378,9 +389,9 @@ static void __init of_selftest_property_string(void)
        rc = of_property_match_string(np, "phandle-list-names", "first");
        selftest(rc == 0, "first expected:0 got:%i\n", rc);
        rc = of_property_match_string(np, "phandle-list-names", "second");
-        selftest(rc == 1, "second expected:0 got:%i\n", rc);
+        selftest(rc == 1, "second expected:1 got:%i\n", rc);
        rc = of_property_match_string(np, "phandle-list-names", "third");
-        selftest(rc == 2, "third expected:0 got:%i\n", rc);
+        selftest(rc == 2, "third expected:2 got:%i\n", rc);
        rc = of_property_match_string(np, "phandle-list-names", "fourth");
        selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
        rc = of_property_match_string(np, "missing-property", "blah");
@@ -478,7 +489,6 @@ static void __init of_selftest_changeset(void)
        struct device_node *n1, *n2, *n21, *nremove, *parent, *np;
        struct of_changeset chgset;
-        of_changeset_init(&chgset);
        n1 = __of_node_dup(NULL, "/testcase-data/changeset/n1");
        selftest(n1, "testcase setup failure\n");
        n2 = __of_node_dup(NULL, "/testcase-data/changeset/n2");
@@ -979,7 +989,7 @@ static int of_path_platform_device_exists(const char *path)
        return pdev != NULL;
 }
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
 /* get the i2c client device instantiated at the path */
 static struct i2c_client *of_path_to_i2c_client(const char *path)
@@ -1445,7 +1455,7 @@ static void of_selftest_overlay_11(void)
                return;
 }
-#if IS_ENABLED(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
+#if IS_BUILTIN(CONFIG_I2C) && IS_ENABLED(CONFIG_OF_OVERLAY)
 struct selftest_i2c_bus_data {
        struct platform_device  *pdev;
@@ -1584,7 +1594,7 @@ static struct i2c_driver selftest_i2c_dev_driver = {
        .id_table = selftest_i2c_dev_id,
 };
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
 struct selftest_i2c_mux_data {
        int nchans;
@@ -1695,7 +1705,7 @@ static int of_selftest_overlay_i2c_init(void)
                        "could not register selftest i2c bus driver\n"))
                return ret;
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
        ret = i2c_add_driver(&selftest_i2c_mux_driver);
        if (selftest(ret == 0,
                        "could not register selftest i2c mux driver\n"))
@@ -1707,7 +1717,7 @@ static int of_selftest_overlay_i2c_init(void)
 static void of_selftest_overlay_i2c_cleanup(void)
 {
-#if IS_ENABLED(CONFIG_I2C_MUX)
+#if IS_BUILTIN(CONFIG_I2C_MUX)
        i2c_del_driver(&selftest_i2c_mux_driver);
 #endif
        platform_driver_unregister(&selftest_i2c_bus_driver);
@@ -1814,7 +1824,7 @@ static void __init of_selftest_overlay(void)
        of_selftest_overlay_10();
        of_selftest_overlay_11();
-#if IS_ENABLED(CONFIG_I2C)
+#if IS_BUILTIN(CONFIG_I2C)
        if (selftest(of_selftest_overlay_i2c_init() == 0, "i2c init failed\n"))
                goto out;
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index aab55474dd0d..ee082c0366ec 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -127,7 +127,7 @@ static bool xgene_pcie_hide_rc_bars(struct pci_bus *bus, int offset)
        return false;
 }
-static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
+static void __iomem *xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                              int offset)
 {
        struct xgene_pcie_port *port = bus->sysdata;
@@ -137,7 +137,7 @@ static int xgene_pcie_map_bus(struct pci_bus *bus, unsigned int devfn,
                return NULL;
        xgene_pcie_set_rtdid_reg(bus, devfn);
-        return xgene_pcie_get_cfg_base(bus);
+        return xgene_pcie_get_cfg_base(bus) + offset;
 }
 static struct pci_ops xgene_pcie_ops = {
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index aa012fb3834b..312f23a8429c 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
        struct pci_dev *pdev = to_pci_dev(dev);
        char *driver_override, *old = pdev->driver_override, *cp;
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                return -EINVAL;
        driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        return sprintf(buf, "%s\n", pdev->driver_override);
+        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
 }
 static DEVICE_ATTR_RW(driver_override);
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index b899947d839d..1245dca79009 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3444,13 +3444,6 @@ static umode_t regulator_attr_is_visible(struct kobject *kobj,
        if (attr == &dev_attr_requested_microamps.attr)
                return rdev->desc->type == REGULATOR_CURRENT ? mode : 0;
-        /* all the other attributes exist to support constraints;
-         * don't show them if there are no constraints, or if the
-         * relevant supporting methods are missing.
-         */
-        if (!rdev->constraints)
-                return 0;
        /* constraints need specific supporting methods */
        if (attr == &dev_attr_min_microvolts.attr ||
            attr == &dev_attr_max_microvolts.attr)
diff --git a/drivers/regulator/da9210-regulator.c b/drivers/regulator/da9210-regulator.c
index bc6100103f7f..f0489cb9018b 100644
--- a/drivers/regulator/da9210-regulator.c
+++ b/drivers/regulator/da9210-regulator.c
@@ -152,6 +152,15 @@ static int da9210_i2c_probe(struct i2c_client *i2c,
        config.regmap = chip->regmap;
        config.of_node = dev->of_node;
+        /* Mask all interrupt sources to deassert interrupt line */
+        error = regmap_write(chip->regmap, DA9210_REG_MASK_A, ~0);
+        if (!error)
+                error = regmap_write(chip->regmap, DA9210_REG_MASK_B, ~0);
+        if (error) {
+                dev_err(&i2c->dev, "Failed to write to mask reg: %d\n", error);
+                return error;
+        }
        rdev = devm_regulator_register(&i2c->dev, &da9210_reg, &config);
        if (IS_ERR(rdev)) {
                dev_err(&i2c->dev, "Failed to register DA9210 regulator\n");
diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
index 1f93b752a81c..3fd44353cc80 100644
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -235,6 +235,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(0),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG2",
@@ -249,6 +250,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(1),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG3",
@@ -263,6 +265,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_BUCK4_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(2),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG4",
@@ -277,6 +280,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(3),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG5",
@@ -291,6 +295,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(4),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG6",
@@ -305,6 +310,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(5),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG7",
@@ -319,6 +325,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(6),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "LDO_REG8",
@@ -333,6 +340,7 @@ static const struct regulator_desc rk808_reg[] = {
                .vsel_mask = RK808_LDO_VSEL_MASK,
                .enable_reg = RK808_LDO_EN_REG,
                .enable_mask = BIT(7),
+                .enable_time = 400,
                .owner = THIS_MODULE,
        }, {
                .name = "SWITCH_REG1",
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 4241eeab3386..f4cf6851fae9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
 static struct s3c_rtc_data const s3c6410_rtc_data = {
        .max_user_freq          = 32768,
+        .needs_src_clk          = true,
        .irq_handler            = s3c6410_rtc_irq,
        .set_freq               = s3c6410_rtc_setfreq,
        .enable_tick            = s3c6410_rtc_enable_tick,
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index 96128cb009f3..da212813f2d5 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -547,7 +547,7 @@ dcssblk_add_store(struct device *dev, struct device_attribute *attr, const char
         * parse input
         */
        num_of_segments = 0;
-        for (i = 0; ((buf[i] != '\0') && (buf[i] != '\n') && i < count); i++) {
+        for (i = 0; (i < count && (buf[i] != '\0') && (buf[i] != '\n')); i++) {
                for (j = i; (buf[j] != ':') &&
                        (buf[j] != '\0') &&
                        (buf[j] != '\n') &&
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
index 09db45296eed..7497ddde2dd6 100644
--- a/drivers/s390/block/scm_blk_cluster.c
+++ b/drivers/s390/block/scm_blk_cluster.c
@@ -92,7 +92,7 @@ bool scm_reserve_cluster(struct scm_request *scmrq)
                        add = 0;
                        continue;
                }
-                for (pos = 0; pos <= iter->aob->request.msb_count; pos++) {
+                for (pos = 0; pos < iter->aob->request.msb_count; pos++) {
                        if (clusters_intersect(req, iter->request[pos]) &&
                            (rq_data_dir(req) == WRITE ||
                             rq_data_dir(iter->request[pos]) == WRITE)) {
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 62b58d38ce2e..60de66252fa2 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
        struct sas_discovery_event *ev = to_sas_discovery_event(work);
        struct asd_sas_port *port = ev->port;
        struct sas_ha_struct *ha = port->ha;
+        struct domain_device *ddev = port->port_dev;
        /* prevent revalidation from finding sata links in recovery */
        mutex_lock(&ha->disco_mutex);
@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
        SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
                    task_pid_nr(current));
-        if (port->port_dev)
+        if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
-                res = sas_ex_revalidate_domain(port->port_dev);
+                     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
+                res = sas_ex_revalidate_domain(ddev);
        SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
                    port->id, task_pid_nr(current), res);
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 9af7841f2e8c..06de34001c66 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -764,17 +764,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
                        (unsigned long long)xfer->rx_dma);
        }
-        /* REVISIT: We're waiting for ENDRX before we start the next
+        /* REVISIT: We're waiting for RXBUFF before we start the next
         * transfer because we need to handle some difficult timing
-         * issues otherwise. If we wait for ENDTX in one transfer and
+         * issues otherwise. If we wait for TXBUFE in one transfer and
-         * then starts waiting for ENDRX in the next, it's difficult
+         * then starts waiting for RXBUFF in the next, it's difficult
-         * to tell the difference between the ENDRX interrupt we're
+         * to tell the difference between the RXBUFF interrupt we're
-         * actually waiting for and the ENDRX interrupt of the
+         * actually waiting for and the RXBUFF interrupt of the
         * previous transfer.
         *
         * It should be doable, though. Just not now...
         */
-        spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
+        spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
        spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
 }
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index a0197fd4e95c..3ce39d10fafb 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -139,6 +139,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws)
                                1,
                                DMA_MEM_TO_DEV,
                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        if (!txdesc)
+                return NULL;
        txdesc->callback = dw_spi_dma_tx_done;
        txdesc->callback_param = dws;
@@ -184,6 +187,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws)
                                1,
                                DMA_DEV_TO_MEM,
                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+        if (!rxdesc)
+                return NULL;
        rxdesc->callback = dw_spi_dma_rx_done;
        rxdesc->callback_param = dws;
diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c
index 5ba331047cbe..6d331e0db331 100644
--- a/drivers/spi/spi-dw-pci.c
+++ b/drivers/spi/spi-dw-pci.c
@@ -36,13 +36,13 @@ struct spi_pci_desc {
 static struct spi_pci_desc spi_pci_mid_desc_1 = {
        .setup = dw_spi_mid_init,
-        .num_cs = 32,
+        .num_cs = 5,
        .bus_num = 0,
 };
 static struct spi_pci_desc spi_pci_mid_desc_2 = {
        .setup = dw_spi_mid_init,
-        .num_cs = 4,
+        .num_cs = 2,
        .bus_num = 1,
 };
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 5a97a62b298a..4847afba89f4 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -621,14 +621,14 @@ static void spi_hw_init(struct device *dev, struct dw_spi *dws)
        if (!dws->fifo_len) {
                u32 fifo;
-                for (fifo = 2; fifo <= 256; fifo++) {
+                for (fifo = 1; fifo < 256; fifo++) {
                        dw_writew(dws, DW_SPI_TXFLTR, fifo);
                        if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
                                break;
                }
                dw_writew(dws, DW_SPI_TXFLTR, 0);
-                dws->fifo_len = (fifo == 2) ? 0 : fifo - 1;
+                dws->fifo_len = (fifo == 1) ? 0 : fifo;
                dev_dbg(dev, "Detected FIFO size: %u bytes\n", dws->fifo_len);
        }
 }
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index c01567d53581..e649bc7d4c08 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -459,6 +459,13 @@ static int img_spfi_transfer_one(struct spi_master *master,
        unsigned long flags;
        int ret;
+        if (xfer->len > SPFI_TRANSACTION_TSIZE_MASK) {
+                dev_err(spfi->dev,
+                        "Transfer length (%d) is greater than the max supported (%d)",
+                        xfer->len, SPFI_TRANSACTION_TSIZE_MASK);
+                return -EINVAL;
+        }
        /*
         * Stop all DMA and reset the controller if the previous transaction
         * timed-out and never completed it's DMA.
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 89ca162801da..ee513a85296b 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -534,12 +534,12 @@ static void giveback(struct pl022 *pl022)
        pl022->cur_msg = NULL;
        pl022->cur_transfer = NULL;
        pl022->cur_chip = NULL;
-        spi_finalize_current_message(pl022->master);
        /* disable the SPI/SSP operation */
        writew((readw(SSP_CR1(pl022->virtbase)) &
                (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
+        spi_finalize_current_message(pl022->master);
 }
 /**
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 884a716e50cb..5c0616870358 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -101,6 +101,7 @@ struct ti_qspi {
 #define QSPI_FLEN(n)                    ((n - 1) << 0)
 /* STATUS REGISTER */
+#define BUSY                            0x01
 #define WC                              0x02
 /* INTERRUPT REGISTER */
@@ -199,6 +200,21 @@ static void ti_qspi_restore_ctx(struct ti_qspi *qspi)
        ti_qspi_write(qspi, ctx_reg->clkctrl, QSPI_SPI_CLOCK_CNTRL_REG);
 }
+static inline u32 qspi_is_busy(struct ti_qspi *qspi)
+{
+        u32 stat;
+        unsigned long timeout = jiffies + QSPI_COMPLETION_TIMEOUT;
+        stat = ti_qspi_read(qspi, QSPI_SPI_STATUS_REG);
+        while ((stat & BUSY) && time_after(timeout, jiffies)) {
+                cpu_relax();
+                stat = ti_qspi_read(qspi, QSPI_SPI_STATUS_REG);
+        }
+        WARN(stat & BUSY, "qspi busy\n");
+        return stat & BUSY;
+}
 static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
 {
        int wlen, count;
@@ -211,6 +227,9 @@ static int qspi_write_msg(struct ti_qspi *qspi, struct spi_transfer *t)
        wlen = t->bits_per_word >> 3;   /* in bytes */
        while (count) {
+                if (qspi_is_busy(qspi))
+                        return -EBUSY;
                switch (wlen) {
                case 1:
                        dev_dbg(qspi->dev, "tx cmd %08x dc %08x data %02x\n",
@@ -266,6 +285,9 @@ static int qspi_read_msg(struct ti_qspi *qspi, struct spi_transfer *t)
        while (count) {
                dev_dbg(qspi->dev, "rx cmd %08x dc %08x\n", cmd, qspi->dc);
+                if (qspi_is_busy(qspi))
+                        return -EBUSY;
                ti_qspi_write(qspi, cmd, QSPI_SPI_CMD_REG);
                if (!wait_for_completion_timeout(&qspi->transfer_complete,
                                                 QSPI_COMPLETION_TIMEOUT)) {
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index af98b096af2f..175c9956cbe3 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -144,10 +144,9 @@ struct ffs_io_data {
        bool read;
        struct kiocb *kiocb;
-        const struct iovec *iovec;
+        struct iov_iter data;
-        unsigned long nr_segs;
+        const void *to_free;
-        char __user *buf;
+        char *buf;
-        size_t len;
        struct mm_struct *mm;
        struct work_struct work;
@@ -649,29 +648,10 @@ static void ffs_user_copy_worker(struct work_struct *work)
                                         io_data->req->actual;
        if (io_data->read && ret > 0) {
-                int i;
-                size_t pos = 0;
-                /*
-                 * Since req->length may be bigger than io_data->len (after
-                 * being rounded up to maxpacketsize), we may end up with more
-                 * data then user space has space for.
-                 */
-                ret = min_t(int, ret, io_data->len);
                use_mm(io_data->mm);
-                for (i = 0; i < io_data->nr_segs; i++) {
+                ret = copy_to_iter(io_data->buf, ret, &io_data->data);
-                        size_t len = min_t(size_t, ret - pos,
+                if (iov_iter_count(&io_data->data))
-                                        io_data->iovec[i].iov_len);
+                        ret = -EFAULT;
-                        if (!len)
-                                break;
-                        if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos], len))) {
-                                ret = -EFAULT;
-                                break;
-                        }
-                        pos += len;
-                }
                unuse_mm(io_data->mm);
        }
@@ -684,7 +664,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
        io_data->kiocb->private = NULL;
        if (io_data->read)
-                kfree(io_data->iovec);
+                kfree(io_data->to_free);
        kfree(io_data->buf);
        kfree(io_data);
 }
@@ -743,6 +723,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 * before the waiting completes, so do not assign to 'gadget' earlier
                 */
                struct usb_gadget *gadget = epfile->ffs->gadget;
+                size_t copied;
                spin_lock_irq(&epfile->ffs->eps_lock);
                /* In the meantime, endpoint got disabled or changed. */
@@ -750,34 +731,21 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                        spin_unlock_irq(&epfile->ffs->eps_lock);
                        return -ESHUTDOWN;
                }
+                data_len = iov_iter_count(&io_data->data);
                /*
                 * Controller may require buffer size to be aligned to
                 * maxpacketsize of an out endpoint.
                 */
-                data_len = io_data->read ?
+                if (io_data->read)
-                           usb_ep_align_maybe(gadget, ep->ep, io_data->len) :
+                        data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
-                           io_data->len;
                spin_unlock_irq(&epfile->ffs->eps_lock);
                data = kmalloc(data_len, GFP_KERNEL);
                if (unlikely(!data))
                        return -ENOMEM;
-                if (io_data->aio && !io_data->read) {
+                if (!io_data->read) {
-                        int i;
+                        copied = copy_from_iter(data, data_len, &io_data->data);
-                        size_t pos = 0;
+                        if (copied != data_len) {
-                        for (i = 0; i < io_data->nr_segs; i++) {
-                                if (unlikely(copy_from_user(&data[pos],
-                                             io_data->iovec[i].iov_base,
-                                             io_data->iovec[i].iov_len))) {
-                                        ret = -EFAULT;
-                                        goto error;
-                                }
-                                pos += io_data->iovec[i].iov_len;
-                        }
-                } else {
-                        if (!io_data->read &&
-                            unlikely(__copy_from_user(data, io_data->buf,
-                                                      io_data->len))) {
                                ret = -EFAULT;
                                goto error;
                        }
@@ -876,10 +844,8 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                                 */
                                ret = ep->status;
                                if (io_data->read && ret > 0) {
-                                        ret = min_t(size_t, ret, io_data->len);
+                                        ret = copy_to_iter(data, ret, &io_data->data);
+                                        if (unlikely(iov_iter_count(&io_data->data)))
-                                        if (unlikely(copy_to_user(io_data->buf,
-                                                data, ret)))
                                                ret = -EFAULT;
                                }
                        }
@@ -898,37 +864,6 @@ error:
        return ret;
 }
-static ssize_t
-ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
-                 loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-        ENTER();
-        io_data.aio = false;
-        io_data.read = false;
-        io_data.buf = (char * __user)buf;
-        io_data.len = len;
-        return ffs_epfile_io(file, &io_data);
-}
-static ssize_t
-ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ffs_io_data io_data;
-        ENTER();
-        io_data.aio = false;
-        io_data.read = true;
-        io_data.buf = buf;
-        io_data.len = len;
-        return ffs_epfile_io(file, &io_data);
-}
 static int
 ffs_epfile_open(struct inode *inode, struct file *file)
 {
@@ -965,67 +900,86 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
        return value;
 }
-static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb,
+static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
-                                    const struct iovec *iovec,
-                                    unsigned long nr_segs, loff_t loff)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
+        ssize_t res;
        ENTER();
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
+        if (!is_sync_kiocb(kiocb)) {
-        if (unlikely(!io_data))
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
-                return -ENOMEM;
+                if (unlikely(!p))
+                        return -ENOMEM;
+                p->aio = true;
+        } else {
+                p->aio = false;
+        }
-        io_data->aio = true;
+        p->read = false;
-        io_data->read = false;
+        p->kiocb = kiocb;
-        io_data->kiocb = kiocb;
+        p->data = *from;
-        io_data->iovec = iovec;
+        p->mm = current->mm;
-        io_data->nr_segs = nr_segs;
-        io_data->len = kiocb->ki_nbytes;
-        io_data->mm = current->mm;
-        kiocb->private = io_data;
+        kiocb->private = p;
        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio)
+                kfree(p);
+        else
+                *from = p->data;
+        return res;
 }
-static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,
+static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
-                                   const struct iovec *iovec,
-                                   unsigned long nr_segs, loff_t loff)
 {
-        struct ffs_io_data *io_data;
+        struct ffs_io_data io_data, *p = &io_data;
-        struct iovec *iovec_copy;
+        ssize_t res;
        ENTER();
-        iovec_copy = kmalloc_array(nr_segs, sizeof(*iovec_copy), GFP_KERNEL);
+        if (!is_sync_kiocb(kiocb)) {
-        if (unlikely(!iovec_copy))
+                p = kmalloc(sizeof(io_data), GFP_KERNEL);
-                return -ENOMEM;
+                if (unlikely(!p))
+                        return -ENOMEM;
-        memcpy(iovec_copy, iovec, sizeof(struct iovec)*nr_segs);
+                p->aio = true;
+        } else {
-        io_data = kmalloc(sizeof(*io_data), GFP_KERNEL);
+                p->aio = false;
-        if (unlikely(!io_data)) {
-                kfree(iovec_copy);
-                return -ENOMEM;
        }
-        io_data->aio = true;
+        p->read = true;
-        io_data->read = true;
+        p->kiocb = kiocb;
-        io_data->kiocb = kiocb;
+        if (p->aio) {
-        io_data->iovec = iovec_copy;
+                p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
-        io_data->nr_segs = nr_segs;
+                if (!p->to_free) {
-        io_data->len = kiocb->ki_nbytes;
+                        kfree(p);
-        io_data->mm = current->mm;
+                        return -ENOMEM;
+                }
+        } else {
+                p->data = *to;
+                p->to_free = NULL;
+        }
+        p->mm = current->mm;
-        kiocb->private = io_data;
+        kiocb->private = p;
        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-        return ffs_epfile_io(kiocb->ki_filp, io_data);
+        res = ffs_epfile_io(kiocb->ki_filp, p);
+        if (res == -EIOCBQUEUED)
+                return res;
+        if (p->aio) {
+                kfree(p->to_free);
+                kfree(p);
+        } else {
+                *to = p->data;
+        }
+        return res;
 }
 static int
@@ -1105,10 +1059,10 @@ static const struct file_operations ffs_epfile_operations = {
        .llseek =       no_llseek,
        .open =         ffs_epfile_open,
-        .write =        ffs_epfile_write,
+        .write =        new_sync_write,
-        .read =         ffs_epfile_read,
+        .read =         new_sync_read,
-        .aio_write =    ffs_epfile_aio_write,
+        .write_iter =   ffs_epfile_write_iter,
-        .aio_read =     ffs_epfile_aio_read,
+        .read_iter =    ffs_epfile_read_iter,
        .release =      ffs_epfile_release,
        .unlocked_ioctl =       ffs_epfile_ioctl,
 };
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index db49ec4c748e..200f9a584064 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -74,6 +74,8 @@ MODULE_DESCRIPTION (DRIVER_DESC);
 MODULE_AUTHOR ("David Brownell");
 MODULE_LICENSE ("GPL");
+static int ep_open(struct inode *, struct file *);
 /*----------------------------------------------------------------------*/
@@ -283,14 +285,15 @@ static void epio_complete (struct usb_ep *ep, struct usb_request *req)
 * still need dev->lock to use epdata->ep.
 */
 static int
-get_ready_ep (unsigned f_flags, struct ep_data *epdata)
+get_ready_ep (unsigned f_flags, struct ep_data *epdata, bool is_write)
 {
        int     val;
        if (f_flags & O_NONBLOCK) {
                if (!mutex_trylock(&epdata->lock))
                        goto nonblock;
-                if (epdata->state != STATE_EP_ENABLED) {
+                if (epdata->state != STATE_EP_ENABLED &&
+                    (!is_write || epdata->state != STATE_EP_READY)) {
                        mutex_unlock(&epdata->lock);
 nonblock:
                        val = -EAGAIN;
@@ -305,18 +308,20 @@ nonblock:
        switch (epdata->state) {
        case STATE_EP_ENABLED:
+                return 0;
+        case STATE_EP_READY:                    /* not configured yet */
+                if (is_write)
+                        return 0;
+                // FALLTHRU
+        case STATE_EP_UNBOUND:                  /* clean disconnect */
                break;
        // case STATE_EP_DISABLED:              /* "can't happen" */
-        // case STATE_EP_READY:                 /* "can't happen" */
        default:                                /* error! */
                pr_debug ("%s: ep %p not available, state %d\n",
                                shortname, epdata, epdata->state);
-                // FALLTHROUGH
-        case STATE_EP_UNBOUND:                  /* clean disconnect */
-                val = -ENODEV;
-                mutex_unlock(&epdata->lock);
        }
-        return val;
+        mutex_unlock(&epdata->lock);
+        return -ENODEV;
 }
 static ssize_t
@@ -363,97 +368,6 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
        return value;
 }
-/* handle a synchronous OUT bulk/intr/iso transfer */
-static ssize_t
-ep_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-        /* FIXME readahead for O_NONBLOCK and poll(); careful with ZLPs */
-        value = -ENOMEM;
-        kbuf = kmalloc (len, GFP_KERNEL);
-        if (unlikely (!kbuf))
-                goto free1;
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s read %zu OUT, status %d\n",
-                data->name, len, (int) value);
-        if (value >= 0 && copy_to_user (buf, kbuf, value))
-                value = -EFAULT;
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
-/* handle a synchronous IN bulk/intr/iso transfer */
-static ssize_t
-ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
-{
-        struct ep_data          *data = fd->private_data;
-        void                    *kbuf;
-        ssize_t                 value;
-        if ((value = get_ready_ep (fd->f_flags, data)) < 0)
-                return value;
-        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (!usb_endpoint_dir_in(&data->desc)) {
-                if (usb_endpoint_xfer_isoc(&data->desc)) {
-                        mutex_unlock(&data->lock);
-                        return -EINVAL;
-                }
-                DBG (data->dev, "%s halt\n", data->name);
-                spin_lock_irq (&data->dev->lock);
-                if (likely (data->ep != NULL))
-                        usb_ep_set_halt (data->ep);
-                spin_unlock_irq (&data->dev->lock);
-                mutex_unlock(&data->lock);
-                return -EBADMSG;
-        }
-        /* FIXME writebehind for O_NONBLOCK and poll(), qlen = 1 */
-        value = -ENOMEM;
-        kbuf = memdup_user(buf, len);
-        if (IS_ERR(kbuf)) {
-                value = PTR_ERR(kbuf);
-                kbuf = NULL;
-                goto free1;
-        }
-        value = ep_io (data, kbuf, len);
-        VDEBUG (data->dev, "%s write %zu IN, status %d\n",
-                data->name, len, (int) value);
-free1:
-        mutex_unlock(&data->lock);
-        kfree (kbuf);
-        return value;
-}
 static int
 ep_release (struct inode *inode, struct file *fd)
 {
@@ -481,7 +395,7 @@ static long ep_ioctl(struct file *fd, unsigned code, unsigned long value)
        struct ep_data          *data = fd->private_data;
        int                     status;
-        if ((status = get_ready_ep (fd->f_flags, data)) < 0)
+        if ((status = get_ready_ep (fd->f_flags, data, false)) < 0)
                return status;
        spin_lock_irq (&data->dev->lock);
@@ -517,8 +431,8 @@ struct kiocb_priv {
        struct mm_struct        *mm;
        struct work_struct      work;
        void                    *buf;
-        const struct iovec      *iv;
+        struct iov_iter         to;
-        unsigned long           nr_segs;
+        const void              *to_free;
        unsigned                actual;
 };
@@ -541,35 +455,6 @@ static int ep_aio_cancel(struct kiocb *iocb)
        return value;
 }
-static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
-{
-        ssize_t                 len, total;
-        void                    *to_copy;
-        int                     i;
-        /* copy stuff into user buffers */
-        total = priv->actual;
-        len = 0;
-        to_copy = priv->buf;
-        for (i=0; i < priv->nr_segs; i++) {
-                ssize_t this = min((ssize_t)(priv->iv[i].iov_len), total);
-                if (copy_to_user(priv->iv[i].iov_base, to_copy, this)) {
-                        if (len == 0)
-                                len = -EFAULT;
-                        break;
-                }
-                total -= this;
-                len += this;
-                to_copy += this;
-                if (total == 0)
-                        break;
-        }
-        return len;
-}
 static void ep_user_copy_worker(struct work_struct *work)
 {
        struct kiocb_priv *priv = container_of(work, struct kiocb_priv, work);
@@ -578,13 +463,16 @@ static void ep_user_copy_worker(struct work_struct *work)
        size_t ret;
        use_mm(mm);
-        ret = ep_copy_to_user(priv);
+        ret = copy_to_iter(priv->buf, priv->actual, &priv->to);
        unuse_mm(mm);
+        if (!ret)
+                ret = -EFAULT;
        /* completing the iocb can drop the ctx and mm, don't touch mm after */
        aio_complete(iocb, ret, ret);
        kfree(priv->buf);
+        kfree(priv->to_free);
        kfree(priv);
 }
@@ -603,8 +491,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
         * don't need to copy anything to userspace, so we can
         * complete the aio request immediately.
         */
-        if (priv->iv == NULL || unlikely(req->actual == 0)) {
+        if (priv->to_free == NULL || unlikely(req->actual == 0)) {
                kfree(req->buf);
+                kfree(priv->to_free);
                kfree(priv);
                iocb->private = NULL;
                /* aio_complete() reports bytes-transferred _and_ faults */
@@ -618,6 +507,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
                priv->buf = req->buf;
                priv->actual = req->actual;
+                INIT_WORK(&priv->work, ep_user_copy_worker);
                schedule_work(&priv->work);
        }
        spin_unlock(&epdata->dev->lock);
@@ -626,38 +516,17 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
        put_ep(epdata);
 }
-static ssize_t
+static ssize_t ep_aio(struct kiocb *iocb,
-ep_aio_rwtail(
+                      struct kiocb_priv *priv,
-        struct kiocb    *iocb,
+                      struct ep_data *epdata,
-        char            *buf,
+                      char *buf,
-        size_t          len,
+                      size_t len)
-        struct ep_data  *epdata,
-        const struct iovec *iv,
-        unsigned long   nr_segs
-)
 {
-        struct kiocb_priv       *priv;
+        struct usb_request *req;
-        struct usb_request      *req;
+        ssize_t value;
-        ssize_t                 value;
-        priv = kmalloc(sizeof *priv, GFP_KERNEL);
-        if (!priv) {
-                value = -ENOMEM;
-fail:
-                kfree(buf);
-                return value;
-        }
        iocb->private = priv;
        priv->iocb = iocb;
-        priv->iv = iv;
-        priv->nr_segs = nr_segs;
-        INIT_WORK(&priv->work, ep_user_copy_worker);
-        value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
-        if (unlikely(value < 0)) {
-                kfree(priv);
-                goto fail;
-        }
        kiocb_set_cancel_fn(iocb, ep_aio_cancel);
        get_ep(epdata);
@@ -669,75 +538,154 @@ fail:
         * allocate or submit those if the host disconnected.
         */
        spin_lock_irq(&epdata->dev->lock);
-        if (likely(epdata->ep)) {
+        value = -ENODEV;
-                req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        if (unlikely(epdata->ep))
-                if (likely(req)) {
+                goto fail;
-                        priv->req = req;
-                        req->buf = buf;
-                        req->length = len;
-                        req->complete = ep_aio_complete;
-                        req->context = iocb;
-                        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
-                        if (unlikely(0 != value))
-                                usb_ep_free_request(epdata->ep, req);
-                } else
-                        value = -EAGAIN;
-        } else
-                value = -ENODEV;
-        spin_unlock_irq(&epdata->dev->lock);
-        mutex_unlock(&epdata->lock);
+        req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
+        value = -ENOMEM;
+        if (unlikely(!req))
+                goto fail;
-        if (unlikely(value)) {
+        priv->req = req;
-                kfree(priv);
+        req->buf = buf;
-                put_ep(epdata);
+        req->length = len;
-        } else
+        req->complete = ep_aio_complete;
-                value = -EIOCBQUEUED;
+        req->context = iocb;
+        value = usb_ep_queue(epdata->ep, req, GFP_ATOMIC);
+        if (unlikely(0 != value)) {
+                usb_ep_free_request(epdata->ep, req);
+                goto fail;
+        }
+        spin_unlock_irq(&epdata->dev->lock);
+        return -EIOCBQUEUED;
+fail:
+        spin_unlock_irq(&epdata->dev->lock);
+        kfree(priv->to_free);
+        kfree(priv);
+        put_ep(epdata);
        return value;
 }
 static ssize_t
-ep_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
-                unsigned long nr_segs, loff_t o)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
+        struct file *file = iocb->ki_filp;
-        char                    *buf;
+        struct ep_data *epdata = file->private_data;
+        size_t len = iov_iter_count(to);
+        ssize_t value;
+        char *buf;
-        if (unlikely(usb_endpoint_dir_in(&epdata->desc)))
+        if ((value = get_ready_ep(file->f_flags, epdata, false)) < 0)
-                return -EINVAL;
+                return value;
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
+        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (unlikely(!buf))
+        if (usb_endpoint_dir_in(&epdata->desc)) {
-                return -ENOMEM;
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
-        return ep_aio_rwtail(iocb, buf, iocb->ki_nbytes, epdata, iov, nr_segs);
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
+                return -ENOMEM;
+        }
+        if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+                if (value >= 0 && copy_to_iter(buf, value, to))
+                        value = -EFAULT;
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (!priv)
+                        goto fail;
+                priv->to_free = dup_iter(&priv->to, to, GFP_KERNEL);
+                if (!priv->to_free) {
+                        kfree(priv);
+                        goto fail;
+                }
+                value = ep_aio(iocb, priv, epdata, buf, len);
+                if (value == -EIOCBQUEUED)
+                        buf = NULL;
+        }
+fail:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
+static ssize_t ep_config(struct ep_data *, const char *, size_t);
 static ssize_t
-ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
-                unsigned long nr_segs, loff_t o)
 {
-        struct ep_data          *epdata = iocb->ki_filp->private_data;
+        struct file *file = iocb->ki_filp;
-        char                    *buf;
+        struct ep_data *epdata = file->private_data;
-        size_t                  len = 0;
+        size_t len = iov_iter_count(from);
-        int                     i = 0;
+        bool configured;
+        ssize_t value;
+        char *buf;
+        if ((value = get_ready_ep(file->f_flags, epdata, true)) < 0)
+                return value;
-        if (unlikely(!usb_endpoint_dir_in(&epdata->desc)))
+        configured = epdata->state == STATE_EP_ENABLED;
-                return -EINVAL;
-        buf = kmalloc(iocb->ki_nbytes, GFP_KERNEL);
+        /* halt any endpoint by doing a "wrong direction" i/o call */
-        if (unlikely(!buf))
+        if (configured && !usb_endpoint_dir_in(&epdata->desc)) {
+                if (usb_endpoint_xfer_isoc(&epdata->desc) ||
+                    !is_sync_kiocb(iocb)) {
+                        mutex_unlock(&epdata->lock);
+                        return -EINVAL;
+                }
+                DBG (epdata->dev, "%s halt\n", epdata->name);
+                spin_lock_irq(&epdata->dev->lock);
+                if (likely(epdata->ep != NULL))
+                        usb_ep_set_halt(epdata->ep);
+                spin_unlock_irq(&epdata->dev->lock);
+                mutex_unlock(&epdata->lock);
+                return -EBADMSG;
+        }
+        buf = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!buf)) {
+                mutex_unlock(&epdata->lock);
                return -ENOMEM;
+        }
-        for (i=0; i < nr_segs; i++) {
+        if (unlikely(copy_from_iter(buf, len, from) != len)) {
-                if (unlikely(copy_from_user(&buf[len], iov[i].iov_base,
+                value = -EFAULT;
-                                iov[i].iov_len) != 0)) {
+                goto out;
-                        kfree(buf);
+        }
-                        return -EFAULT;
+        if (unlikely(!configured)) {
+                value = ep_config(epdata, buf, len);
+        } else if (is_sync_kiocb(iocb)) {
+                value = ep_io(epdata, buf, len);
+        } else {
+                struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
+                value = -ENOMEM;
+                if (priv) {
+                        value = ep_aio(iocb, priv, epdata, buf, len);
+                        if (value == -EIOCBQUEUED)
+                                buf = NULL;
                }
-                len += iov[i].iov_len;
        }
-        return ep_aio_rwtail(iocb, buf, len, epdata, NULL, 0);
+out:
+        kfree(buf);
+        mutex_unlock(&epdata->lock);
+        return value;
 }
 /*----------------------------------------------------------------------*/
@@ -745,15 +693,15 @@ ep_aio_write(struct kiocb *iocb, const struct iovec *iov,
 /* used after endpoint configuration */
 static const struct file_operations ep_io_operations = {
        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-        .read =         ep_read,
+        .open =         ep_open,
-        .write =        ep_write,
-        .unlocked_ioctl = ep_ioctl,
        .release =      ep_release,
+        .llseek =       no_llseek,
-        .aio_read =     ep_aio_read,
+        .read =         new_sync_read,
-        .aio_write =    ep_aio_write,
+        .write =        new_sync_write,
+        .unlocked_ioctl = ep_ioctl,
+        .read_iter =    ep_read_iter,
+        .write_iter =   ep_write_iter,
 };
 /* ENDPOINT INITIALIZATION
@@ -770,17 +718,12 @@ static const struct file_operations ep_io_operations = {
 * speed descriptor, then optional high speed descriptor.
 */
 static ssize_t
-ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ep_config (struct ep_data *data, const char *buf, size_t len)
 {
-        struct ep_data          *data = fd->private_data;
        struct usb_ep           *ep;
        u32                     tag;
        int                     value, length = len;
-        value = mutex_lock_interruptible(&data->lock);
-        if (value < 0)
-                return value;
        if (data->state != STATE_EP_READY) {
                value = -EL2HLT;
                goto fail;
@@ -791,9 +734,7 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                goto fail0;
        /* we might need to change message format someday */
-        if (copy_from_user (&tag, buf, 4)) {
+        memcpy(&tag, buf, 4);
-                goto fail1;
-        }
        if (tag != 1) {
                DBG(data->dev, "config %s, bad tag %d\n", data->name, tag);
                goto fail0;
@@ -806,19 +747,15 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         */
        /* full/low speed descriptor, then high speed */
-        if (copy_from_user (&data->desc, buf, USB_DT_ENDPOINT_SIZE)) {
+        memcpy(&data->desc, buf, USB_DT_ENDPOINT_SIZE);
-                goto fail1;
-        }
        if (data->desc.bLength != USB_DT_ENDPOINT_SIZE
                        || data->desc.bDescriptorType != USB_DT_ENDPOINT)
                goto fail0;
        if (len != USB_DT_ENDPOINT_SIZE) {
                if (len != 2 * USB_DT_ENDPOINT_SIZE)
                        goto fail0;
-                if (copy_from_user (&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
+                memcpy(&data->hs_desc, buf + USB_DT_ENDPOINT_SIZE,
-                                        USB_DT_ENDPOINT_SIZE)) {
+                        USB_DT_ENDPOINT_SIZE);
-                        goto fail1;
-                }
                if (data->hs_desc.bLength != USB_DT_ENDPOINT_SIZE
                                || data->hs_desc.bDescriptorType
                                        != USB_DT_ENDPOINT) {
@@ -840,24 +777,20 @@ ep_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        case USB_SPEED_LOW:
        case USB_SPEED_FULL:
                ep->desc = &data->desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                break;
        case USB_SPEED_HIGH:
                /* fails if caller didn't provide that descriptor... */
                ep->desc = &data->hs_desc;
-                value = usb_ep_enable(ep);
-                if (value == 0)
-                        data->state = STATE_EP_ENABLED;
                break;
        default:
                DBG(data->dev, "unconnected, %s init abandoned\n",
                                data->name);
                value = -EINVAL;
+                goto gone;
        }
+        value = usb_ep_enable(ep);
        if (value == 0) {
-                fd->f_op = &ep_io_operations;
+                data->state = STATE_EP_ENABLED;
                value = length;
        }
 gone:
@@ -867,14 +800,10 @@ fail:
                data->desc.bDescriptorType = 0;
                data->hs_desc.bDescriptorType = 0;
        }
-        mutex_unlock(&data->lock);
        return value;
 fail0:
        value = -EINVAL;
        goto fail;
-fail1:
-        value = -EFAULT;
-        goto fail;
 }
 static int
@@ -902,15 +831,6 @@ ep_open (struct inode *inode, struct file *fd)
        return value;
 }
-/* used before endpoint configuration */
-static const struct file_operations ep_config_operations = {
-        .llseek =       no_llseek,
-        .open =         ep_open,
-        .write =        ep_config,
-        .release =      ep_release,
-};
 /*----------------------------------------------------------------------*/
 /* EP0 IMPLEMENTATION can be partly in userspace.
@@ -989,6 +909,10 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
        enum ep0_state                  state;
        spin_lock_irq (&dev->lock);
+        if (dev->state <= STATE_DEV_OPENED) {
+                retval = -EINVAL;
+                goto done;
+        }
        /* report fd mode change before acting on it */
        if (dev->setup_abort) {
@@ -1187,8 +1111,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        struct dev_data         *dev = fd->private_data;
        ssize_t                 retval = -ESRCH;
-        spin_lock_irq (&dev->lock);
        /* report fd mode change before acting on it */
        if (dev->setup_abort) {
                dev->setup_abort = 0;
@@ -1234,7 +1156,6 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        } else
                DBG (dev, "fail %s, state %d\n", __func__, dev->state);
-        spin_unlock_irq (&dev->lock);
        return retval;
 }
@@ -1281,6 +1202,9 @@ ep0_poll (struct file *fd, poll_table *wait)
       struct dev_data         *dev = fd->private_data;
       int                     mask = 0;
+        if (dev->state <= STATE_DEV_OPENED)
+                return DEFAULT_POLLMASK;
       poll_wait(fd, &dev->wait, wait);
       spin_lock_irq (&dev->lock);
@@ -1316,19 +1240,6 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
        return ret;
 }
-/* used after device configuration */
-static const struct file_operations ep0_io_operations = {
-        .owner =        THIS_MODULE,
-        .llseek =       no_llseek,
-        .read =         ep0_read,
-        .write =        ep0_write,
-        .fasync =       ep0_fasync,
-        .poll =         ep0_poll,
-        .unlocked_ioctl =       dev_ioctl,
-        .release =      dev_release,
-};
 /*----------------------------------------------------------------------*/
 /* The in-kernel gadget driver handles most ep0 issues, in particular
@@ -1650,7 +1561,7 @@ static int activate_ep_files (struct dev_data *dev)
                        goto enomem1;
                data->dentry = gadgetfs_create_file (dev->sb, data->name,
-                                data, &ep_config_operations);
+                                data, &ep_io_operations);
                if (!data->dentry)
                        goto enomem2;
                list_add_tail (&data->epfiles, &dev->epfiles);
@@ -1852,6 +1763,14 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        u32                     tag;
        char                    *kbuf;
+        spin_lock_irq(&dev->lock);
+        if (dev->state > STATE_DEV_OPENED) {
+                value = ep0_write(fd, buf, len, ptr);
+                spin_unlock_irq(&dev->lock);
+                return value;
+        }
+        spin_unlock_irq(&dev->lock);
        if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
                return -EINVAL;
@@ -1925,7 +1844,6 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 * on, they can work ... except in cleanup paths that
                 * kick in after the ep0 descriptor is closed.
                 */
-                fd->f_op = &ep0_io_operations;
                value = len;
        }
        return value;
@@ -1956,12 +1874,14 @@ dev_open (struct inode *inode, struct file *fd)
        return value;
 }
-static const struct file_operations dev_init_operations = {
+static const struct file_operations ep0_operations = {
        .llseek =       no_llseek,
        .open =         dev_open,
+        .read =         ep0_read,
        .write =        dev_config,
        .fasync =       ep0_fasync,
+        .poll =         ep0_poll,
        .unlocked_ioctl = dev_ioctl,
        .release =      dev_release,
 };
@@ -2077,7 +1997,7 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                goto Enomem;
        dev->sb = sb;
-        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &dev_init_operations);
+        dev->dentry = gadgetfs_create_file(sb, CHIP, dev, &ep0_operations);
        if (!dev->dentry) {
                put_dev(dev);
                goto Enomem;
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index f88bfdf5b6a0..2027a27546ef 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -868,12 +868,14 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
                                func = vfio_pci_set_err_trigger;
                        break;
                }
+                break;
        case VFIO_PCI_REQ_IRQ_INDEX:
                switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
                case VFIO_IRQ_SET_ACTION_TRIGGER:
                        func = vfio_pci_set_req_trigger;
                        break;
                }
+                break;
        }
        if (!func)
diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c
index 32c0b6b28097..9362424c2340 100644
--- a/drivers/video/fbdev/amba-clcd.c
+++ b/drivers/video/fbdev/amba-clcd.c
@@ -599,6 +599,9 @@ static int clcdfb_of_get_mode(struct device *dev, struct device_node *endpoint,
        len = clcdfb_snprintf_mode(NULL, 0, mode);
        name = devm_kzalloc(dev, len + 1, GFP_KERNEL);
+        if (!name)
+                return -ENOMEM;
        clcdfb_snprintf_mode(name, len + 1, mode);
        mode->name = name;
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 95338593ebf4..868facdec638 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -624,9 +624,6 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
        int num = 0, i, first = 1;
        int ver, rev;
-        ver = edid[EDID_STRUCT_VERSION];
-        rev = edid[EDID_STRUCT_REVISION];
        mode = kzalloc(50 * sizeof(struct fb_videomode), GFP_KERNEL);
        if (mode == NULL)
                return NULL;
@@ -637,6 +634,9 @@ static struct fb_videomode *fb_create_modedb(unsigned char *edid, int *dbsize,
                return NULL;
        }
+        ver = edid[EDID_STRUCT_VERSION];
+        rev = edid[EDID_STRUCT_REVISION];
        *dbsize = 0;
        DPRINTK("   Detailed Timings\n");
diff --git a/drivers/video/fbdev/omap2/dss/display-sysfs.c b/drivers/video/fbdev/omap2/dss/display-sysfs.c
index 5a2095a98ed8..12186557a9d4 100644
--- a/drivers/video/fbdev/omap2/dss/display-sysfs.c
+++ b/drivers/video/fbdev/omap2/dss/display-sysfs.c
@@ -28,44 +28,22 @@
 #include <video/omapdss.h>
 #include "dss.h"
-static struct omap_dss_device *to_dss_device_sysfs(struct device *dev)
+static ssize_t display_name_show(struct omap_dss_device *dssdev, char *buf)
 {
-        struct omap_dss_device *dssdev = NULL;
-        for_each_dss_dev(dssdev) {
-                if (dssdev->dev == dev) {
-                        omap_dss_put_device(dssdev);
-                        return dssdev;
-                }
-        }
-        return NULL;
-}
-static ssize_t display_name_show(struct device *dev,
-                struct device_attribute *attr, char *buf)
-{
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        return snprintf(buf, PAGE_SIZE, "%s\n",
                        dssdev->name ?
                        dssdev->name : "");
 }
-static ssize_t display_enabled_show(struct device *dev,
+static ssize_t display_enabled_show(struct omap_dss_device *dssdev, char *buf)
-                struct device_attribute *attr, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        return snprintf(buf, PAGE_SIZE, "%d\n",
                        omapdss_device_is_enabled(dssdev));
 }
-static ssize_t display_enabled_store(struct device *dev,
+static ssize_t display_enabled_store(struct omap_dss_device *dssdev,
-                struct device_attribute *attr,
                const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        int r;
        bool enable;
@@ -90,19 +68,16 @@ static ssize_t display_enabled_store(struct device *dev,
        return size;
 }
-static ssize_t display_tear_show(struct device *dev,
+static ssize_t display_tear_show(struct omap_dss_device *dssdev, char *buf)
-                struct device_attribute *attr, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        return snprintf(buf, PAGE_SIZE, "%d\n",
                        dssdev->driver->get_te ?
                        dssdev->driver->get_te(dssdev) : 0);
 }
-static ssize_t display_tear_store(struct device *dev,
+static ssize_t display_tear_store(struct omap_dss_device *dssdev,
-                struct device_attribute *attr, const char *buf, size_t size)
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        int r;
        bool te;
@@ -120,10 +95,8 @@ static ssize_t display_tear_store(struct device *dev,
        return size;
 }
-static ssize_t display_timings_show(struct device *dev,
+static ssize_t display_timings_show(struct omap_dss_device *dssdev, char *buf)
-                struct device_attribute *attr, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        struct omap_video_timings t;
        if (!dssdev->driver->get_timings)
@@ -137,10 +110,9 @@ static ssize_t display_timings_show(struct device *dev,
                        t.y_res, t.vfp, t.vbp, t.vsw);
 }
-static ssize_t display_timings_store(struct device *dev,
+static ssize_t display_timings_store(struct omap_dss_device *dssdev,
-                struct device_attribute *attr, const char *buf, size_t size)
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        struct omap_video_timings t = dssdev->panel.timings;
        int r, found;
@@ -176,10 +148,8 @@ static ssize_t display_timings_store(struct device *dev,
        return size;
 }
-static ssize_t display_rotate_show(struct device *dev,
+static ssize_t display_rotate_show(struct omap_dss_device *dssdev, char *buf)
-                struct device_attribute *attr, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        int rotate;
        if (!dssdev->driver->get_rotate)
                return -ENOENT;
@@ -187,10 +157,9 @@ static ssize_t display_rotate_show(struct device *dev,
        return snprintf(buf, PAGE_SIZE, "%u\n", rotate);
 }
-static ssize_t display_rotate_store(struct device *dev,
+static ssize_t display_rotate_store(struct omap_dss_device *dssdev,
-                struct device_attribute *attr, const char *buf, size_t size)
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        int rot, r;
        if (!dssdev->driver->set_rotate || !dssdev->driver->get_rotate)
@@ -207,10 +176,8 @@ static ssize_t display_rotate_store(struct device *dev,
        return size;
 }
-static ssize_t display_mirror_show(struct device *dev,
+static ssize_t display_mirror_show(struct omap_dss_device *dssdev, char *buf)
-                struct device_attribute *attr, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        int mirror;
        if (!dssdev->driver->get_mirror)
                return -ENOENT;
@@ -218,10 +185,9 @@ static ssize_t display_mirror_show(struct device *dev,
        return snprintf(buf, PAGE_SIZE, "%u\n", mirror);
 }
-static ssize_t display_mirror_store(struct device *dev,
+static ssize_t display_mirror_store(struct omap_dss_device *dssdev,
-                struct device_attribute *attr, const char *buf, size_t size)
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        int r;
        bool mirror;
@@ -239,10 +205,8 @@ static ssize_t display_mirror_store(struct device *dev,
        return size;
 }
-static ssize_t display_wss_show(struct device *dev,
+static ssize_t display_wss_show(struct omap_dss_device *dssdev, char *buf)
-                struct device_attribute *attr, char *buf)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        unsigned int wss;
        if (!dssdev->driver->get_wss)
@@ -253,10 +217,9 @@ static ssize_t display_wss_show(struct device *dev,
        return snprintf(buf, PAGE_SIZE, "0x%05x\n", wss);
 }
-static ssize_t display_wss_store(struct device *dev,
+static ssize_t display_wss_store(struct omap_dss_device *dssdev,
-                struct device_attribute *attr, const char *buf, size_t size)
+        const char *buf, size_t size)
 {
-        struct omap_dss_device *dssdev = to_dss_device_sysfs(dev);
        u32 wss;
        int r;
@@ -277,50 +240,94 @@ static ssize_t display_wss_store(struct device *dev,
        return size;
 }
-static DEVICE_ATTR(display_name, S_IRUGO, display_name_show, NULL);
+struct display_attribute {
-static DEVICE_ATTR(enabled, S_IRUGO|S_IWUSR,
+        struct attribute attr;
+        ssize_t (*show)(struct omap_dss_device *, char *);
+        ssize_t (*store)(struct omap_dss_device *, const char *, size_t);
+};
+#define DISPLAY_ATTR(_name, _mode, _show, _store) \
+        struct display_attribute display_attr_##_name = \
+        __ATTR(_name, _mode, _show, _store)
+static DISPLAY_ATTR(name, S_IRUGO, display_name_show, NULL);
+static DISPLAY_ATTR(display_name, S_IRUGO, display_name_show, NULL);
+static DISPLAY_ATTR(enabled, S_IRUGO|S_IWUSR,
                display_enabled_show, display_enabled_store);
-static DEVICE_ATTR(tear_elim, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(tear_elim, S_IRUGO|S_IWUSR,
                display_tear_show, display_tear_store);
-static DEVICE_ATTR(timings, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(timings, S_IRUGO|S_IWUSR,
                display_timings_show, display_timings_store);
-static DEVICE_ATTR(rotate, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(rotate, S_IRUGO|S_IWUSR,
                display_rotate_show, display_rotate_store);
-static DEVICE_ATTR(mirror, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(mirror, S_IRUGO|S_IWUSR,
                display_mirror_show, display_mirror_store);
-static DEVICE_ATTR(wss, S_IRUGO|S_IWUSR,
+static DISPLAY_ATTR(wss, S_IRUGO|S_IWUSR,
                display_wss_show, display_wss_store);
-static const struct attribute *display_sysfs_attrs[] = {
+static struct attribute *display_sysfs_attrs[] = {
-        &dev_attr_display_name.attr,
+        &display_attr_name.attr,
-        &dev_attr_enabled.attr,
+        &display_attr_display_name.attr,
-        &dev_attr_tear_elim.attr,
+        &display_attr_enabled.attr,
-        &dev_attr_timings.attr,
+        &display_attr_tear_elim.attr,
-        &dev_attr_rotate.attr,
+        &display_attr_timings.attr,
-        &dev_attr_mirror.attr,
+        &display_attr_rotate.attr,
-        &dev_attr_wss.attr,
+        &display_attr_mirror.attr,
+        &display_attr_wss.attr,
        NULL
 };
+static ssize_t display_attr_show(struct kobject *kobj, struct attribute *attr,
+                char *buf)
+{
+        struct omap_dss_device *dssdev;
+        struct display_attribute *display_attr;
+        dssdev = container_of(kobj, struct omap_dss_device, kobj);
+        display_attr = container_of(attr, struct display_attribute, attr);
+        if (!display_attr->show)
+                return -ENOENT;
+        return display_attr->show(dssdev, buf);
+}
+static ssize_t display_attr_store(struct kobject *kobj, struct attribute *attr,
+                const char *buf, size_t size)
+{
+        struct omap_dss_device *dssdev;
+        struct display_attribute *display_attr;
+        dssdev = container_of(kobj, struct omap_dss_device, kobj);
+        display_attr = container_of(attr, struct display_attribute, attr);
+        if (!display_attr->store)
+                return -ENOENT;
+        return display_attr->store(dssdev, buf, size);
+}
+static const struct sysfs_ops display_sysfs_ops = {
+        .show = display_attr_show,
+        .store = display_attr_store,
+};
+static struct kobj_type display_ktype = {
+        .sysfs_ops = &display_sysfs_ops,
+        .default_attrs = display_sysfs_attrs,
+};
 int display_init_sysfs(struct platform_device *pdev)
 {
        struct omap_dss_device *dssdev = NULL;
        int r;
        for_each_dss_dev(dssdev) {
-                struct kobject *kobj = &dssdev->dev->kobj;
+                r = kobject_init_and_add(&dssdev->kobj, &display_ktype,
+                        &pdev->dev.kobj, dssdev->alias);
-                r = sysfs_create_files(kobj, display_sysfs_attrs);
                if (r) {
                        DSSERR("failed to create sysfs files\n");
-                        goto err;
+                        omap_dss_put_device(dssdev);
-                }
-                r = sysfs_create_link(&pdev->dev.kobj, kobj, dssdev->alias);
-                if (r) {
-                        sysfs_remove_files(kobj, display_sysfs_attrs);
-                        DSSERR("failed to create sysfs display link\n");
                        goto err;
                }
        }
@@ -338,8 +345,12 @@ void display_uninit_sysfs(struct platform_device *pdev)
        struct omap_dss_device *dssdev = NULL;
        for_each_dss_dev(dssdev) {
-                sysfs_remove_link(&pdev->dev.kobj, dssdev->alias);
+                if (kobject_name(&dssdev->kobj) == NULL)
-                sysfs_remove_files(&dssdev->dev->kobj,
+                        continue;
-                                display_sysfs_attrs);
+                kobject_del(&dssdev->kobj);
+                kobject_put(&dssdev->kobj);
+                memset(&dssdev->kobj, 0, sizeof(dssdev->kobj));
        }
 }
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b4bca2d4a7e5..70fba973a107 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
        pirq_query_unmask(irq);
        rc = set_evtchn_to_irq(evtchn, irq);
-        if (rc != 0) {
+        if (rc)
-                pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
+                goto err;
-                       irq, rc);
-                xen_evtchn_close(evtchn);
-                return 0;
-        }
        bind_evtchn_to_cpu(evtchn, 0);
        info->evtchn = evtchn;
+        rc = xen_evtchn_port_setup(info);
+        if (rc)
+                goto err;
 out:
        unmask_evtchn(evtchn);
        eoi_pirq(irq_get_irq_data(irq));
        return 0;
+err:
+        pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
+        xen_evtchn_close(evtchn);
+        return 0;
 }
 static unsigned int startup_pirq(struct irq_data *data)
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 46ae0f9f02ad..75fe3d466515 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -16,7 +16,7 @@
 #include "conf_space.h"
 #include "conf_space_quirks.h"
-static bool permissive;
+bool permissive;
 module_param(permissive, bool, 0644);
 /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
index e56c934ad137..2e1d73d1d5d0 100644
--- a/drivers/xen/xen-pciback/conf_space.h
+++ b/drivers/xen/xen-pciback/conf_space.h
@@ -64,6 +64,8 @@ struct config_field_entry {
        void *data;
 };
+extern bool permissive;
 #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
 /* Add fields to a device - the add_fields macro expects to get a pointer to
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index c5ee82587e8c..2d7369391472 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -11,6 +11,10 @@
 #include "pciback.h"
 #include "conf_space.h"
+struct pci_cmd_info {
+        u16 val;
+};
 struct pci_bar_info {
        u32 val;
        u32 len_val;
@@ -20,22 +24,36 @@ struct pci_bar_info {
 #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
 #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+/* Bits guests are allowed to control in permissive mode. */
+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
+                           PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
+                           PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
+static void *command_init(struct pci_dev *dev, int offset)
 {
-        int i;
+        struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
-        int ret;
+        int err;
-        ret = xen_pcibk_read_config_word(dev, offset, value, data);
+        if (!cmd)
-        if (!pci_is_enabled(dev))
+                return ERR_PTR(-ENOMEM);
-                return ret;
+        err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
-        for (i = 0; i < PCI_ROM_RESOURCE; i++) {
+        if (err) {
-                if (dev->resource[i].flags & IORESOURCE_IO)
+                kfree(cmd);
-                        *value |= PCI_COMMAND_IO;
+                return ERR_PTR(err);
-                if (dev->resource[i].flags & IORESOURCE_MEM)
-                        *value |= PCI_COMMAND_MEMORY;
        }
+        return cmd;
+}
+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
+{
+        int ret = pci_read_config_word(dev, offset, value);
+        const struct pci_cmd_info *cmd = data;
+        *value &= PCI_COMMAND_GUEST;
+        *value |= cmd->val & ~PCI_COMMAND_GUEST;
        return ret;
 }
@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
 {
        struct xen_pcibk_dev_data *dev_data;
        int err;
+        u16 val;
+        struct pci_cmd_info *cmd = data;
        dev_data = pci_get_drvdata(dev);
        if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
                }
        }
+        cmd->val = value;
+        if (!permissive && (!dev_data || !dev_data->permissive))
+                return 0;
+        /* Only allow the guest to control certain bits. */
+        err = pci_read_config_word(dev, offset, &val);
+        if (err || val == value)
+                return err;
+        value &= PCI_COMMAND_GUEST;
+        value |= val & ~PCI_COMMAND_GUEST;
        return pci_write_config_word(dev, offset, value);
 }
@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
        {
         .offset    = PCI_COMMAND,
         .size      = 2,
+         .init      = command_init,
+         .release   = bar_release,
         .u.w.read  = command_read,
         .u.w.write = command_write,
        },
diff --git a/fs/locks.c b/fs/locks.c
index f1bad681fc1c..528fedfda15e 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1728,7 +1728,7 @@ static int generic_delete_lease(struct file *filp, void *owner)
                        break;
                }
        }
-        trace_generic_delete_lease(inode, fl);
+        trace_generic_delete_lease(inode, victim);
        if (victim)
                error = fl->fl_lmops->lm_change(victim, F_UNLCK, &dispose);
        spin_unlock(&ctx->flc_lock);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 469086b9f99b..0c3f303baf32 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                                             struct the_nilfs *nilfs)
 {
        struct nilfs_inode_info *ii, *n;
+        int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
        int defer_iput = false;
        spin_lock(&nilfs->ns_inode_lock);
@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
                brelse(ii->i_bh);
                ii->i_bh = NULL;
                list_del_init(&ii->i_dirty);
-                if (!ii->vfs_inode.i_nlink) {
+                if (!ii->vfs_inode.i_nlink || during_mount) {
                        /*
-                         * Defer calling iput() to avoid a deadlock
+                         * Defer calling iput() to avoid deadlocks if
-                         * over I_SYNC flag for inodes with i_nlink == 0
+                         * i_nlink == 0 or mount is not yet finished.
                         */
                        list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
                        defer_iput = true;
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 9a66ff79ff27..d2f97ecca6a5 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -143,7 +143,8 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
            !(marks_mask & FS_ISDIR & ~marks_ignored_mask))
                return false;
-        if (event_mask & marks_mask & ~marks_ignored_mask)
+        if (event_mask & FAN_ALL_OUTGOING_EVENTS & marks_mask &
+                                 ~marks_ignored_mask)
                return true;
        return false;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 8490c64d34fe..460c6c37e683 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -502,7 +502,7 @@ static inline int ocfs2_writes_unwritten_extents(struct ocfs2_super *osb)
 static inline int ocfs2_supports_append_dio(struct ocfs2_super *osb)
 {
-        if (osb->s_feature_ro_compat & OCFS2_FEATURE_RO_COMPAT_APPEND_DIO)
+        if (osb->s_feature_incompat & OCFS2_FEATURE_INCOMPAT_APPEND_DIO)
                return 1;
        return 0;
 }
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 20e37a3ed26f..db64ce2d4667 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -102,11 +102,11 @@
                                         | OCFS2_FEATURE_INCOMPAT_INDEXED_DIRS \
                                         | OCFS2_FEATURE_INCOMPAT_REFCOUNT_TREE \
                                         | OCFS2_FEATURE_INCOMPAT_DISCONTIG_BG  \
-                                         | OCFS2_FEATURE_INCOMPAT_CLUSTERINFO)
+                                         | OCFS2_FEATURE_INCOMPAT_CLUSTERINFO \
+                                         | OCFS2_FEATURE_INCOMPAT_APPEND_DIO)
 #define OCFS2_FEATURE_RO_COMPAT_SUPP    (OCFS2_FEATURE_RO_COMPAT_UNWRITTEN \
                                         | OCFS2_FEATURE_RO_COMPAT_USRQUOTA \
-                                         | OCFS2_FEATURE_RO_COMPAT_GRPQUOTA \
+                                         | OCFS2_FEATURE_RO_COMPAT_GRPQUOTA)
-                                         | OCFS2_FEATURE_RO_COMPAT_APPEND_DIO)
 /*
 * Heartbeat-only devices are missing journals and other files.  The
@@ -179,6 +179,11 @@
 #define OCFS2_FEATURE_INCOMPAT_CLUSTERINFO      0x4000
 /*
+ * Append Direct IO support
+ */
+#define OCFS2_FEATURE_INCOMPAT_APPEND_DIO       0x8000
+/*
 * backup superblock flag is used to indicate that this volume
 * has backup superblocks.
 */
@@ -200,10 +205,6 @@
 #define OCFS2_FEATURE_RO_COMPAT_USRQUOTA        0x0002
 #define OCFS2_FEATURE_RO_COMPAT_GRPQUOTA        0x0004
-/*
- * Append Direct IO support
- */
-#define OCFS2_FEATURE_RO_COMPAT_APPEND_DIO      0x0008
 /* The byte offset of the first backup block will be 1G.
 * The following will be 4G, 16G, 64G, 256G and 1T.
diff --git a/include/dt-bindings/pinctrl/am33xx.h b/include/dt-bindings/pinctrl/am33xx.h
index 2fbc804e1a45..226f77246a70 100644
--- a/include/dt-bindings/pinctrl/am33xx.h
+++ b/include/dt-bindings/pinctrl/am33xx.h
@@ -13,7 +13,8 @@
 #define PULL_DISABLE            (1 << 3)
 #define INPUT_EN                (1 << 5)
-#define SLEWCTRL_FAST           (1 << 6)
+#define SLEWCTRL_SLOW           (1 << 6)
+#define SLEWCTRL_FAST           0
 /* update macro depending on INPUT_EN and PULL_ENA */
 #undef PIN_OUTPUT
diff --git a/include/dt-bindings/pinctrl/am43xx.h b/include/dt-bindings/pinctrl/am43xx.h
index 9c2e4f82381e..5f4d01898c9c 100644
--- a/include/dt-bindings/pinctrl/am43xx.h
+++ b/include/dt-bindings/pinctrl/am43xx.h
@@ -18,7 +18,8 @@
 #define PULL_DISABLE            (1 << 16)
 #define PULL_UP                 (1 << 17)
 #define INPUT_EN                (1 << 18)
-#define SLEWCTRL_FAST           (1 << 19)
+#define SLEWCTRL_SLOW           (1 << 19)
+#define SLEWCTRL_FAST           0
 #define DS0_PULL_UP_DOWN_EN     (1 << 27)
 #define PIN_OUTPUT              (PULL_DISABLE)
diff --git a/include/linux/clk.h b/include/linux/clk.h
index 8381bbfbc308..68c16a6bedb3 100644
--- a/include/linux/clk.h
+++ b/include/linux/clk.h
@@ -125,6 +125,19 @@ int clk_set_phase(struct clk *clk, int degrees);
 */
 int clk_get_phase(struct clk *clk);
+/**
+ * clk_is_match - check if two clk's point to the same hardware clock
+ * @p: clk compared against q
+ * @q: clk compared against p
+ *
+ * Returns true if the two struct clk pointers both point to the same hardware
+ * clock node. Put differently, returns true if struct clk *p and struct clk *q
+ * share the same struct clk_core object.
+ *
+ * Returns false otherwise. Note that two NULL clks are treated as matching.
+ */
+bool clk_is_match(const struct clk *p, const struct clk *q);
 #else
 static inline long clk_get_accuracy(struct clk *clk)
@@ -142,6 +155,11 @@ static inline long clk_get_phase(struct clk *clk)
        return -ENOTSUPP;
 }
+static inline bool clk_is_match(const struct clk *p, const struct clk *q)
+{
+        return p == q;
+}
 #endif
 /**
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 800544bc7bfd..781974afff9f 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -166,6 +166,11 @@
 #define GITS_TRANSLATER                 0x10040
+#define GITS_CTLR_ENABLE                (1U << 0)
+#define GITS_CTLR_QUIESCENT             (1U << 31)
+#define GITS_TYPER_DEVBITS_SHIFT        13
+#define GITS_TYPER_DEVBITS(r)           ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
 #define GITS_TYPER_PTA                  (1UL << 19)
 #define GITS_CBASER_VALID               (1UL << 63)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 72ba725ddf9c..5bb074431eb0 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -5,6 +5,7 @@
 struct kmem_cache;
 struct page;
+struct vm_struct;
 #ifdef CONFIG_KASAN
@@ -49,15 +50,11 @@ void kasan_krealloc(const void *object, size_t new_size);
 void kasan_slab_alloc(struct kmem_cache *s, void *object);
 void kasan_slab_free(struct kmem_cache *s, void *object);
-#define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
 int kasan_module_alloc(void *addr, size_t size);
-void kasan_module_free(void *addr);
+void kasan_free_shadow(const struct vm_struct *vm);
 #else /* CONFIG_KASAN */
-#define MODULE_ALIGN 1
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
 static inline void kasan_enable_current(void) {}
@@ -82,7 +79,7 @@ static inline void kasan_slab_alloc(struct kmem_cache *s, void *object) {}
 static inline void kasan_slab_free(struct kmem_cache *s, void *object) {}
 static inline int kasan_module_alloc(void *addr, size_t size) { return 0; }
-static inline void kasan_module_free(void *addr) {}
+static inline void kasan_free_shadow(const struct vm_struct *vm) {}
 #endif /* CONFIG_KASAN */
diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
index f7556261fe3c..4d0cb9bba93e 100644
--- a/include/linux/moduleloader.h
+++ b/include/linux/moduleloader.h
@@ -84,4 +84,12 @@ void module_arch_cleanup(struct module *mod);
 /* Any cleanup before freeing mod->module_init */
 void module_arch_freeing_init(struct module *mod);
+#ifdef CONFIG_KASAN
+#include <linux/kasan.h>
+#define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
+#else
+#define MODULE_ALIGN PAGE_SIZE
+#endif
 #endif
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index 8a860f096c35..611a691145c4 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -84,7 +84,7 @@ static inline int of_platform_populate(struct device_node *root,
 static inline void of_platform_depopulate(struct device *parent) { }
 #endif
-#ifdef CONFIG_OF_DYNAMIC
+#if defined(CONFIG_OF_DYNAMIC) && defined(CONFIG_OF_ADDRESS)
 extern void of_platform_register_reconfig_notifier(void);
 #else
 static inline void of_platform_register_reconfig_notifier(void) { }
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index ed9489d893a4..856d34dde79b 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -649,7 +649,7 @@ struct spi_transfer {
 * sequence completes.  On some systems, many such sequences can execute as
 * as single programmed DMA transfer.  On all systems, these messages are
 * queued, and might complete after transactions to other devices.  Messages
- * sent to a given spi_device are alway executed in FIFO order.
+ * sent to a given spi_device are always executed in FIFO order.
 *
 * The code that submits an spi_message (and its spi_transfers)
 * to the lower layers is responsible for managing its memory.
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 07a022641996..71880299ed48 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -98,6 +98,8 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, struct page ***pages,
                        size_t maxsize, size_t *start);
 int iov_iter_npages(const struct iov_iter *i, int maxpages);
+const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags);
 static inline size_t iov_iter_count(struct iov_iter *i)
 {
        return i->count;
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 7d7acb35603d..0ec598381f97 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -17,6 +17,7 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
 #define VM_VPAGES               0x00000010      /* buffer for pages was vmalloc'ed */
 #define VM_UNINITIALIZED        0x00000020      /* vm_struct is not fully initialized */
 #define VM_NO_GUARD             0x00000040      /* don't add guard page */
+#define VM_KASAN                0x00000080      /* has allocated kasan shadow memory */
 /* bits [20..32] reserved for arch specific ioremap internals */
 /*
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 74db135f9957..f597846ff605 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -70,7 +70,8 @@ enum {
        /* data contains off-queue information when !WORK_STRUCT_PWQ */
        WORK_OFFQ_FLAG_BASE     = WORK_STRUCT_COLOR_SHIFT,
-        WORK_OFFQ_CANCELING     = (1 << WORK_OFFQ_FLAG_BASE),
+        __WORK_OFFQ_CANCELING   = WORK_OFFQ_FLAG_BASE,
+        WORK_OFFQ_CANCELING     = (1 << __WORK_OFFQ_CANCELING),
        /*
         * When a work item is off queue, its high bits point to the last
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 9eaaa7884586..decb9a095ae7 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -119,6 +119,22 @@ int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
                           const struct nft_data *data,
                           enum nft_data_types type);
+/**
+ *      struct nft_userdata - user defined data associated with an object
+ *
+ *      @len: length of the data
+ *      @data: content
+ *
+ *      The presence of user data is indicated in an object specific fashion,
+ *      so a length of zero can't occur and the value "len" indicates data
+ *      of length len + 1.
+ */
+struct nft_userdata {
+        u8                      len;
+        unsigned char           data[0];
+};
 /**
 *      struct nft_set_elem - generic representation of set elements
 *
@@ -380,7 +396,7 @@ static inline void *nft_expr_priv(const struct nft_expr *expr)
 *      @handle: rule handle
 *      @genmask: generation mask
 *      @dlen: length of expression data
- *      @ulen: length of user data (used for comments)
+ *      @udata: user data is appended to the rule
 *      @data: expression data
 */
 struct nft_rule {
@@ -388,7 +404,7 @@ struct nft_rule {
        u64                             handle:42,
                                        genmask:2,
                                        dlen:12,
-                                        ulen:8;
+                                        udata:1;
        unsigned char                   data[]
                __attribute__((aligned(__alignof__(struct nft_expr))));
 };
@@ -476,7 +492,7 @@ static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
        return (struct nft_expr *)&rule->data[rule->dlen];
 }
-static inline void *nft_userdata(const struct nft_rule *rule)
+static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule)
 {
        return (void *)&rule->data[rule->dlen];
 }
diff --git a/include/soc/at91/at91sam9_ddrsdr.h b/include/soc/at91/at91sam9_ddrsdr.h
index 0210797abf2e..dc10c52e0e91 100644
--- a/include/soc/at91/at91sam9_ddrsdr.h
+++ b/include/soc/at91/at91sam9_ddrsdr.h
@@ -92,7 +92,7 @@
 #define         AT91_DDRSDRC_UPD_MR     (3 << 20)        /* Update load mode register and extended mode register */
 #define AT91_DDRSDRC_MDR        0x20    /* Memory Device Register */
-#define         AT91_DDRSDRC_MD         (3 << 0)                /* Memory Device Type */
+#define         AT91_DDRSDRC_MD         (7 << 0)        /* Memory Device Type */
 #define                 AT91_DDRSDRC_MD_SDR             0
 #define                 AT91_DDRSDRC_MD_LOW_POWER_SDR   1
 #define                 AT91_DDRSDRC_MD_LOW_POWER_DDR   3
diff --git a/include/video/omapdss.h b/include/video/omapdss.h
index 60de61fea8e3..c8ed15daad02 100644
--- a/include/video/omapdss.h
+++ b/include/video/omapdss.h
@@ -689,6 +689,7 @@ struct omapdss_dsi_ops {
 };
 struct omap_dss_device {
+        struct kobject kobj;
        struct device *dev;
        struct module *owner;
diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h
index b78f21caf55a..b0f1c9e5d687 100644
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -114,9 +114,9 @@ int __must_check __xenbus_register_backend(struct xenbus_driver *drv,
                                           const char *mod_name);
 #define xenbus_register_frontend(drv) \
-        __xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME);
+        __xenbus_register_frontend(drv, THIS_MODULE, KBUILD_MODNAME)
 #define xenbus_register_backend(drv) \
-        __xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME);
+        __xenbus_register_backend(drv, THIS_MODULE, KBUILD_MODNAME)
 void xenbus_unregister_driver(struct xenbus_driver *drv);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 1d1fe9361d29..fc7f4748d34a 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -548,9 +548,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
        rcu_read_lock();
        cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
-                if (cp == root_cs)
-                        continue;
                /* skip the whole subtree if @cp doesn't have any CPU */
                if (cpumask_empty(cp->cpus_allowed)) {
                        pos_css = css_rightmost_descendant(pos_css);
@@ -873,7 +870,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
                 * If it becomes empty, inherit the effective mask of the
                 * parent, which is guaranteed to have some CPUs.
                 */
-                if (cpumask_empty(new_cpus))
+                if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
                        cpumask_copy(new_cpus, parent->effective_cpus);
                /* Skip the whole subtree if the cpumask remains the same. */
@@ -1129,7 +1126,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
                 * If it becomes empty, inherit the effective mask of the
                 * parent, which is guaranteed to have some MEMs.
                 */
-                if (nodes_empty(*new_mems))
+                if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
                        *new_mems = parent->effective_mems;
                /* Skip the whole subtree if the nodemask remains the same. */
@@ -1979,7 +1976,9 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
        spin_lock_irq(&callback_lock);
        cs->mems_allowed = parent->mems_allowed;
+        cs->effective_mems = parent->mems_allowed;
        cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
+        cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
        spin_unlock_irq(&callback_lock);
 out_unlock:
        mutex_unlock(&cpuset_mutex);
diff --git a/kernel/module.c b/kernel/module.c
index cc93cf68653c..b3d634ed06c9 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -56,7 +56,6 @@
 #include <linux/async.h>
 #include <linux/percpu.h>
 #include <linux/kmemleak.h>
-#include <linux/kasan.h>
 #include <linux/jump_label.h>
 #include <linux/pfn.h>
 #include <linux/bsearch.h>
@@ -1814,7 +1813,6 @@ static void unset_module_init_ro_nx(struct module *mod) { }
 void __weak module_memfree(void *module_region)
 {
        vfree(module_region);
-        kasan_module_free(module_region);
 }
 void __weak module_arch_cleanup(struct module *mod)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 45e5cb143d17..4f228024055b 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1059,6 +1059,12 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
 static struct pid * const ftrace_swapper_pid = &init_struct_pid;
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+static int ftrace_graph_active;
+#else
+# define ftrace_graph_active 0
+#endif
 #ifdef CONFIG_DYNAMIC_FTRACE
 static struct ftrace_ops *removed_ops;
@@ -2041,8 +2047,12 @@ static int ftrace_check_record(struct dyn_ftrace *rec, int enable, int update)
                if (!ftrace_rec_count(rec))
                        rec->flags = 0;
                else
-                        /* Just disable the record (keep REGS state) */
+                        /*
-                        rec->flags &= ~FTRACE_FL_ENABLED;
+                         * Just disable the record, but keep the ops TRAMP
+                         * and REGS states. The _EN flags must be disabled though.
+                         */
+                        rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
+                                        FTRACE_FL_REGS_EN);
        }
        return FTRACE_UPDATE_MAKE_NOP;
@@ -2688,24 +2698,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
 static void ftrace_startup_sysctl(void)
 {
+        int command;
        if (unlikely(ftrace_disabled))
                return;
        /* Force update next time */
        saved_ftrace_func = NULL;
        /* ftrace_start_up is true if we want ftrace running */
-        if (ftrace_start_up)
+        if (ftrace_start_up) {
-                ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+                command = FTRACE_UPDATE_CALLS;
+                if (ftrace_graph_active)
+                        command |= FTRACE_START_FUNC_RET;
+                ftrace_startup_enable(command);
+        }
 }
 static void ftrace_shutdown_sysctl(void)
 {
+        int command;
        if (unlikely(ftrace_disabled))
                return;
        /* ftrace_start_up is true if ftrace is running */
-        if (ftrace_start_up)
+        if (ftrace_start_up) {
-                ftrace_run_update_code(FTRACE_DISABLE_CALLS);
+                command = FTRACE_DISABLE_CALLS;
+                if (ftrace_graph_active)
+                        command |= FTRACE_STOP_FUNC_RET;
+                ftrace_run_update_code(command);
+        }
 }
 static cycle_t          ftrace_update_time;
@@ -5558,12 +5580,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
        if (ftrace_enabled) {
-                ftrace_startup_sysctl();
                /* we are starting ftrace again */
                if (ftrace_ops_list != &ftrace_list_end)
                        update_ftrace_function();
+                ftrace_startup_sysctl();
        } else {
                /* stopping ftrace calls (just send to ftrace_stub) */
                ftrace_trace_function = ftrace_stub;
@@ -5590,8 +5612,6 @@ static struct ftrace_ops graph_ops = {
        ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
 };
-static int ftrace_graph_active;
 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
 {
        return 0;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index f28849394791..41ff75b478c6 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2728,19 +2728,57 @@ bool flush_work(struct work_struct *work)
 }
 EXPORT_SYMBOL_GPL(flush_work);
+struct cwt_wait {
+        wait_queue_t            wait;
+        struct work_struct      *work;
+};
+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
+{
+        struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
+        if (cwait->work != key)
+                return 0;
+        return autoremove_wake_function(wait, mode, sync, key);
+}
 static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
 {
+        static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
        unsigned long flags;
        int ret;
        do {
                ret = try_to_grab_pending(work, is_dwork, &flags);
                /*
-                 * If someone else is canceling, wait for the same event it
+                 * If someone else is already canceling, wait for it to
-                 * would be waiting for before retrying.
+                 * finish.  flush_work() doesn't work for PREEMPT_NONE
+                 * because we may get scheduled between @work's completion
+                 * and the other canceling task resuming and clearing
+                 * CANCELING - flush_work() will return false immediately
+                 * as @work is no longer busy, try_to_grab_pending() will
+                 * return -ENOENT as @work is still being canceled and the
+                 * other canceling task won't be able to clear CANCELING as
+                 * we're hogging the CPU.
+                 *
+                 * Let's wait for completion using a waitqueue.  As this
+                 * may lead to the thundering herd problem, use a custom
+                 * wake function which matches @work along with exclusive
+                 * wait and wakeup.
                 */
-                if (unlikely(ret == -ENOENT))
+                if (unlikely(ret == -ENOENT)) {
-                        flush_work(work);
+                        struct cwt_wait cwait;
+                        init_wait(&cwait.wait);
+                        cwait.wait.func = cwt_wakefn;
+                        cwait.work = work;
+                        prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
+                                                  TASK_UNINTERRUPTIBLE);
+                        if (work_is_canceling(work))
+                                schedule();
+                        finish_wait(&cancel_waitq, &cwait.wait);
+                }
        } while (unlikely(ret < 0));
        /* tell other tasks trying to grab @work to back off */
@@ -2749,6 +2787,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
        flush_work(work);
        clear_work_data(work);
+        /*
+         * Paired with prepare_to_wait() above so that either
+         * waitqueue_active() is visible here or !work_is_canceling() is
+         * visible there.
+         */
+        smp_mb();
+        if (waitqueue_active(&cancel_waitq))
+                __wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
        return ret;
 }
diff --git a/lib/Makefile b/lib/Makefile
index 87eb3bffc283..58f74d2dd396 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,7 @@ obj-y	+= lockref.o
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
         bust_spinlocks.o kasprintf.o bitmap.o scatterlist.o \
-         gcd.o lcm.o list_sort.o uuid.o flex_array.o clz_ctz.o \
+         gcd.o lcm.o list_sort.o uuid.o flex_array.o iov_iter.o clz_ctz.o \
         bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o kfifo.o \
         percpu-refcount.o percpu_ida.o rhashtable.o reciprocal_div.o
 obj-y += string_helpers.o
diff --git a/mm/iov_iter.c b/lib/iov_iter.c
index 827732047da1..9d96e283520c 100644
--- a/mm/iov_iter.c
+++ b/lib/iov_iter.c
@@ -751,3 +751,18 @@ int iov_iter_npages(const struct iov_iter *i, int maxpages)
        return npages;
 }
 EXPORT_SYMBOL(iov_iter_npages);
+const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags)
+{
+        *new = *old;
+        if (new->type & ITER_BVEC)
+                return new->bvec = kmemdup(new->bvec,
+                                    new->nr_segs * sizeof(struct bio_vec),
+                                    flags);
+        else
+                /* iovec and kvec have identical layout */
+                return new->iov = kmemdup(new->iov,
+                                   new->nr_segs * sizeof(struct iovec),
+                                   flags);
+}
+EXPORT_SYMBOL(dup_iter);
diff --git a/lib/seq_buf.c b/lib/seq_buf.c
index 88c0854bd752..5c94e1012a91 100644
--- a/lib/seq_buf.c
+++ b/lib/seq_buf.c
@@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args)
        if (s->len < s->size) {
                len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
-                if (seq_buf_can_fit(s, len)) {
+                if (s->len + len < s->size) {
                        s->len += len;
                        return 0;
                }
@@ -118,7 +118,7 @@ int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary)
        if (s->len < s->size) {
                ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
-                if (seq_buf_can_fit(s, ret)) {
+                if (s->len + ret < s->size) {
                        s->len += ret;
                        return 0;
                }
diff --git a/mm/Makefile b/mm/Makefile
index 3c1caa2693bd..15dbe9903c27 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -21,7 +21,7 @@ obj-y			:= filemap.o mempool.o oom_kill.o \
                           mm_init.o mmu_context.o percpu.o slab_common.o \
                           compaction.o vmacache.o \
                           interval_tree.o list_lru.o workingset.o \
-                           iov_iter.o debug.o $(mmu-y)
+                           debug.o $(mmu-y)
 obj-y += init-mm.o
diff --git a/mm/cma.c b/mm/cma.c
index 75016fd1de90..68ecb7a42983 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -64,15 +64,17 @@ static unsigned long cma_bitmap_aligned_mask(struct cma *cma, int align_order)
        return (1UL << (align_order - cma->order_per_bit)) - 1;
 }
+/*
+ * Find a PFN aligned to the specified order and return an offset represented in
+ * order_per_bits.
+ */
 static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
 {
-        unsigned int alignment;
        if (align_order <= cma->order_per_bit)
                return 0;
-        alignment = 1UL << (align_order - cma->order_per_bit);
-        return ALIGN(cma->base_pfn, alignment) -
+        return (ALIGN(cma->base_pfn, (1UL << align_order))
-                (cma->base_pfn >> cma->order_per_bit);
+                - cma->base_pfn) >> cma->order_per_bit;
 }
 static unsigned long cma_bitmap_maxno(struct cma *cma)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index fc00c8cb5a82..626e93db28ba 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1295,8 +1295,13 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         * Avoid grouping on DSO/COW pages in specific and RO pages
         * in general, RO pages shouldn't hurt as much anyway since
         * they can be in shared cache state.
+         *
+         * FIXME! This checks "pmd_dirty()" as an approximation of
+         * "is this a read-only page", since checking "pmd_write()"
+         * is even more broken. We haven't actually turned this into
+         * a writable page, so pmd_write() will always be false.
         */
-        if (!pmd_write(pmd))
+        if (!pmd_dirty(pmd))
                flags |= TNF_NO_GROUP;
        /*
@@ -1482,6 +1487,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
        if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
                pmd_t entry;
+                ret = 1;
                /*
                 * Avoid trapping faults against the zero page. The read-only
@@ -1490,11 +1496,10 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                 */
                if (prot_numa && is_huge_zero_pmd(*pmd)) {
                        spin_unlock(ptl);
-                        return 0;
+                        return ret;
                }
                if (!prot_numa || !pmd_protnone(*pmd)) {
-                        ret = 1;
                        entry = pmdp_get_and_clear_notify(mm, addr, pmd);
                        entry = pmd_modify(entry, newprot);
                        ret = HPAGE_PMD_NR;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 0a9ac6c26832..c41b2a0ee273 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -917,7 +917,6 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
        __SetPageHead(page);
        __ClearPageReserved(page);
        for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
-                __SetPageTail(p);
                /*
                 * For gigantic hugepages allocated through bootmem at
                 * boot, it's safer to be consistent with the not-gigantic
@@ -933,6 +932,9 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
                __ClearPageReserved(p);
                set_page_count(p, 0);
                p->first_page = page;
+                /* Make sure p->first_page is always valid for PageTail() */
+                smp_wmb();
+                __SetPageTail(p);
        }
 }
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 78fee632a7ee..936d81661c47 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -29,6 +29,7 @@
 #include <linux/stacktrace.h>
 #include <linux/string.h>
 #include <linux/types.h>
+#include <linux/vmalloc.h>
 #include <linux/kasan.h>
 #include "kasan.h"
@@ -414,12 +415,19 @@ int kasan_module_alloc(void *addr, size_t size)
                        GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
                        PAGE_KERNEL, VM_NO_GUARD, NUMA_NO_NODE,
                        __builtin_return_address(0));
-        return ret ? 0 : -ENOMEM;
+        if (ret) {
+                find_vm_area(addr)->flags |= VM_KASAN;
+                return 0;
+        }
+        return -ENOMEM;
 }
-void kasan_module_free(void *addr)
+void kasan_free_shadow(const struct vm_struct *vm)
 {
-        vfree(kasan_mem_to_shadow(addr));
+        if (vm->flags & VM_KASAN)
+                vfree(kasan_mem_to_shadow(vm->addr));
 }
 static void register_global(struct kasan_global *global)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9fe07692eaad..b34ef4a32a3b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5232,7 +5232,9 @@ static void mem_cgroup_bind(struct cgroup_subsys_state *root_css)
         * on for the root memcg is enough.
         */
        if (cgroup_on_dfl(root_css->cgroup))
-                mem_cgroup_from_css(root_css)->use_hierarchy = true;
+                root_mem_cgroup->use_hierarchy = true;
+        else
+                root_mem_cgroup->use_hierarchy = false;
 }
 static u64 memory_current_read(struct cgroup_subsys_state *css,
diff --git a/mm/memory.c b/mm/memory.c
index 8068893697bb..411144f977b1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3072,8 +3072,13 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
         * Avoid grouping on DSO/COW pages in specific and RO pages
         * in general, RO pages shouldn't hurt as much anyway since
         * they can be in shared cache state.
+         *
+         * FIXME! This checks "pmd_dirty()" as an approximation of
+         * "is this a read-only page", since checking "pmd_write()"
+         * is even more broken. We haven't actually turned this into
+         * a writable page, so pmd_write() will always be false.
         */
-        if (!pte_write(pte))
+        if (!pte_dirty(pte))
                flags |= TNF_NO_GROUP;
        /*
diff --git a/mm/mlock.c b/mm/mlock.c
index 73cf0987088c..8a54cd214925 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -26,10 +26,10 @@
 int can_do_mlock(void)
 {
-        if (capable(CAP_IPC_LOCK))
-                return 1;
        if (rlimit(RLIMIT_MEMLOCK) != 0)
                return 1;
+        if (capable(CAP_IPC_LOCK))
+                return 1;
        return 0;
 }
 EXPORT_SYMBOL(can_do_mlock);
diff --git a/mm/nommu.c b/mm/nommu.c
index 3e67e7538ecf..3fba2dc97c44 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -62,6 +62,7 @@ void *high_memory;
 EXPORT_SYMBOL(high_memory);
 struct page *mem_map;
 unsigned long max_mapnr;
+EXPORT_SYMBOL(max_mapnr);
 unsigned long highest_memmap_pfn;
 struct percpu_counter vm_committed_as;
 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 7abfa70cdc1a..40e29429e7b0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2373,7 +2373,8 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
                        goto out;
        }
        /* Exhausted what can be done so it's blamo time */
-        if (out_of_memory(ac->zonelist, gfp_mask, order, ac->nodemask, false))
+        if (out_of_memory(ac->zonelist, gfp_mask, order, ac->nodemask, false)
+                        || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL))
                *did_some_progress = 1;
 out:
        oom_zonelist_unlock(ac->zonelist, gfp_mask);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 35b25e1340ca..49abccf29a29 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1418,6 +1418,7 @@ struct vm_struct *remove_vm_area(const void *addr)
                spin_unlock(&vmap_area_lock);
                vmap_debug_free_range(va->va_start, va->va_end);
+                kasan_free_shadow(vm);
                free_unmap_vmap_area(va);
                vm->size -= PAGE_SIZE;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 66e08040ced7..32d710eaf1fc 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
                goto inval_skb;
        }
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb_reset_mac_header(skb);
        skb_reset_network_header(skb);
        skb_reset_transport_header(skb);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2c8d98e728c0..145a50c4d566 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -659,27 +659,30 @@ EXPORT_SYMBOL(ip_defrag);
 struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
 {
        struct iphdr iph;
+        int netoff;
        u32 len;
        if (skb->protocol != htons(ETH_P_IP))
                return skb;
-        if (skb_copy_bits(skb, 0, &iph, sizeof(iph)) < 0)
+        netoff = skb_network_offset(skb);
+        if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
                return skb;
        if (iph.ihl < 5 || iph.version != 4)
                return skb;
        len = ntohs(iph.tot_len);
-        if (skb->len < len || len < (iph.ihl * 4))
+        if (skb->len < netoff + len || len < (iph.ihl * 4))
                return skb;
        if (ip_is_fragment(&iph)) {
                skb = skb_share_check(skb, GFP_ATOMIC);
                if (skb) {
-                        if (!pskb_may_pull(skb, iph.ihl*4))
+                        if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
                                return skb;
-                        if (pskb_trim_rcsum(skb, len))
+                        if (pskb_trim_rcsum(skb, netoff + len))
                                return skb;
                        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                        if (ip_defrag(skb, user))
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 31d8c71986b4..5cd99271d3a6 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -432,17 +432,32 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
                kfree_skb(skb);
 }
-static bool ipv4_pktinfo_prepare_errqueue(const struct sock *sk,
+/* IPv4 supports cmsg on all imcp errors and some timestamps
-                                          const struct sk_buff *skb,
+ *
-                                          int ee_origin)
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ipv4_datagram_support_cmsg(const struct sock *sk,
+                                       struct sk_buff *skb,
+                                       int ee_origin)
 {
-        struct in_pktinfo *info = PKTINFO_SKB_CB(skb);
+        struct in_pktinfo *info;
+        if (ee_origin == SO_EE_ORIGIN_ICMP)
+                return true;
-        if ((ee_origin != SO_EE_ORIGIN_TIMESTAMPING) ||
+        if (ee_origin == SO_EE_ORIGIN_LOCAL)
-            (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
+                return false;
+        /* Support IP_PKTINFO on tstamp packets if requested, to correlate
+         * timestamp with egress dev. Not possible for packets without dev
+         * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
+         */
+        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
            (!skb->dev))
                return false;
+        info = PKTINFO_SKB_CB(skb);
        info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
        info->ipi_ifindex = skb->dev->ifindex;
        return true;
@@ -483,7 +498,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        serr = SKB_EXT_ERR(skb);
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                sin->sin_family = AF_INET;
                sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
                                                   serr->addr_offset);
@@ -496,9 +511,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        sin = &errhdr.offender;
        memset(sin, 0, sizeof(*sin));
-        if (skb->len &&
+        if (ipv4_datagram_support_cmsg(sk, skb, serr->ee.ee_origin)) {
-            (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
-             ipv4_pktinfo_prepare_errqueue(sk, skb, serr->ee.ee_origin))) {
                sin->sin_family = AF_INET;
                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                if (inet_sk(sk)->cmsg_flags)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index e9f66e1cda50..208d5439e59b 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -259,6 +259,9 @@ int ping_init_sock(struct sock *sk)
        kgid_t low, high;
        int ret = 0;
+        if (sk->sk_family == AF_INET6)
+                sk->sk_ipv6only = 1;
        inet_get_ping_group_range_net(net, &low, &high);
        if (gid_lte(low, group) && gid_lte(group, high))
                return 0;
@@ -305,6 +308,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                if (addr_len < sizeof(*addr))
                        return -EINVAL;
+                if (addr->sin_family != AF_INET &&
+                    !(addr->sin_family == AF_UNSPEC &&
+                      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
+                        return -EAFNOSUPPORT;
                pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
                         sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
@@ -330,7 +338,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                        return -EINVAL;
                if (addr->sin6_family != AF_INET6)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
                pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                         sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
@@ -716,7 +724,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                if (msg->msg_namelen < sizeof(*usin))
                        return -EINVAL;
                if (usin->sin_family != AF_INET)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
                daddr = usin->sin_addr.s_addr;
                /* no remote port */
        } else {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9d72a0fcd928..995a2259bcfc 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -835,17 +835,13 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                                       int large_allowed)
 {
        struct tcp_sock *tp = tcp_sk(sk);
-        u32 new_size_goal, size_goal, hlen;
+        u32 new_size_goal, size_goal;
        if (!large_allowed || !sk_can_gso(sk))
                return mss_now;
-        /* Maybe we should/could use sk->sk_prot->max_header here ? */
+        /* Note : tcp_tso_autosize() will eventually split this later */
-        hlen = inet_csk(sk)->icsk_af_ops->net_header_len +
+        new_size_goal = sk->sk_gso_max_size - 1 - MAX_TCP_HEADER;
-               inet_csk(sk)->icsk_ext_hdr_len +
-               tp->tcp_header_len;
-        new_size_goal = sk->sk_gso_max_size - 1 - hlen;
        new_size_goal = tcp_bound_to_half_wnd(tp, new_size_goal);
        /* We try hard to avoid divides here */
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index c215be70cac0..ace8daca5c83 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -325,14 +325,34 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
        kfree_skb(skb);
 }
-static void ip6_datagram_prepare_pktinfo_errqueue(struct sk_buff *skb)
+/* IPv6 supports cmsg on all origins aside from SO_EE_ORIGIN_LOCAL.
+ *
+ * At one point, excluding local errors was a quick test to identify icmp/icmp6
+ * errors. This is no longer true, but the test remained, so the v6 stack,
+ * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
+                                      struct sock_exterr_skb *serr)
 {
-        int ifindex = skb->dev ? skb->dev->ifindex : -1;
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
+            serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6)
+                return true;
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+        if (!skb->dev)
+                return false;
        if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = ifindex;
+                IP6CB(skb)->iif = skb->dev->ifindex;
        else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = ifindex;
+                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
+        return true;
 }
 /*
@@ -369,7 +389,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        serr = SKB_EXT_ERR(skb);
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                const unsigned char *nh = skb_network_header(skb);
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
@@ -394,14 +414,11 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
        sin = &errhdr.offender;
        memset(sin, 0, sizeof(*sin));
-        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL && skb->len) {
+        if (ip6_datagram_support_cmsg(skb, serr)) {
                sin->sin6_family = AF_INET6;
-                if (np->rxopt.all) {
+                if (np->rxopt.all)
-                        if (serr->ee.ee_origin != SO_EE_ORIGIN_ICMP &&
-                            serr->ee.ee_origin != SO_EE_ORIGIN_ICMP6)
-                                ip6_datagram_prepare_pktinfo_errqueue(skb);
                        ip6_datagram_recv_common_ctl(sk, msg, skb);
-                }
                if (skb->protocol == htons(ETH_P_IPV6)) {
                        sin->sin6_addr = ipv6_hdr(skb)->saddr;
                        if (np->rxopt.all)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index bd46f736f61d..a2dfff6ff227 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -102,9 +102,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (msg->msg_name) {
                DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
-                if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
+                if (msg->msg_namelen < sizeof(*u))
-                    u->sin6_family != AF_INET6) {
                        return -EINVAL;
+                if (u->sin6_family != AF_INET6) {
+                        return -EAFNOSUPPORT;
                }
                if (sk->sk_bound_dev_if &&
                    sk->sk_bound_dev_if != u->sin6_scope_id) {
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index c47ffd7a0a70..d93ceeb3ef04 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -896,6 +896,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                        IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
                        return;
                }
+                if (!(flags & IP_VS_CONN_F_TEMPLATE))
+                        kfree(param->pe_data);
        }
        if (opt)
@@ -1169,6 +1171,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
                                (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
                                );
 #endif
+        ip_vs_pe_put(param.pe);
        return 0;
        /* Error exit */
 out:
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 199fd0f27b0e..6ab777912237 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
 {
-        rule->genmask = 0;
+        rule->genmask &= ~(1 << gencursor_next(net));
 }
 static int
@@ -1711,9 +1711,12 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
        }
        nla_nest_end(skb, list);
-        if (rule->ulen &&
+        if (rule->udata) {
-            nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
+                struct nft_userdata *udata = nft_userdata(rule);
-                goto nla_put_failure;
+                if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
+                            udata->data) < 0)
+                        goto nla_put_failure;
+        }
        nlmsg_end(skb, nlh);
        return 0;
@@ -1896,11 +1899,12 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
        struct nft_table *table;
        struct nft_chain *chain;
        struct nft_rule *rule, *old_rule = NULL;
+        struct nft_userdata *udata;
        struct nft_trans *trans = NULL;
        struct nft_expr *expr;
        struct nft_ctx ctx;
        struct nlattr *tmp;
-        unsigned int size, i, n, ulen = 0;
+        unsigned int size, i, n, ulen = 0, usize = 0;
        int err, rem;
        bool create;
        u64 handle, pos_handle;
@@ -1968,12 +1972,19 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                        n++;
                }
        }
+        /* Check for overflow of dlen field */
+        err = -EFBIG;
+        if (size >= 1 << 12)
+                goto err1;
-        if (nla[NFTA_RULE_USERDATA])
+        if (nla[NFTA_RULE_USERDATA]) {
                ulen = nla_len(nla[NFTA_RULE_USERDATA]);
+                if (ulen > 0)
+                        usize = sizeof(struct nft_userdata) + ulen;
+        }
        err = -ENOMEM;
-        rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
+        rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
        if (rule == NULL)
                goto err1;
@@ -1981,10 +1992,13 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
        rule->handle = handle;
        rule->dlen   = size;
-        rule->ulen   = ulen;
+        rule->udata  = ulen ? 1 : 0;
-        if (ulen)
+        if (ulen) {
-                nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
+                udata = nft_userdata(rule);
+                udata->len = ulen - 1;
+                nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
+        }
        expr = nft_expr_first(rule);
        for (i = 0; i < n; i++) {
@@ -2031,12 +2045,6 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 err3:
        list_del_rcu(&rule->list);
-        if (trans) {
-                list_del_rcu(&nft_trans_rule(trans)->list);
-                nft_rule_clear(net, nft_trans_rule(trans));
-                nft_trans_destroy(trans);
-                chain->use++;
-        }
 err2:
        nf_tables_rule_destroy(&ctx, rule);
 err1:
@@ -3612,12 +3620,11 @@ static int nf_tables_commit(struct sk_buff *skb)
                                                 &te->elem,
                                                 NFT_MSG_DELSETELEM, 0);
                        te->set->ops->get(te->set, &te->elem);
-                        te->set->ops->remove(te->set, &te->elem);
                        nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-                        if (te->elem.flags & NFT_SET_MAP) {
+                        if (te->set->flags & NFT_SET_MAP &&
-                                nft_data_uninit(&te->elem.data,
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
-                                                te->set->dtype);
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
-                        }
+                        te->set->ops->remove(te->set, &te->elem);
                        nft_trans_destroy(trans);
                        break;
                }
@@ -3658,7 +3665,7 @@ static int nf_tables_abort(struct sk_buff *skb)
 {
        struct net *net = sock_net(skb->sk);
        struct nft_trans *trans, *next;
-        struct nft_set *set;
+        struct nft_trans_elem *te;
        list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
                switch (trans->msg_type) {
@@ -3719,9 +3726,13 @@ static int nf_tables_abort(struct sk_buff *skb)
                        break;
                case NFT_MSG_NEWSETELEM:
                        nft_trans_elem_set(trans)->nelems--;
-                        set = nft_trans_elem_set(trans);
+                        te = (struct nft_trans_elem *)trans->data;
-                        set->ops->get(set, &nft_trans_elem(trans));
+                        te->set->ops->get(te->set, &te->elem);
-                        set->ops->remove(set, &nft_trans_elem(trans));
+                        nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                        nft_trans_destroy(trans);
                        break;
                case NFT_MSG_DELSETELEM:
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 1279cd85663e..213584cf04b3 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -123,7 +123,7 @@ static void
 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                           const struct nft_ctx *ctx,
                           struct xt_target *target, void *info,
-                           union nft_entry *entry, u8 proto, bool inv)
+                           union nft_entry *entry, u16 proto, bool inv)
 {
        par->net        = ctx->net;
        par->table      = ctx->table->name;
@@ -137,7 +137,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                break;
        case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                break;
        }
@@ -171,7 +171,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
        [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
-static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
 {
        struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
        u32 flags;
@@ -203,7 +203,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        struct xt_target *target = expr->ops->data;
        struct xt_tgchk_param par;
        size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
        bool inv = false;
        union nft_entry e = {};
        int ret;
@@ -334,7 +334,7 @@ static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
 static void
 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                          struct xt_match *match, void *info,
-                          union nft_entry *entry, u8 proto, bool inv)
+                          union nft_entry *entry, u16 proto, bool inv)
 {
        par->net        = ctx->net;
        par->table      = ctx->table->name;
@@ -348,7 +348,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                break;
        case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                break;
        }
@@ -385,7 +385,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        struct xt_match *match = expr->ops->data;
        struct xt_mtchk_param par;
        size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
        bool inv = false;
        union nft_entry e = {};
        int ret;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 5bf1e968a728..f8db7064d81c 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3123,11 +3123,18 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
        return 0;
 }
-static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
+static void packet_dev_mclist_delete(struct net_device *dev,
+                                     struct packet_mclist **mlp)
 {
-        for ( ; i; i = i->next) {
+        struct packet_mclist *ml;
-                if (i->ifindex == dev->ifindex)
-                        packet_dev_mc(dev, i, what);
+        while ((ml = *mlp) != NULL) {
+                if (ml->ifindex == dev->ifindex) {
+                        packet_dev_mc(dev, ml, -1);
+                        *mlp = ml->next;
+                        kfree(ml);
+                } else
+                        mlp = &ml->next;
        }
 }
@@ -3204,12 +3211,11 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                                        packet_dev_mc(dev, ml, -1);
                                kfree(ml);
                        }
-                        rtnl_unlock();
+                        break;
-                        return 0;
                }
        }
        rtnl_unlock();
-        return -EADDRNOTAVAIL;
+        return 0;
 }
 static void packet_flush_mclist(struct sock *sk)
@@ -3559,7 +3565,7 @@ static int packet_notifier(struct notifier_block *this,
                switch (msg) {
                case NETDEV_UNREGISTER:
                        if (po->mclist)
-                                packet_dev_mclist(dev, po->mclist, -1);
+                                packet_dev_mclist_delete(dev, &po->mclist);
                        /* fallthrough */
                case NETDEV_DOWN:
diff --git a/net/rxrpc/ar-error.c b/net/rxrpc/ar-error.c
index 5394b6be46ec..0610efa83d72 100644
--- a/net/rxrpc/ar-error.c
+++ b/net/rxrpc/ar-error.c
@@ -42,7 +42,8 @@ void rxrpc_UDP_error_report(struct sock *sk)
                _leave("UDP socket errqueue empty");
                return;
        }
-        if (!skb->len) {
+        serr = SKB_EXT_ERR(skb);
+        if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
                _leave("UDP empty message");
                kfree_skb(skb);
                return;
@@ -50,7 +51,6 @@ void rxrpc_UDP_error_report(struct sock *sk)
        rxrpc_new_skb(skb);
-        serr = SKB_EXT_ERR(skb);
        addr = *(__be32 *)(skb_network_header(skb) + serr->addr_offset);
        port = serr->port;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a4cf364316de..14f09b3cb87c 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -464,10 +464,11 @@ void tipc_link_reset(struct tipc_link *l_ptr)
        /* Clean up all queues, except inputq: */
        __skb_queue_purge(&l_ptr->outqueue);
        __skb_queue_purge(&l_ptr->deferred_queue);
-        skb_queue_splice_init(&l_ptr->wakeupq, &l_ptr->inputq);
+        if (!owner->inputq)
-        if (!skb_queue_empty(&l_ptr->inputq))
+                owner->inputq = &l_ptr->inputq;
+        skb_queue_splice_init(&l_ptr->wakeupq, owner->inputq);
+        if (!skb_queue_empty(owner->inputq))
                owner->action_flags |= TIPC_MSG_EVT;
-        owner->inputq = &l_ptr->inputq;
        l_ptr->next_out = NULL;
        l_ptr->unacked_window = 0;
        l_ptr->checkpoint = 1;
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index b680b4ec6331..8ec5289f8e05 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -687,12 +687,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
        return val;
 }
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
+{
+        unsigned int wcaps = get_wcaps(codec, nid);
+        hda_nid_t conn;
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+        if (snd_hda_get_num_conns(codec, nid) != 1)
+                return false;
+        if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
+}
 /* initialize the amp value (only at the first time) */
 static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 {
        unsigned int caps = query_amp_caps(codec, nid, dir);
        int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-        snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+        if (is_stereo_amps(codec, nid, dir))
+                snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
+        else
+                snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
+}
+/* update the amp, doing in stereo or mono depending on NID */
+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
+                      unsigned int mask, unsigned int val)
+{
+        if (is_stereo_amps(codec, nid, dir))
+                return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
+                                                mask, val);
+        else
+                return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
+                                                mask, val);
 }
 /* calculate amp value mask we can modify;
@@ -732,7 +765,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
                return;
        val &= mask;
-        snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
+        update_amp(codec, nid, dir, idx, mask, val);
 }
 static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
@@ -4424,13 +4457,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
        has_amp = nid_has_mute(codec, mix, HDA_INPUT);
        for (i = 0; i < nums; i++) {
                if (has_amp)
-                        snd_hda_codec_amp_stereo(codec, mix,
+                        update_amp(codec, mix, HDA_INPUT, i,
-                                                 HDA_INPUT, i,
+                                   0xff, HDA_AMP_MUTE);
-                                                 0xff, HDA_AMP_MUTE);
                else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-                        snd_hda_codec_amp_stereo(codec, conn[i],
+                        update_amp(codec, conn[i], HDA_OUTPUT, 0,
-                                                 HDA_OUTPUT, 0,
+                                   0xff, HDA_AMP_MUTE);
-                                                 0xff, HDA_AMP_MUTE);
        }
 }
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index ce5a6da83419..05e19f78b4cb 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
                    (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
 }
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
+                           int dir, unsigned int wcaps, int indices)
+{
+        hda_nid_t conn;
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        /* check for a stereo-to-mono mix; it must be:
+         * only a single connection, only for input, and only a mixer widget
+         */
+        if (indices != 1 || dir != HDA_INPUT ||
+            get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+        if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        /* the connection source is a stereo? */
+        wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
+        return !!(wcaps & AC_WCAP_STEREO);
+}
 static void print_amp_vals(struct snd_info_buffer *buffer,
                           struct hda_codec *codec, hda_nid_t nid,
-                           int dir, int stereo, int indices)
+                           int dir, unsigned int wcaps, int indices)
 {
        unsigned int val;
+        bool stereo;
        int i;
+        stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
        dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
        for (i = 0; i < indices; i++) {
                snd_iprintf(buffer, " [");
@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                            (codec->single_adc_amp &&
                             wid_type == AC_WID_AUD_IN))
                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
+                                               wid_caps, 1);
-                                               1);
                        else
                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
+                                               wid_caps, conn_len);
-                                               conn_len);
                }
                if (wid_caps & AC_WCAP_OUT_AMP) {
                        snd_iprintf(buffer, "  Amp-Out caps: ");
@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                        if (wid_type == AC_WID_PIN &&
                            codec->pin_amp_workaround)
                                print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO,
+                                               wid_caps, conn_len);
-                                               conn_len);
                        else
                                print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO, 1);
+                                               wid_caps, 1);
                }
                switch (wid_type) {
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 1589c9bcce3e..dd2b3d92071f 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
        SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
        SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
        SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
+        SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
        SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
        SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
        {} /* terminator */
@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec *codec)
                return -ENOMEM;
        spec->gen.automute_hook = cs_automute;
+        codec->single_adc_amp = 1;
        snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
                           cs420x_fixups);
diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
index 75870c0ea2c9..91eb3aef7f02 100644
--- a/sound/soc/fsl/fsl_spdif.c
+++ b/sound/soc/fsl/fsl_spdif.c
@@ -1049,7 +1049,7 @@ static u32 fsl_spdif_txclk_caldiv(struct fsl_spdif_priv *spdif_priv,
                                enum spdif_txrate index, bool round)
 {
        const u32 rate[] = { 32000, 44100, 48000, 96000, 192000 };
-        bool is_sysclk = clk == spdif_priv->sysclk;
+        bool is_sysclk = clk_is_match(clk, spdif_priv->sysclk);
        u64 rate_ideal, rate_actual, sub;
        u32 sysclk_dfmin, sysclk_dfmax;
        u32 txclk_df, sysclk_df, arate;
@@ -1143,7 +1143,7 @@ static int fsl_spdif_probe_txclk(struct fsl_spdif_priv *spdif_priv,
                        spdif_priv->txclk_src[index], rate[index]);
        dev_dbg(&pdev->dev, "use txclk df %d for %dHz sample rate\n",
                        spdif_priv->txclk_df[index], rate[index]);
-        if (spdif_priv->txclk[index] == spdif_priv->sysclk)
+        if (clk_is_match(spdif_priv->txclk[index], spdif_priv->sysclk))
                dev_dbg(&pdev->dev, "use sysclk df %d for %dHz sample rate\n",
                                spdif_priv->sysclk_df[index], rate[index]);
        dev_dbg(&pdev->dev, "the best rate for %dHz sample rate is %dHz\n",
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index def7d8260c4e..d19483081f9b 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -579,7 +579,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
                if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
                        return -EPROBE_DEFER;
        } else {
-                if (priv->extclk == priv->clk) {
+                if (clk_is_match(priv->extclk, priv->clk)) {
                        devm_clk_put(&pdev->dev, priv->extclk);
                        priv->extclk = ERR_PTR(-EINVAL);
                } else {
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 67d476548dcf..07f984d5f516 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                }
        }
 },
+{
+        USB_DEVICE(0x0582, 0x0159),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                /* .vendor_name = "Roland", */
+                /* .product_name = "UA-22", */
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = & (const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 /* this catches most recent vendor-specific Roland devices */
 {
        .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 3ed7c0476d48..2e2ba2efa0d9 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -209,7 +209,7 @@ $(OUTPUT)%.o: %.c
 $(OUTPUT)cpupower: $(UTIL_OBJS) $(OUTPUT)libcpupower.so.$(LIB_MAJ)
        $(ECHO) "  CC      " $@
-        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -Wl,-rpath=./ -lrt -lpci -L$(OUTPUT) -o $@
+        $(QUIET) $(CC) $(CFLAGS) $(LDFLAGS) $(UTIL_OBJS) -lcpupower -lrt -lpci -L$(OUTPUT) -o $@
        $(QUIET) $(STRIPCMD) $@
 $(OUTPUT)po/$(PACKAGE).pot: $(UTIL_SRC)
diff --git a/tools/testing/selftests/exec/execveat.c b/tools/testing/selftests/exec/execveat.c
index e238c9559caf..8d5d1d2ee7c1 100644
--- a/tools/testing/selftests/exec/execveat.c
+++ b/tools/testing/selftests/exec/execveat.c
@@ -30,7 +30,7 @@ static int execveat_(int fd, const char *path, char **argv, char **envp,
 #ifdef __NR_execveat
        return syscall(__NR_execveat, fd, path, argv, envp, flags);
 #else
-        errno = -ENOSYS;
+        errno = ENOSYS;
        return -1;
 #endif
 }
@@ -234,6 +234,14 @@ static int run_tests(void)
        int fd_cloexec = open_or_die("execveat", O_RDONLY|O_CLOEXEC);
        int fd_script_cloexec = open_or_die("script", O_RDONLY|O_CLOEXEC);
+        /* Check if we have execveat at all, and bail early if not */
+        errno = 0;
+        execveat_(-1, NULL, NULL, NULL, 0);
+        if (errno == ENOSYS) {
+                printf("[FAIL] ENOSYS calling execveat - no kernel support?\n");
+                return 1;
+        }
        /* Change file position to confirm it doesn't affect anything */
        lseek(fd, 10, SEEK_SET);