421 files changed, 3722 insertions, 2210 deletions

diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index 728c38c242d6..56fb62b09fc5 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -141,3 +141,4 @@ Version History
 1.2.0   Handle creation of arrays that contain failed devices.
 1.3.0   Added support for RAID 10
 1.3.1   Allow device replacement/rebuild for RAID 10
+1.3.2   Fix/improve redundancy checking for RAID10
diff --git a/Documentation/hid/hid-sensor.txt b/Documentation/hid/hid-sensor.txt
index 948b0989c433..948b0989c433 100755..100644
--- a/Documentation/hid/hid-sensor.txt
+++ b/Documentation/hid/hid-sensor.txt
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 363e348bff9b..6c723811c0a0 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2438,7 +2438,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         real-time workloads.  It can also improve energy
                         efficiency for asymmetric multiprocessors.
 
-        rcu_nocbs_poll  [KNL,BOOT]
+        rcu_nocb_poll   [KNL,BOOT]
                         Rather than requiring that offloaded CPUs
                         (specified by rcu_nocbs= above) explicitly
                         awaken the corresponding "rcuoN" kthreads,
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index 406d82d5d2bb..e540fd67f767 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -57,6 +57,10 @@ Protocol 2.10:	(Kernel 2.6.31) Added a protocol for relaxed alignment
 Protocol 2.11:  (Kernel 3.6) Added a field for offset of EFI handover
                 protocol entry point.
 
+Protocol 2.12:  (Kernel 3.8) Added the xloadflags field and extension fields
+                to struct boot_params for for loading bzImage and ramdisk
+                above 4G in 64bit.
+
 **** MEMORY LAYOUT
 
 The traditional memory map for the kernel loader, used for Image or
@@ -182,7 +186,7 @@ Offset	Proto	Name		Meaning
 0230/4  2.05+   kernel_alignment Physical addr alignment required for kernel
 0234/1  2.05+   relocatable_kernel Whether kernel is relocatable or not
 0235/1  2.10+   min_alignment   Minimum alignment, as a power of two
-0236/2  N/A     pad3            Unused
+0236/2  2.12+   xloadflags      Boot protocol option flags
 0238/4  2.06+   cmdline_size    Maximum size of the kernel command line
 023C/4  2.07+   hardware_subarch Hardware subarchitecture
 0240/8  2.07+   hardware_subarch_data Subarchitecture-specific data
@@ -582,6 +586,27 @@ Protocol:	2.10+
   misaligned kernel.  Therefore, a loader should typically try each
   power-of-two alignment from kernel_alignment down to this alignment.
 
+Field name:     xloadflags
+Type:           read
+Offset/size:    0x236/2
+Protocol:       2.12+
+
+  This field is a bitmask.
+
+  Bit 0 (read): XLF_KERNEL_64
+        - If 1, this kernel has the legacy 64-bit entry point at 0x200.
+
+  Bit 1 (read): XLF_CAN_BE_LOADED_ABOVE_4G
+        - If 1, kernel/boot_params/cmdline/ramdisk can be above 4G.
+
+  Bit 2 (read): XLF_EFI_HANDOVER_32
+        - If 1, the kernel supports the 32-bit EFI handoff entry point
+          given at handover_offset.
+
+  Bit 3 (read): XLF_EFI_HANDOVER_64
+        - If 1, the kernel supports the 64-bit EFI handoff entry point
+          given at handover_offset + 0x200.
+
 Field name:     cmdline_size
 Type:           read
 Offset/size:    0x238/4
diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt
index cf5437deda81..199f453cb4de 100644
--- a/Documentation/x86/zero-page.txt
+++ b/Documentation/x86/zero-page.txt
@@ -19,6 +19,9 @@ Offset	Proto	Name		Meaning
 090/010 ALL     hd1_info        hd1 disk parameter, OBSOLETE!!
 0A0/010 ALL     sys_desc_table  System description table (struct sys_desc_table)
 0B0/010 ALL     olpc_ofw_header OLPC's OpenFirmware CIF and friends
+0C0/004 ALL     ext_ramdisk_image ramdisk_image high 32bits
+0C4/004 ALL     ext_ramdisk_size  ramdisk_size high 32bits
+0C8/004 ALL     ext_cmd_line_ptr  cmd_line_ptr high 32bits
 140/080 ALL     edid_info       Video mode setup (struct edid_info)
 1C0/020 ALL     efi_info        EFI 32 information (struct efi_info)
 1E0/004 ALL     alk_mem_k       Alternative mem check, in KB
@@ -27,6 +30,7 @@ Offset	Proto	Name		Meaning
 1E9/001 ALL     eddbuf_entries  Number of entries in eddbuf (below)
 1EA/001 ALL     edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer
                                 (below)
+1EF/001 ALL     sentinel        Used to detect broken bootloaders
 290/040 ALL     edd_mbr_sig_buffer EDD MBR signatures
 2D0/A00 ALL     e820_map        E820 memory map table
                                 (array of struct e820entry)
diff --git a/MAINTAINERS b/MAINTAINERS
index 8ae709e34523..35a56bcd5e75 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1489,7 +1489,7 @@ AVR32 ARCHITECTURE
 M:      Haavard Skinnemoen <hskinnemoen@gmail.com>
 M:      Hans-Christian Egtvedt <egtvedt@samfundet.no>
 W:      http://www.atmel.com/products/AVR32/
-W:      http://avr32linux.org/
+W:      http://mirror.egtvedt.no/avr32linux.org/
 W:      http://avrfreaks.net/
 S:      Maintained
 F:      arch/avr32/
@@ -2966,7 +2966,7 @@ S:	Maintained
 F:      drivers/net/ethernet/i825xx/eexpress.*
 
 ETHERNET BRIDGE
-M:      Stephen Hemminger <shemminger@vyatta.com>
+M:      Stephen Hemminger <stephen@networkplumber.org>
 L:      bridge@lists.linux-foundation.org
 L:      netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net:Bridge
@@ -4905,7 +4905,7 @@ S:	Maintained
 
 MARVELL GIGABIT ETHERNET DRIVERS (skge/sky2)
 M:      Mirko Lindner <mlindner@marvell.com>
-M:      Stephen Hemminger <shemminger@vyatta.com>
+M:      Stephen Hemminger <stephen@networkplumber.org>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/marvell/sk*
@@ -5180,7 +5180,7 @@ S:	Supported
 F:      drivers/infiniband/hw/nes/
 
 NETEM NETWORK EMULATOR
-M:      Stephen Hemminger <shemminger@vyatta.com>
+M:      Stephen Hemminger <stephen@networkplumber.org>
 L:      netem@lists.linux-foundation.org
 S:      Maintained
 F:      net/sched/sch_netem.c
@@ -7088,7 +7088,7 @@ F:	include/uapi/sound/
 F:      sound/
 
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
-M:      Liam Girdwood <lrg@ti.com>
+M:      Liam Girdwood <lgirdwood@gmail.com>
 M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
diff --git a/Makefile b/Makefile
index 2d3c92c774fb..54dfde5e9f9e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
-NAME = Terrified Chipmunk
+EXTRAVERSION = -rc6
+NAME = Unicycling Gorilla
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index e103c290bc9e..85afb031b676 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -414,7 +414,7 @@ config MACH_EXYNOS4_DT
         select CPU_EXYNOS4210
         select HAVE_SAMSUNG_KEYPAD if INPUT_KEYBOARD
         select PINCTRL
-        select PINCTRL_EXYNOS4
+        select PINCTRL_EXYNOS
         select USE_OF
         help
           Machine support for Samsung Exynos4 machine with device tree enabled.
diff --git a/arch/avr32/include/asm/dma-mapping.h b/arch/avr32/include/asm/dma-mapping.h
index aaf5199d8fcb..b3d18f9f3e8d 100644
--- a/arch/avr32/include/asm/dma-mapping.h
+++ b/arch/avr32/include/asm/dma-mapping.h
@@ -336,4 +336,14 @@ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
 
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
+
 #endif /* __ASM_AVR32_DMA_MAPPING_H */
diff --git a/arch/blackfin/include/asm/dma-mapping.h b/arch/blackfin/include/asm/dma-mapping.h
index bbf461076a0a..054d9ec57d9d 100644
--- a/arch/blackfin/include/asm/dma-mapping.h
+++ b/arch/blackfin/include/asm/dma-mapping.h
@@ -154,4 +154,14 @@ dma_cache_sync(struct device *dev, void *vaddr, size_t size,
         _dma_sync((dma_addr_t)vaddr, size, dir);
 }
 
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
+
 #endif                          /* _BLACKFIN_DMA_MAPPING_H */
diff --git a/arch/c6x/include/asm/dma-mapping.h b/arch/c6x/include/asm/dma-mapping.h
index 3c694065030f..88bd0d899bdb 100644
--- a/arch/c6x/include/asm/dma-mapping.h
+++ b/arch/c6x/include/asm/dma-mapping.h
@@ -89,4 +89,19 @@ extern void dma_free_coherent(struct device *, size_t, void *, dma_addr_t);
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent((d), (s), (h), (f))
 #define dma_free_noncoherent(d, s, v, h)  dma_free_coherent((d), (s), (v), (h))
 
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
+
 #endif  /* _ASM_C6X_DMA_MAPPING_H */
diff --git a/arch/cris/include/asm/dma-mapping.h b/arch/cris/include/asm/dma-mapping.h
index 8588b2ccf854..2f0f654f1b44 100644
--- a/arch/cris/include/asm/dma-mapping.h
+++ b/arch/cris/include/asm/dma-mapping.h
@@ -158,5 +158,15 @@ dma_cache_sync(struct device *dev, void *vaddr, size_t size,
 {
 }
 
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
+
 
 #endif
diff --git a/arch/frv/include/asm/dma-mapping.h b/arch/frv/include/asm/dma-mapping.h
index dfb811002c64..1746a2b8e6e7 100644
--- a/arch/frv/include/asm/dma-mapping.h
+++ b/arch/frv/include/asm/dma-mapping.h
@@ -132,4 +132,19 @@ void dma_cache_sync(struct device *dev, void *vaddr, size_t size,
         flush_write_buffers();
 }
 
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
+
 #endif  /* _ASM_DMA_MAPPING_H */
diff --git a/arch/m68k/include/asm/dma-mapping.h b/arch/m68k/include/asm/dma-mapping.h
index 3e6b8445af6a..292805f0762e 100644
--- a/arch/m68k/include/asm/dma-mapping.h
+++ b/arch/m68k/include/asm/dma-mapping.h
@@ -115,4 +115,14 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t handle)
 #include <asm-generic/dma-mapping-broken.h>
 #endif
 
+/* drivers/base/dma-mapping.c */
+extern int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
+                           void *cpu_addr, dma_addr_t dma_addr, size_t size);
+extern int dma_common_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size);
+
+#define dma_mmap_coherent(d, v, c, h, s) dma_common_mmap(d, v, c, h, s)
+#define dma_get_sgtable(d, t, v, h, s) dma_common_get_sgtable(d, t, v, h, s)
+
 #endif  /* _M68K_DMA_MAPPING_H */
diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
index d7af29f1fcf0..ba611927749b 100644
--- a/arch/mips/bcm47xx/Kconfig
+++ b/arch/mips/bcm47xx/Kconfig
@@ -8,8 +8,10 @@ config BCM47XX_SSB
         select SSB_DRIVER_EXTIF
         select SSB_EMBEDDED
         select SSB_B43_PCI_BRIDGE if PCI
+        select SSB_DRIVER_PCICORE if PCI
         select SSB_PCICORE_HOSTMODE if PCI
         select SSB_DRIVER_GPIO
+        select GPIOLIB
         default y
         help
          Add support for old Broadcom BCM47xx boards with Sonics Silicon Backplane support.
@@ -25,6 +27,7 @@ config BCM47XX_BCMA
         select BCMA_HOST_PCI if PCI
         select BCMA_DRIVER_PCI_HOSTMODE if PCI
         select BCMA_DRIVER_GPIO
+        select GPIOLIB
         default y
         help
          Add support for new Broadcom BCM47xx boards with Broadcom specific Advanced Microcontroller Bus.
diff --git a/arch/mips/cavium-octeon/executive/cvmx-l2c.c b/arch/mips/cavium-octeon/executive/cvmx-l2c.c
index 9f883bf76953..33b72144db31 100644
--- a/arch/mips/cavium-octeon/executive/cvmx-l2c.c
+++ b/arch/mips/cavium-octeon/executive/cvmx-l2c.c
@@ -30,6 +30,7 @@
  * measurement, and debugging facilities.
  */
 
+#include <linux/compiler.h>
 #include <linux/irqflags.h>
 #include <asm/octeon/cvmx.h>
 #include <asm/octeon/cvmx-l2c.h>
@@ -285,22 +286,22 @@ uint64_t cvmx_l2c_read_perf(uint32_t counter)
  */
 static void fault_in(uint64_t addr, int len)
 {
-        volatile char *ptr;
-        volatile char dummy;
+        char *ptr;
+
         /*
          * Adjust addr and length so we get all cache lines even for
          * small ranges spanning two cache lines.
          */
         len += addr & CVMX_CACHE_LINE_MASK;
         addr &= ~CVMX_CACHE_LINE_MASK;
-        ptr = (volatile char *)cvmx_phys_to_ptr(addr);
+        ptr = cvmx_phys_to_ptr(addr);
         /*
          * Invalidate L1 cache to make sure all loads result in data
          * being in L2.
          */
         CVMX_DCACHE_INVALIDATE;
         while (len > 0) {
-                dummy += *ptr;
+                ACCESS_ONCE(*ptr);
                 len -= CVMX_CACHE_LINE_SIZE;
                 ptr += CVMX_CACHE_LINE_SIZE;
         }
diff --git a/arch/mips/include/asm/dsp.h b/arch/mips/include/asm/dsp.h
index e9bfc0813c72..7bfad0520e25 100644
--- a/arch/mips/include/asm/dsp.h
+++ b/arch/mips/include/asm/dsp.h
@@ -16,7 +16,7 @@
 #include <asm/mipsregs.h>
 
 #define DSP_DEFAULT     0x00000000
-#define DSP_MASK        0x3ff
+#define DSP_MASK        0x3f
 
 #define __enable_dsp_hazard()                                           \
 do {                                                                    \
diff --git a/arch/mips/include/asm/inst.h b/arch/mips/include/asm/inst.h
index ab84064283db..33c34adbecfa 100644
--- a/arch/mips/include/asm/inst.h
+++ b/arch/mips/include/asm/inst.h
@@ -353,6 +353,7 @@ union mips_instruction {
         struct u_format u_format;
         struct c_format c_format;
         struct r_format r_format;
+        struct p_format p_format;
         struct f_format f_format;
         struct ma_format ma_format;
         struct b_format b_format;
diff --git a/arch/mips/include/asm/mach-pnx833x/war.h b/arch/mips/include/asm/mach-pnx833x/war.h
index edaa06d9d492..e410df4e1b3a 100644
--- a/arch/mips/include/asm/mach-pnx833x/war.h
+++ b/arch/mips/include/asm/mach-pnx833x/war.h
@@ -21,4 +21,4 @@
 #define R10000_LLSC_WAR                 0
 #define MIPS34K_MISSED_ITLB_WAR         0
 
-#endif /* __ASM_MIPS_MACH_PNX8550_WAR_H */
+#endif /* __ASM_MIPS_MACH_PNX833X_WAR_H */
diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
index c63191055e69..013d5f781263 100644
--- a/arch/mips/include/asm/pgtable-64.h
+++ b/arch/mips/include/asm/pgtable-64.h
@@ -230,6 +230,7 @@ static inline void pud_clear(pud_t *pudp)
 #else
 #define pte_pfn(x)              ((unsigned long)((x).pte >> _PFN_SHIFT))
 #define pfn_pte(pfn, prot)      __pte(((pfn) << _PFN_SHIFT) | pgprot_val(prot))
+#define pfn_pmd(pfn, prot)      __pmd(((pfn) << _PFN_SHIFT) | pgprot_val(prot))
 #endif
 
 #define __pgd_offset(address)   pgd_index(address)
diff --git a/arch/mips/include/uapi/asm/Kbuild b/arch/mips/include/uapi/asm/Kbuild
index a1a0452ac185..77d4fb33f75a 100644
--- a/arch/mips/include/uapi/asm/Kbuild
+++ b/arch/mips/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 header-y += auxvec.h
 header-y += bitsperlong.h
+header-y += break.h
 header-y += byteorder.h
 header-y += cachectl.h
 header-y += errno.h
diff --git a/arch/mips/include/asm/break.h b/arch/mips/include/uapi/asm/break.h
index 9161e684cb4c..9161e684cb4c 100644
--- a/arch/mips/include/asm/break.h
+++ b/arch/mips/include/uapi/asm/break.h
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 6a2d758dd8e9..83fa1460e294 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -25,6 +25,12 @@
 #define MCOUNT_OFFSET_INSNS 4
 #endif
 
+/* Arch override because MIPS doesn't need to run this from stop_machine() */
+void arch_ftrace_update_code(int command)
+{
+        ftrace_modify_all_code(command);
+}
+
 /*
  * Check if the address is in kernel space
  *
@@ -89,6 +95,24 @@ static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
         return 0;
 }
 
+#ifndef CONFIG_64BIT
+static int ftrace_modify_code_2(unsigned long ip, unsigned int new_code1,
+                                unsigned int new_code2)
+{
+        int faulted;
+
+        safe_store_code(new_code1, ip, faulted);
+        if (unlikely(faulted))
+                return -EFAULT;
+        ip += 4;
+        safe_store_code(new_code2, ip, faulted);
+        if (unlikely(faulted))
+                return -EFAULT;
+        flush_icache_range(ip, ip + 8); /* original ip + 12 */
+        return 0;
+}
+#endif
+
 /*
  * The details about the calling site of mcount on MIPS
  *
@@ -131,8 +155,18 @@ int ftrace_make_nop(struct module *mod,
          * needed.
          */
         new = in_kernel_space(ip) ? INSN_NOP : INSN_B_1F;
-
+#ifdef CONFIG_64BIT
         return ftrace_modify_code(ip, new);
+#else
+        /*
+         * On 32 bit MIPS platforms, gcc adds a stack adjust
+         * instruction in the delay slot after the branch to
+         * mcount and expects mcount to restore the sp on return.
+         * This is based on a legacy API and does nothing but
+         * waste instructions so it's being removed at runtime.
+         */
+        return ftrace_modify_code_2(ip, new, INSN_NOP);
+#endif
 }
 
 int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
index 4c968e7efb74..165867673357 100644
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -46,9 +46,8 @@
         PTR_L   a5, PT_R9(sp)
         PTR_L   a6, PT_R10(sp)
         PTR_L   a7, PT_R11(sp)
-        PTR_ADDIU       sp, PT_SIZE
 #else
-        PTR_ADDIU       sp, (PT_SIZE + 8)
+        PTR_ADDIU       sp, PT_SIZE
 #endif
 .endm
 
@@ -69,7 +68,9 @@ NESTED(ftrace_caller, PT_SIZE, ra)
         .globl _mcount
 _mcount:
         b       ftrace_stub
-         nop
+        addiu sp,sp,8
+
+        /* When tracing is activated, it calls ftrace_caller+8 (aka here) */
         lw      t1, function_trace_stop
         bnez    t1, ftrace_stub
          nop
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index eec690af6581..147cec19621d 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -705,7 +705,7 @@ static int vpe_run(struct vpe * v)
 
                         printk(KERN_WARNING
                                "VPE loader: TC %d is already in use.\n",
-                               t->index);
+                               v->tc->index);
                         return -ENOEXEC;
                 }
         } else {
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index f36acd1b3808..a7935bf0fecb 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -408,7 +408,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
 #endif
 
         /* tell oprofile which irq to use */
-        cp0_perfcount_irq = LTQ_PERF_IRQ;
+        cp0_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
 
         /*
          * if the timer irq is not one of the mips irqs we need to
diff --git a/arch/mips/lib/delay.c b/arch/mips/lib/delay.c
index dc81ca8dc0dd..288f7954988d 100644
--- a/arch/mips/lib/delay.c
+++ b/arch/mips/lib/delay.c
@@ -21,7 +21,7 @@ void __delay(unsigned long loops)
         "       .set    noreorder                               \n"
         "       .align  3                                       \n"
         "1:     bnez    %0, 1b                                  \n"
-#if __SIZEOF_LONG__ == 4
+#if BITS_PER_LONG == 32
         "       subu    %0, 1                                   \n"
 #else
         "       dsubu   %0, 1                                   \n"
diff --git a/arch/mips/mm/ioremap.c b/arch/mips/mm/ioremap.c
index 7657fd21cd3f..cacfd31e8ec9 100644
--- a/arch/mips/mm/ioremap.c
+++ b/arch/mips/mm/ioremap.c
@@ -190,9 +190,3 @@ void __iounmap(const volatile void __iomem *addr)
 
 EXPORT_SYMBOL(__ioremap);
 EXPORT_SYMBOL(__iounmap);
-
-int __virt_addr_valid(const volatile void *kaddr)
-{
-        return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
-}
-EXPORT_SYMBOL_GPL(__virt_addr_valid);
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index d9be7540a6be..7e5fe2790d8a 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -192,3 +192,9 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 
         return ret;
 }
+
+int __virt_addr_valid(const volatile void *kaddr)
+{
+        return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
+}
+EXPORT_SYMBOL_GPL(__virt_addr_valid);
diff --git a/arch/mips/netlogic/xlr/setup.c b/arch/mips/netlogic/xlr/setup.c
index 4e7f49d3d5a8..c5ce6992ac4c 100644
--- a/arch/mips/netlogic/xlr/setup.c
+++ b/arch/mips/netlogic/xlr/setup.c
@@ -193,8 +193,11 @@ static void nlm_init_node(void)
 
 void __init prom_init(void)
 {
-        int i, *argv, *envp;            /* passed as 32 bit ptrs */
+        int *argv, *envp;               /* passed as 32 bit ptrs */
         struct psb_info *prom_infop;
+#ifdef CONFIG_SMP
+        int i;
+#endif
 
         /* truncate to 32 bit and sign extend all args */
         argv = (int *)(long)(int)fw_arg1;
diff --git a/arch/mips/pci/pci-ar71xx.c b/arch/mips/pci/pci-ar71xx.c
index 1552522b8718..6eaa4f2d0e38 100644
--- a/arch/mips/pci/pci-ar71xx.c
+++ b/arch/mips/pci/pci-ar71xx.c
@@ -24,7 +24,7 @@
 #include <asm/mach-ath79/pci.h>
 
 #define AR71XX_PCI_MEM_BASE     0x10000000
-#define AR71XX_PCI_MEM_SIZE     0x08000000
+#define AR71XX_PCI_MEM_SIZE     0x07000000
 
 #define AR71XX_PCI_WIN0_OFFS            0x10000000
 #define AR71XX_PCI_WIN1_OFFS            0x11000000
diff --git a/arch/mips/pci/pci-ar724x.c b/arch/mips/pci/pci-ar724x.c
index 86d77a666458..c11c75be2d7e 100644
--- a/arch/mips/pci/pci-ar724x.c
+++ b/arch/mips/pci/pci-ar724x.c
@@ -21,7 +21,7 @@
 #define AR724X_PCI_CTRL_SIZE    0x100
 
 #define AR724X_PCI_MEM_BASE     0x10000000
-#define AR724X_PCI_MEM_SIZE     0x08000000
+#define AR724X_PCI_MEM_SIZE     0x04000000
 
 #define AR724X_PCI_REG_RESET            0x18
 #define AR724X_PCI_REG_INT_STATUS       0x4c
diff --git a/arch/mn10300/include/asm/dma-mapping.h b/arch/mn10300/include/asm/dma-mapping.h
index c1be4397b1ed..a18abfc558eb 100644
--- a/arch/mn10300/include/asm/dma-mapping.h
+++ b/arch/mn10300/include/asm/dma-mapping.h
@@ -168,4 +168,19 @@ void dma_cache_sync(void *vaddr, size_t size,
         mn10300_dcache_flush_inv();
 }
 
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
+
 #endif
diff --git a/arch/parisc/include/asm/dma-mapping.h b/arch/parisc/include/asm/dma-mapping.h
index 467bbd510eac..106b395688e1 100644
--- a/arch/parisc/include/asm/dma-mapping.h
+++ b/arch/parisc/include/asm/dma-mapping.h
@@ -238,4 +238,19 @@ void * sba_get_iommu(struct parisc_device *dev);
 /* At the moment, we panic on error for IOMMU resource exaustion */
 #define dma_mapping_error(dev, x)       0
 
+/* This API cannot be supported on PA-RISC */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
+
 #endif
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index d22e73e4618b..e514de57a125 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -439,6 +439,8 @@ ret_from_fork:
 ret_from_kernel_thread:
         REST_NVGPRS(r1)
         bl      schedule_tail
+        li      r3,0
+        stw     r3,0(r1)
         mtlr    r14
         mr      r3,r15
         PPC440EP_ERR42
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index b310a0573625..3d990d3bd8ba 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -664,6 +664,19 @@ resume_kernel:
         ld      r4,TI_FLAGS(r9)
         andi.   r0,r4,_TIF_NEED_RESCHED
         bne     1b
+
+        /*
+         * arch_local_irq_restore() from preempt_schedule_irq above may
+         * enable hard interrupt but we really should disable interrupts
+         * when we return from the interrupt, and so that we don't get
+         * interrupted after loading SRR0/1.
+         */
+#ifdef CONFIG_PPC_BOOK3E
+        wrteei  0
+#else
+        ld      r10,PACAKMSR(r13) /* Get kernel MSR without EE */
+        mtmsrd  r10,1             /* Update machine state */
+#endif /* CONFIG_PPC_BOOK3E */
 #endif /* CONFIG_PREEMPT */
 
         .globl  fast_exc_return_irq
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index c470a40b29f5..a7bc7521c064 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -154,12 +154,12 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
 static int kgdb_singlestep(struct pt_regs *regs)
 {
         struct thread_info *thread_info, *exception_thread_info;
-        struct thread_info *backup_current_thread_info = \
-                (struct thread_info *)kmalloc(sizeof(struct thread_info), GFP_KERNEL);
+        struct thread_info *backup_current_thread_info;
 
         if (user_mode(regs))
                 return 0;
 
+        backup_current_thread_info = (struct thread_info *)kmalloc(sizeof(struct thread_info), GFP_KERNEL);
         /*
          * On Book E and perhaps other processors, singlestep is handled on
          * the critical exception stack.  This causes current_thread_info()
@@ -185,6 +185,7 @@ static int kgdb_singlestep(struct pt_regs *regs)
                 /* Restore current_thread_info lastly. */
                 memcpy(exception_thread_info, backup_current_thread_info, sizeof *thread_info);
 
+        kfree(backup_current_thread_info);
         return 1;
 }
 
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 6f6b1cccc916..127361e093f4 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -494,10 +494,15 @@ void timer_interrupt(struct pt_regs * regs)
         set_dec(DECREMENTER_MAX);
 
         /* Some implementations of hotplug will get timer interrupts while
-         * offline, just ignore these
+         * offline, just ignore these and we also need to set
+         * decrementers_next_tb as MAX to make sure __check_irq_replay
+         * don't replay timer interrupt when return, otherwise we'll trap
+         * here infinitely :(
          */
-        if (!cpu_online(smp_processor_id()))
+        if (!cpu_online(smp_processor_id())) {
+                *next_tb = ~(u64)0;
                 return;
+        }
 
         /* Conditionally hard-enable interrupts now that the DEC has been
          * bumped to its maximum value
diff --git a/arch/powerpc/mm/hash_low_64.S b/arch/powerpc/mm/hash_low_64.S
index 56585086413a..7443481a315c 100644
--- a/arch/powerpc/mm/hash_low_64.S
+++ b/arch/powerpc/mm/hash_low_64.S
@@ -115,11 +115,13 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
         sldi    r29,r5,SID_SHIFT - VPN_SHIFT
         rldicl  r28,r3,64 - VPN_SHIFT,64 - (SID_SHIFT - VPN_SHIFT)
         or      r29,r28,r29
-
-        /* Calculate hash value for primary slot and store it in r28 */
-        rldicl  r5,r5,0,25              /* vsid & 0x0000007fffffffff */
-        rldicl  r0,r3,64-12,48          /* (ea >> 12) & 0xffff */
-        xor     r28,r5,r0
+        /*
+         * Calculate hash value for primary slot and store it in r28
+         * r3 = va, r5 = vsid
+         * r0 = (va >> 12) & ((1ul << (28 - 12)) -1)
+         */
+        rldicl  r0,r3,64-12,48
+        xor     r28,r5,r0               /* hash */
         b       4f
 
 3:      /* Calc vpn and put it in r29 */
@@ -130,11 +132,12 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
         /*
          * calculate hash value for primary slot and
          * store it in r28 for 1T segment
+         * r3 = va, r5 = vsid
          */
-        rldic   r28,r5,25,25            /* (vsid << 25) & 0x7fffffffff */
-        clrldi  r5,r5,40                /* vsid & 0xffffff */
-        rldicl  r0,r3,64-12,36          /* (ea >> 12) & 0xfffffff */
-        xor     r28,r28,r5
+        sldi    r28,r5,25               /* vsid << 25 */
+        /* r0 =  (va >> 12) & ((1ul << (40 - 12)) -1) */
+        rldicl  r0,r3,64-12,36
+        xor     r28,r28,r5              /* vsid ^ ( vsid << 25) */
         xor     r28,r28,r0              /* hash */
 
         /* Convert linux PTE bits into HW equivalents */
@@ -407,11 +410,13 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
          */
         rldicl  r28,r3,64 - VPN_SHIFT,64 - (SID_SHIFT - VPN_SHIFT)
         or      r29,r28,r29
-
-        /* Calculate hash value for primary slot and store it in r28 */
-        rldicl  r5,r5,0,25              /* vsid & 0x0000007fffffffff */
-        rldicl  r0,r3,64-12,48          /* (ea >> 12) & 0xffff */
-        xor     r28,r5,r0
+        /*
+         * Calculate hash value for primary slot and store it in r28
+         * r3 = va, r5 = vsid
+         * r0 = (va >> 12) & ((1ul << (28 - 12)) -1)
+         */
+        rldicl  r0,r3,64-12,48
+        xor     r28,r5,r0               /* hash */
         b       4f
 
 3:      /* Calc vpn and put it in r29 */
@@ -426,11 +431,12 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
         /*
          * Calculate hash value for primary slot and
          * store it in r28  for 1T segment
+         * r3 = va, r5 = vsid
          */
-        rldic   r28,r5,25,25            /* (vsid << 25) & 0x7fffffffff */
-        clrldi  r5,r5,40                /* vsid & 0xffffff */
-        rldicl  r0,r3,64-12,36          /* (ea >> 12) & 0xfffffff */
-        xor     r28,r28,r5
+        sldi    r28,r5,25               /* vsid << 25 */
+        /* r0 = (va >> 12) & ((1ul << (40 - 12)) -1) */
+        rldicl  r0,r3,64-12,36
+        xor     r28,r28,r5              /* vsid ^ ( vsid << 25) */
         xor     r28,r28,r0              /* hash */
 
         /* Convert linux PTE bits into HW equivalents */
@@ -752,25 +758,27 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
         rldicl  r28,r3,64 - VPN_SHIFT,64 - (SID_SHIFT - VPN_SHIFT)
         or      r29,r28,r29
 
-        /* Calculate hash value for primary slot and store it in r28 */
-        rldicl  r5,r5,0,25              /* vsid & 0x0000007fffffffff */
-        rldicl  r0,r3,64-16,52          /* (ea >> 16) & 0xfff */
-        xor     r28,r5,r0
+        /* Calculate hash value for primary slot and store it in r28
+         * r3 = va, r5 = vsid
+         * r0 = (va >> 16) & ((1ul << (28 - 16)) -1)
+         */
+        rldicl  r0,r3,64-16,52
+        xor     r28,r5,r0               /* hash */
         b       4f
 
 3:      /* Calc vpn and put it in r29 */
         sldi    r29,r5,SID_SHIFT_1T - VPN_SHIFT
         rldicl  r28,r3,64 - VPN_SHIFT,64 - (SID_SHIFT_1T - VPN_SHIFT)
         or      r29,r28,r29
-
         /*
          * calculate hash value for primary slot and
          * store it in r28 for 1T segment
+         * r3 = va, r5 = vsid
          */
-        rldic   r28,r5,25,25            /* (vsid << 25) & 0x7fffffffff */
-        clrldi  r5,r5,40                /* vsid & 0xffffff */
-        rldicl  r0,r3,64-16,40          /* (ea >> 16) & 0xffffff */
-        xor     r28,r28,r5
+        sldi    r28,r5,25               /* vsid << 25 */
+        /* r0 = (va >> 16) & ((1ul << (40 - 16)) -1) */
+        rldicl  r0,r3,64-16,40
+        xor     r28,r28,r5              /* vsid ^ ( vsid << 25) */
         xor     r28,r28,r0              /* hash */
 
         /* Convert linux PTE bits into HW equivalents */
diff --git a/arch/powerpc/oprofile/op_model_power4.c b/arch/powerpc/oprofile/op_model_power4.c
index 315f9495e9b2..f444b94935f5 100644
--- a/arch/powerpc/oprofile/op_model_power4.c
+++ b/arch/powerpc/oprofile/op_model_power4.c
@@ -52,7 +52,7 @@ static int power7_marked_instr_event(u64 mmcr1)
         for (pmc = 0; pmc < 4; pmc++) {
                 psel = mmcr1 & (OPROFILE_PM_PMCSEL_MSK
                                 << (OPROFILE_MAX_PMC_NUM - pmc)
-                                * OPROFILE_MAX_PMC_NUM);
+                                * OPROFILE_PMSEL_FIELD_WIDTH);
                 psel = (psel >> ((OPROFILE_MAX_PMC_NUM - pmc)
                                  * OPROFILE_PMSEL_FIELD_WIDTH)) & ~1ULL;
                 unit = mmcr1 & (OPROFILE_PM_UNIT_MSK
diff --git a/arch/powerpc/platforms/pasemi/cpufreq.c b/arch/powerpc/platforms/pasemi/cpufreq.c
index 95d00173029f..890f30e70f98 100644
--- a/arch/powerpc/platforms/pasemi/cpufreq.c
+++ b/arch/powerpc/platforms/pasemi/cpufreq.c
@@ -236,6 +236,13 @@ out:
 
 static int pas_cpufreq_cpu_exit(struct cpufreq_policy *policy)
 {
+        /*
+         * We don't support CPU hotplug. Don't unmap after the system
+         * has already made it to a running state.
+         */
+        if (system_state != SYSTEM_BOOTING)
+                return 0;
+
         if (sdcasr_mapbase)
                 iounmap(sdcasr_mapbase);
         if (sdcpwr_mapbase)
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index c1d7930a82f4..098adbb62660 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1365,6 +1365,18 @@ static inline void pmdp_invalidate(struct vm_area_struct *vma,
         __pmd_idte(address, pmdp);
 }
 
+#define __HAVE_ARCH_PMDP_SET_WRPROTECT
+static inline void pmdp_set_wrprotect(struct mm_struct *mm,
+                                      unsigned long address, pmd_t *pmdp)
+{
+        pmd_t pmd = *pmdp;
+
+        if (pmd_write(pmd)) {
+                __pmd_idte(address, pmdp);
+                set_pmd_at(mm, address, pmdp, pmd_wrprotect(pmd));
+        }
+}
+
 static inline pmd_t mk_pmd_phys(unsigned long physpage, pgprot_t pgprot)
 {
         pmd_t __pmd;
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 79795af59810..225543bf45a5 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2138,6 +2138,7 @@ config OLPC_XO1_RTC
 config OLPC_XO1_SCI
         bool "OLPC XO-1 SCI extras"
         depends on OLPC && OLPC_XO1_PM
+        depends on INPUT=y
         select POWER_SUPPLY
         select GPIO_CS5535
         select MFD_CORE
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index ccce0ed67dde..379814bc41e3 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -71,7 +71,7 @@ GCOV_PROFILE := n
 $(obj)/bzImage: asflags-y  := $(SVGA_MODE)
 
 quiet_cmd_image = BUILD   $@
-cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin > $@
+cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/zoffset.h > $@
 
 $(obj)/bzImage: $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/tools/build FORCE
         $(call if_changed,image)
@@ -92,7 +92,7 @@ targets += voffset.h
 $(obj)/voffset.h: vmlinux FORCE
         $(call if_changed,voffset)
 
-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) . \(startup_32\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+sed-zoffset := -e 's/^\([0-9a-fA-F]*\) . \(startup_32\|startup_64\|efi_pe_entry\|efi_stub_entry\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
 
 quiet_cmd_zoffset = ZOFFSET $@
       cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index 18e329ca108e..f8fa41190c35 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -256,10 +256,10 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
         int i;
         struct setup_data *data;
 
-        data = (struct setup_data *)params->hdr.setup_data;
+        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
 
         while (data && data->next)
-                data = (struct setup_data *)data->next;
+                data = (struct setup_data *)(unsigned long)data->next;
 
         status = efi_call_phys5(sys_table->boottime->locate_handle,
                                 EFI_LOCATE_BY_PROTOCOL, &pci_proto,
@@ -295,16 +295,18 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
                 if (!pci)
                         continue;
 
+#ifdef CONFIG_X86_64
                 status = efi_call_phys4(pci->attributes, pci,
                                         EfiPciIoAttributeOperationGet, 0,
                                         &attributes);
-
+#else
+                status = efi_call_phys5(pci->attributes, pci,
+                                        EfiPciIoAttributeOperationGet, 0, 0,
+                                        &attributes);
+#endif
                 if (status != EFI_SUCCESS)
                         continue;
 
-                if (!(attributes & EFI_PCI_IO_ATTRIBUTE_EMBEDDED_ROM))
-                        continue;
-
                 if (!pci->romimage || !pci->romsize)
                         continue;
 
@@ -345,9 +347,9 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
                 memcpy(rom->romdata, pci->romimage, pci->romsize);
 
                 if (data)
-                        data->next = (uint64_t)rom;
+                        data->next = (unsigned long)rom;
                 else
-                        params->hdr.setup_data = (uint64_t)rom;
+                        params->hdr.setup_data = (unsigned long)rom;
 
                 data = (struct setup_data *)rom;
 
@@ -432,10 +434,9 @@ static efi_status_t setup_gop(struct screen_info *si, efi_guid_t *proto,
                          * Once we've found a GOP supporting ConOut,
                          * don't bother looking any further.
                          */
+                        first_gop = gop;
                         if (conout_found)
                                 break;
-
-                        first_gop = gop;
                 }
         }
 
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index aa4aaf1b2380..1e3184f6072f 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -35,11 +35,11 @@ ENTRY(startup_32)
 #ifdef CONFIG_EFI_STUB
         jmp     preferred_addr
 
-        .balign 0x10
         /*
          * We don't need the return address, so set up the stack so
-         * efi_main() can find its arugments.
+         * efi_main() can find its arguments.
          */
+ENTRY(efi_pe_entry)
         add     $0x4, %esp
 
         call    make_boot_params
@@ -50,8 +50,10 @@ ENTRY(startup_32)
         pushl   %eax
         pushl   %esi
         pushl   %ecx
+        sub     $0x4, %esp
 
-        .org 0x30,0x90
+ENTRY(efi_stub_entry)
+        add     $0x4, %esp
         call    efi_main
         cmpl    $0, %eax
         movl    %eax, %esi
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 2c4b171eec33..f5d1aaa0dec8 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -201,12 +201,12 @@ ENTRY(startup_64)
          */
 #ifdef CONFIG_EFI_STUB
         /*
-         * The entry point for the PE/COFF executable is 0x210, so only
-         * legacy boot loaders will execute this jmp.
+         * The entry point for the PE/COFF executable is efi_pe_entry, so
+         * only legacy boot loaders will execute this jmp.
          */
         jmp     preferred_addr
 
-        .org 0x210
+ENTRY(efi_pe_entry)
         mov     %rcx, %rdi
         mov     %rdx, %rsi
         pushq   %rdi
@@ -218,7 +218,7 @@ ENTRY(startup_64)
         popq    %rsi
         popq    %rdi
 
-        .org 0x230,0x90
+ENTRY(efi_stub_entry)
         call    efi_main
         movq    %rax,%rsi
         cmpq    $0,%rax
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 8c132a625b94..944ce595f767 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -21,6 +21,7 @@
 #include <asm/e820.h>
 #include <asm/page_types.h>
 #include <asm/setup.h>
+#include <asm/bootparam.h>
 #include "boot.h"
 #include "voffset.h"
 #include "zoffset.h"
@@ -255,6 +256,9 @@ section_table:
         # header, from the old boot sector.
 
         .section ".header", "a"
+        .globl  sentinel
+sentinel:       .byte 0xff, 0xff        /* Used to detect broken loaders */
+
         .globl  hdr
 hdr:
 setup_sects:    .byte 0                 /* Filled in by build.c */
@@ -279,7 +283,7 @@ _start:
         # Part 2 of the header, from the old setup.S
 
                 .ascii  "HdrS"          # header signature
-                .word   0x020b          # header version number (>= 0x0105)
+                .word   0x020c          # header version number (>= 0x0105)
                                         # or else old loadlin-1.5 will fail)
                 .globl realmode_swtch
 realmode_swtch: .word   0, 0            # default_switch, SETUPSEG
@@ -297,13 +301,7 @@ type_of_loader:	.byte	0		# 0 means ancient bootloader, newer
 
 # flags, unused bits must be zero (RFU) bit within loadflags
 loadflags:
-LOADED_HIGH     = 1                     # If set, the kernel is loaded high
-CAN_USE_HEAP    = 0x80                  # If set, the loader also has set
-                                        # heap_end_ptr to tell how much
-                                        # space behind setup.S can be used for
-                                        # heap purposes.
-                                        # Only the loader knows what is free
-                .byte   LOADED_HIGH
+                .byte   LOADED_HIGH     # The kernel is to be loaded high
 
 setup_move_size: .word  0x8000          # size to move, when setup is not
                                         # loaded at 0x90000. We will move setup
@@ -369,7 +367,23 @@ relocatable_kernel:    .byte 1
 relocatable_kernel:    .byte 0
 #endif
 min_alignment:          .byte MIN_KERNEL_ALIGN_LG2      # minimum alignment
-pad3:                   .word 0
+
+xloadflags:
+#ifdef CONFIG_X86_64
+# define XLF0 XLF_KERNEL_64                     /* 64-bit kernel */
+#else
+# define XLF0 0
+#endif
+#ifdef CONFIG_EFI_STUB
+# ifdef CONFIG_X86_64
+#  define XLF23 XLF_EFI_HANDOVER_64             /* 64-bit EFI handover ok */
+# else
+#  define XLF23 XLF_EFI_HANDOVER_32             /* 32-bit EFI handover ok */
+# endif
+#else
+# define XLF23 0
+#endif
+                        .word XLF0 | XLF23
 
 cmdline_size:   .long   COMMAND_LINE_SIZE-1     #length of the command line,
                                                 #added with boot protocol
@@ -397,8 +411,13 @@ pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
 #define INIT_SIZE VO_INIT_SIZE
 #endif
 init_size:              .long INIT_SIZE         # kernel initialization size
-handover_offset:        .long 0x30              # offset to the handover
+handover_offset:
+#ifdef CONFIG_EFI_STUB
+                        .long 0x30              # offset to the handover
                                                 # protocol entry point
+#else
+                        .long 0
+#endif
 
 # End of setup header #####################################################
 
diff --git a/arch/x86/boot/setup.ld b/arch/x86/boot/setup.ld
index 03c0683636b6..96a6c7563538 100644
--- a/arch/x86/boot/setup.ld
+++ b/arch/x86/boot/setup.ld
@@ -13,7 +13,7 @@ SECTIONS
         .bstext         : { *(.bstext) }
         .bsdata         : { *(.bsdata) }
 
-        . = 497;
+        . = 495;
         .header         : { *(.header) }
         .entrytext      : { *(.entrytext) }
         .inittext       : { *(.inittext) }
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 4b8e165ee572..94c544650020 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -52,6 +52,10 @@ int is_big_kernel;
 
 #define PECOFF_RELOC_RESERVE 0x20
 
+unsigned long efi_stub_entry;
+unsigned long efi_pe_entry;
+unsigned long startup_64;
+
 /*----------------------------------------------------------------------*/
 
 static const u32 crctab32[] = {
@@ -132,7 +136,7 @@ static void die(const char * str, ...)
 
 static void usage(void)
 {
-        die("Usage: build setup system [> image]");
+        die("Usage: build setup system [zoffset.h] [> image]");
 }
 
 #ifdef CONFIG_EFI_STUB
@@ -206,30 +210,54 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
          */
         put_unaligned_le32(file_sz - 512, &buf[pe_header + 0x1c]);
 
-#ifdef CONFIG_X86_32
         /*
-         * Address of entry point.
-         *
-         * The EFI stub entry point is +16 bytes from the start of
-         * the .text section.
+         * Address of entry point for PE/COFF executable
          */
-        put_unaligned_le32(text_start + 16, &buf[pe_header + 0x28]);
-#else
-        /*
-         * Address of entry point. startup_32 is at the beginning and
-         * the 64-bit entry point (startup_64) is always 512 bytes
-         * after. The EFI stub entry point is 16 bytes after that, as
-         * the first instruction allows legacy loaders to jump over
-         * the EFI stub initialisation
-         */
-        put_unaligned_le32(text_start + 528, &buf[pe_header + 0x28]);
-#endif /* CONFIG_X86_32 */
+        put_unaligned_le32(text_start + efi_pe_entry, &buf[pe_header + 0x28]);
 
         update_pecoff_section_header(".text", text_start, text_sz);
 }
 
 #endif /* CONFIG_EFI_STUB */
 
+
+/*
+ * Parse zoffset.h and find the entry points. We could just #include zoffset.h
+ * but that would mean tools/build would have to be rebuilt every time. It's
+ * not as if parsing it is hard...
+ */
+#define PARSE_ZOFS(p, sym) do { \
+        if (!strncmp(p, "#define ZO_" #sym " ", 11+sizeof(#sym)))       \
+                sym = strtoul(p + 11 + sizeof(#sym), NULL, 16);         \
+} while (0)
+
+static void parse_zoffset(char *fname)
+{
+        FILE *file;
+        char *p;
+        int c;
+
+        file = fopen(fname, "r");
+        if (!file)
+                die("Unable to open `%s': %m", fname);
+        c = fread(buf, 1, sizeof(buf) - 1, file);
+        if (ferror(file))
+                die("read-error on `zoffset.h'");
+        buf[c] = 0;
+
+        p = (char *)buf;
+
+        while (p && *p) {
+                PARSE_ZOFS(p, efi_stub_entry);
+                PARSE_ZOFS(p, efi_pe_entry);
+                PARSE_ZOFS(p, startup_64);
+
+                p = strchr(p, '\n');
+                while (p && (*p == '\r' || *p == '\n'))
+                        p++;
+        }
+}
+
 int main(int argc, char ** argv)
 {
         unsigned int i, sz, setup_sectors;
@@ -241,7 +269,19 @@ int main(int argc, char ** argv)
         void *kernel;
         u32 crc = 0xffffffffUL;
 
-        if (argc != 3)
+        /* Defaults for old kernel */
+#ifdef CONFIG_X86_32
+        efi_pe_entry = 0x10;
+        efi_stub_entry = 0x30;
+#else
+        efi_pe_entry = 0x210;
+        efi_stub_entry = 0x230;
+        startup_64 = 0x200;
+#endif
+
+        if (argc == 4)
+                parse_zoffset(argv[3]);
+        else if (argc != 3)
                 usage();
 
         /* Copy the setup code */
@@ -299,6 +339,11 @@ int main(int argc, char ** argv)
 
 #ifdef CONFIG_EFI_STUB
         update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+
+#ifdef CONFIG_X86_64 /* Yes, this is really how we defined it :( */
+        efi_stub_entry -= 0x200;
+#endif
+        put_unaligned_le32(efi_stub_entry, &buf[0x264]);
 #endif
 
         crc = partial_crc32(buf, i, crc);
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 102ff7cb3e41..142c4ceff112 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -207,7 +207,7 @@ sysexit_from_sys_call:
         testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
         jnz ia32_ret_from_sys_call
         TRACE_IRQS_ON
-        sti
+        ENABLE_INTERRUPTS(CLBR_NONE)
         movl %eax,%esi          /* second arg, syscall return value */
         cmpl $-MAX_ERRNO,%eax   /* is it an error ? */
         jbe 1f
@@ -217,7 +217,7 @@ sysexit_from_sys_call:
         call __audit_syscall_exit
         movq RAX-ARGOFFSET(%rsp),%rax   /* reload syscall return value */
         movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
-        cli
+        DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
         testl %edi,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
         jz \exit
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 6e8fdf5ad113..28677c55113f 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -94,6 +94,7 @@ extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
 #endif /* CONFIG_X86_32 */
 
 extern int add_efi_memmap;
+extern unsigned long x86_efi_facility;
 extern void efi_set_executable(efi_memory_desc_t *md, bool executable);
 extern int efi_memblock_x86_reserve_range(void);
 extern void efi_call_phys_prelog(void);
diff --git a/arch/x86/include/asm/uv/uv.h b/arch/x86/include/asm/uv/uv.h
index b47c2a82ff15..062921ef34e9 100644
--- a/arch/x86/include/asm/uv/uv.h
+++ b/arch/x86/include/asm/uv/uv.h
@@ -16,7 +16,7 @@ extern void uv_system_init(void);
 extern const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
                                                  struct mm_struct *mm,
                                                  unsigned long start,
-                                                 unsigned end,
+                                                 unsigned long end,
                                                  unsigned int cpu);
 
 #else   /* X86_UV */
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 92862cd90201..c15ddaf90710 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -1,6 +1,31 @@
 #ifndef _ASM_X86_BOOTPARAM_H
 #define _ASM_X86_BOOTPARAM_H
 
+/* setup_data types */
+#define SETUP_NONE                      0
+#define SETUP_E820_EXT                  1
+#define SETUP_DTB                       2
+#define SETUP_PCI                       3
+
+/* ram_size flags */
+#define RAMDISK_IMAGE_START_MASK        0x07FF
+#define RAMDISK_PROMPT_FLAG             0x8000
+#define RAMDISK_LOAD_FLAG               0x4000
+
+/* loadflags */
+#define LOADED_HIGH     (1<<0)
+#define QUIET_FLAG      (1<<5)
+#define KEEP_SEGMENTS   (1<<6)
+#define CAN_USE_HEAP    (1<<7)
+
+/* xloadflags */
+#define XLF_KERNEL_64                   (1<<0)
+#define XLF_CAN_BE_LOADED_ABOVE_4G      (1<<1)
+#define XLF_EFI_HANDOVER_32             (1<<2)
+#define XLF_EFI_HANDOVER_64             (1<<3)
+
+#ifndef __ASSEMBLY__
+
 #include <linux/types.h>
 #include <linux/screen_info.h>
 #include <linux/apm_bios.h>
@@ -9,12 +34,6 @@
 #include <asm/ist.h>
 #include <video/edid.h>
 
-/* setup data types */
-#define SETUP_NONE                      0
-#define SETUP_E820_EXT                  1
-#define SETUP_DTB                       2
-#define SETUP_PCI                       3
-
 /* extensible setup data list node */
 struct setup_data {
         __u64 next;
@@ -28,9 +47,6 @@ struct setup_header {
         __u16   root_flags;
         __u32   syssize;
         __u16   ram_size;
-#define RAMDISK_IMAGE_START_MASK        0x07FF
-#define RAMDISK_PROMPT_FLAG             0x8000
-#define RAMDISK_LOAD_FLAG               0x4000
         __u16   vid_mode;
         __u16   root_dev;
         __u16   boot_flag;
@@ -42,10 +58,6 @@ struct setup_header {
         __u16   kernel_version;
         __u8    type_of_loader;
         __u8    loadflags;
-#define LOADED_HIGH     (1<<0)
-#define QUIET_FLAG      (1<<5)
-#define KEEP_SEGMENTS   (1<<6)
-#define CAN_USE_HEAP    (1<<7)
         __u16   setup_move_size;
         __u32   code32_start;
         __u32   ramdisk_image;
@@ -58,7 +70,8 @@ struct setup_header {
         __u32   initrd_addr_max;
         __u32   kernel_alignment;
         __u8    relocatable_kernel;
-        __u8    _pad2[3];
+        __u8    min_alignment;
+        __u16   xloadflags;
         __u32   cmdline_size;
         __u32   hardware_subarch;
         __u64   hardware_subarch_data;
@@ -106,7 +119,10 @@ struct boot_params {
         __u8  hd1_info[16];     /* obsolete! */         /* 0x090 */
         struct sys_desc_table sys_desc_table;           /* 0x0a0 */
         struct olpc_ofw_header olpc_ofw_header;         /* 0x0b0 */
-        __u8  _pad4[128];                               /* 0x0c0 */
+        __u32 ext_ramdisk_image;                        /* 0x0c0 */
+        __u32 ext_ramdisk_size;                         /* 0x0c4 */
+        __u32 ext_cmd_line_ptr;                         /* 0x0c8 */
+        __u8  _pad4[116];                               /* 0x0cc */
         struct edid_info edid_info;                     /* 0x140 */
         struct efi_info efi_info;                       /* 0x1c0 */
         __u32 alt_mem_k;                                /* 0x1e0 */
@@ -115,7 +131,20 @@ struct boot_params {
         __u8  eddbuf_entries;                           /* 0x1e9 */
         __u8  edd_mbr_sig_buf_entries;                  /* 0x1ea */
         __u8  kbd_status;                               /* 0x1eb */
-        __u8  _pad6[5];                                 /* 0x1ec */
+        __u8  _pad5[3];                                 /* 0x1ec */
+        /*
+         * The sentinel is set to a nonzero value (0xff) in header.S.
+         *
+         * A bootloader is supposed to only take setup_header and put
+         * it into a clean boot_params buffer. If it turns out that
+         * it is clumsy or too generous with the buffer, it most
+         * probably will pick up the sentinel variable too. The fact
+         * that this variable then is still 0xff will let kernel
+         * know that some variables in boot_params are invalid and
+         * kernel should zero out certain portions of boot_params.
+         */
+        __u8  sentinel;                                 /* 0x1ef */
+        __u8  _pad6[1];                                 /* 0x1f0 */
         struct setup_header hdr;    /* setup header */  /* 0x1f1 */
         __u8  _pad7[0x290-0x1f1-sizeof(struct setup_header)];
         __u32 edd_mbr_sig_buffer[EDD_MBR_SIG_MAX];      /* 0x290 */
@@ -134,6 +163,6 @@ enum {
         X86_NR_SUBARCHS,
 };
 
-
+#endif /* __ASSEMBLY__ */
 
 #endif /* _ASM_X86_BOOTPARAM_H */
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index fe9edec6698a..84c1309c4c0c 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -298,8 +298,7 @@ struct _cache_attr {
                          unsigned int);
 };
 
-#ifdef CONFIG_AMD_NB
-
+#if defined(CONFIG_AMD_NB) && defined(CONFIG_SYSFS)
 /*
  * L3 cache descriptors
  */
@@ -524,9 +523,9 @@ store_subcaches(struct _cpuid4_info *this_leaf, const char *buf, size_t count,
 static struct _cache_attr subcaches =
         __ATTR(subcaches, 0644, show_subcaches, store_subcaches);
 
-#else   /* CONFIG_AMD_NB */
+#else
 #define amd_init_l3_cache(x, y)
-#endif /* CONFIG_AMD_NB */
+#endif  /* CONFIG_AMD_NB && CONFIG_SYSFS */
 
 static int
 __cpuinit cpuid4_cache_lookup_regs(int index,
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 93b9e1181f83..4914e94ad6e8 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2019,7 +2019,10 @@ __init int intel_pmu_init(void)
                 break;
 
         case 28: /* Atom */
-        case 54: /* Cedariew */
+        case 38: /* Lincroft */
+        case 39: /* Penwell */
+        case 53: /* Cloverview */
+        case 54: /* Cedarview */
                 memcpy(hw_cache_event_ids, atom_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
@@ -2084,6 +2087,7 @@ __init int intel_pmu_init(void)
                 pr_cont("SandyBridge events, ");
                 break;
         case 58: /* IvyBridge */
+        case 62: /* IvyBridge EP */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
                 memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs,
diff --git a/arch/x86/kernel/cpu/perf_event_p6.c b/arch/x86/kernel/cpu/perf_event_p6.c
index f2af39f5dc3d..4820c232a0b9 100644
--- a/arch/x86/kernel/cpu/perf_event_p6.c
+++ b/arch/x86/kernel/cpu/perf_event_p6.c
@@ -19,7 +19,7 @@ static const u64 p6_perfmon_event_map[] =
 
 };
 
-static __initconst u64 p6_hw_cache_event_ids
+static u64 p6_hw_cache_event_ids
                                 [PERF_COUNT_HW_CACHE_MAX]
                                 [PERF_COUNT_HW_CACHE_OP_MAX]
                                 [PERF_COUNT_HW_CACHE_RESULT_MAX] =
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 07a7a04529bc..cb3c591339aa 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1781,6 +1781,7 @@ first_nmi:
          * Leave room for the "copied" frame
          */
         subq $(5*8), %rsp
+        CFI_ADJUST_CFA_OFFSET 5*8
 
         /* Copy the stack frame to the Saved frame */
         .rept 5
@@ -1863,10 +1864,8 @@ end_repeat_nmi:
 nmi_swapgs:
         SWAPGS_UNSAFE_STACK
 nmi_restore:
-        RESTORE_ALL 8
-
-        /* Pop the extra iret frame */
-        addq $(5*8), %rsp
+        /* Pop the extra iret frame at once */
+        RESTORE_ALL 6*8
 
         /* Clear the NMI executing stack variable */
         movq $0, 5*8(%rsp)
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 8e7f6556028f..c8932c79e78b 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -300,6 +300,12 @@ ENTRY(startup_32_smp)
         leal -__PAGE_OFFSET(%ecx),%esp
 
 default_entry:
+#define CR0_STATE       (X86_CR0_PE | X86_CR0_MP | X86_CR0_ET | \
+                         X86_CR0_NE | X86_CR0_WP | X86_CR0_AM | \
+                         X86_CR0_PG)
+        movl $(CR0_STATE & ~X86_CR0_PG),%eax
+        movl %eax,%cr0
+
 /*
  *      New page tables may be in 4Mbyte page mode and may
  *      be using the global pages. 
@@ -364,8 +370,7 @@ default_entry:
  */
         movl $pa(initial_page_table), %eax
         movl %eax,%cr3          /* set the page table pointer.. */
-        movl %cr0,%eax
-        orl  $X86_CR0_PG,%eax
+        movl $CR0_STATE,%eax
         movl %eax,%cr0          /* ..and set paging (PG) bit */
         ljmp $__BOOT_CS,$1f     /* Clear prefetch and normalize %eip */
 1:
diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
index a7c5661f8496..4929502c1372 100644
--- a/arch/x86/kernel/msr.c
+++ b/arch/x86/kernel/msr.c
@@ -174,6 +174,9 @@ static int msr_open(struct inode *inode, struct file *file)
         unsigned int cpu;
         struct cpuinfo_x86 *c;
 
+        if (!capable(CAP_SYS_RAWIO))
+                return -EPERM;
+
         cpu = iminor(file->f_path.dentry->d_inode);
         if (cpu >= nr_cpu_ids || !cpu_online(cpu))
                 return -ENXIO;  /* No such CPU */
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 0f5dec5c80e0..872079a67e4d 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -56,7 +56,7 @@ struct device x86_dma_fallback_dev = {
 EXPORT_SYMBOL(x86_dma_fallback_dev);
 
 /* Number of entries preallocated for DMA-API debugging */
-#define PREALLOC_DMA_DEBUG_ENTRIES       32768
+#define PREALLOC_DMA_DEBUG_ENTRIES       65536
 
 int dma_set_mask(struct device *dev, u64 mask)
 {
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 4e8ba39eaf0f..76fa1e9a2b39 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -584,7 +584,7 @@ static void native_machine_emergency_restart(void)
                         break;
 
                 case BOOT_EFI:
-                        if (efi_enabled)
+                        if (efi_enabled(EFI_RUNTIME_SERVICES))
                                 efi.reset_system(reboot_mode ?
                                                  EFI_RESET_WARM :
                                                  EFI_RESET_COLD,
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 00f6c1472b85..8b24289cc10c 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -807,15 +807,15 @@ void __init setup_arch(char **cmdline_p)
 #ifdef CONFIG_EFI
         if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
                      "EL32", 4)) {
-                efi_enabled = 1;
-                efi_64bit = false;
+                set_bit(EFI_BOOT, &x86_efi_facility);
         } else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
                      "EL64", 4)) {
-                efi_enabled = 1;
-                efi_64bit = true;
+                set_bit(EFI_BOOT, &x86_efi_facility);
+                set_bit(EFI_64BIT, &x86_efi_facility);
         }
-        if (efi_enabled && efi_memblock_x86_reserve_range())
-                efi_enabled = 0;
+
+        if (efi_enabled(EFI_BOOT))
+                efi_memblock_x86_reserve_range();
 #endif
 
         x86_init.oem.arch_setup();
@@ -888,7 +888,7 @@ void __init setup_arch(char **cmdline_p)
 
         finish_e820_parsing();
 
-        if (efi_enabled)
+        if (efi_enabled(EFI_BOOT))
                 efi_init();
 
         dmi_scan_machine();
@@ -971,7 +971,7 @@ void __init setup_arch(char **cmdline_p)
          * The EFI specification says that boot service code won't be called
          * after ExitBootServices(). This is, in fact, a lie.
          */
-        if (efi_enabled)
+        if (efi_enabled(EFI_MEMMAP))
                 efi_reserve_boot_services();
 
         /* preallocate 4k for mptable mpc */
@@ -1114,7 +1114,7 @@ void __init setup_arch(char **cmdline_p)
 
 #ifdef CONFIG_VT
 #if defined(CONFIG_VGA_CONSOLE)
-        if (!efi_enabled || (efi_mem_type(0xa0000) != EFI_CONVENTIONAL_MEMORY))
+        if (!efi_enabled(EFI_BOOT) || (efi_mem_type(0xa0000) != EFI_CONVENTIONAL_MEMORY))
                 conswitchp = &vga_con;
 #elif defined(CONFIG_DUMMY_CONSOLE)
         conswitchp = &dummy_con;
@@ -1131,14 +1131,14 @@ void __init setup_arch(char **cmdline_p)
         register_refined_jiffies(CLOCK_TICK_RATE);
 
 #ifdef CONFIG_EFI
-        /* Once setup is done above, disable efi_enabled on mismatched
-         * firmware/kernel archtectures since there is no support for
-         * runtime services.
+        /* Once setup is done above, unmap the EFI memory map on
+         * mismatched firmware/kernel archtectures since there is no
+         * support for runtime services.
          */
-        if (efi_enabled && IS_ENABLED(CONFIG_X86_64) != efi_64bit) {
+        if (efi_enabled(EFI_BOOT) &&
+            IS_ENABLED(CONFIG_X86_64) != efi_enabled(EFI_64BIT)) {
                 pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
                 efi_unmap_memmap();
-                efi_enabled = 0;
         }
 #endif
 }
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index ad4439145f85..77cf0090c0a3 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -51,9 +51,6 @@
 
 #define EFI_DEBUG       1
 
-int efi_enabled;
-EXPORT_SYMBOL(efi_enabled);
-
 struct efi __read_mostly efi = {
         .mps        = EFI_INVALID_TABLE_ADDR,
         .acpi       = EFI_INVALID_TABLE_ADDR,
@@ -69,19 +66,28 @@ EXPORT_SYMBOL(efi);
 
 struct efi_memory_map memmap;
 
-bool efi_64bit;
-
 static struct efi efi_phys __initdata;
 static efi_system_table_t efi_systab __initdata;
 
 static inline bool efi_is_native(void)
 {
-        return IS_ENABLED(CONFIG_X86_64) == efi_64bit;
+        return IS_ENABLED(CONFIG_X86_64) == efi_enabled(EFI_64BIT);
+}
+
+unsigned long x86_efi_facility;
+
+/*
+ * Returns 1 if 'facility' is enabled, 0 otherwise.
+ */
+int efi_enabled(int facility)
+{
+        return test_bit(facility, &x86_efi_facility) != 0;
 }
+EXPORT_SYMBOL(efi_enabled);
 
 static int __init setup_noefi(char *arg)
 {
-        efi_enabled = 0;
+        clear_bit(EFI_BOOT, &x86_efi_facility);
         return 0;
 }
 early_param("noefi", setup_noefi);
@@ -426,6 +432,7 @@ void __init efi_reserve_boot_services(void)
 
 void __init efi_unmap_memmap(void)
 {
+        clear_bit(EFI_MEMMAP, &x86_efi_facility);
         if (memmap.map) {
                 early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size);
                 memmap.map = NULL;
@@ -460,7 +467,7 @@ void __init efi_free_boot_services(void)
 
 static int __init efi_systab_init(void *phys)
 {
-        if (efi_64bit) {
+        if (efi_enabled(EFI_64BIT)) {
                 efi_system_table_64_t *systab64;
                 u64 tmp = 0;
 
@@ -552,7 +559,7 @@ static int __init efi_config_init(u64 tables, int nr_tables)
         void *config_tables, *tablep;
         int i, sz;
 
-        if (efi_64bit)
+        if (efi_enabled(EFI_64BIT))
                 sz = sizeof(efi_config_table_64_t);
         else
                 sz = sizeof(efi_config_table_32_t);
@@ -572,7 +579,7 @@ static int __init efi_config_init(u64 tables, int nr_tables)
                 efi_guid_t guid;
                 unsigned long table;
 
-                if (efi_64bit) {
+                if (efi_enabled(EFI_64BIT)) {
                         u64 table64;
                         guid = ((efi_config_table_64_t *)tablep)->guid;
                         table64 = ((efi_config_table_64_t *)tablep)->table;
@@ -684,7 +691,6 @@ void __init efi_init(void)
         if (boot_params.efi_info.efi_systab_hi ||
             boot_params.efi_info.efi_memmap_hi) {
                 pr_info("Table located above 4GB, disabling EFI.\n");
-                efi_enabled = 0;
                 return;
         }
         efi_phys.systab = (efi_system_table_t *)boot_params.efi_info.efi_systab;
@@ -694,10 +700,10 @@ void __init efi_init(void)
                           ((__u64)boot_params.efi_info.efi_systab_hi<<32));
 #endif
 
-        if (efi_systab_init(efi_phys.systab)) {
-                efi_enabled = 0;
+        if (efi_systab_init(efi_phys.systab))
                 return;
-        }
+
+        set_bit(EFI_SYSTEM_TABLES, &x86_efi_facility);
 
         /*
          * Show what we know for posterity
@@ -715,10 +721,10 @@ void __init efi_init(void)
                 efi.systab->hdr.revision >> 16,
                 efi.systab->hdr.revision & 0xffff, vendor);
 
-        if (efi_config_init(efi.systab->tables, efi.systab->nr_tables)) {
-                efi_enabled = 0;
+        if (efi_config_init(efi.systab->tables, efi.systab->nr_tables))
                 return;
-        }
+
+        set_bit(EFI_CONFIG_TABLES, &x86_efi_facility);
 
         /*
          * Note: We currently don't support runtime services on an EFI
@@ -727,15 +733,17 @@ void __init efi_init(void)
 
         if (!efi_is_native())
                 pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n");
-        else if (efi_runtime_init()) {
-                efi_enabled = 0;
-                return;
+        else {
+                if (efi_runtime_init())
+                        return;
+                set_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility);
         }
 
-        if (efi_memmap_init()) {
-                efi_enabled = 0;
+        if (efi_memmap_init())
                 return;
-        }
+
+        set_bit(EFI_MEMMAP, &x86_efi_facility);
+
 #ifdef CONFIG_X86_32
         if (efi_is_native()) {
                 x86_platform.get_wallclock = efi_get_time;
@@ -941,7 +949,7 @@ void __init efi_enter_virtual_mode(void)
          *
          * Call EFI services through wrapper functions.
          */
-        efi.runtime_version = efi_systab.fw_revision;
+        efi.runtime_version = efi_systab.hdr.revision;
         efi.get_time = virt_efi_get_time;
         efi.set_time = virt_efi_set_time;
         efi.get_wakeup_time = virt_efi_get_wakeup_time;
@@ -969,6 +977,9 @@ u32 efi_mem_type(unsigned long phys_addr)
         efi_memory_desc_t *md;
         void *p;
 
+        if (!efi_enabled(EFI_MEMMAP))
+                return 0;
+
         for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                 md = p;
                 if ((md->phys_addr <= phys_addr) &&
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 95fd505dfeb6..2b2003860615 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -38,7 +38,7 @@
 #include <asm/cacheflush.h>
 #include <asm/fixmap.h>
 
-static pgd_t save_pgd __initdata;
+static pgd_t *save_pgd __initdata;
 static unsigned long efi_flags __initdata;
 
 static void __init early_code_mapping_set_exec(int executable)
@@ -61,12 +61,20 @@ static void __init early_code_mapping_set_exec(int executable)
 void __init efi_call_phys_prelog(void)
 {
         unsigned long vaddress;
+        int pgd;
+        int n_pgds;
 
         early_code_mapping_set_exec(1);
         local_irq_save(efi_flags);
-        vaddress = (unsigned long)__va(0x0UL);
-        save_pgd = *pgd_offset_k(0x0UL);
-        set_pgd(pgd_offset_k(0x0UL), *pgd_offset_k(vaddress));
+
+        n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
+        save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
+
+        for (pgd = 0; pgd < n_pgds; pgd++) {
+                save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE);
+                vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
+                set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
+        }
         __flush_tlb_all();
 }
 
@@ -75,7 +83,11 @@ void __init efi_call_phys_epilog(void)
         /*
          * After the lock is released, the original page table is restored.
          */
-        set_pgd(pgd_offset_k(0x0UL), save_pgd);
+        int pgd;
+        int n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
+        for (pgd = 0; pgd < n_pgds; pgd++)
+                set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
+        kfree(save_pgd);
         __flush_tlb_all();
         local_irq_restore(efi_flags);
         early_code_mapping_set_exec(0);
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index b8b3a37c80cd..dbbdca5f508c 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1034,7 +1034,8 @@ static int set_distrib_bits(struct cpumask *flush_mask, struct bau_control *bcp,
  * globally purge translation cache of a virtual address or all TLB's
  * @cpumask: mask of all cpu's in which the address is to be removed
  * @mm: mm_struct containing virtual address range
- * @va: virtual address to be removed (or TLB_FLUSH_ALL for all TLB's on cpu)
+ * @start: start virtual address to be removed from TLB
+ * @end: end virtual address to be remove from TLB
  * @cpu: the current cpu
  *
  * This is the entry point for initiating any UV global TLB shootdown.
@@ -1056,7 +1057,7 @@ static int set_distrib_bits(struct cpumask *flush_mask, struct bau_control *bcp,
  */
 const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
                                 struct mm_struct *mm, unsigned long start,
-                                unsigned end, unsigned int cpu)
+                                unsigned long end, unsigned int cpu)
 {
         int locals = 0;
         int remotes = 0;
@@ -1113,7 +1114,10 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
 
         record_send_statistics(stat, locals, hubs, remotes, bau_desc);
 
-        bau_desc->payload.address = start;
+        if (!end || (end - start) <= PAGE_SIZE)
+                bau_desc->payload.address = start;
+        else
+                bau_desc->payload.address = TLB_FLUSH_ALL;
         bau_desc->payload.sending_cpu = cpu;
         /*
          * uv_flush_send_and_wait returns 0 if all cpu's were messaged,
diff --git a/arch/x86/tools/insn_sanity.c b/arch/x86/tools/insn_sanity.c
index cc2f8c131286..872eb60e7806 100644
--- a/arch/x86/tools/insn_sanity.c
+++ b/arch/x86/tools/insn_sanity.c
@@ -55,7 +55,7 @@ static FILE		*input_file;	/* Input file name */
 static void usage(const char *err)
 {
         if (err)
-                fprintf(stderr, "Error: %s\n\n", err);
+                fprintf(stderr, "%s: Error: %s\n\n", prog, err);
         fprintf(stderr, "Usage: %s [-y|-n|-v] [-s seed[,no]] [-m max] [-i input]\n", prog);
         fprintf(stderr, "\t-y   64bit mode\n");
         fprintf(stderr, "\t-n   32bit mode\n");
@@ -269,7 +269,13 @@ int main(int argc, char **argv)
                 insns++;
         }
 
-        fprintf(stdout, "%s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n", (errors) ? "Failure" : "Success", insns, (input_file) ? "given" : "random", errors, seed);
+        fprintf(stdout, "%s: %s: decoded and checked %d %s instructions with %d errors (seed:0x%x)\n",
+                prog,
+                (errors) ? "Failure" : "Success",
+                insns,
+                (input_file) ? "given" : "random",
+                errors,
+                seed);
 
         return errors ? 1 : 0;
 }
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 5a1847d61930..79d67bd507fa 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -814,12 +814,14 @@ int main(int argc, char **argv)
         read_relocs(fp);
         if (show_absolute_syms) {
                 print_absolute_symbols();
-                return 0;
+                goto out;
         }
         if (show_absolute_relocs) {
                 print_absolute_relocs();
-                return 0;
+                goto out;
         }
         emit_relocs(as_text, use_real_mode);
+out:
+        fclose(fp);
         return 0;
 }
diff --git a/arch/xtensa/include/asm/dma-mapping.h b/arch/xtensa/include/asm/dma-mapping.h
index 4acb5feba1fb..172a02a6ad14 100644
--- a/arch/xtensa/include/asm/dma-mapping.h
+++ b/arch/xtensa/include/asm/dma-mapping.h
@@ -170,4 +170,19 @@ dma_cache_sync(struct device *dev, void *vaddr, size_t size,
         consistent_sync(vaddr, size, direction);
 }
 
+/* Not supported for now */
+static inline int dma_mmap_coherent(struct device *dev,
+                                    struct vm_area_struct *vma, void *cpu_addr,
+                                    dma_addr_t dma_addr, size_t size)
+{
+        return -EINVAL;
+}
+
+static inline int dma_get_sgtable(struct device *dev, struct sg_table *sgt,
+                                  void *cpu_addr, dma_addr_t dma_addr,
+                                  size_t size)
+{
+        return -EINVAL;
+}
+
 #endif  /* _XTENSA_DMA_MAPPING_H */
diff --git a/block/genhd.c b/block/genhd.c
index 9a289d7c84bb..3993ebf4135f 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -35,6 +35,8 @@ static DEFINE_IDR(ext_devt_idr);
 
 static struct device_type disk_type;
 
+static void disk_check_events(struct disk_events *ev,
+                              unsigned int *clearing_ptr);
 static void disk_alloc_events(struct gendisk *disk);
 static void disk_add_events(struct gendisk *disk);
 static void disk_del_events(struct gendisk *disk);
@@ -1549,6 +1551,7 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask)
         const struct block_device_operations *bdops = disk->fops;
         struct disk_events *ev = disk->ev;
         unsigned int pending;
+        unsigned int clearing = mask;
 
         if (!ev) {
                 /* for drivers still using the old ->media_changed method */
@@ -1558,34 +1561,53 @@ unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask)
                 return 0;
         }
 
-        /* tell the workfn about the events being cleared */
+        disk_block_events(disk);
+
+        /*
+         * store the union of mask and ev->clearing on the stack so that the
+         * race with disk_flush_events does not cause ambiguity (ev->clearing
+         * can still be modified even if events are blocked).
+         */
         spin_lock_irq(&ev->lock);
-        ev->clearing |= mask;
+        clearing |= ev->clearing;
+        ev->clearing = 0;
         spin_unlock_irq(&ev->lock);
 
-        /* uncondtionally schedule event check and wait for it to finish */
-        disk_block_events(disk);
-        queue_delayed_work(system_freezable_wq, &ev->dwork, 0);
-        flush_delayed_work(&ev->dwork);
-        __disk_unblock_events(disk, false);
+        disk_check_events(ev, &clearing);
+        /*
+         * if ev->clearing is not 0, the disk_flush_events got called in the
+         * middle of this function, so we want to run the workfn without delay.
+         */
+        __disk_unblock_events(disk, ev->clearing ? true : false);
 
         /* then, fetch and clear pending events */
         spin_lock_irq(&ev->lock);
-        WARN_ON_ONCE(ev->clearing & mask);      /* cleared by workfn */
         pending = ev->pending & mask;
         ev->pending &= ~mask;
         spin_unlock_irq(&ev->lock);
+        WARN_ON_ONCE(clearing & mask);
 
         return pending;
 }
 
+/*
+ * Separate this part out so that a different pointer for clearing_ptr can be
+ * passed in for disk_clear_events.
+ */
 static void disk_events_workfn(struct work_struct *work)
 {
         struct delayed_work *dwork = to_delayed_work(work);
         struct disk_events *ev = container_of(dwork, struct disk_events, dwork);
+
+        disk_check_events(ev, &ev->clearing);
+}
+
+static void disk_check_events(struct disk_events *ev,
+                              unsigned int *clearing_ptr)
+{
         struct gendisk *disk = ev->disk;
         char *envp[ARRAY_SIZE(disk_uevents) + 1] = { };
-        unsigned int clearing = ev->clearing;
+        unsigned int clearing = *clearing_ptr;
         unsigned int events;
         unsigned long intv;
         int nr_events = 0, i;
@@ -1598,7 +1620,7 @@ static void disk_events_workfn(struct work_struct *work)
 
         events &= ~ev->pending;
         ev->pending |= events;
-        ev->clearing &= ~clearing;
+        *clearing_ptr &= ~clearing;
 
         intv = disk_events_poll_jiffies(disk);
         if (!ev->block && intv)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 3ff267861541..bd22f8667eed 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -250,7 +250,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void)
                 return acpi_rsdp;
 #endif
 
-        if (efi_enabled) {
+        if (efi_enabled(EFI_CONFIG_TABLES)) {
                 if (efi.acpi20 != EFI_INVALID_TABLE_ADDR)
                         return efi.acpi20;
                 else if (efi.acpi != EFI_INVALID_TABLE_ADDR)
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index 6a0955e6d4fc..53ecac5a2161 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -636,82 +636,82 @@ struct rx_buf_desc {
 #define SEG_BASE IPHASE5575_FRAG_CONTROL_REG_BASE  
 #define REASS_BASE IPHASE5575_REASS_CONTROL_REG_BASE  
 
-typedef volatile u_int  freg_t;
+typedef volatile u_int  ffreg_t;
 typedef u_int   rreg_t;
 
 typedef struct _ffredn_t {
-        freg_t  idlehead_high;  /* Idle cell header (high)              */
-        freg_t  idlehead_low;   /* Idle cell header (low)               */
-        freg_t  maxrate;        /* Maximum rate                         */
-        freg_t  stparms;        /* Traffic Management Parameters        */
-        freg_t  abrubr_abr;     /* ABRUBR Priority Byte 1, TCR Byte 0   */
-        freg_t  rm_type;        /*                                      */
-        u_int   filler5[0x17 - 0x06];
-        freg_t  cmd_reg;        /* Command register                     */
-        u_int   filler18[0x20 - 0x18];
-        freg_t  cbr_base;       /* CBR Pointer Base                     */
-        freg_t  vbr_base;       /* VBR Pointer Base                     */
-        freg_t  abr_base;       /* ABR Pointer Base                     */
-        freg_t  ubr_base;       /* UBR Pointer Base                     */
-        u_int   filler24;
-        freg_t  vbrwq_base;     /* VBR Wait Queue Base                  */
-        freg_t  abrwq_base;     /* ABR Wait Queue Base                  */
-        freg_t  ubrwq_base;     /* UBR Wait Queue Base                  */
-        freg_t  vct_base;       /* Main VC Table Base                   */
-        freg_t  vcte_base;      /* Extended Main VC Table Base          */
-        u_int   filler2a[0x2C - 0x2A];
-        freg_t  cbr_tab_beg;    /* CBR Table Begin                      */
-        freg_t  cbr_tab_end;    /* CBR Table End                        */
-        freg_t  cbr_pointer;    /* CBR Pointer                          */
-        u_int   filler2f[0x30 - 0x2F];
-        freg_t  prq_st_adr;     /* Packet Ready Queue Start Address     */
-        freg_t  prq_ed_adr;     /* Packet Ready Queue End Address       */
-        freg_t  prq_rd_ptr;     /* Packet Ready Queue read pointer      */
-        freg_t  prq_wr_ptr;     /* Packet Ready Queue write pointer     */
-        freg_t  tcq_st_adr;     /* Transmit Complete Queue Start Address*/
-        freg_t  tcq_ed_adr;     /* Transmit Complete Queue End Address  */
-        freg_t  tcq_rd_ptr;     /* Transmit Complete Queue read pointer */
-        freg_t  tcq_wr_ptr;     /* Transmit Complete Queue write pointer*/
-        u_int   filler38[0x40 - 0x38];
-        freg_t  queue_base;     /* Base address for PRQ and TCQ         */
-        freg_t  desc_base;      /* Base address of descriptor table     */
-        u_int   filler42[0x45 - 0x42];
-        freg_t  mode_reg_0;     /* Mode register 0                      */
-        freg_t  mode_reg_1;     /* Mode register 1                      */
-        freg_t  intr_status_reg;/* Interrupt Status register            */
-        freg_t  mask_reg;       /* Mask Register                        */
-        freg_t  cell_ctr_high1; /* Total cell transfer count (high)     */
-        freg_t  cell_ctr_lo1;   /* Total cell transfer count (low)      */
-        freg_t  state_reg;      /* Status register                      */
-        u_int   filler4c[0x58 - 0x4c];
-        freg_t  curr_desc_num;  /* Contains the current descriptor num  */
-        freg_t  next_desc;      /* Next descriptor                      */
-        freg_t  next_vc;        /* Next VC                              */
-        u_int   filler5b[0x5d - 0x5b];
-        freg_t  present_slot_cnt;/* Present slot count                  */
-        u_int   filler5e[0x6a - 0x5e];
-        freg_t  new_desc_num;   /* New descriptor number                */
-        freg_t  new_vc;         /* New VC                               */
-        freg_t  sched_tbl_ptr;  /* Schedule table pointer               */
-        freg_t  vbrwq_wptr;     /* VBR wait queue write pointer         */
-        freg_t  vbrwq_rptr;     /* VBR wait queue read pointer          */
-        freg_t  abrwq_wptr;     /* ABR wait queue write pointer         */
-        freg_t  abrwq_rptr;     /* ABR wait queue read pointer          */
-        freg_t  ubrwq_wptr;     /* UBR wait queue write pointer         */
-        freg_t  ubrwq_rptr;     /* UBR wait queue read pointer          */
-        freg_t  cbr_vc;         /* CBR VC                               */
-        freg_t  vbr_sb_vc;      /* VBR SB VC                            */
-        freg_t  abr_sb_vc;      /* ABR SB VC                            */
-        freg_t  ubr_sb_vc;      /* UBR SB VC                            */
-        freg_t  vbr_next_link;  /* VBR next link                        */
-        freg_t  abr_next_link;  /* ABR next link                        */
-        freg_t  ubr_next_link;  /* UBR next link                        */
-        u_int   filler7a[0x7c-0x7a];
-        freg_t  out_rate_head;  /* Out of rate head                     */
-        u_int   filler7d[0xca-0x7d]; /* pad out to full address space   */
-        freg_t  cell_ctr_high1_nc;/* Total cell transfer count (high)   */
-        freg_t  cell_ctr_lo1_nc;/* Total cell transfer count (low)      */
-        u_int   fillercc[0x100-0xcc]; /* pad out to full address space   */
+        ffreg_t idlehead_high;  /* Idle cell header (high)              */
+        ffreg_t idlehead_low;   /* Idle cell header (low)               */
+        ffreg_t maxrate;        /* Maximum rate                         */
+        ffreg_t stparms;        /* Traffic Management Parameters        */
+        ffreg_t abrubr_abr;     /* ABRUBR Priority Byte 1, TCR Byte 0   */
+        ffreg_t rm_type;        /*                                      */
+        u_int   filler5[0x17 - 0x06];
+        ffreg_t cmd_reg;        /* Command register                     */
+        u_int   filler18[0x20 - 0x18];
+        ffreg_t cbr_base;       /* CBR Pointer Base                     */
+        ffreg_t vbr_base;       /* VBR Pointer Base                     */
+        ffreg_t abr_base;       /* ABR Pointer Base                     */
+        ffreg_t ubr_base;       /* UBR Pointer Base                     */
+        u_int   filler24;
+        ffreg_t vbrwq_base;     /* VBR Wait Queue Base                  */
+        ffreg_t abrwq_base;     /* ABR Wait Queue Base                  */
+        ffreg_t ubrwq_base;     /* UBR Wait Queue Base                  */
+        ffreg_t vct_base;       /* Main VC Table Base                   */
+        ffreg_t vcte_base;      /* Extended Main VC Table Base          */
+        u_int   filler2a[0x2C - 0x2A];
+        ffreg_t cbr_tab_beg;    /* CBR Table Begin                      */
+        ffreg_t cbr_tab_end;    /* CBR Table End                        */
+        ffreg_t cbr_pointer;    /* CBR Pointer                          */
+        u_int   filler2f[0x30 - 0x2F];
+        ffreg_t prq_st_adr;     /* Packet Ready Queue Start Address     */
+        ffreg_t prq_ed_adr;     /* Packet Ready Queue End Address       */
+        ffreg_t prq_rd_ptr;     /* Packet Ready Queue read pointer      */
+        ffreg_t prq_wr_ptr;     /* Packet Ready Queue write pointer     */
+        ffreg_t tcq_st_adr;     /* Transmit Complete Queue Start Address*/
+        ffreg_t tcq_ed_adr;     /* Transmit Complete Queue End Address  */
+        ffreg_t tcq_rd_ptr;     /* Transmit Complete Queue read pointer */
+        ffreg_t tcq_wr_ptr;     /* Transmit Complete Queue write pointer*/
+        u_int   filler38[0x40 - 0x38];
+        ffreg_t queue_base;     /* Base address for PRQ and TCQ         */
+        ffreg_t desc_base;      /* Base address of descriptor table     */
+        u_int   filler42[0x45 - 0x42];
+        ffreg_t mode_reg_0;     /* Mode register 0                      */
+        ffreg_t mode_reg_1;     /* Mode register 1                      */
+        ffreg_t intr_status_reg;/* Interrupt Status register            */
+        ffreg_t mask_reg;       /* Mask Register                        */
+        ffreg_t cell_ctr_high1; /* Total cell transfer count (high)     */
+        ffreg_t cell_ctr_lo1;   /* Total cell transfer count (low)      */
+        ffreg_t state_reg;      /* Status register                      */
+        u_int   filler4c[0x58 - 0x4c];
+        ffreg_t curr_desc_num;  /* Contains the current descriptor num  */
+        ffreg_t next_desc;      /* Next descriptor                      */
+        ffreg_t next_vc;        /* Next VC                              */
+        u_int   filler5b[0x5d - 0x5b];
+        ffreg_t present_slot_cnt;/* Present slot count                  */
+        u_int   filler5e[0x6a - 0x5e];
+        ffreg_t new_desc_num;   /* New descriptor number                */
+        ffreg_t new_vc;         /* New VC                               */
+        ffreg_t sched_tbl_ptr;  /* Schedule table pointer               */
+        ffreg_t vbrwq_wptr;     /* VBR wait queue write pointer         */
+        ffreg_t vbrwq_rptr;     /* VBR wait queue read pointer          */
+        ffreg_t abrwq_wptr;     /* ABR wait queue write pointer         */
+        ffreg_t abrwq_rptr;     /* ABR wait queue read pointer          */
+        ffreg_t ubrwq_wptr;     /* UBR wait queue write pointer         */
+        ffreg_t ubrwq_rptr;     /* UBR wait queue read pointer          */
+        ffreg_t cbr_vc;         /* CBR VC                               */
+        ffreg_t vbr_sb_vc;      /* VBR SB VC                            */
+        ffreg_t abr_sb_vc;      /* ABR SB VC                            */
+        ffreg_t ubr_sb_vc;      /* UBR SB VC                            */
+        ffreg_t vbr_next_link;  /* VBR next link                        */
+        ffreg_t abr_next_link;  /* ABR next link                        */
+        ffreg_t ubr_next_link;  /* UBR next link                        */
+        u_int   filler7a[0x7c-0x7a];
+        ffreg_t out_rate_head;  /* Out of rate head                     */
+        u_int   filler7d[0xca-0x7d]; /* pad out to full address space   */
+        ffreg_t cell_ctr_high1_nc;/* Total cell transfer count (high)   */
+        ffreg_t cell_ctr_lo1_nc;/* Total cell transfer count (low)      */
+        u_int   fillercc[0x100-0xcc]; /* pad out to full address space   */
 } ffredn_t;
 
 typedef struct _rfredn_t {
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 19e3fbfd5757..cb0c45488572 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -94,11 +94,16 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 #ifdef CONFIG_BCMA_DRIVER_GPIO
 /* driver_gpio.c */
 int bcma_gpio_init(struct bcma_drv_cc *cc);
+int bcma_gpio_unregister(struct bcma_drv_cc *cc);
 #else
 static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
 {
         return -ENOTSUPP;
 }
+static inline int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return 0;
+}
 #endif /* CONFIG_BCMA_DRIVER_GPIO */
 
 #endif
diff --git a/drivers/bcma/driver_chipcommon_nflash.c b/drivers/bcma/driver_chipcommon_nflash.c
index dbda91e4dff5..1f0b83e18f68 100644
--- a/drivers/bcma/driver_chipcommon_nflash.c
+++ b/drivers/bcma/driver_chipcommon_nflash.c
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc)
         struct bcma_bus *bus = cc->core->bus;
 
         if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
-            cc->core->id.rev != 0x38) {
+            cc->core->id.rev != 38) {
                 bcma_err(bus, "NAND flash on unsupported board!\n");
                 return -ENOTSUPP;
         }
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 9a6f585da2d9..71f755c06fc6 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -96,3 +96,8 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
 
         return gpiochip_add(chip);
 }
+
+int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return gpiochip_remove(&cc->gpio);
+}
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 4a92f647b58b..324f9debda88 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -268,6 +268,13 @@ int bcma_bus_register(struct bcma_bus *bus)
 void bcma_bus_unregister(struct bcma_bus *bus)
 {
         struct bcma_device *cores[3];
+        int err;
+
+        err = bcma_gpio_unregister(&bus->drv_cc);
+        if (err == -EBUSY)
+                bcma_err(bus, "Some GPIOs are still in use.\n");
+        else if (err)
+                bcma_err(bus, "Can not unregister GPIO driver: %i\n", err);
 
         cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
         cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index f58a4a4b4dfb..2b8303ad63c9 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -168,7 +168,7 @@ static void wake_all_senders(struct drbd_tconn *tconn) {
 }
 
 /* must hold resource->req_lock */
-static void start_new_tl_epoch(struct drbd_tconn *tconn)
+void start_new_tl_epoch(struct drbd_tconn *tconn)
 {
         /* no point closing an epoch, if it is empty, anyways. */
         if (tconn->current_tle_writes == 0)
diff --git a/drivers/block/drbd/drbd_req.h b/drivers/block/drbd/drbd_req.h
index 016de6b8bb57..c08d22964d06 100644
--- a/drivers/block/drbd/drbd_req.h
+++ b/drivers/block/drbd/drbd_req.h
@@ -267,6 +267,7 @@ struct bio_and_error {
         int error;
 };
 
+extern void start_new_tl_epoch(struct drbd_tconn *tconn);
 extern void drbd_req_destroy(struct kref *kref);
 extern void _req_may_be_done(struct drbd_request *req,
                 struct bio_and_error *m);
diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
index 53bf6182bac4..0fe220cfb9e9 100644
--- a/drivers/block/drbd/drbd_state.c
+++ b/drivers/block/drbd/drbd_state.c
@@ -931,6 +931,7 @@ __drbd_set_state(struct drbd_conf *mdev, union drbd_state ns,
         enum drbd_state_rv rv = SS_SUCCESS;
         enum sanitize_state_warnings ssw;
         struct after_state_chg_work *ascw;
+        bool did_remote, should_do_remote;
 
         os = drbd_read_state(mdev);
 
@@ -981,11 +982,17 @@ __drbd_set_state(struct drbd_conf *mdev, union drbd_state ns,
             (os.disk != D_DISKLESS && ns.disk == D_DISKLESS))
                 atomic_inc(&mdev->local_cnt);
 
+        did_remote = drbd_should_do_remote(mdev->state);
         mdev->state.i = ns.i;
+        should_do_remote = drbd_should_do_remote(mdev->state);
         mdev->tconn->susp = ns.susp;
         mdev->tconn->susp_nod = ns.susp_nod;
         mdev->tconn->susp_fen = ns.susp_fen;
 
+        /* put replicated vs not-replicated requests in seperate epochs */
+        if (did_remote != should_do_remote)
+                start_new_tl_epoch(mdev->tconn);
+
         if (os.disk == D_ATTACHING && ns.disk >= D_NEGOTIATING)
                 drbd_print_uuids(mdev, "attached to UUIDs");
 
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 9694dd99bbbc..3fd100990453 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -626,12 +626,13 @@ static void mtip_timeout_function(unsigned long int data)
                 }
         }
 
-        if (cmdto_cnt && !test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+        if (cmdto_cnt) {
                 print_tags(port->dd, "timed out", tagaccum, cmdto_cnt);
-
-                mtip_restart_port(port);
+                if (!test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+                        mtip_restart_port(port);
+                        wake_up_interruptible(&port->svc_wait);
+                }
                 clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
-                wake_up_interruptible(&port->svc_wait);
         }
 
         if (port->ic_pause_timer) {
@@ -3887,7 +3888,12 @@ static int mtip_block_remove(struct driver_data *dd)
          * Delete our gendisk structure. This also removes the device
          * from /dev
          */
-        del_gendisk(dd->disk);
+        if (dd->disk) {
+                if (dd->disk->queue)
+                        del_gendisk(dd->disk);
+                else
+                        put_disk(dd->disk);
+        }
 
         spin_lock(&rssd_index_lock);
         ida_remove(&rssd_index_ida, dd->index);
@@ -3921,7 +3927,13 @@ static int mtip_block_shutdown(struct driver_data *dd)
                 "Shutting down %s ...\n", dd->disk->disk_name);
 
         /* Delete our gendisk structure, and cleanup the blk queue. */
-        del_gendisk(dd->disk);
+        if (dd->disk) {
+                if (dd->disk->queue)
+                        del_gendisk(dd->disk);
+                else
+                        put_disk(dd->disk);
+        }
+
 
         spin_lock(&rssd_index_lock);
         ida_remove(&rssd_index_ida, dd->index);
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 74374fb762aa..5ac841ff6cc7 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -161,10 +161,12 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
 static void make_response(struct xen_blkif *blkif, u64 id,
                           unsigned short op, int st);
 
-#define foreach_grant(pos, rbtree, node) \
-        for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node); \
+#define foreach_grant_safe(pos, n, rbtree, node) \
+        for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node), \
+             (n) = rb_next(&(pos)->node); \
              &(pos)->node != NULL; \
-             (pos) = container_of(rb_next(&(pos)->node), typeof(*(pos)), node))
+             (pos) = container_of(n, typeof(*(pos)), node), \
+             (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL)
 
 
 static void add_persistent_gnt(struct rb_root *root,
@@ -217,10 +219,11 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
         struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct page *pages[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct persistent_gnt *persistent_gnt;
+        struct rb_node *n;
         int ret = 0;
         int segs_to_unmap = 0;
 
-        foreach_grant(persistent_gnt, root, node) {
+        foreach_grant_safe(persistent_gnt, n, root, node) {
                 BUG_ON(persistent_gnt->handle ==
                         BLKBACK_INVALID_HANDLE);
                 gnttab_set_unmap_op(&unmap[segs_to_unmap],
@@ -230,9 +233,6 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
                         persistent_gnt->handle);
 
                 pages[segs_to_unmap] = persistent_gnt->page;
-                rb_erase(&persistent_gnt->node, root);
-                kfree(persistent_gnt);
-                num--;
 
                 if (++segs_to_unmap == BLKIF_MAX_SEGMENTS_PER_REQUEST ||
                         !rb_next(&persistent_gnt->node)) {
@@ -241,6 +241,10 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
                         BUG_ON(ret);
                         segs_to_unmap = 0;
                 }
+
+                rb_erase(&persistent_gnt->node, root);
+                kfree(persistent_gnt);
+                num--;
         }
         BUG_ON(num != 0);
 }
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 96e9b00db081..11043c18ac5a 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -792,6 +792,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 {
         struct llist_node *all_gnts;
         struct grant *persistent_gnt;
+        struct llist_node *n;
 
         /* Prevent new requests being issued until we fix things up. */
         spin_lock_irq(&info->io_lock);
@@ -804,7 +805,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
         /* Remove all persistent grants */
         if (info->persistent_gnts_c) {
                 all_gnts = llist_del_all(&info->persistent_gnts);
-                llist_for_each_entry(persistent_gnt, all_gnts, node) {
+                llist_for_each_entry_safe(persistent_gnt, n, all_gnts, node) {
                         gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
                         __free_page(pfn_to_page(persistent_gnt->pfn));
                         kfree(persistent_gnt);
@@ -835,7 +836,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                              struct blkif_response *bret)
 {
-        int i;
+        int i = 0;
         struct bio_vec *bvec;
         struct req_iterator iter;
         unsigned long flags;
@@ -852,7 +853,8 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                  */
                 rq_for_each_segment(bvec, s->request, iter) {
                         BUG_ON((bvec->bv_offset + bvec->bv_len) > PAGE_SIZE);
-                        i = offset >> PAGE_SHIFT;
+                        if (bvec->bv_offset < offset)
+                                i++;
                         BUG_ON(i >= s->req.u.rw.nr_segments);
                         shared_data = kmap_atomic(
                                 pfn_to_page(s->grants_used[i]->pfn));
@@ -861,7 +863,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                                 bvec->bv_len);
                         bvec_kunmap_irq(bvec_data, &flags);
                         kunmap_atomic(shared_data);
-                        offset += bvec->bv_len;
+                        offset = bvec->bv_offset + bvec->bv_len;
                 }
         }
         /* Add the persistent grant into the list of free grants */
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index b00000e8aef6..33c9a44a9678 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -77,10 +77,15 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x13d3, 0x3375) },
         { USB_DEVICE(0x04CA, 0x3005) },
+        { USB_DEVICE(0x04CA, 0x3006) },
+        { USB_DEVICE(0x04CA, 0x3008) },
         { USB_DEVICE(0x13d3, 0x3362) },
         { USB_DEVICE(0x0CF3, 0xE004) },
         { USB_DEVICE(0x0930, 0x0219) },
         { USB_DEVICE(0x0489, 0xe057) },
+        { USB_DEVICE(0x13d3, 0x3393) },
+        { USB_DEVICE(0x0489, 0xe04e) },
+        { USB_DEVICE(0x0489, 0xe056) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -104,10 +109,15 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index a1d4ede5b892..7e351e345476 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -135,10 +135,15 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 684b0d53764f..ee4dbeafb377 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2062,7 +2062,8 @@ static void virtcons_remove(struct virtio_device *vdev)
         /* Disable interrupts for vqs */
         vdev->config->reset(vdev);
         /* Finish up work that's lined up */
-        cancel_work_sync(&portdev->control_work);
+        if (use_multiport(portdev))
+                cancel_work_sync(&portdev->control_work);
 
         list_for_each_entry_safe(port, port2, &portdev->ports, list)
                 unplug_port(port);
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 281f566a5513..d1e9eb191f2b 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -340,7 +340,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
         /*
          * Alocate and fill the csrow/channels structs
          */
-        mci->csrows = kcalloc(sizeof(*mci->csrows), tot_csrows, GFP_KERNEL);
+        mci->csrows = kcalloc(tot_csrows, sizeof(*mci->csrows), GFP_KERNEL);
         if (!mci->csrows)
                 goto error;
         for (row = 0; row < tot_csrows; row++) {
@@ -351,7 +351,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
                 csr->csrow_idx = row;
                 csr->mci = mci;
                 csr->nr_channels = tot_channels;
-                csr->channels = kcalloc(sizeof(*csr->channels), tot_channels,
+                csr->channels = kcalloc(tot_channels, sizeof(*csr->channels),
                                         GFP_KERNEL);
                 if (!csr->channels)
                         goto error;
@@ -369,7 +369,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
         /*
          * Allocate and fill the dimm structs
          */
-        mci->dimms  = kcalloc(sizeof(*mci->dimms), tot_dimms, GFP_KERNEL);
+        mci->dimms  = kcalloc(tot_dimms, sizeof(*mci->dimms), GFP_KERNEL);
         if (!mci->dimms)
                 goto error;
 
diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index dc6e905ee1a5..0056c4dae9d5 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -256,7 +256,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
         struct edac_pci_dev_attribute *edac_pci_dev;
         edac_pci_dev = (struct edac_pci_dev_attribute *)attr;
 
-        if (edac_pci_dev->show)
+        if (edac_pci_dev->store)
                 return edac_pci_dev->store(edac_pci_dev->value, buffer, count);
         return -EIO;
 }
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index fd3ae6290d71..982f1f5f5742 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -471,7 +471,7 @@ void __init dmi_scan_machine(void)
         char __iomem *p, *q;
         int rc;
 
-        if (efi_enabled) {
+        if (efi_enabled(EFI_CONFIG_TABLES)) {
                 if (efi.smbios == EFI_INVALID_TABLE_ADDR)
                         goto error;
 
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 7b1c37497c9a..f5596db0cf58 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -674,7 +674,7 @@ static int efi_status_to_err(efi_status_t status)
                 err = -EACCES;
                 break;
         case EFI_NOT_FOUND:
-                err = -ENOENT;
+                err = -EIO;
                 break;
         default:
                 err = -EINVAL;
@@ -793,6 +793,7 @@ static ssize_t efivarfs_file_write(struct file *file,
                 spin_unlock(&efivars->lock);
                 efivar_unregister(var);
                 drop_nlink(inode);
+                d_delete(file->f_dentry);
                 dput(file->f_dentry);
 
         } else {
@@ -994,7 +995,7 @@ static int efivarfs_unlink(struct inode *dir, struct dentry *dentry)
                 list_del(&var->list);
                 spin_unlock(&efivars->lock);
                 efivar_unregister(var);
-                drop_nlink(dir);
+                drop_nlink(dentry->d_inode);
                 dput(dentry);
                 return 0;
         }
@@ -1782,7 +1783,7 @@ efivars_init(void)
         printk(KERN_INFO "EFI Variables Facility v%s %s\n", EFIVARS_VERSION,
                EFIVARS_DATE);
 
-        if (!efi_enabled)
+        if (!efi_enabled(EFI_RUNTIME_SERVICES))
                 return 0;
 
         /* For now we'll register the efi directory at /sys/firmware/efi */
@@ -1822,7 +1823,7 @@ err_put:
 static void __exit
 efivars_exit(void)
 {
-        if (efi_enabled) {
+        if (efi_enabled(EFI_RUNTIME_SERVICES)) {
                 unregister_efivars(&__efivars);
                 kobject_put(efi_kobj);
         }
diff --git a/drivers/firmware/iscsi_ibft_find.c b/drivers/firmware/iscsi_ibft_find.c
index 4da4eb9ae926..2224f1dc074b 100644
--- a/drivers/firmware/iscsi_ibft_find.c
+++ b/drivers/firmware/iscsi_ibft_find.c
@@ -99,7 +99,7 @@ unsigned long __init find_ibft_region(unsigned long *sizep)
         /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
          * only use ACPI for this */
 
-        if (!efi_enabled)
+        if (!efi_enabled(EFI_BOOT))
                 find_ibft_in_mem();
 
         if (ibft_addr) {
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 1d1f1e5e33f0..046bcda36abe 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -24,7 +24,7 @@ config DRM_EXYNOS_DMABUF
 
 config DRM_EXYNOS_FIMD
         bool "Exynos DRM FIMD"
-        depends on DRM_EXYNOS && !FB_S3C
+        depends on DRM_EXYNOS && !FB_S3C && !ARCH_MULTIPLATFORM
         help
           Choose this option if you want to use Exynos FIMD for DRM.
 
@@ -48,7 +48,7 @@ config DRM_EXYNOS_G2D
 
 config DRM_EXYNOS_IPP
         bool "Exynos DRM IPP"
-        depends on DRM_EXYNOS
+        depends on DRM_EXYNOS && !ARCH_MULTIPLATFORM
         help
           Choose this option if you want to use IPP feature for DRM.
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index ab37437bad8a..4c5b6859c9ea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -18,7 +18,6 @@
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
-#define MAX_EDID 256
 #define to_exynos_connector(x)  container_of(x, struct exynos_drm_connector,\
                                 drm_connector)
 
@@ -96,7 +95,9 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                                         to_exynos_connector(connector);
         struct exynos_drm_manager *manager = exynos_connector->manager;
         struct exynos_drm_display_ops *display_ops = manager->display_ops;
-        unsigned int count;
+        struct edid *edid = NULL;
+        unsigned int count = 0;
+        int ret;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -114,27 +115,21 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
          * because lcd panel has only one mode.
          */
         if (display_ops->get_edid) {
-                int ret;
-                void *edid;
-
-                edid = kzalloc(MAX_EDID, GFP_KERNEL);
-                if (!edid) {
-                        DRM_ERROR("failed to allocate edid\n");
-                        return 0;
+                edid = display_ops->get_edid(manager->dev, connector);
+                if (IS_ERR_OR_NULL(edid)) {
+                        ret = PTR_ERR(edid);
+                        edid = NULL;
+                        DRM_ERROR("Panel operation get_edid failed %d\n", ret);
+                        goto out;
                 }
 
-                ret = display_ops->get_edid(manager->dev, connector,
-                                                edid, MAX_EDID);
-                if (ret < 0) {
-                        DRM_ERROR("failed to get edid data.\n");
-                        kfree(edid);
-                        edid = NULL;
-                        return 0;
+                count = drm_add_edid_modes(connector, edid);
+                if (count < 0) {
+                        DRM_ERROR("Add edid modes failed %d\n", count);
+                        goto out;
                 }
 
                 drm_mode_connector_update_edid_property(connector, edid);
-                count = drm_add_edid_modes(connector, edid);
-                kfree(edid);
         } else {
                 struct exynos_drm_panel_info *panel;
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
@@ -161,6 +156,8 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 count = 1;
         }
 
+out:
+        kfree(edid);
         return count;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index 9df97714b6c0..ba0a3aa78547 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -19,6 +19,7 @@
 struct exynos_drm_dmabuf_attachment {
         struct sg_table sgt;
         enum dma_data_direction dir;
+        bool is_mapped;
 };
 
 static int exynos_gem_attach_dma_buf(struct dma_buf *dmabuf,
@@ -72,17 +73,10 @@ static struct sg_table *
 
         DRM_DEBUG_PRIME("%s\n", __FILE__);
 
-        if (WARN_ON(dir == DMA_NONE))
-                return ERR_PTR(-EINVAL);
-
         /* just return current sgt if already requested. */
-        if (exynos_attach->dir == dir)
+        if (exynos_attach->dir == dir && exynos_attach->is_mapped)
                 return &exynos_attach->sgt;
 
-        /* reattaching is not allowed. */
-        if (WARN_ON(exynos_attach->dir != DMA_NONE))
-                return ERR_PTR(-EBUSY);
-
         buf = gem_obj->buffer;
         if (!buf) {
                 DRM_ERROR("buffer is null.\n");
@@ -107,13 +101,17 @@ static struct sg_table *
                 wr = sg_next(wr);
         }
 
-        nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
-        if (!nents) {
-                DRM_ERROR("failed to map sgl with iommu.\n");
-                sgt = ERR_PTR(-EIO);
-                goto err_unlock;
+        if (dir != DMA_NONE) {
+                nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
+                if (!nents) {
+                        DRM_ERROR("failed to map sgl with iommu.\n");
+                        sg_free_table(sgt);
+                        sgt = ERR_PTR(-EIO);
+                        goto err_unlock;
+                }
         }
 
+        exynos_attach->is_mapped = true;
         exynos_attach->dir = dir;
         attach->priv = exynos_attach;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index b9e51bc09e81..4606fac7241a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -148,8 +148,8 @@ struct exynos_drm_overlay {
 struct exynos_drm_display_ops {
         enum exynos_drm_output_type type;
         bool (*is_connected)(struct device *dev);
-        int (*get_edid)(struct device *dev, struct drm_connector *connector,
-                                u8 *edid, int len);
+        struct edid *(*get_edid)(struct device *dev,
+                        struct drm_connector *connector);
         void *(*get_panel)(struct device *dev);
         int (*check_timing)(struct device *dev, void *timing);
         int (*power_on)(struct device *dev, int mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 36c3905536a6..9a4c08e7453c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -324,7 +324,7 @@ out:
         g2d_userptr = NULL;
 }
 
-dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
+static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
                                         unsigned long userptr,
                                         unsigned long size,
                                         struct drm_file *filp,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 850e9950b7da..28644539b305 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -108,18 +108,17 @@ static bool drm_hdmi_is_connected(struct device *dev)
         return false;
 }
 
-static int drm_hdmi_get_edid(struct device *dev,
-                struct drm_connector *connector, u8 *edid, int len)
+static struct edid *drm_hdmi_get_edid(struct device *dev,
+                        struct drm_connector *connector)
 {
         struct drm_hdmi_context *ctx = to_context(dev);
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         if (hdmi_ops && hdmi_ops->get_edid)
-                return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector, edid,
-                                          len);
+                return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector);
 
-        return 0;
+        return NULL;
 }
 
 static int drm_hdmi_check_timing(struct device *dev, void *timing)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
index 784a7e9a766c..d80516fc9ed7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
@@ -30,8 +30,8 @@ struct exynos_drm_hdmi_context {
 struct exynos_hdmi_ops {
         /* display */
         bool (*is_connected)(void *ctx);
-        int (*get_edid)(void *ctx, struct drm_connector *connector,
-                        u8 *edid, int len);
+        struct edid *(*get_edid)(void *ctx,
+                        struct drm_connector *connector);
         int (*check_timing)(void *ctx, void *timing);
         int (*power_on)(void *ctx, int mode);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 0bda96454a02..1a556354e92f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -869,7 +869,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
         }
 }
 
-void ipp_handle_cmd_work(struct device *dev,
+static void ipp_handle_cmd_work(struct device *dev,
                 struct exynos_drm_ippdrv *ippdrv,
                 struct drm_exynos_ipp_cmd_work *cmd_work,
                 struct drm_exynos_ipp_cmd_node *c_node)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index e9e83ef688f0..f976e29def6e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -734,7 +734,7 @@ static int rotator_remove(struct platform_device *pdev)
         return 0;
 }
 
-struct rot_limit_table rot_limit_tbl = {
+static struct rot_limit_table rot_limit_tbl = {
         .ycbcr420_2p = {
                 .min_w = 32,
                 .min_h = 32,
@@ -751,7 +751,7 @@ struct rot_limit_table rot_limit_tbl = {
         },
 };
 
-struct platform_device_id rotator_driver_ids[] = {
+static struct platform_device_id rotator_driver_ids[] = {
         {
                 .name           = "exynos-rot",
                 .driver_data    = (unsigned long)&rot_limit_tbl,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index d0ca3c4e06c6..13ccbd4bcfaa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -98,10 +98,12 @@ static bool vidi_display_is_connected(struct device *dev)
         return ctx->connected ? true : false;
 }
 
-static int vidi_get_edid(struct device *dev, struct drm_connector *connector,
-                                u8 *edid, int len)
+static struct edid *vidi_get_edid(struct device *dev,
+                        struct drm_connector *connector)
 {
         struct vidi_context *ctx = get_vidi_context(dev);
+        struct edid *edid;
+        int edid_len;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -111,13 +113,18 @@ static int vidi_get_edid(struct device *dev, struct drm_connector *connector,
          */
         if (!ctx->raw_edid) {
                 DRM_DEBUG_KMS("raw_edid is null.\n");
-                return -EFAULT;
+                return ERR_PTR(-EFAULT);
         }
 
-        memcpy(edid, ctx->raw_edid, min((1 + ctx->raw_edid->extensions)
-                                        * EDID_LENGTH, len));
+        edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH;
+        edid = kzalloc(edid_len, GFP_KERNEL);
+        if (!edid) {
+                DRM_DEBUG_KMS("failed to allocate edid\n");
+                return ERR_PTR(-ENOMEM);
+        }
 
-        return 0;
+        memcpy(edid, ctx->raw_edid, edid_len);
+        return edid;
 }
 
 static void *vidi_get_panel(struct device *dev)
@@ -514,7 +521,6 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
         struct exynos_drm_manager *manager;
         struct exynos_drm_display_ops *display_ops;
         struct drm_exynos_vidi_connection *vidi = data;
-        struct edid *raw_edid;
         int edid_len;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -551,11 +557,11 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
         }
 
         if (vidi->connection) {
-                if (!vidi->edid) {
-                        DRM_DEBUG_KMS("edid data is null.\n");
+                struct edid *raw_edid  = (struct edid *)(uint32_t)vidi->edid;
+                if (!drm_edid_is_valid(raw_edid)) {
+                        DRM_DEBUG_KMS("edid data is invalid.\n");
                         return -EINVAL;
                 }
-                raw_edid = (struct edid *)(uint32_t)vidi->edid;
                 edid_len = (1 + raw_edid->extensions) * EDID_LENGTH;
                 ctx->raw_edid = kzalloc(edid_len, GFP_KERNEL);
                 if (!ctx->raw_edid) {
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 41ff79d8ac8e..fbab3c468603 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -34,7 +34,6 @@
 #include <linux/regulator/consumer.h>
 #include <linux/io.h>
 #include <linux/of_gpio.h>
-#include <plat/gpio-cfg.h>
 
 #include <drm/exynos_drm.h>
 
@@ -98,8 +97,7 @@ struct hdmi_context {
 
         void __iomem                    *regs;
         void                            *parent_ctx;
-        int                             external_irq;
-        int                             internal_irq;
+        int                             irq;
 
         struct i2c_client               *ddc_port;
         struct i2c_client               *hdmiphy_port;
@@ -1391,8 +1389,7 @@ static bool hdmi_is_connected(void *ctx)
         return hdata->hpd;
 }
 
-static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
-                                u8 *edid, int len)
+static struct edid *hdmi_get_edid(void *ctx, struct drm_connector *connector)
 {
         struct edid *raw_edid;
         struct hdmi_context *hdata = ctx;
@@ -1400,22 +1397,18 @@ static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
         if (!hdata->ddc_port)
-                return -ENODEV;
+                return ERR_PTR(-ENODEV);
 
         raw_edid = drm_get_edid(connector, hdata->ddc_port->adapter);
-        if (raw_edid) {
-                hdata->dvi_mode = !drm_detect_hdmi_monitor(raw_edid);
-                memcpy(edid, raw_edid, min((1 + raw_edid->extensions)
-                                        * EDID_LENGTH, len));
-                DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
-                        (hdata->dvi_mode ? "dvi monitor" : "hdmi monitor"),
-                        raw_edid->width_cm, raw_edid->height_cm);
-                kfree(raw_edid);
-        } else {
-                return -ENODEV;
-        }
+        if (!raw_edid)
+                return ERR_PTR(-ENODEV);
 
-        return 0;
+        hdata->dvi_mode = !drm_detect_hdmi_monitor(raw_edid);
+        DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
+                (hdata->dvi_mode ? "dvi monitor" : "hdmi monitor"),
+                raw_edid->width_cm, raw_edid->height_cm);
+
+        return raw_edid;
 }
 
 static int hdmi_v13_check_timing(struct fb_videomode *check_timing)
@@ -1652,16 +1645,16 @@ static void hdmi_conf_reset(struct hdmi_context *hdata)
 
         /* resetting HDMI core */
         hdmi_reg_writemask(hdata, reg,  0, HDMI_CORE_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
         hdmi_reg_writemask(hdata, reg, ~0, HDMI_CORE_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
 }
 
 static void hdmi_conf_init(struct hdmi_context *hdata)
 {
         struct hdmi_infoframe infoframe;
 
-        /* disable HPD interrupts */
+        /* disable HPD interrupts from HDMI IP block, use GPIO instead */
         hdmi_reg_writemask(hdata, HDMI_INTC_CON, 0, HDMI_INTC_EN_GLOBAL |
                 HDMI_INTC_EN_HPD_PLUG | HDMI_INTC_EN_HPD_UNPLUG);
 
@@ -1779,7 +1772,7 @@ static void hdmi_v13_timing_apply(struct hdmi_context *hdata)
                 u32 val = hdmi_reg_read(hdata, HDMI_V13_PHY_STATUS);
                 if (val & HDMI_PHY_STATUS_READY)
                         break;
-                mdelay(1);
+                usleep_range(1000, 2000);
         }
         /* steady state not achieved */
         if (tries == 0) {
@@ -1946,7 +1939,7 @@ static void hdmi_v14_timing_apply(struct hdmi_context *hdata)
                 u32 val = hdmi_reg_read(hdata, HDMI_PHY_STATUS_0);
                 if (val & HDMI_PHY_STATUS_READY)
                         break;
-                mdelay(1);
+                usleep_range(1000, 2000);
         }
         /* steady state not achieved */
         if (tries == 0) {
@@ -1998,9 +1991,9 @@ static void hdmiphy_conf_reset(struct hdmi_context *hdata)
 
         /* reset hdmiphy */
         hdmi_reg_writemask(hdata, reg, ~0, HDMI_PHY_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
         hdmi_reg_writemask(hdata, reg,  0, HDMI_PHY_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
 }
 
 static void hdmiphy_poweron(struct hdmi_context *hdata)
@@ -2048,7 +2041,7 @@ static void hdmiphy_conf_apply(struct hdmi_context *hdata)
                 return;
         }
 
-        mdelay(10);
+        usleep_range(10000, 12000);
 
         /* operation mode */
         operation[0] = 0x1f;
@@ -2170,6 +2163,13 @@ static void hdmi_commit(void *ctx)
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
+        mutex_lock(&hdata->hdmi_mutex);
+        if (!hdata->powered) {
+                mutex_unlock(&hdata->hdmi_mutex);
+                return;
+        }
+        mutex_unlock(&hdata->hdmi_mutex);
+
         hdmi_conf_apply(hdata);
 }
 
@@ -2265,7 +2265,7 @@ static struct exynos_hdmi_ops hdmi_ops = {
         .dpms           = hdmi_dpms,
 };
 
-static irqreturn_t hdmi_external_irq_thread(int irq, void *arg)
+static irqreturn_t hdmi_irq_thread(int irq, void *arg)
 {
         struct exynos_drm_hdmi_context *ctx = arg;
         struct hdmi_context *hdata = ctx->ctx;
@@ -2280,31 +2280,6 @@ static irqreturn_t hdmi_external_irq_thread(int irq, void *arg)
         return IRQ_HANDLED;
 }
 
-static irqreturn_t hdmi_internal_irq_thread(int irq, void *arg)
-{
-        struct exynos_drm_hdmi_context *ctx = arg;
-        struct hdmi_context *hdata = ctx->ctx;
-        u32 intc_flag;
-
-        intc_flag = hdmi_reg_read(hdata, HDMI_INTC_FLAG);
-        /* clearing flags for HPD plug/unplug */
-        if (intc_flag & HDMI_INTC_FLAG_HPD_UNPLUG) {
-                DRM_DEBUG_KMS("unplugged\n");
-                hdmi_reg_writemask(hdata, HDMI_INTC_FLAG, ~0,
-                        HDMI_INTC_FLAG_HPD_UNPLUG);
-        }
-        if (intc_flag & HDMI_INTC_FLAG_HPD_PLUG) {
-                DRM_DEBUG_KMS("plugged\n");
-                hdmi_reg_writemask(hdata, HDMI_INTC_FLAG, ~0,
-                        HDMI_INTC_FLAG_HPD_PLUG);
-        }
-
-        if (ctx->drm_dev)
-                drm_helper_hpd_irq_event(ctx->drm_dev);
-
-        return IRQ_HANDLED;
-}
-
 static int hdmi_resources_init(struct hdmi_context *hdata)
 {
         struct device *dev = hdata->dev;
@@ -2555,39 +2530,24 @@ static int hdmi_probe(struct platform_device *pdev)
 
         hdata->hdmiphy_port = hdmi_hdmiphy;
 
-        hdata->external_irq = gpio_to_irq(hdata->hpd_gpio);
-        if (hdata->external_irq < 0) {
-                DRM_ERROR("failed to get GPIO external irq\n");
-                ret = hdata->external_irq;
-                goto err_hdmiphy;
-        }
-
-        hdata->internal_irq = platform_get_irq(pdev, 0);
-        if (hdata->internal_irq < 0) {
-                DRM_ERROR("failed to get platform internal irq\n");
-                ret = hdata->internal_irq;
+        hdata->irq = gpio_to_irq(hdata->hpd_gpio);
+        if (hdata->irq < 0) {
+                DRM_ERROR("failed to get GPIO irq\n");
+                ret = hdata->irq;
                 goto err_hdmiphy;
         }
 
         hdata->hpd = gpio_get_value(hdata->hpd_gpio);
 
-        ret = request_threaded_irq(hdata->external_irq, NULL,
-                        hdmi_external_irq_thread, IRQF_TRIGGER_RISING |
+        ret = request_threaded_irq(hdata->irq, NULL,
+                        hdmi_irq_thread, IRQF_TRIGGER_RISING |
                         IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
-                        "hdmi_external", drm_hdmi_ctx);
+                        "hdmi", drm_hdmi_ctx);
         if (ret) {
-                DRM_ERROR("failed to register hdmi external interrupt\n");
+                DRM_ERROR("failed to register hdmi interrupt\n");
                 goto err_hdmiphy;
         }
 
-        ret = request_threaded_irq(hdata->internal_irq, NULL,
-                        hdmi_internal_irq_thread, IRQF_ONESHOT,
-                        "hdmi_internal", drm_hdmi_ctx);
-        if (ret) {
-                DRM_ERROR("failed to register hdmi internal interrupt\n");
-                goto err_free_irq;
-        }
-
         /* Attach HDMI Driver to common hdmi. */
         exynos_hdmi_drv_attach(drm_hdmi_ctx);
 
@@ -2598,8 +2558,6 @@ static int hdmi_probe(struct platform_device *pdev)
 
         return 0;
 
-err_free_irq:
-        free_irq(hdata->external_irq, drm_hdmi_ctx);
 err_hdmiphy:
         i2c_del_driver(&hdmiphy_driver);
 err_ddc:
@@ -2617,8 +2575,7 @@ static int hdmi_remove(struct platform_device *pdev)
 
         pm_runtime_disable(dev);
 
-        free_irq(hdata->internal_irq, hdata);
-        free_irq(hdata->external_irq, hdata);
+        free_irq(hdata->irq, hdata);
 
 
         /* hdmiphy i2c driver */
@@ -2637,8 +2594,7 @@ static int hdmi_suspend(struct device *dev)
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
-        disable_irq(hdata->internal_irq);
-        disable_irq(hdata->external_irq);
+        disable_irq(hdata->irq);
 
         hdata->hpd = false;
         if (ctx->drm_dev)
@@ -2663,8 +2619,7 @@ static int hdmi_resume(struct device *dev)
 
         hdata->hpd = gpio_get_value(hdata->hpd_gpio);
 
-        enable_irq(hdata->external_irq);
-        enable_irq(hdata->internal_irq);
+        enable_irq(hdata->irq);
 
         if (!pm_runtime_suspended(dev)) {
                 DRM_DEBUG_KMS("%s : Already resumed\n", __func__);
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index c187ea33b748..c414584bfbae 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -600,7 +600,7 @@ static void vp_win_reset(struct mixer_context *ctx)
                 /* waiting until VP_SRESET_PROCESSING is 0 */
                 if (~vp_reg_read(res, VP_SRESET) & VP_SRESET_PROCESSING)
                         break;
-                mdelay(10);
+                usleep_range(10000, 12000);
         }
         WARN(tries == 0, "failed to reset Video Processor\n");
 }
@@ -776,6 +776,13 @@ static void mixer_win_commit(void *ctx, int win)
 
         DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
 
+        mutex_lock(&mixer_ctx->mixer_mutex);
+        if (!mixer_ctx->powered) {
+                mutex_unlock(&mixer_ctx->mixer_mutex);
+                return;
+        }
+        mutex_unlock(&mixer_ctx->mixer_mutex);
+
         if (win > 1 && mixer_ctx->vp_enabled)
                 vp_video_buffer(mixer_ctx, win);
         else
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 7944d301518a..9d4a2c2adf0e 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -30,6 +30,7 @@
 #include <linux/debugfs.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <generated/utsrelease.h>
 #include <drm/drmP.h>
 #include "intel_drv.h"
 #include "intel_ringbuffer.h"
@@ -690,6 +691,7 @@ static int i915_error_state(struct seq_file *m, void *unused)
 
         seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
                    error->time.tv_usec);
+        seq_printf(m, "Kernel: " UTS_RELEASE);
         seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
         seq_printf(m, "EIR: 0x%08x\n", error->eir);
         seq_printf(m, "IER: 0x%08x\n", error->ier);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index b401788e1791..59afb7eb6db6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -533,6 +533,7 @@
 #define MI_MODE         0x0209c
 # define VS_TIMER_DISPATCH                              (1 << 6)
 # define MI_FLUSH_ENABLE                                (1 << 12)
+# define ASYNC_FLIP_PERF_DISABLE                        (1 << 14)
 
 #define GEN6_GT_MODE    0x20d0
 #define   GEN6_GT_MODE_HI                               (1 << 9)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index ae253e04c391..42ff97d667d2 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -505,13 +505,25 @@ static int init_render_ring(struct intel_ring_buffer *ring)
         struct drm_i915_private *dev_priv = dev->dev_private;
         int ret = init_ring_common(ring);
 
-        if (INTEL_INFO(dev)->gen > 3) {
+        if (INTEL_INFO(dev)->gen > 3)
                 I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(VS_TIMER_DISPATCH));
-                if (IS_GEN7(dev))
-                        I915_WRITE(GFX_MODE_GEN7,
-                                   _MASKED_BIT_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
-                                   _MASKED_BIT_ENABLE(GFX_REPLAY_MODE));
-        }
+
+        /* We need to disable the AsyncFlip performance optimisations in order
+         * to use MI_WAIT_FOR_EVENT within the CS. It should already be
+         * programmed to '1' on all products.
+         */
+        if (INTEL_INFO(dev)->gen >= 6)
+                I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(ASYNC_FLIP_PERF_DISABLE));
+
+        /* Required for the hardware to program scanline values for waiting */
+        if (INTEL_INFO(dev)->gen == 6)
+                I915_WRITE(GFX_MODE,
+                           _MASKED_BIT_ENABLE(GFX_TLB_INVALIDATE_ALWAYS));
+
+        if (IS_GEN7(dev))
+                I915_WRITE(GFX_MODE_GEN7,
+                           _MASKED_BIT_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
+                           _MASKED_BIT_ENABLE(GFX_REPLAY_MODE));
 
         if (INTEL_INFO(dev)->gen >= 5) {
                 ret = init_pipe_control(ring);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 4d0e60adbc6d..a2d478e8692a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1313,14 +1313,18 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                                 if (!(tmp & EVERGREEN_CRTC_BLANK_DATA_EN)) {
                                         radeon_wait_for_vblank(rdev, i);
                                         tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
                                 if (!(tmp & EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE)) {
                                         radeon_wait_for_vblank(rdev, i);
                                         tmp |= EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         WREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         }
                         /* wait for the next frame */
@@ -1345,6 +1349,8 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                 blackout &= ~BLACKOUT_MODE_MASK;
                 WREG32(MC_SHARED_BLACKOUT_CNTL, blackout | 1);
         }
+        /* wait for the MC to settle */
+        udelay(100);
 }
 
 void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *save)
@@ -1378,11 +1384,15 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
                         if (ASIC_IS_DCE6(rdev)) {
                                 tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i]);
                                 tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                 WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
                                 tmp &= ~EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                 WREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i], tmp);
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                         }
                         /* wait for the next frame */
                         frame_count = radeon_get_vblank_counter(rdev, i);
@@ -2036,9 +2046,20 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(HDP_ADDR_CONFIG, gb_addr_config);
         WREG32(DMA_TILING_CONFIG, gb_addr_config);
 
-        tmp = gb_addr_config & NUM_PIPES_MASK;
-        tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.evergreen.max_backends,
-                                        EVERGREEN_MAX_BACKENDS, disabled_rb_mask);
+        if ((rdev->config.evergreen.max_backends == 1) &&
+            (rdev->flags & RADEON_IS_IGP)) {
+                if ((disabled_rb_mask & 3) == 1) {
+                        /* RB0 disabled, RB1 enabled */
+                        tmp = 0x11111111;
+                } else {
+                        /* RB1 disabled, RB0 enabled */
+                        tmp = 0x00000000;
+                }
+        } else {
+                tmp = gb_addr_config & NUM_PIPES_MASK;
+                tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.evergreen.max_backends,
+                                                EVERGREEN_MAX_BACKENDS, disabled_rb_mask);
+        }
         WREG32(GB_BACKEND_MAP, tmp);
 
         WREG32(CGTS_SYS_TCC_DISABLE, 0);
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 59acabb45c9b..835992d8d067 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1216,7 +1216,7 @@ void cayman_dma_stop(struct radeon_device *rdev)
 int cayman_dma_resume(struct radeon_device *rdev)
 {
         struct radeon_ring *ring;
-        u32 rb_cntl, dma_cntl;
+        u32 rb_cntl, dma_cntl, ib_cntl;
         u32 rb_bufsz;
         u32 reg_offset, wb_offset;
         int i, r;
@@ -1265,7 +1265,11 @@ int cayman_dma_resume(struct radeon_device *rdev)
                 WREG32(DMA_RB_BASE + reg_offset, ring->gpu_addr >> 8);
 
                 /* enable DMA IBs */
-                WREG32(DMA_IB_CNTL + reg_offset, DMA_IB_ENABLE | CMD_VMID_FORCE);
+                ib_cntl = DMA_IB_ENABLE | CMD_VMID_FORCE;
+#ifdef __BIG_ENDIAN
+                ib_cntl |= DMA_IB_SWAP_ENABLE;
+#endif
+                WREG32(DMA_IB_CNTL + reg_offset, ib_cntl);
 
                 dma_cntl = RREG32(DMA_CNTL + reg_offset);
                 dma_cntl &= ~CTXEMPTY_INT_ENABLE;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 3cb9d6089373..becb03e8b32f 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1462,12 +1462,15 @@ u32 r6xx_remap_render_backend(struct radeon_device *rdev,
                               u32 disabled_rb_mask)
 {
         u32 rendering_pipe_num, rb_num_width, req_rb_num;
-        u32 pipe_rb_ratio, pipe_rb_remain;
+        u32 pipe_rb_ratio, pipe_rb_remain, tmp;
         u32 data = 0, mask = 1 << (max_rb_num - 1);
         unsigned i, j;
 
         /* mask out the RBs that don't exist on that asic */
-        disabled_rb_mask |= (0xff << max_rb_num) & 0xff;
+        tmp = disabled_rb_mask | ((0xff << max_rb_num) & 0xff);
+        /* make sure at least one RB is available */
+        if ((tmp & 0xff) != 0xff)
+                disabled_rb_mask = tmp;
 
         rendering_pipe_num = 1 << tiling_pipe_num;
         req_rb_num = total_max_rb_num - r600_count_pipe_bits(disabled_rb_mask);
@@ -2313,7 +2316,7 @@ void r600_dma_stop(struct radeon_device *rdev)
 int r600_dma_resume(struct radeon_device *rdev)
 {
         struct radeon_ring *ring = &rdev->ring[R600_RING_TYPE_DMA_INDEX];
-        u32 rb_cntl, dma_cntl;
+        u32 rb_cntl, dma_cntl, ib_cntl;
         u32 rb_bufsz;
         int r;
 
@@ -2353,7 +2356,11 @@ int r600_dma_resume(struct radeon_device *rdev)
         WREG32(DMA_RB_BASE, ring->gpu_addr >> 8);
 
         /* enable DMA IBs */
-        WREG32(DMA_IB_CNTL, DMA_IB_ENABLE);
+        ib_cntl = DMA_IB_ENABLE;
+#ifdef __BIG_ENDIAN
+        ib_cntl |= DMA_IB_SWAP_ENABLE;
+#endif
+        WREG32(DMA_IB_CNTL, ib_cntl);
 
         dma_cntl = RREG32(DMA_CNTL);
         dma_cntl &= ~CTXEMPTY_INT_ENABLE;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 9056fafb00ea..0b202c07fe50 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1445,7 +1445,7 @@ static struct radeon_asic cayman_asic = {
         .vm = {
                 .init = &cayman_vm_init,
                 .fini = &cayman_vm_fini,
-                .pt_ring_index = R600_RING_TYPE_DMA_INDEX,
+                .pt_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .set_page = &cayman_vm_set_page,
         },
         .ring = {
@@ -1572,7 +1572,7 @@ static struct radeon_asic trinity_asic = {
         .vm = {
                 .init = &cayman_vm_init,
                 .fini = &cayman_vm_fini,
-                .pt_ring_index = R600_RING_TYPE_DMA_INDEX,
+                .pt_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .set_page = &cayman_vm_set_page,
         },
         .ring = {
@@ -1699,7 +1699,7 @@ static struct radeon_asic si_asic = {
         .vm = {
                 .init = &si_vm_init,
                 .fini = &si_vm_fini,
-                .pt_ring_index = R600_RING_TYPE_DMA_INDEX,
+                .pt_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .set_page = &si_vm_set_page,
         },
         .ring = {
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 33a56a09ff10..3e403bdda58f 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2470,6 +2470,14 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
                                                                    1),
                                                                   ATOM_DEVICE_CRT1_SUPPORT);
                                 }
+                                /* RV100 board with external TDMS bit mis-set.
+                                 * Actually uses internal TMDS, clear the bit.
+                                 */
+                                if (dev->pdev->device == 0x5159 &&
+                                    dev->pdev->subsystem_vendor == 0x1014 &&
+                                    dev->pdev->subsystem_device == 0x029A) {
+                                        tmp &= ~(1 << 4);
+                                }
                                 if ((tmp >> 4) & 0x1) {
                                         devices |= ATOM_DEVICE_DFP2_SUPPORT;
                                         radeon_add_legacy_encoder(dev,
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 469661fd1903..5407459e56d2 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -286,6 +286,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                             p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
                                 kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
                                 kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
+                                p->chunks[p->chunk_ib_idx].kpage[0] = NULL;
+                                p->chunks[p->chunk_ib_idx].kpage[1] = NULL;
                                 return -ENOMEM;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index ad6df625e8b8..0d67674b64b1 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -241,7 +241,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                 y = 0;
         }
 
-        if (ASIC_IS_AVIVO(rdev)) {
+        /* fixed on DCE6 and newer */
+        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
                 int i = 0;
                 struct drm_crtc *crtc_p;
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index edfc54e41842..0d6562bb0c93 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -429,7 +429,8 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
         uint32_t reg;
 
-        if (efi_enabled && rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+        if (efi_enabled(EFI_BOOT) &&
+            rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
                 return false;
 
         /* first check CRTCs */
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 1da2386d7cf7..05c96fa0b051 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1115,14 +1115,16 @@ radeon_user_framebuffer_create(struct drm_device *dev,
         }
 
         radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL);
-        if (radeon_fb == NULL)
+        if (radeon_fb == NULL) {
+                drm_gem_object_unreference_unlocked(obj);
                 return ERR_PTR(-ENOMEM);
+        }
 
         ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
         if (ret) {
                 kfree(radeon_fb);
                 drm_gem_object_unreference_unlocked(obj);
-                return NULL;
+                return ERR_PTR(ret);
         }
 
         return &radeon_fb->base;
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 2430d80b1871..cd72062d5a91 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -377,6 +377,9 @@ int radeon_ring_alloc(struct radeon_device *rdev, struct radeon_ring *ring, unsi
 {
         int r;
 
+        /* make sure we aren't trying to allocate more space than there is on the ring */
+        if (ndw > (ring->ring_size / 4))
+                return -ENOMEM;
         /* Align requested size with padding so unlock_commit can
          * pad safely */
         ndw = (ndw + ring->align_mask) & ~ring->align_mask;
diff --git a/drivers/gpu/drm/radeon/reg_srcs/cayman b/drivers/gpu/drm/radeon/reg_srcs/cayman
index 0f656b111c15..a072fa8c46b0 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/cayman
+++ b/drivers/gpu/drm/radeon/reg_srcs/cayman
@@ -1,5 +1,6 @@
 cayman 0x9400
 0x0000802C GRBM_GFX_INDEX
+0x00008040 WAIT_UNTIL
 0x000084FC CP_STRMOUT_CNTL
 0x000085F0 CP_COHER_CNTL
 0x000085F4 CP_COHER_SIZE
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 2bb6d0e84b3d..435ed3551364 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -336,6 +336,8 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
                                 WREG32(R600_CITF_CNTL, blackout);
                 }
         }
+        /* wait for the MC to settle */
+        udelay(100);
 }
 
 void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 44420fca7dfa..8be35c809c7b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -429,7 +429,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         struct ttm_bo_device *bdev = bo->bdev;
         struct ttm_bo_driver *driver = bdev->driver;
 
-        fbo = kzalloc(sizeof(*fbo), GFP_KERNEL);
+        fbo = kmalloc(sizeof(*fbo), GFP_KERNEL);
         if (!fbo)
                 return -ENOMEM;
 
@@ -448,7 +448,12 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         fbo->vm_node = NULL;
         atomic_set(&fbo->cpu_writers, 0);
 
-        fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
+        spin_lock(&bdev->fence_lock);
+        if (bo->sync_obj)
+                fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
+        else
+                fbo->sync_obj = NULL;
+        spin_unlock(&bdev->fence_lock);
         kref_init(&fbo->list_kref);
         kref_init(&fbo->kref);
         fbo->destroy = &ttm_transfered_destroy;
@@ -661,13 +666,11 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
                  */
 
                 set_bit(TTM_BO_PRIV_FLAG_MOVING, &bo->priv_flags);
-
-                /* ttm_buffer_object_transfer accesses bo->sync_obj */
-                ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                 spin_unlock(&bdev->fence_lock);
                 if (tmp_obj)
                         driver->sync_obj_unref(&tmp_obj);
 
+                ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                 if (ret)
                         return ret;
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 4dfa605e2d14..34e25471aeaa 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -306,6 +306,9 @@
 #define USB_VENDOR_ID_EZKEY             0x0518
 #define USB_DEVICE_ID_BTC_8193          0x0002
 
+#define USB_VENDOR_ID_FORMOSA          0x147a
+#define USB_DEVICE_ID_FORMOSA_IR_RECEIVER      0xe03e
+
 #define USB_VENDOR_ID_FREESCALE         0x15A2
 #define USB_DEVICE_ID_FREESCALE_MX28    0x004F
 
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 12e4fdc810bf..e766b5614ef5 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -540,13 +540,24 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
 {
         struct i2c_client *client = hid->driver_data;
         int report_id = buf[0];
+        int ret;
 
         if (report_type == HID_INPUT_REPORT)
                 return -EINVAL;
 
-        return i2c_hid_set_report(client,
+        if (report_id) {
+                buf++;
+                count--;
+        }
+
+        ret = i2c_hid_set_report(client,
                                 report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
                                 report_id, buf, count);
+
+        if (report_id && ret >= 0)
+                ret++; /* add report_id to the number of transfered bytes */
+
+        return ret;
 }
 
 static int i2c_hid_parse(struct hid_device *hid)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index ac9e35228254..e0e6abf1cd3b 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,6 +70,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 4850d03870c2..35275099cafd 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -263,20 +263,15 @@ static void remove_qp(struct qib_ibdev *dev, struct qib_qp *qp)
                 struct qib_qp __rcu **qpp;
 
                 qpp = &dev->qp_table[n];
-                q = rcu_dereference_protected(*qpp,
-                        lockdep_is_held(&dev->qpt_lock));
-                for (; q; qpp = &q->next) {
+                for (; (q = rcu_dereference_protected(*qpp,
+                                lockdep_is_held(&dev->qpt_lock))) != NULL;
+                                qpp = &q->next)
                         if (q == qp) {
                                 atomic_dec(&qp->refcount);
                                 *qpp = qp->next;
                                 rcu_assign_pointer(qp->next, NULL);
-                                q = rcu_dereference_protected(*qpp,
-                                        lockdep_is_held(&dev->qpt_lock));
                                 break;
                         }
-                        q = rcu_dereference_protected(*qpp,
-                                lockdep_is_held(&dev->qpt_lock));
-                }
         }
 
         spin_unlock_irqrestore(&dev->qpt_lock, flags);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 03103d2bd641..67b0c1d23678 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -741,6 +741,9 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
 
         tx_req->mapping = addr;
 
+        skb_orphan(skb);
+        skb_dst_drop(skb);
+
         rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1),
                        addr, skb->len);
         if (unlikely(rc)) {
@@ -752,9 +755,6 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
                 dev->trans_start = jiffies;
                 ++tx->tx_head;
 
-                skb_orphan(skb);
-                skb_dst_drop(skb);
-
                 if (++priv->tx_outstanding == ipoib_sendq_size) {
                         ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
                                   tx->qp->qp_num);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index a1bca70e20aa..2cfa76f5d99e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -600,6 +600,9 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 netif_stop_queue(dev);
         }
 
+        skb_orphan(skb);
+        skb_dst_drop(skb);
+
         rc = post_send(priv, priv->tx_head & (ipoib_sendq_size - 1),
                        address->ah, qpn, tx_req, phead, hlen);
         if (unlikely(rc)) {
@@ -615,9 +618,6 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
 
                 address->last_send = priv->tx_head;
                 ++priv->tx_head;
-
-                skb_orphan(skb);
-                skb_dst_drop(skb);
         }
 
         if (unlikely(priv->tx_outstanding > MAX_SEND_CQE))
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 81837b0710a9..faf10ba1ed9a 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -975,6 +975,38 @@ static void __init free_iommu_all(void)
 }
 
 /*
+ * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations)
+ * Workaround:
+ *     BIOS should disable L2B micellaneous clock gating by setting
+ *     L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
+ */
+static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
+{
+        u32 value;
+
+        if ((boot_cpu_data.x86 != 0x15) ||
+            (boot_cpu_data.x86_model < 0x10) ||
+            (boot_cpu_data.x86_model > 0x1f))
+                return;
+
+        pci_write_config_dword(iommu->dev, 0xf0, 0x90);
+        pci_read_config_dword(iommu->dev, 0xf4, &value);
+
+        if (value & BIT(2))
+                return;
+
+        /* Select NB indirect register 0x90 and enable writing */
+        pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8));
+
+        pci_write_config_dword(iommu->dev, 0xf4, value | 0x4);
+        pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n",
+                dev_name(&iommu->dev->dev));
+
+        /* Clear the enable writing bit */
+        pci_write_config_dword(iommu->dev, 0xf0, 0x90);
+}
+
+/*
  * This function clues the initialization function for one IOMMU
  * together and also allocates the command buffer and programs the
  * hardware. It does NOT enable the IOMMU. This is done afterwards.
@@ -1172,6 +1204,8 @@ static int iommu_init_pci(struct amd_iommu *iommu)
                         iommu->stored_l2[i] = iommu_read_l2(iommu, i);
         }
 
+        amd_iommu_erratum_746_workaround(iommu);
+
         return pci_enable_device(iommu->dev);
 }
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index b9d091157884..eca28014ef3e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4234,6 +4234,21 @@ static struct iommu_ops intel_iommu_ops = {
         .pgsize_bitmap  = INTEL_IOMMU_PGSIZES,
 };
 
+static void quirk_iommu_g4x_gfx(struct pci_dev *dev)
+{
+        /* G4x/GM45 integrated gfx dmar support is totally busted. */
+        printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
+        dmar_map_gfx = 0;
+}
+
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_g4x_gfx);
+
 static void quirk_iommu_rwbf(struct pci_dev *dev)
 {
         /*
@@ -4242,12 +4257,6 @@ static void quirk_iommu_rwbf(struct pci_dev *dev)
          */
         printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
         rwbf_quirk = 1;
-
-        /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
-        if (dev->revision == 0x07) {
-                printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
-                dmar_map_gfx = 0;
-        }
 }
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index 68452b768da2..03a0a01a4054 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -248,6 +248,8 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
                 CAPIMSG_APPID(data), CAPIMSG_MSGID(data), l,
                 CAPIMSG_CONTROL(data));
         l -= 12;
+        if (l <= 0)
+                return;
         dbgline = kmalloc(3 * l, GFP_ATOMIC);
         if (!dbgline)
                 return;
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 3d8984edeff7..9e58dbd8d8cb 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -340,24 +340,22 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
 }
 
 /*
- * validate_rebuild_devices
+ * validate_raid_redundancy
  * @rs
  *
- * Determine if the devices specified for rebuild can result in a valid
- * usable array that is capable of rebuilding the given devices.
+ * Determine if there are enough devices in the array that haven't
+ * failed (or are being rebuilt) to form a usable array.
  *
  * Returns: 0 on success, -EINVAL on failure.
  */
-static int validate_rebuild_devices(struct raid_set *rs)
+static int validate_raid_redundancy(struct raid_set *rs)
 {
         unsigned i, rebuild_cnt = 0;
         unsigned rebuilds_per_group, copies, d;
 
-        if (!(rs->print_flags & DMPF_REBUILD))
-                return 0;
-
         for (i = 0; i < rs->md.raid_disks; i++)
-                if (!test_bit(In_sync, &rs->dev[i].rdev.flags))
+                if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
+                    !rs->dev[i].rdev.sb_page)
                         rebuild_cnt++;
 
         switch (rs->raid_type->level) {
@@ -393,27 +391,24 @@ static int validate_rebuild_devices(struct raid_set *rs)
                  *          A    A    B    B    C
                  *          C    D    D    E    E
                  */
-                rebuilds_per_group = 0;
                 for (i = 0; i < rs->md.raid_disks * copies; i++) {
+                        if (!(i % copies))
+                                rebuilds_per_group = 0;
                         d = i % rs->md.raid_disks;
-                        if (!test_bit(In_sync, &rs->dev[d].rdev.flags) &&
+                        if ((!rs->dev[d].rdev.sb_page ||
+                             !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
                             (++rebuilds_per_group >= copies))
                                 goto too_many;
-                        if (!((i + 1) % copies))
-                                rebuilds_per_group = 0;
                 }
                 break;
         default:
-                DMERR("The rebuild parameter is not supported for %s",
-                      rs->raid_type->name);
-                rs->ti->error = "Rebuild not supported for this RAID type";
-                return -EINVAL;
+                if (rebuild_cnt)
+                        return -EINVAL;
         }
 
         return 0;
 
 too_many:
-        rs->ti->error = "Too many rebuild devices specified";
         return -EINVAL;
 }
 
@@ -664,9 +659,6 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
         }
         rs->md.dev_sectors = sectors_per_dev;
 
-        if (validate_rebuild_devices(rs))
-                return -EINVAL;
-
         /* Assume there are no metadata devices until the drives are parsed */
         rs->md.persistent = 0;
         rs->md.external = 1;
@@ -995,28 +987,10 @@ static int super_validate(struct mddev *mddev, struct md_rdev *rdev)
 static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
 {
         int ret;
-        unsigned redundancy = 0;
         struct raid_dev *dev;
         struct md_rdev *rdev, *tmp, *freshest;
         struct mddev *mddev = &rs->md;
 
-        switch (rs->raid_type->level) {
-        case 1:
-                redundancy = rs->md.raid_disks - 1;
-                break;
-        case 4:
-        case 5:
-        case 6:
-                redundancy = rs->raid_type->parity_devs;
-                break;
-        case 10:
-                redundancy = raid10_md_layout_to_copies(mddev->layout) - 1;
-                break;
-        default:
-                ti->error = "Unknown RAID type";
-                return -EINVAL;
-        }
-
         freshest = NULL;
         rdev_for_each_safe(rdev, tmp, mddev) {
                 /*
@@ -1045,44 +1019,43 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
                         break;
                 default:
                         dev = container_of(rdev, struct raid_dev, rdev);
-                        if (redundancy--) {
-                                if (dev->meta_dev)
-                                        dm_put_device(ti, dev->meta_dev);
-
-                                dev->meta_dev = NULL;
-                                rdev->meta_bdev = NULL;
+                        if (dev->meta_dev)
+                                dm_put_device(ti, dev->meta_dev);
 
-                                if (rdev->sb_page)
-                                        put_page(rdev->sb_page);
+                        dev->meta_dev = NULL;
+                        rdev->meta_bdev = NULL;
 
-                                rdev->sb_page = NULL;
+                        if (rdev->sb_page)
+                                put_page(rdev->sb_page);
 
-                                rdev->sb_loaded = 0;
+                        rdev->sb_page = NULL;
 
-                                /*
-                                 * We might be able to salvage the data device
-                                 * even though the meta device has failed.  For
-                                 * now, we behave as though '- -' had been
-                                 * set for this device in the table.
-                                 */
-                                if (dev->data_dev)
-                                        dm_put_device(ti, dev->data_dev);
+                        rdev->sb_loaded = 0;
 
-                                dev->data_dev = NULL;
-                                rdev->bdev = NULL;
+                        /*
+                         * We might be able to salvage the data device
+                         * even though the meta device has failed.  For
+                         * now, we behave as though '- -' had been
+                         * set for this device in the table.
+                         */
+                        if (dev->data_dev)
+                                dm_put_device(ti, dev->data_dev);
 
-                                list_del(&rdev->same_set);
+                        dev->data_dev = NULL;
+                        rdev->bdev = NULL;
 
-                                continue;
-                        }
-                        ti->error = "Failed to load superblock";
-                        return ret;
+                        list_del(&rdev->same_set);
                 }
         }
 
         if (!freshest)
                 return 0;
 
+        if (validate_raid_redundancy(rs)) {
+                rs->ti->error = "Insufficient redundancy to activate array";
+                return -EINVAL;
+        }
+
         /*
          * Validation of the freshest device provides the source of
          * validation for the remaining devices.
@@ -1432,7 +1405,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 4, 0},
+        .version = {1, 4, 1},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 675ae5274016..5409607d4875 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2746,19 +2746,9 @@ static int thin_iterate_devices(struct dm_target *ti,
         return 0;
 }
 
-/*
- * A thin device always inherits its queue limits from its pool.
- */
-static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
-{
-        struct thin_c *tc = ti->private;
-
-        *limits = bdev_get_queue(tc->pool_dev->bdev)->limits;
-}
-
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
@@ -2767,7 +2757,6 @@ static struct target_type thin_target = {
         .postsuspend = thin_postsuspend,
         .status = thin_status,
         .iterate_devices = thin_iterate_devices,
-        .io_hints = thin_io_hints,
 };
 
 /*----------------------------------------------------------------*/
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index c72e4d5a9617..314a0e2faf79 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1188,6 +1188,7 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
 {
         struct dm_target *ti;
         sector_t len;
+        unsigned num_requests;
 
         do {
                 ti = dm_table_find_target(ci->map, ci->sector);
@@ -1200,7 +1201,8 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
                  * reconfiguration might also have changed that since the
                  * check was performed.
                  */
-                if (!get_num_requests || !get_num_requests(ti))
+                num_requests = get_num_requests ? get_num_requests(ti) : 0;
+                if (!num_requests)
                         return -EOPNOTSUPP;
 
                 if (is_split_required && !is_split_required(ti))
@@ -1208,7 +1210,7 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
                 else
                         len = min(ci->sector_count, max_io_len(ci->sector, ti));
 
-                __issue_target_requests(ci, ti, ti->num_discard_requests, len);
+                __issue_target_requests(ci, ti, num_requests, len);
 
                 ci->sector += len;
         } while (ci->sector_count -= len);
diff --git a/drivers/media/radio/radio-keene.c b/drivers/media/radio/radio-keene.c
index e10e525f33e5..296941a9ae25 100644
--- a/drivers/media/radio/radio-keene.c
+++ b/drivers/media/radio/radio-keene.c
@@ -374,6 +374,7 @@ static int usb_keene_probe(struct usb_interface *intf,
         radio->vdev.ioctl_ops = &usb_keene_ioctl_ops;
         radio->vdev.lock = &radio->lock;
         radio->vdev.release = video_device_release_empty;
+        radio->vdev.vfl_dir = VFL_DIR_TX;
 
         radio->usbdev = interface_to_usbdev(intf);
         radio->intf = intf;
diff --git a/drivers/media/radio/radio-si4713.c b/drivers/media/radio/radio-si4713.c
index a082e400ed0f..1507c9d508d7 100644
--- a/drivers/media/radio/radio-si4713.c
+++ b/drivers/media/radio/radio-si4713.c
@@ -250,6 +250,7 @@ static struct video_device radio_si4713_vdev_template = {
         .name                   = "radio-si4713",
         .release                = video_device_release,
         .ioctl_ops              = &radio_si4713_ioctl_ops,
+        .vfl_dir                = VFL_DIR_TX,
 };
 
 /* Platform driver interface */
diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index c48be195bbad..cabbe3adf435 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -1971,6 +1971,7 @@ static struct video_device wl1273_viddev_template = {
         .ioctl_ops              = &wl1273_ioctl_ops,
         .name                   = WL1273_FM_DRIVER_NAME,
         .release                = wl1273_vdev_release,
+        .vfl_dir                = VFL_DIR_TX,
 };
 
 static int wl1273_fm_radio_remove(struct platform_device *pdev)
diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c
index 048de4536036..0a8ee8fab924 100644
--- a/drivers/media/radio/wl128x/fmdrv_v4l2.c
+++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c
@@ -518,6 +518,16 @@ static struct video_device fm_viddev_template = {
         .ioctl_ops = &fm_drv_ioctl_ops,
         .name = FM_DRV_NAME,
         .release = video_device_release,
+        /*
+         * To ensure both the tuner and modulator ioctls are accessible we
+         * set the vfl_dir to M2M to indicate this.
+         *
+         * It is not really a mem2mem device of course, but it can both receive
+         * and transmit using the same radio device. It's the only radio driver
+         * that does this and it should really be split in two radio devices,
+         * but that would affect applications using this driver.
+         */
+        .vfl_dir = VFL_DIR_M2M,
 };
 
 int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 47ad4e270877..ff553babf455 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -237,6 +237,7 @@ config MFD_TPS65910
         depends on I2C=y && GPIOLIB
         select MFD_CORE
         select REGMAP_I2C
+        select REGMAP_IRQ
         select IRQ_DOMAIN
         help
           if you say yes here you get support for the TPS65910 series of
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index e1650badd106..4778bb124efe 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -19,6 +19,7 @@
 #include <linux/mfd/core.h>
 #include <linux/mfd/abx500.h>
 #include <linux/mfd/abx500/ab8500.h>
+#include <linux/mfd/abx500/ab8500-bm.h>
 #include <linux/mfd/dbx500-prcmu.h>
 #include <linux/regulator/ab8500.h>
 #include <linux/of.h>
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index bc8a3edb6bbf..222c03a5ddc0 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -239,7 +239,12 @@ static int arizona_runtime_resume(struct device *dev)
                 return ret;
         }
 
-        regcache_sync(arizona->regmap);
+        ret = regcache_sync(arizona->regmap);
+        if (ret != 0) {
+                dev_err(arizona->dev, "Failed to restore register cache\n");
+                regulator_disable(arizona->dcvdd);
+                return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/mfd/arizona-irq.c b/drivers/mfd/arizona-irq.c
index 74713bf5371f..2bec5f0db3ee 100644
--- a/drivers/mfd/arizona-irq.c
+++ b/drivers/mfd/arizona-irq.c
@@ -176,14 +176,7 @@ int arizona_irq_init(struct arizona *arizona)
                 aod = &wm5102_aod;
                 irq = &wm5102_irq;
 
-                switch (arizona->rev) {
-                case 0:
-                case 1:
-                        ctrlif_error = false;
-                        break;
-                default:
-                        break;
-                }
+                ctrlif_error = false;
                 break;
 #endif
 #ifdef CONFIG_MFD_WM5110
@@ -191,14 +184,7 @@ int arizona_irq_init(struct arizona *arizona)
                 aod = &wm5110_aod;
                 irq = &wm5110_irq;
 
-                switch (arizona->rev) {
-                case 0:
-                case 1:
-                        ctrlif_error = false;
-                        break;
-                default:
-                        break;
-                }
+                ctrlif_error = false;
                 break;
 #endif
         default:
diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c
index ac74a4d1daea..885e56780358 100644
--- a/drivers/mfd/da9052-i2c.c
+++ b/drivers/mfd/da9052-i2c.c
@@ -27,6 +27,66 @@
 #include <linux/of_device.h>
 #endif
 
+/* I2C safe register check */
+static inline bool i2c_safe_reg(unsigned char reg)
+{
+        switch (reg) {
+        case DA9052_STATUS_A_REG:
+        case DA9052_STATUS_B_REG:
+        case DA9052_STATUS_C_REG:
+        case DA9052_STATUS_D_REG:
+        case DA9052_ADC_RES_L_REG:
+        case DA9052_ADC_RES_H_REG:
+        case DA9052_VDD_RES_REG:
+        case DA9052_ICHG_AV_REG:
+        case DA9052_TBAT_RES_REG:
+        case DA9052_ADCIN4_RES_REG:
+        case DA9052_ADCIN5_RES_REG:
+        case DA9052_ADCIN6_RES_REG:
+        case DA9052_TJUNC_RES_REG:
+        case DA9052_TSI_X_MSB_REG:
+        case DA9052_TSI_Y_MSB_REG:
+        case DA9052_TSI_LSB_REG:
+        case DA9052_TSI_Z_MSB_REG:
+                return true;
+        default:
+                return false;
+        }
+}
+
+/*
+ * There is an issue with DA9052 and DA9053_AA/BA/BB PMIC where the PMIC
+ * gets lockup up or fails to respond following a system reset.
+ * This fix is to follow any read or write with a dummy read to a safe
+ * register.
+ */
+int da9052_i2c_fix(struct da9052 *da9052, unsigned char reg)
+{
+        int val;
+
+        switch (da9052->chip_id) {
+        case DA9052:
+        case DA9053_AA:
+        case DA9053_BA:
+        case DA9053_BB:
+                /* A dummy read to a safe register address. */
+        if (!i2c_safe_reg(reg))
+                        return regmap_read(da9052->regmap,
+                                           DA9052_PARK_REGISTER,
+                                           &val);
+                break;
+        default:
+                /*
+                 * For other chips parking of I2C register
+                 * to a safe place is not required.
+                 */
+                break;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(da9052_i2c_fix);
+
 static int da9052_i2c_enable_multiwrite(struct da9052 *da9052)
 {
         int reg_val, ret;
@@ -83,6 +143,7 @@ static int da9052_i2c_probe(struct i2c_client *client,
 
         da9052->dev = &client->dev;
         da9052->chip_irq = client->irq;
+        da9052->fix_io = da9052_i2c_fix;
 
         i2c_set_clientdata(client, da9052);
 
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index dc8826d8d69d..268f45d42394 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2524,7 +2524,7 @@ static bool read_mailbox_0(void)
 
                 for (n = 0; n < NUM_PRCMU_WAKEUPS; n++) {
                         if (ev & prcmu_irq_bit[n])
-                                generic_handle_irq(IRQ_PRCMU_BASE + n);
+                                generic_handle_irq(irq_find_mapping(db8500_irq_domain, n));
                 }
                 r = true;
                 break;
@@ -2737,13 +2737,14 @@ static int db8500_irq_map(struct irq_domain *d, unsigned int virq,
 }
 
 static struct irq_domain_ops db8500_irq_ops = {
-        .map    = db8500_irq_map,
-        .xlate  = irq_domain_xlate_twocell,
+        .map    = db8500_irq_map,
+        .xlate  = irq_domain_xlate_twocell,
 };
 
 static int db8500_irq_init(struct device_node *np)
 {
-        int irq_base = -1;
+        int irq_base = 0;
+        int i;
 
         /* In the device tree case, just take some IRQs */
         if (!np)
@@ -2758,6 +2759,10 @@ static int db8500_irq_init(struct device_node *np)
                 return -ENOSYS;
         }
 
+        /* All wakeups will be used, so create mappings for all */
+        for (i = 0; i < NUM_PRCMU_WAKEUPS; i++)
+                irq_create_mapping(db8500_irq_domain, i);
+
         return 0;
 }
 
diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
index f6878f8db57d..4d73963cd8f0 100644
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -93,15 +93,6 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
         if (max77686 == NULL)
                 return -ENOMEM;
 
-        max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
-        if (IS_ERR(max77686->regmap)) {
-                ret = PTR_ERR(max77686->regmap);
-                dev_err(max77686->dev, "Failed to allocate register map: %d\n",
-                                ret);
-                kfree(max77686);
-                return ret;
-        }
-
         i2c_set_clientdata(i2c, max77686);
         max77686->dev = &i2c->dev;
         max77686->i2c = i2c;
@@ -111,6 +102,15 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
         max77686->irq_gpio = pdata->irq_gpio;
         max77686->irq = i2c->irq;
 
+        max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
+        if (IS_ERR(max77686->regmap)) {
+                ret = PTR_ERR(max77686->regmap);
+                dev_err(max77686->dev, "Failed to allocate register map: %d\n",
+                                ret);
+                kfree(max77686);
+                return ret;
+        }
+
         if (regmap_read(max77686->regmap,
                          MAX77686_REG_DEVICE_ID, &data) < 0) {
                 dev_err(max77686->dev,
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index cc5155e20494..9e60fed5ff82 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -114,35 +114,37 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
         u8 reg_data;
         int ret = 0;
 
+        if (!pdata) {
+                dev_err(&i2c->dev, "No platform data found.\n");
+                return -EINVAL;
+        }
+
         max77693 = devm_kzalloc(&i2c->dev,
                         sizeof(struct max77693_dev), GFP_KERNEL);
         if (max77693 == NULL)
                 return -ENOMEM;
 
-        max77693->regmap = devm_regmap_init_i2c(i2c, &max77693_regmap_config);
-        if (IS_ERR(max77693->regmap)) {
-                ret = PTR_ERR(max77693->regmap);
-                dev_err(max77693->dev,"failed to allocate register map: %d\n",
-                                ret);
-                goto err_regmap;
-        }
-
         i2c_set_clientdata(i2c, max77693);
         max77693->dev = &i2c->dev;
         max77693->i2c = i2c;
         max77693->irq = i2c->irq;
         max77693->type = id->driver_data;
 
-        if (!pdata)
-                goto err_regmap;
+        max77693->regmap = devm_regmap_init_i2c(i2c, &max77693_regmap_config);
+        if (IS_ERR(max77693->regmap)) {
+                ret = PTR_ERR(max77693->regmap);
+                dev_err(max77693->dev, "failed to allocate register map: %d\n",
+                                ret);
+                return ret;
+        }
 
         max77693->wakeup = pdata->wakeup;
 
-        if (max77693_read_reg(max77693->regmap,
-                                MAX77693_PMIC_REG_PMIC_ID2, &reg_data) < 0) {
+        ret = max77693_read_reg(max77693->regmap, MAX77693_PMIC_REG_PMIC_ID2,
+                                &reg_data);
+        if (ret < 0) {
                 dev_err(max77693->dev, "device not found on this channel\n");
-                ret = -ENODEV;
-                goto err_regmap;
+                return ret;
         } else
                 dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
 
@@ -163,7 +165,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 ret = PTR_ERR(max77693->regmap_muic);
                 dev_err(max77693->dev,
                         "failed to allocate register map: %d\n", ret);
-                goto err_regmap;
+                goto err_regmap_muic;
         }
 
         ret = max77693_irq_init(max77693);
@@ -184,9 +186,9 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 err_mfd:
         max77693_irq_exit(max77693);
 err_irq:
+err_regmap_muic:
         i2c_unregister_device(max77693->muic);
         i2c_unregister_device(max77693->haptic);
-err_regmap:
         return ret;
 }
 
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 64803f13bcec..d11567307fbe 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -208,6 +208,8 @@ static int pcf50633_probe(struct i2c_client *client,
         if (!pcf)
                 return -ENOMEM;
 
+        i2c_set_clientdata(client, pcf);
+        pcf->dev = &client->dev;
         pcf->pdata = pdata;
 
         mutex_init(&pcf->lock);
@@ -219,9 +221,6 @@ static int pcf50633_probe(struct i2c_client *client,
                 return ret;
         }
 
-        i2c_set_clientdata(client, pcf);
-        pcf->dev = &client->dev;
-
         version = pcf50633_reg_read(pcf, 0);
         variant = pcf50633_reg_read(pcf, 1);
         if (version < 0 || variant < 0) {
diff --git a/drivers/mfd/rtl8411.c b/drivers/mfd/rtl8411.c
index 89f046ca9e41..3d3b4addf81a 100644
--- a/drivers/mfd/rtl8411.c
+++ b/drivers/mfd/rtl8411.c
@@ -112,6 +112,21 @@ static int rtl8411_card_power_off(struct rtsx_pcr *pcr, int card)
                         BPP_LDO_POWB, BPP_LDO_SUSPEND);
 }
 
+static int rtl8411_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        u8 mask, val;
+
+        mask = (BPP_REG_TUNED18 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_MASK;
+        if (voltage == OUTPUT_3V3)
+                val = (BPP_ASIC_3V3 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_3V3;
+        else if (voltage == OUTPUT_1V8)
+                val = (BPP_ASIC_1V8 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_1V8;
+        else
+                return -EINVAL;
+
+        return rtsx_pci_write_register(pcr, LDO_CTL, mask, val);
+}
+
 static unsigned int rtl8411_cd_deglitch(struct rtsx_pcr *pcr)
 {
         unsigned int card_exist;
@@ -163,6 +178,18 @@ static unsigned int rtl8411_cd_deglitch(struct rtsx_pcr *pcr)
         return card_exist;
 }
 
+static int rtl8411_conv_clk_and_div_n(int input, int dir)
+{
+        int output;
+
+        if (dir == CLK_TO_DIV_N)
+                output = input * 4 / 5 - 2;
+        else
+                output = (input + 2) * 5 / 4;
+
+        return output;
+}
+
 static const struct pcr_ops rtl8411_pcr_ops = {
         .extra_init_hw = rtl8411_extra_init_hw,
         .optimize_phy = NULL,
@@ -172,7 +199,9 @@ static const struct pcr_ops rtl8411_pcr_ops = {
         .disable_auto_blink = rtl8411_disable_auto_blink,
         .card_power_on = rtl8411_card_power_on,
         .card_power_off = rtl8411_card_power_off,
+        .switch_output_voltage = rtl8411_switch_output_voltage,
         .cd_deglitch = rtl8411_cd_deglitch,
+        .conv_clk_and_div_n = rtl8411_conv_clk_and_div_n,
 };
 
 /* SD Pull Control Enable:
diff --git a/drivers/mfd/rts5209.c b/drivers/mfd/rts5209.c
index 283a4f148084..98fe0f39463e 100644
--- a/drivers/mfd/rts5209.c
+++ b/drivers/mfd/rts5209.c
@@ -144,6 +144,25 @@ static int rts5209_card_power_off(struct rtsx_pcr *pcr, int card)
         return rtsx_pci_send_cmd(pcr, 100);
 }
 
+static int rts5209_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        int err;
+
+        if (voltage == OUTPUT_3V3) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
+                if (err < 0)
+                        return err;
+        } else if (voltage == OUTPUT_1V8) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
+                if (err < 0)
+                        return err;
+        } else {
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static const struct pcr_ops rts5209_pcr_ops = {
         .extra_init_hw = rts5209_extra_init_hw,
         .optimize_phy = rts5209_optimize_phy,
@@ -153,7 +172,9 @@ static const struct pcr_ops rts5209_pcr_ops = {
         .disable_auto_blink = rts5209_disable_auto_blink,
         .card_power_on = rts5209_card_power_on,
         .card_power_off = rts5209_card_power_off,
+        .switch_output_voltage = rts5209_switch_output_voltage,
         .cd_deglitch = NULL,
+        .conv_clk_and_div_n = NULL,
 };
 
 /* SD Pull Control Enable:
diff --git a/drivers/mfd/rts5229.c b/drivers/mfd/rts5229.c
index b9dbab266fda..29d889cbb9c5 100644
--- a/drivers/mfd/rts5229.c
+++ b/drivers/mfd/rts5229.c
@@ -114,6 +114,25 @@ static int rts5229_card_power_off(struct rtsx_pcr *pcr, int card)
         return rtsx_pci_send_cmd(pcr, 100);
 }
 
+static int rts5229_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        int err;
+
+        if (voltage == OUTPUT_3V3) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
+                if (err < 0)
+                        return err;
+        } else if (voltage == OUTPUT_1V8) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
+                if (err < 0)
+                        return err;
+        } else {
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static const struct pcr_ops rts5229_pcr_ops = {
         .extra_init_hw = rts5229_extra_init_hw,
         .optimize_phy = rts5229_optimize_phy,
@@ -123,7 +142,9 @@ static const struct pcr_ops rts5229_pcr_ops = {
         .disable_auto_blink = rts5229_disable_auto_blink,
         .card_power_on = rts5229_card_power_on,
         .card_power_off = rts5229_card_power_off,
+        .switch_output_voltage = rts5229_switch_output_voltage,
         .cd_deglitch = NULL,
+        .conv_clk_and_div_n = NULL,
 };
 
 /* SD Pull Control Enable:
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 7a7b0bda4618..9fc57009e228 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -630,7 +630,10 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
         if (clk == pcr->cur_clock)
                 return 0;
 
-        N = (u8)(clk - 2);
+        if (pcr->ops->conv_clk_and_div_n)
+                N = (u8)pcr->ops->conv_clk_and_div_n(clk, CLK_TO_DIV_N);
+        else
+                N = (u8)(clk - 2);
         if ((clk <= 2) || (N > max_N))
                 return -EINVAL;
 
@@ -641,7 +644,14 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
         /* Make sure that the SSC clock div_n is equal or greater than min_N */
         div = CLK_DIV_1;
         while ((N < min_N) && (div < max_div)) {
-                N = (N + 2) * 2 - 2;
+                if (pcr->ops->conv_clk_and_div_n) {
+                        int dbl_clk = pcr->ops->conv_clk_and_div_n(N,
+                                        DIV_N_TO_CLK) * 2;
+                        N = (u8)pcr->ops->conv_clk_and_div_n(dbl_clk,
+                                        CLK_TO_DIV_N);
+                } else {
+                        N = (N + 2) * 2 - 2;
+                }
                 div++;
         }
         dev_dbg(&(pcr->pci->dev), "N = %d, div = %d\n", N, div);
@@ -703,6 +713,15 @@ int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card)
 }
 EXPORT_SYMBOL_GPL(rtsx_pci_card_power_off);
 
+int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        if (pcr->ops->switch_output_voltage)
+                return pcr->ops->switch_output_voltage(pcr, voltage);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rtsx_pci_switch_output_voltage);
+
 unsigned int rtsx_pci_card_exist(struct rtsx_pcr *pcr)
 {
         unsigned int val;
@@ -767,10 +786,10 @@ static void rtsx_pci_card_detect(struct work_struct *work)
 
         spin_unlock_irqrestore(&pcr->lock, flags);
 
-        if (card_detect & SD_EXIST)
+        if ((card_detect & SD_EXIST) && pcr->slots[RTSX_SD_CARD].card_event)
                 pcr->slots[RTSX_SD_CARD].card_event(
                                 pcr->slots[RTSX_SD_CARD].p_dev);
-        if (card_detect & MS_EXIST)
+        if ((card_detect & MS_EXIST) && pcr->slots[RTSX_MS_CARD].card_event)
                 pcr->slots[RTSX_MS_CARD].card_event(
                                 pcr->slots[RTSX_MS_CARD].p_dev);
 }
diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
index a06d66b929b1..ecc092c7f745 100644
--- a/drivers/mfd/tc3589x.c
+++ b/drivers/mfd/tc3589x.c
@@ -219,25 +219,18 @@ static void tc3589x_irq_unmap(struct irq_domain *d, unsigned int virq)
 }
 
 static struct irq_domain_ops tc3589x_irq_ops = {
-        .map    = tc3589x_irq_map,
+        .map    = tc3589x_irq_map,
         .unmap  = tc3589x_irq_unmap,
-        .xlate  = irq_domain_xlate_twocell,
+        .xlate  = irq_domain_xlate_twocell,
 };
 
 static int tc3589x_irq_init(struct tc3589x *tc3589x, struct device_node *np)
 {
         int base = tc3589x->irq_base;
 
-        if (base) {
-                tc3589x->domain = irq_domain_add_legacy(
-                        NULL, TC3589x_NR_INTERNAL_IRQS, base,
-                        0, &tc3589x_irq_ops, tc3589x);
-        }
-        else {
-                tc3589x->domain = irq_domain_add_linear(
-                        np, TC3589x_NR_INTERNAL_IRQS,
-                        &tc3589x_irq_ops, tc3589x);
-        }
+        tc3589x->domain = irq_domain_add_simple(
+                np, TC3589x_NR_INTERNAL_IRQS, base,
+                &tc3589x_irq_ops, tc3589x);
 
         if (!tc3589x->domain) {
                 dev_err(tc3589x->dev, "Failed to create irqdomain\n");
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index 4dae241e5017..dd362c1078e1 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -159,7 +159,7 @@ out:
 static int twl4030_write_script(u8 address, struct twl4030_ins *script,
                                        int len)
 {
-        int err;
+        int err = -EINVAL;
 
         for (; len; len--, address++, script++) {
                 if (len == 1) {
diff --git a/drivers/mfd/vexpress-config.c b/drivers/mfd/vexpress-config.c
index fae15d880758..3c1723aa6225 100644
--- a/drivers/mfd/vexpress-config.c
+++ b/drivers/mfd/vexpress-config.c
@@ -67,6 +67,7 @@ struct vexpress_config_bridge *vexpress_config_bridge_register(
 
         return bridge;
 }
+EXPORT_SYMBOL(vexpress_config_bridge_register);
 
 void vexpress_config_bridge_unregister(struct vexpress_config_bridge *bridge)
 {
@@ -83,6 +84,7 @@ void vexpress_config_bridge_unregister(struct vexpress_config_bridge *bridge)
         while (!list_empty(&__bridge.transactions))
                 cpu_relax();
 }
+EXPORT_SYMBOL(vexpress_config_bridge_unregister);
 
 
 struct vexpress_config_func {
@@ -142,6 +144,7 @@ struct vexpress_config_func *__vexpress_config_func_get(struct device *dev,
 
         return func;
 }
+EXPORT_SYMBOL(__vexpress_config_func_get);
 
 void vexpress_config_func_put(struct vexpress_config_func *func)
 {
@@ -149,7 +152,7 @@ void vexpress_config_func_put(struct vexpress_config_func *func)
         of_node_put(func->bridge->node);
         kfree(func);
 }
-
+EXPORT_SYMBOL(vexpress_config_func_put);
 
 struct vexpress_config_trans {
         struct vexpress_config_func *func;
@@ -229,6 +232,7 @@ void vexpress_config_complete(struct vexpress_config_bridge *bridge,
 
         complete(&trans->completion);
 }
+EXPORT_SYMBOL(vexpress_config_complete);
 
 int vexpress_config_wait(struct vexpress_config_trans *trans)
 {
@@ -236,7 +240,7 @@ int vexpress_config_wait(struct vexpress_config_trans *trans)
 
         return trans->status;
 }
-
+EXPORT_SYMBOL(vexpress_config_wait);
 
 int vexpress_config_read(struct vexpress_config_func *func, int offset,
                 u32 *data)
diff --git a/drivers/mfd/wm5102-tables.c b/drivers/mfd/wm5102-tables.c
index 088872ab6338..1133a64c2dc9 100644
--- a/drivers/mfd/wm5102-tables.c
+++ b/drivers/mfd/wm5102-tables.c
@@ -1882,7 +1882,7 @@ static bool wm5102_volatile_register(struct device *dev, unsigned int reg)
         }
 }
 
-#define WM5102_MAX_REGISTER 0x1a8fff
+#define WM5102_MAX_REGISTER 0x1a9800
 
 const struct regmap_config wm5102_spi_regmap = {
         .reg_bits = 32,
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index 571915dfb218..f74b5adca642 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -1060,26 +1060,6 @@ static int sd_wait_voltage_stable_2(struct realtek_pci_sdmmc *host)
         return 0;
 }
 
-static int sd_change_bank_voltage(struct realtek_pci_sdmmc *host, u8 voltage)
-{
-        struct rtsx_pcr *pcr = host->pcr;
-        int err;
-
-        if (voltage == SD_IO_3V3) {
-                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
-                if (err < 0)
-                        return err;
-        } else if (voltage == SD_IO_1V8) {
-                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
-                if (err < 0)
-                        return err;
-        } else {
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
 static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
 {
         struct realtek_pci_sdmmc *host = mmc_priv(mmc);
@@ -1098,11 +1078,11 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
         rtsx_pci_start_run(pcr);
 
         if (ios->signal_voltage == MMC_SIGNAL_VOLTAGE_330)
-                voltage = SD_IO_3V3;
+                voltage = OUTPUT_3V3;
         else
-                voltage = SD_IO_1V8;
+                voltage = OUTPUT_1V8;
 
-        if (voltage == SD_IO_1V8) {
+        if (voltage == OUTPUT_1V8) {
                 err = rtsx_pci_write_register(pcr,
                                 SD30_DRIVE_SEL, 0x07, DRIVER_TYPE_B);
                 if (err < 0)
@@ -1113,11 +1093,11 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
                         goto out;
         }
 
-        err = sd_change_bank_voltage(host, voltage);
+        err = rtsx_pci_switch_output_voltage(pcr, voltage);
         if (err < 0)
                 goto out;
 
-        if (voltage == SD_IO_1V8) {
+        if (voltage == OUTPUT_1V8) {
                 err = sd_wait_voltage_stable_2(host);
                 if (err < 0)
                         goto out;
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index 27f80cd8aef3..46dcb54c32ec 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -272,6 +272,7 @@ config MTD_DOCG3
         tristate "M-Systems Disk-On-Chip G3"
         select BCH
         select BCH_CONST_PARAMS
+        select BITREVERSE
         ---help---
           This provides an MTD device driver for the M-Systems DiskOnChip
           G3 devices.
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index 67cc73c18ddd..7901d72c9242 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -170,7 +170,7 @@ static int of_flash_probe(struct platform_device *dev)
         resource_size_t res_size;
         struct mtd_part_parser_data ppdata;
         bool map_indirect;
-        const char *mtd_name;
+        const char *mtd_name = NULL;
 
         match = of_match_device(of_flash_match, &dev->dev);
         if (!match)
diff --git a/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c b/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c
index 86c9a79b89b3..595de4012e71 100644
--- a/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c
+++ b/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c
@@ -17,8 +17,8 @@
 #include "bcm47xxnflash.h"
 
 /* Broadcom uses 1'000'000 but it seems to be too many. Tests on WNDR4500 has
- * shown 164 retries as maxiumum. */
-#define NFLASH_READY_RETRIES            1000
+ * shown ~1000 retries as maxiumum. */
+#define NFLASH_READY_RETRIES            10000
 
 #define NFLASH_SECTOR_SIZE              512
 
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 3502606f6480..feae55c7b880 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -523,7 +523,7 @@ static struct nand_ecclayout hwecc4_2048 __initconst = {
 static const struct of_device_id davinci_nand_of_match[] = {
         {.compatible = "ti,davinci-nand", },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, davinci_nand_of_match);
 
 static struct davinci_nand_pdata
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 8323ac991ad1..3766682a0289 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2857,8 +2857,11 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
         int i;
         int val;
 
-        /* ONFI need to be probed in 8 bits mode */
-        WARN_ON(chip->options & NAND_BUSWIDTH_16);
+        /* ONFI need to be probed in 8 bits mode, and 16 bits should be selected with NAND_BUSWIDTH_AUTO */
+        if (chip->options & NAND_BUSWIDTH_16) {
+                pr_err("Trying ONFI probe in 16 bits mode, aborting !\n");
+                return 0;
+        }
         /* Try ONFI for unknown chip or LP */
         chip->cmdfunc(mtd, NAND_CMD_READID, 0x20, -1);
         if (chip->read_byte(mtd) != 'O' || chip->read_byte(mtd) != 'N' ||
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1877ed7ca086..1c9e09fbdff8 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1053,6 +1053,7 @@ static ssize_t bonding_store_primary(struct device *d,
                 pr_info("%s: Setting primary slave to None.\n",
                         bond->dev->name);
                 bond->primary_slave = NULL;
+                memset(bond->params.primary, 0, sizeof(bond->params.primary));
                 bond_select_active_slave(bond);
                 goto out;
         }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 5233b8f58d77..2282b1ae9765 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -488,8 +488,12 @@ static void c_can_setup_receive_object(struct net_device *dev, int iface,
 
         priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface),
                         IFX_WRITE_LOW_16BIT(mask));
+
+        /* According to C_CAN documentation, the reserved bit
+         * in IFx_MASK2 register is fixed 1
+         */
         priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface),
-                        IFX_WRITE_HIGH_16BIT(mask));
+                        IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
 
         priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
                         IFX_WRITE_LOW_16BIT(id));
@@ -960,7 +964,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
                 break;
         case LEC_ACK_ERROR:
                 netdev_dbg(dev, "ack error\n");
-                cf->data[2] |= (CAN_ERR_PROT_LOC_ACK |
+                cf->data[3] |= (CAN_ERR_PROT_LOC_ACK |
                                 CAN_ERR_PROT_LOC_ACK_DEL);
                 break;
         case LEC_BIT1_ERROR:
@@ -973,7 +977,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
                 break;
         case LEC_CRC_ERROR:
                 netdev_dbg(dev, "CRC error\n");
-                cf->data[2] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
+                cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
                                 CAN_ERR_PROT_LOC_CRC_DEL);
                 break;
         default:
diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
index 7d1748575b1f..5c314a961970 100644
--- a/drivers/net/can/pch_can.c
+++ b/drivers/net/can/pch_can.c
@@ -560,7 +560,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
                 stats->rx_errors++;
                 break;
         case PCH_CRC_ERR:
-                cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
                                CAN_ERR_PROT_LOC_CRC_DEL;
                 priv->can.can_stats.bus_error++;
                 stats->rx_errors++;
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index f898c6363729..300581b24ff3 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -746,12 +746,12 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
                 }
                 if (err_status & HECC_CANES_CRCE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE);
-                        cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+                        cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
                                         CAN_ERR_PROT_LOC_CRC_DEL;
                 }
                 if (err_status & HECC_CANES_ACKE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE);
-                        cf->data[2] |= CAN_ERR_PROT_LOC_ACK |
+                        cf->data[3] |= CAN_ERR_PROT_LOC_ACK |
                                         CAN_ERR_PROT_LOC_ACK_DEL;
                 }
         }
diff --git a/drivers/net/ethernet/3com/3c574_cs.c b/drivers/net/ethernet/3com/3c574_cs.c
index 66df93638085..ffd8de28a76a 100644
--- a/drivers/net/ethernet/3com/3c574_cs.c
+++ b/drivers/net/ethernet/3com/3c574_cs.c
@@ -432,7 +432,7 @@ static int tc574_config(struct pcmcia_device *link)
         netdev_info(dev, "%s at io %#3lx, irq %d, hw_addr %pM\n",
                     cardname, dev->base_addr, dev->irq, dev->dev_addr);
         netdev_info(dev, " %dK FIFO split %s Rx:Tx, %sMII interface.\n",
-                    8 << config & Ram_size,
+                    8 << (config & Ram_size),
                     ram_split[(config & Ram_split) >> Ram_split_shift],
                     config & Autoselect ? "autoselect " : "");
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 78ea90c40e19..bdb086934cd9 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -1283,14 +1283,26 @@ static int tg3_phy_auxctl_write(struct tg3 *tp, int reg, u32 set)
         return tg3_writephy(tp, MII_TG3_AUX_CTRL, set | reg);
 }
 
-#define TG3_PHY_AUXCTL_SMDSP_ENABLE(tp) \
-        tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
-                             MII_TG3_AUXCTL_ACTL_SMDSP_ENA | \
-                             MII_TG3_AUXCTL_ACTL_TX_6DB)
+static int tg3_phy_toggle_auxctl_smdsp(struct tg3 *tp, bool enable)
+{
+        u32 val;
+        int err;
 
-#define TG3_PHY_AUXCTL_SMDSP_DISABLE(tp) \
-        tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
-                             MII_TG3_AUXCTL_ACTL_TX_6DB);
+        err = tg3_phy_auxctl_read(tp, MII_TG3_AUXCTL_SHDWSEL_AUXCTL, &val);
+
+        if (err)
+                return err;
+        if (enable)
+
+                val |= MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
+        else
+                val &= ~MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
+
+        err = tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL,
+                                   val | MII_TG3_AUXCTL_ACTL_TX_6DB);
+
+        return err;
+}
 
 static int tg3_bmcr_reset(struct tg3 *tp)
 {
@@ -2223,7 +2235,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
 
         otp = tp->phy_otp;
 
-        if (TG3_PHY_AUXCTL_SMDSP_ENABLE(tp))
+        if (tg3_phy_toggle_auxctl_smdsp(tp, true))
                 return;
 
         phy = ((otp & TG3_OTP_AGCTGT_MASK) >> TG3_OTP_AGCTGT_SHIFT);
@@ -2248,7 +2260,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
               ((otp & TG3_OTP_RCOFF_MASK) >> TG3_OTP_RCOFF_SHIFT);
         tg3_phydsp_write(tp, MII_TG3_DSP_EXP97, phy);
 
-        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+        tg3_phy_toggle_auxctl_smdsp(tp, false);
 }
 
 static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
@@ -2284,9 +2296,9 @@ static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
 
         if (!tp->setlpicnt) {
                 if (current_link_up == 1 &&
-                   !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+                   !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                         tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, 0x0000);
-                        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                        tg3_phy_toggle_auxctl_smdsp(tp, false);
                 }
 
                 val = tr32(TG3_CPMU_EEE_MODE);
@@ -2302,11 +2314,11 @@ static void tg3_phy_eee_enable(struct tg3 *tp)
             (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719 ||
              tg3_flag(tp, 57765_CLASS)) &&
-            !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+            !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                 val = MII_TG3_DSP_TAP26_ALNOKO |
                       MII_TG3_DSP_TAP26_RMRXSTO;
                 tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, val);
-                TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                tg3_phy_toggle_auxctl_smdsp(tp, false);
         }
 
         val = tr32(TG3_CPMU_EEE_MODE);
@@ -2450,7 +2462,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
                 tg3_writephy(tp, MII_CTRL1000,
                              CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER);
 
-                err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
+                err = tg3_phy_toggle_auxctl_smdsp(tp, true);
                 if (err)
                         return err;
 
@@ -2471,7 +2483,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
         tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x8200);
         tg3_writephy(tp, MII_TG3_DSP_CONTROL, 0x0000);
 
-        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+        tg3_phy_toggle_auxctl_smdsp(tp, false);
 
         tg3_writephy(tp, MII_CTRL1000, phy9_orig);
 
@@ -2572,10 +2584,10 @@ static int tg3_phy_reset(struct tg3 *tp)
 
 out:
         if ((tp->phy_flags & TG3_PHYFLG_ADC_BUG) &&
-            !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+            !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                 tg3_phydsp_write(tp, 0x201f, 0x2aaa);
                 tg3_phydsp_write(tp, 0x000a, 0x0323);
-                TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                tg3_phy_toggle_auxctl_smdsp(tp, false);
         }
 
         if (tp->phy_flags & TG3_PHYFLG_5704_A0_BUG) {
@@ -2584,14 +2596,14 @@ out:
         }
 
         if (tp->phy_flags & TG3_PHYFLG_BER_BUG) {
-                if (!TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+                if (!tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                         tg3_phydsp_write(tp, 0x000a, 0x310b);
                         tg3_phydsp_write(tp, 0x201f, 0x9506);
                         tg3_phydsp_write(tp, 0x401f, 0x14e2);
-                        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                        tg3_phy_toggle_auxctl_smdsp(tp, false);
                 }
         } else if (tp->phy_flags & TG3_PHYFLG_JITTER_BUG) {
-                if (!TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+                if (!tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                         tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
                         if (tp->phy_flags & TG3_PHYFLG_ADJUST_TRIM) {
                                 tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x110b);
@@ -2600,7 +2612,7 @@ out:
                         } else
                                 tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
 
-                        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                        tg3_phy_toggle_auxctl_smdsp(tp, false);
                 }
         }
 
@@ -4009,7 +4021,7 @@ static int tg3_phy_autoneg_cfg(struct tg3 *tp, u32 advertise, u32 flowctrl)
         tw32(TG3_CPMU_EEE_MODE,
              tr32(TG3_CPMU_EEE_MODE) & ~TG3_CPMU_EEEMD_LPI_ENABLE);
 
-        err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
+        err = tg3_phy_toggle_auxctl_smdsp(tp, true);
         if (!err) {
                 u32 err2;
 
@@ -4042,7 +4054,7 @@ static int tg3_phy_autoneg_cfg(struct tg3 *tp, u32 advertise, u32 flowctrl)
                                                  MII_TG3_DSP_CH34TP2_HIBW01);
                 }
 
-                err2 = TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                err2 = tg3_phy_toggle_auxctl_smdsp(tp, false);
                 if (!err)
                         err = err2;
         }
@@ -6950,6 +6962,9 @@ static void tg3_poll_controller(struct net_device *dev)
         int i;
         struct tg3 *tp = netdev_priv(dev);
 
+        if (tg3_irq_sync(tp))
+                return;
+
         for (i = 0; i < tp->irq_cnt; i++)
                 tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
 }
@@ -16367,6 +16382,7 @@ static int tg3_init_one(struct pci_dev *pdev,
         tp->pm_cap = pm_cap;
         tp->rx_mode = TG3_DEF_RX_MODE;
         tp->tx_mode = TG3_DEF_TX_MODE;
+        tp->irq_sync = 1;
 
         if (tg3_debug > 0)
                 tp->msg_enable = tg3_debug;
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index b407043ce9b0..f7f02900f650 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -548,6 +548,10 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p)
                 return -1;
         }
 
+        /* All frames should fit into a single buffer */
+        if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG))
+                return -1;
+
         /* Check if packet has checksum already */
         if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) &&
                 !(ext_status & RXDESC_IP_PAYLOAD_MASK))
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index f0718e1a8369..c306df7d4568 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -1994,9 +1994,20 @@ static int set_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
 {
         const struct port_info *pi = netdev_priv(dev);
         struct adapter *adap = pi->adapter;
-
-        return set_rxq_intr_params(adap, &adap->sge.ethrxq[pi->first_qset].rspq,
-                        c->rx_coalesce_usecs, c->rx_max_coalesced_frames);
+        struct sge_rspq *q;
+        int i;
+        int r = 0;
+
+        for (i = pi->first_qset; i < pi->first_qset + pi->nqsets; i++) {
+                q = &adap->sge.ethrxq[i].rspq;
+                r = set_rxq_intr_params(adap, q, c->rx_coalesce_usecs,
+                        c->rx_max_coalesced_frames);
+                if (r) {
+                        dev_err(&dev->dev, "failed to set coalesce %d\n", r);
+                        break;
+                }
+        }
+        return r;
 }
 
 static int get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 4eba17b83ba8..f1b3df167ff2 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -36,13 +36,13 @@
 
 #define DRV_VER                 "4.4.161.0u"
 #define DRV_NAME                "be2net"
-#define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
-#define BE3_NAME                "ServerEngines BladeEngine3 10Gbps NIC"
-#define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
+#define BE_NAME                 "Emulex BladeEngine2"
+#define BE3_NAME                "Emulex BladeEngine3"
+#define OC_NAME                 "Emulex OneConnect"
 #define OC_NAME_BE              OC_NAME "(be3)"
 #define OC_NAME_LANCER          OC_NAME "(Lancer)"
 #define OC_NAME_SH              OC_NAME "(Skyhawk)"
-#define DRV_DESC                "ServerEngines BladeEngine 10Gbps NIC Driver"
+#define DRV_DESC                "Emulex OneConnect 10Gbps NIC Driver"
 
 #define BE_VENDOR_ID            0x19a2
 #define EMULEX_VENDOR_ID        0x10df
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 5c995700e534..4d6f3c54427a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -25,7 +25,7 @@
 MODULE_VERSION(DRV_VER);
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
 MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
-MODULE_AUTHOR("ServerEngines Corporation");
+MODULE_AUTHOR("Emulex Corporation");
 MODULE_LICENSE("GPL");
 
 static unsigned int num_vfs;
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 02a12b69555f..4dab6fc265a2 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -232,6 +232,7 @@
 #define E1000_CTRL_FRCDPX   0x00001000  /* Force Duplex */
 #define E1000_CTRL_LANPHYPC_OVERRIDE 0x00010000 /* SW control of LANPHYPC */
 #define E1000_CTRL_LANPHYPC_VALUE    0x00020000 /* SW value of LANPHYPC */
+#define E1000_CTRL_MEHE     0x00080000  /* Memory Error Handling Enable */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
 #define E1000_CTRL_SWDPIO0  0x00400000  /* SWDPIN 0 Input or output */
@@ -389,6 +390,12 @@
 
 #define E1000_PBS_16K E1000_PBA_16K
 
+/* Uncorrectable/correctable ECC Error counts and enable bits */
+#define E1000_PBECCSTS_CORR_ERR_CNT_MASK        0x000000FF
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_MASK      0x0000FF00
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT     8
+#define E1000_PBECCSTS_ECC_ENABLE               0x00010000
+
 #define IFS_MAX       80
 #define IFS_MIN       40
 #define IFS_RATIO     4
@@ -408,6 +415,7 @@
 #define E1000_ICR_RXSEQ         0x00000008 /* Rx sequence error */
 #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
 #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+#define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
 #define E1000_ICR_INT_ASSERTED  0x80000000 /* If this bit asserted, the driver should claim the interrupt */
 #define E1000_ICR_RXQ0          0x00100000 /* Rx Queue 0 Interrupt */
 #define E1000_ICR_RXQ1          0x00200000 /* Rx Queue 1 Interrupt */
@@ -443,6 +451,7 @@
 #define E1000_IMS_RXSEQ     E1000_ICR_RXSEQ     /* Rx sequence error */
 #define E1000_IMS_RXDMT0    E1000_ICR_RXDMT0    /* Rx desc min. threshold */
 #define E1000_IMS_RXT0      E1000_ICR_RXT0      /* Rx timer intr */
+#define E1000_IMS_ECCER     E1000_ICR_ECCER     /* Uncorrectable ECC Error */
 #define E1000_IMS_RXQ0      E1000_ICR_RXQ0      /* Rx Queue 0 Interrupt */
 #define E1000_IMS_RXQ1      E1000_ICR_RXQ1      /* Rx Queue 1 Interrupt */
 #define E1000_IMS_TXQ0      E1000_ICR_TXQ0      /* Tx Queue 0 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index 6782a2eea1bc..7e95f221d60b 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -309,6 +309,8 @@ struct e1000_adapter {
 
         struct napi_struct napi;
 
+        unsigned int uncorr_errors;     /* uncorrectable ECC errors */
+        unsigned int corr_errors;       /* correctable ECC errors */
         unsigned int restart_queue;
         u32 txd_cmd;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index f95bc6ee1c22..fd4772a2691c 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -108,6 +108,8 @@ static const struct e1000_stats e1000_gstrings_stats[] = {
         E1000_STAT("dropped_smbus", stats.mgpdc),
         E1000_STAT("rx_dma_failed", rx_dma_failed),
         E1000_STAT("tx_dma_failed", tx_dma_failed),
+        E1000_STAT("uncorr_ecc_errors", uncorr_errors),
+        E1000_STAT("corr_ecc_errors", corr_errors),
 };
 
 #define E1000_GLOBAL_STATS_LEN  ARRAY_SIZE(e1000_gstrings_stats)
diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
index cf217777586c..b88676ff3d86 100644
--- a/drivers/net/ethernet/intel/e1000e/hw.h
+++ b/drivers/net/ethernet/intel/e1000e/hw.h
@@ -77,6 +77,7 @@ enum e1e_registers {
 #define E1000_POEMB     E1000_PHY_CTRL  /* PHY OEM Bits */
         E1000_PBA      = 0x01000, /* Packet Buffer Allocation - RW */
         E1000_PBS      = 0x01008, /* Packet Buffer Size */
+        E1000_PBECCSTS = 0x0100C, /* Packet Buffer ECC Status - RW */
         E1000_EEMNGCTL = 0x01010, /* MNG EEprom Control */
         E1000_EEWR     = 0x0102C, /* EEPROM Write Register - RW */
         E1000_FLOP     = 0x0103C, /* FLASH Opcode Register */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 976336547607..24d9f61956f0 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -3624,6 +3624,17 @@ static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw)
         if (hw->mac.type == e1000_ich8lan)
                 reg |= (E1000_RFCTL_IPV6_EX_DIS | E1000_RFCTL_NEW_IPV6_EXT_DIS);
         ew32(RFCTL, reg);
+
+        /* Enable ECC on Lynxpoint */
+        if (hw->mac.type == e1000_pch_lpt) {
+                reg = er32(PBECCSTS);
+                reg |= E1000_PBECCSTS_ECC_ENABLE;
+                ew32(PBECCSTS, reg);
+
+                reg = er32(CTRL);
+                reg |= E1000_CTRL_MEHE;
+                ew32(CTRL, reg);
+        }
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index fbf75fdca994..643c883dd795 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1678,6 +1678,23 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
                         mod_timer(&adapter->watchdog_timer, jiffies + 1);
         }
 
+        /* Reset on uncorrectable ECC error */
+        if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
+                u32 pbeccsts = er32(PBECCSTS);
+
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+
+                /* Do the reset outside of interrupt context */
+                schedule_work(&adapter->reset_task);
+
+                /* return immediately since reset is imminent */
+                return IRQ_HANDLED;
+        }
+
         if (napi_schedule_prep(&adapter->napi)) {
                 adapter->total_tx_bytes = 0;
                 adapter->total_tx_packets = 0;
@@ -1741,6 +1758,23 @@ static irqreturn_t e1000_intr(int irq, void *data)
                         mod_timer(&adapter->watchdog_timer, jiffies + 1);
         }
 
+        /* Reset on uncorrectable ECC error */
+        if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
+                u32 pbeccsts = er32(PBECCSTS);
+
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+
+                /* Do the reset outside of interrupt context */
+                schedule_work(&adapter->reset_task);
+
+                /* return immediately since reset is imminent */
+                return IRQ_HANDLED;
+        }
+
         if (napi_schedule_prep(&adapter->napi)) {
                 adapter->total_tx_bytes = 0;
                 adapter->total_tx_packets = 0;
@@ -2104,6 +2138,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
         if (adapter->msix_entries) {
                 ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
                 ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER | E1000_IMS_LSC);
+        } else if (hw->mac.type == e1000_pch_lpt) {
+                ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
         } else {
                 ew32(IMS, IMS_ENABLE_MASK);
         }
@@ -4251,6 +4287,16 @@ static void e1000e_update_stats(struct e1000_adapter *adapter)
         adapter->stats.mgptc += er32(MGTPTC);
         adapter->stats.mgprc += er32(MGTPRC);
         adapter->stats.mgpdc += er32(MGTPDC);
+
+        /* Correctable ECC Errors */
+        if (hw->mac.type == e1000_pch_lpt) {
+                u32 pbeccsts = er32(PBECCSTS);
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+        }
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/Makefile b/drivers/net/ethernet/intel/ixgbe/Makefile
index f3a632bf8d96..687c83d1bdab 100644
--- a/drivers/net/ethernet/intel/ixgbe/Makefile
+++ b/drivers/net/ethernet/intel/ixgbe/Makefile
@@ -32,7 +32,7 @@
 
 obj-$(CONFIG_IXGBE) += ixgbe.o
 
-ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o ixgbe_debugfs.o\
+ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o \
               ixgbe_82599.o ixgbe_82598.o ixgbe_phy.o ixgbe_sriov.o \
               ixgbe_mbx.o ixgbe_x540.o ixgbe_lib.o ixgbe_ptp.o
 
@@ -40,4 +40,5 @@ ixgbe-$(CONFIG_IXGBE_DCB) +=  ixgbe_dcb.o ixgbe_dcb_82598.o \
                               ixgbe_dcb_82599.o ixgbe_dcb_nl.o
 
 ixgbe-$(CONFIG_IXGBE_HWMON) += ixgbe_sysfs.o
+ixgbe-$(CONFIG_DEBUG_FS) += ixgbe_debugfs.o
 ixgbe-$(CONFIG_FCOE:m=y) += ixgbe_fcoe.o
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
index 50aa546b8c7a..3504686d3af5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
@@ -24,9 +24,6 @@
   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 
 *******************************************************************************/
-
-#ifdef CONFIG_DEBUG_FS
-
 #include <linux/debugfs.h>
 #include <linux/module.h>
 
@@ -277,5 +274,3 @@ void ixgbe_dbg_exit(void)
 {
         debugfs_remove_recursive(ixgbe_dbg_root);
 }
-
-#endif /* CONFIG_DEBUG_FS */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index 1a751c9d09c4..bb9256a1b0a9 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -660,11 +660,11 @@ int ixgbe_ptp_hwtstamp_ioctl(struct ixgbe_adapter *adapter,
                 break;
         case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
                 tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
-                tsync_rx_mtrl = IXGBE_RXMTRL_V1_SYNC_MSG;
+                tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG;
                 break;
         case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
                 tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
-                tsync_rx_mtrl = IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
+                tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
                 break;
         case HWTSTAMP_FILTER_PTP_V2_EVENT:
         case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 2b799f4f1c37..6771b69f40d5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -630,10 +630,15 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                 ring->tx_csum++;
         }
 
-        /* Copy dst mac address to wqe */
-        ethh = (struct ethhdr *)skb->data;
-        tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
-        tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
+        if (mlx4_is_mfunc(mdev->dev) || priv->validate_loopback) {
+                /* Copy dst mac address to wqe. This allows loopback in eSwitch,
+                 * so that VFs and PF can communicate with each other
+                 */
+                ethh = (struct ethhdr *)skb->data;
+                tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
+                tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
+        }
+
         /* Handle LSO (TSO) packets */
         if (lso_header_size) {
                 /* Mark opcode as LSO */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index e1bafffbc3b1..5163af314990 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -380,7 +380,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 }
         }
 
-        if ((dev_cap->flags &
+        if ((dev->caps.flags &
             (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) &&
             mlx4_is_master(dev))
                 dev->caps.function_caps |= MLX4_FUNC_CAP_64B_EQE_CQE;
@@ -1790,15 +1790,8 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
         int i;
 
         if (msi_x) {
-                /* In multifunction mode each function gets 2 msi-X vectors
-                 * one for data path completions anf the other for asynch events
-                 * or command completions */
-                if (mlx4_is_mfunc(dev)) {
-                        nreq = 2;
-                } else {
-                        nreq = min_t(int, dev->caps.num_eqs -
-                                     dev->caps.reserved_eqs, nreq);
-                }
+                nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
+                             nreq);
 
                 entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
                 if (!entries)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index bc165f4d0f65..695667d471a1 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -144,7 +144,7 @@ void netxen_release_tx_buffers(struct netxen_adapter *adapter)
                                          buffrag->length, PCI_DMA_TODEVICE);
                         buffrag->dma = 0ULL;
                 }
-                for (j = 0; j < cmd_buf->frag_count; j++) {
+                for (j = 1; j < cmd_buf->frag_count; j++) {
                         buffrag++;
                         if (buffrag->dma) {
                                 pci_unmap_page(adapter->pdev, buffrag->dma,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 6098fd4adfeb..69e321a65077 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1963,10 +1963,12 @@ unwind:
         while (--i >= 0) {
                 nf = &pbuf->frag_array[i+1];
                 pci_unmap_page(pdev, nf->dma, nf->length, PCI_DMA_TODEVICE);
+                nf->dma = 0ULL;
         }
 
         nf = &pbuf->frag_array[0];
         pci_unmap_single(pdev, nf->dma, skb_headlen(skb), PCI_DMA_TODEVICE);
+        nf->dma = 0ULL;
 
 out_err:
         return -ENOMEM;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index ed96f309bca8..11702324a071 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -1826,8 +1826,6 @@ static void rtl8169_rx_vlan_tag(struct RxDesc *desc, struct sk_buff *skb)
 
         if (opts2 & RxVlanTag)
                 __vlan_hwaccel_put_tag(skb, swab16(opts2 & 0xffff));
-
-        desc->opts2 = 0;
 }
 
 static int rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd)
@@ -6064,8 +6062,6 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
                             !(status & (RxRWT | RxFOVF)) &&
                             (dev->features & NETIF_F_RXALL))
                                 goto process_pkt;
-
-                        rtl8169_mark_to_asic(desc, rx_buf_sz);
                 } else {
                         struct sk_buff *skb;
                         dma_addr_t addr;
@@ -6086,16 +6082,14 @@ process_pkt:
                         if (unlikely(rtl8169_fragmented_frame(status))) {
                                 dev->stats.rx_dropped++;
                                 dev->stats.rx_length_errors++;
-                                rtl8169_mark_to_asic(desc, rx_buf_sz);
-                                continue;
+                                goto release_descriptor;
                         }
 
                         skb = rtl8169_try_rx_copy(tp->Rx_databuff[entry],
                                                   tp, pkt_size, addr);
-                        rtl8169_mark_to_asic(desc, rx_buf_sz);
                         if (!skb) {
                                 dev->stats.rx_dropped++;
-                                continue;
+                                goto release_descriptor;
                         }
 
                         rtl8169_rx_csum(skb, status);
@@ -6111,13 +6105,10 @@ process_pkt:
                         tp->rx_stats.bytes += pkt_size;
                         u64_stats_update_end(&tp->rx_stats.syncp);
                 }
-
-                /* Work around for AMD plateform. */
-                if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
-                    (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
-                        desc->opts2 = 0;
-                        cur_rx++;
-                }
+release_descriptor:
+                desc->opts2 = 0;
+                wmb();
+                rtl8169_mark_to_asic(desc, rx_buf_sz);
         }
 
         count = cur_rx - tp->cur_rx;
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index 7992b3e05d3d..78ace59efd29 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1801,7 +1801,7 @@ static void rhine_tx(struct net_device *dev)
                                          rp->tx_skbuff[entry]->len,
                                          PCI_DMA_TODEVICE);
                 }
-                dev_kfree_skb_irq(rp->tx_skbuff[entry]);
+                dev_kfree_skb(rp->tx_skbuff[entry]);
                 rp->tx_skbuff[entry] = NULL;
                 entry = (++rp->dirty_tx) % TX_RING_SIZE;
         }
@@ -2010,11 +2010,7 @@ static void rhine_slow_event_task(struct work_struct *work)
         if (intr_status & IntrPCIErr)
                 netif_warn(rp, hw, dev, "PCI error\n");
 
-        napi_disable(&rp->napi);
-        rhine_irq_disable(rp);
-        /* Slow and safe. Consider __napi_schedule as a replacement ? */
-        napi_enable(&rp->napi);
-        napi_schedule(&rp->napi);
+        iowrite16(RHINE_EVENT & 0xffff, rp->base + IntrEnable);
 
 out_unlock:
         mutex_unlock(&rp->task_lock);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 5fd6f4674326..e6fe0d80d612 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -84,7 +84,7 @@ struct hv_netvsc_packet {
 };
 
 struct netvsc_device_info {
-        unsigned char mac_adr[6];
+        unsigned char mac_adr[ETH_ALEN];
         bool link_state;        /* 0 - link up, 1 - link down */
         int  ring_size;
 };
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f825a629a699..8264f0ef7692 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -349,7 +349,7 @@ static int netvsc_set_mac_addr(struct net_device *ndev, void *p)
         struct net_device_context *ndevctx = netdev_priv(ndev);
         struct hv_device *hdev =  ndevctx->device_ctx;
         struct sockaddr *addr = p;
-        char save_adr[14];
+        char save_adr[ETH_ALEN];
         unsigned char save_aatype;
         int err;
 
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 81f8f9e31db5..fcbf680c3e62 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -77,6 +77,11 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 
         skb_orphan(skb);
 
+        /* Before queueing this packet to netif_rx(),
+         * make sure dst is refcounted.
+         */
+        skb_dst_force(skb);
+
         skb->protocol = eth_type_trans(skb, dev);
 
         /* it's OK to use per_cpu_ptr() because BHs are off */
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 68a43fe602e7..d3fb97d97cbc 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -822,7 +822,10 @@ static int macvlan_changelink(struct net_device *dev,
 
 static size_t macvlan_get_size(const struct net_device *dev)
 {
-        return nla_total_size(4);
+        return (0
+                + nla_total_size(4) /* IFLA_MACVLAN_MODE */
+                + nla_total_size(2) /* IFLA_MACVLAN_FLAGS */
+                );
 }
 
 static int macvlan_fill_info(struct sk_buff *skb,
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index d5199cb4caec..b5ddd5077a80 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -36,8 +36,9 @@ MODULE_LICENSE("GPL");
 
 /* IP101A/G - IP1001 */
 #define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
+#define IP1001_RXPHASE_SEL              (1<<0)  /* Add delay on RX_CLK */
+#define IP1001_TXPHASE_SEL              (1<<1)  /* Add delay on TX_CLK */
 #define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
 #define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
 #define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 #define IP101A_G_IRQ_CONF_STATUS        0x11    /* Conf Info IRQ & Status Reg */
@@ -138,19 +139,24 @@ static int ip1001_config_init(struct phy_device *phydev)
         if (c < 0)
                 return c;
 
-        /* INTR pin used: speed/link/duplex will cause an interrupt */
-        c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
-        if (c < 0)
-                return c;
+        if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
-                /* Additional delay (2ns) used to adjust RX clock phase
-                 * at RGMII interface */
                 c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
                 if (c < 0)
                         return c;
 
-                c |= IP1001_PHASE_SEL_MASK;
+                c &= ~(IP1001_RXPHASE_SEL | IP1001_TXPHASE_SEL);
+
+                if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+                        c |= (IP1001_RXPHASE_SEL | IP1001_TXPHASE_SEL);
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
+                        c |= IP1001_RXPHASE_SEL;
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
+                        c |= IP1001_TXPHASE_SEL;
+
                 c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
                 if (c < 0)
                         return c;
@@ -167,6 +173,11 @@ static int ip101a_g_config_init(struct phy_device *phydev)
         if (c < 0)
                 return c;
 
+        /* INTR pin used: speed/link/duplex will cause an interrupt */
+        c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
+        if (c < 0)
+                return c;
+
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
         c |= IP101A_G_APS_ON;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 5d2a3f215887..22dec9c7ef05 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -353,15 +353,6 @@ static int m88e1111_config_init(struct phy_device *phydev)
         int err;
         int temp;
 
-        /* Enable Fiber/Copper auto selection */
-        temp = phy_read(phydev, MII_M1111_PHY_EXT_SR);
-        temp &= ~MII_M1111_HWCFG_FIBER_COPPER_AUTO;
-        phy_write(phydev, MII_M1111_PHY_EXT_SR, temp);
-
-        temp = phy_read(phydev, MII_BMCR);
-        temp |= BMCR_RESET;
-        phy_write(phydev, MII_BMCR, temp);
-
         if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
             (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
             (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index af372d0957fe..2917a86f4c43 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -109,11 +109,11 @@ struct tap_filter {
         unsigned char   addr[FLT_EXACT_COUNT][ETH_ALEN];
 };
 
-/* 1024 is probably a high enough limit: modern hypervisors seem to support on
- * the order of 100-200 CPUs so this leaves us some breathing space if we want
- * to match a queue per guest CPU.
- */
-#define MAX_TAP_QUEUES 1024
+/* DEFAULT_MAX_NUM_RSS_QUEUES were choosed to let the rx/tx queues allocated for
+ * the netdevice to be fit in one page. So we can make sure the success of
+ * memory allocation. TODO: increase the limit. */
+#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
+#define MAX_TAP_FLOWS  4096
 
 #define TUN_FLOW_EXPIRE (3 * HZ)
 
@@ -185,6 +185,8 @@ struct tun_struct {
         unsigned long ageing_time;
         unsigned int numdisabled;
         struct list_head disabled;
+        void *security;
+        u32 flow_count;
 };
 
 static inline u32 tun_hashfn(u32 rxhash)
@@ -218,6 +220,7 @@ static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
                 e->queue_index = queue_index;
                 e->tun = tun;
                 hlist_add_head_rcu(&e->hash_link, head);
+                ++tun->flow_count;
         }
         return e;
 }
@@ -228,6 +231,7 @@ static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
                   e->rxhash, e->queue_index);
         hlist_del_rcu(&e->hash_link);
         kfree_rcu(e, rcu);
+        --tun->flow_count;
 }
 
 static void tun_flow_flush(struct tun_struct *tun)
@@ -294,11 +298,12 @@ static void tun_flow_cleanup(unsigned long data)
 }
 
 static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
-                            u16 queue_index)
+                            struct tun_file *tfile)
 {
         struct hlist_head *head;
         struct tun_flow_entry *e;
         unsigned long delay = tun->ageing_time;
+        u16 queue_index = tfile->queue_index;
 
         if (!rxhash)
                 return;
@@ -307,7 +312,9 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
 
         rcu_read_lock();
 
-        if (tun->numqueues == 1)
+        /* We may get a very small possibility of OOO during switching, not
+         * worth to optimize.*/
+        if (tun->numqueues == 1 || tfile->detached)
                 goto unlock;
 
         e = tun_flow_find(head, rxhash);
@@ -317,7 +324,8 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
                 e->updated = jiffies;
         } else {
                 spin_lock_bh(&tun->lock);
-                if (!tun_flow_find(head, rxhash))
+                if (!tun_flow_find(head, rxhash) &&
+                    tun->flow_count < MAX_TAP_FLOWS)
                         tun_flow_create(tun, head, rxhash, queue_index);
 
                 if (!timer_pending(&tun->flow_gc_timer))
@@ -406,21 +414,21 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
 
         tun = rtnl_dereference(tfile->tun);
 
-        if (tun) {
+        if (tun && !tfile->detached) {
                 u16 index = tfile->queue_index;
                 BUG_ON(index >= tun->numqueues);
                 dev = tun->dev;
 
                 rcu_assign_pointer(tun->tfiles[index],
                                    tun->tfiles[tun->numqueues - 1]);
-                rcu_assign_pointer(tfile->tun, NULL);
                 ntfile = rtnl_dereference(tun->tfiles[index]);
                 ntfile->queue_index = index;
 
                 --tun->numqueues;
-                if (clean)
+                if (clean) {
+                        rcu_assign_pointer(tfile->tun, NULL);
                         sock_put(&tfile->sk);
-                else
+                } else
                         tun_disable_queue(tun, tfile);
 
                 synchronize_net();
@@ -434,10 +442,13 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
         }
 
         if (clean) {
-                if (tun && tun->numqueues == 0 && tun->numdisabled == 0 &&
-                    !(tun->flags & TUN_PERSIST))
-                        if (tun->dev->reg_state == NETREG_REGISTERED)
+                if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
+                        netif_carrier_off(tun->dev);
+
+                        if (!(tun->flags & TUN_PERSIST) &&
+                            tun->dev->reg_state == NETREG_REGISTERED)
                                 unregister_netdevice(tun->dev);
+                }
 
                 BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
                                  &tfile->socket.flags));
@@ -465,6 +476,10 @@ static void tun_detach_all(struct net_device *dev)
                 rcu_assign_pointer(tfile->tun, NULL);
                 --tun->numqueues;
         }
+        list_for_each_entry(tfile, &tun->disabled, next) {
+                wake_up_all(&tfile->wq.wait);
+                rcu_assign_pointer(tfile->tun, NULL);
+        }
         BUG_ON(tun->numqueues != 0);
 
         synchronize_net();
@@ -490,8 +505,12 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
         struct tun_file *tfile = file->private_data;
         int err;
 
+        err = security_tun_dev_attach(tfile->socket.sk, tun->security);
+        if (err < 0)
+                goto out;
+
         err = -EINVAL;
-        if (rtnl_dereference(tfile->tun))
+        if (rtnl_dereference(tfile->tun) && !tfile->detached)
                 goto out;
 
         err = -EBUSY;
@@ -1190,7 +1209,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         tun->dev->stats.rx_packets++;
         tun->dev->stats.rx_bytes += len;
 
-        tun_flow_update(tun, rxhash, tfile->queue_index);
+        tun_flow_update(tun, rxhash, tfile);
         return total_len;
 }
 
@@ -1373,6 +1392,7 @@ static void tun_free_netdev(struct net_device *dev)
 
         BUG_ON(!(list_empty(&tun->disabled)));
         tun_flow_uninit(tun);
+        security_tun_dev_free_security(tun->security);
         free_netdev(dev);
 }
 
@@ -1562,7 +1582,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 if (tun_not_capable(tun))
                         return -EPERM;
-                err = security_tun_dev_attach(tfile->socket.sk);
+                err = security_tun_dev_open(tun->security);
                 if (err < 0)
                         return err;
 
@@ -1577,6 +1597,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         else {
                 char *name;
                 unsigned long flags = 0;
+                int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
+                             MAX_TAP_QUEUES : 1;
 
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                         return -EPERM;
@@ -1600,8 +1622,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                         name = ifr->ifr_name;
 
                 dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
-                                       tun_setup,
-                                       MAX_TAP_QUEUES, MAX_TAP_QUEUES);
+                                       tun_setup, queues, queues);
+
                 if (!dev)
                         return -ENOMEM;
 
@@ -1619,7 +1641,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 spin_lock_init(&tun->lock);
 
-                security_tun_dev_post_create(&tfile->sk);
+                err = security_tun_dev_alloc_security(&tun->security);
+                if (err < 0)
+                        goto err_free_dev;
 
                 tun_net_init(dev);
 
@@ -1644,10 +1668,10 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                     device_create_file(&tun->dev->dev, &dev_attr_owner) ||
                     device_create_file(&tun->dev->dev, &dev_attr_group))
                         pr_err("Failed to create tun sysfs files\n");
-
-                netif_carrier_on(tun->dev);
         }
 
+        netif_carrier_on(tun->dev);
+
         tun_debug(KERN_INFO, tun, "tun_set_iff\n");
 
         if (ifr->ifr_flags & IFF_NO_PI)
@@ -1789,19 +1813,24 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
 
         if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
                 tun = tfile->detached;
-                if (!tun)
+                if (!tun) {
                         ret = -EINVAL;
-                else
-                        ret = tun_attach(tun, file);
+                        goto unlock;
+                }
+                ret = security_tun_dev_attach_queue(tun->security);
+                if (ret < 0)
+                        goto unlock;
+                ret = tun_attach(tun, file);
         } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
                 tun = rtnl_dereference(tfile->tun);
-                if (!tun || !(tun->flags & TUN_TAP_MQ))
+                if (!tun || !(tun->flags & TUN_TAP_MQ) || tfile->detached)
                         ret = -EINVAL;
                 else
                         __tun_detach(tfile, false);
         } else
                 ret = -EINVAL;
 
+unlock:
         rtnl_unlock();
         return ret;
 }
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 42f51c71ec1f..248d2dc765a5 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -374,6 +374,21 @@ static const struct driver_info cdc_mbim_info = {
         .tx_fixup = cdc_mbim_tx_fixup,
 };
 
+/* MBIM and NCM devices should not need a ZLP after NTBs with
+ * dwNtbOutMaxSize length. This driver_info is for the exceptional
+ * devices requiring it anyway, allowing them to be supported without
+ * forcing the performance penalty on all the sane devices.
+ */
+static const struct driver_info cdc_mbim_info_zlp = {
+        .description = "CDC MBIM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = cdc_mbim_bind,
+        .unbind = cdc_mbim_unbind,
+        .manage_power = cdc_mbim_manage_power,
+        .rx_fixup = cdc_mbim_rx_fixup,
+        .tx_fixup = cdc_mbim_tx_fixup,
+};
+
 static const struct usb_device_id mbim_devs[] = {
         /* This duplicate NCM entry is intentional. MBIM devices can
          * be disguised as NCM by default, and this is necessary to
@@ -385,6 +400,10 @@ static const struct usb_device_id mbim_devs[] = {
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
+        /* Sierra Wireless MC7710 need ZLPs */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68a2, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+        },
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 71b6e92b8e9b..00d3b2d37828 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -435,6 +435,13 @@ advance:
                 len -= temp;
         }
 
+        /* some buggy devices have an IAD but no CDC Union */
+        if (!ctx->union_desc && intf->intf_assoc && intf->intf_assoc->bInterfaceCount == 2) {
+                ctx->control = intf;
+                ctx->data = usb_ifnum_to_if(dev->udev, intf->cur_altsetting->desc.bInterfaceNumber + 1);
+                dev_dbg(&intf->dev, "CDC Union missing - got slave from IAD\n");
+        }
+
         /* check if we got everything */
         if ((ctx->control == NULL) || (ctx->data == NULL) ||
             ((!ctx->mbim_desc) && ((ctx->ether_desc == NULL) || (ctx->control != intf))))
@@ -497,7 +504,8 @@ advance:
 error2:
         usb_set_intfdata(ctx->control, NULL);
         usb_set_intfdata(ctx->data, NULL);
-        usb_driver_release_interface(driver, ctx->data);
+        if (ctx->data != ctx->control)
+                usb_driver_release_interface(driver, ctx->data);
 error:
         cdc_ncm_free((struct cdc_ncm_ctx *)dev->data[0]);
         dev->data[0] = 0;
@@ -1155,6 +1163,20 @@ static const struct driver_info wwan_info = {
         .tx_fixup = cdc_ncm_tx_fixup,
 };
 
+/* Same as wwan_info, but with FLAG_NOARP  */
+static const struct driver_info wwan_noarp_info = {
+        .description = "Mobile Broadband Network Device (NO ARP)",
+        .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+                        | FLAG_WWAN | FLAG_NOARP,
+        .bind = cdc_ncm_bind,
+        .unbind = cdc_ncm_unbind,
+        .check_connect = cdc_ncm_check_connect,
+        .manage_power = usbnet_manage_power,
+        .status = cdc_ncm_status,
+        .rx_fixup = cdc_ncm_rx_fixup,
+        .tx_fixup = cdc_ncm_tx_fixup,
+};
+
 static const struct usb_device_id cdc_devs[] = {
         /* Ericsson MBM devices like F5521gw */
         { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
@@ -1193,6 +1215,16 @@ static const struct usb_device_id cdc_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46),
           .driver_info = (unsigned long)&wwan_info,
         },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
+          .driver_info = (unsigned long)&wwan_info,
+        },
+
+        /* Infineon(now Intel) HSPA Modem platform */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_noarp_info,
+        },
 
         /* Generic CDC-NCM devices */
         { USB_INTERFACE_INFO(USB_CLASS_COMM,
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 3f554c1149f3..d7e99445518e 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -45,6 +45,12 @@
 #define DM_MCAST_ADDR   0x16    /* 8 bytes */
 #define DM_GPR_CTRL     0x1e
 #define DM_GPR_DATA     0x1f
+#define DM_CHIP_ID      0x2c
+#define DM_MODE_CTRL    0x91    /* only on dm9620 */
+
+/* chip id values */
+#define ID_DM9601       0
+#define ID_DM9620       1
 
 #define DM_MAX_MCAST    64
 #define DM_MCAST_SIZE   8
@@ -53,7 +59,6 @@
 #define DM_RX_OVERHEAD  7       /* 3 byte header + 4 byte crc tail */
 #define DM_TIMEOUT      1000
 
-
 static int dm_read(struct usbnet *dev, u8 reg, u16 length, void *data)
 {
         int err;
@@ -84,32 +89,23 @@ static int dm_write(struct usbnet *dev, u8 reg, u16 length, void *data)
 
 static int dm_write_reg(struct usbnet *dev, u8 reg, u8 value)
 {
-        return usbnet_write_cmd(dev, DM_WRITE_REGS,
+        return usbnet_write_cmd(dev, DM_WRITE_REG,
                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                                 value, reg, NULL, 0);
 }
 
-static void dm_write_async_helper(struct usbnet *dev, u8 reg, u8 value,
-                                  u16 length, void *data)
+static void dm_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
 {
         usbnet_write_cmd_async(dev, DM_WRITE_REGS,
                                USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                               value, reg, data, length);
-}
-
-static void dm_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
-{
-        netdev_dbg(dev->net, "dm_write_async() reg=0x%02x length=%d\n", reg, length);
-
-        dm_write_async_helper(dev, reg, 0, length, data);
+                               0, reg, data, length);
 }
 
 static void dm_write_reg_async(struct usbnet *dev, u8 reg, u8 value)
 {
-        netdev_dbg(dev->net, "dm_write_reg_async() reg=0x%02x value=0x%02x\n",
-                   reg, value);
-
-        dm_write_async_helper(dev, reg, value, 0, NULL);
+        usbnet_write_cmd_async(dev, DM_WRITE_REG,
+                               USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                               value, reg, NULL, 0);
 }
 
 static int dm_read_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 *value)
@@ -358,7 +354,7 @@ static const struct net_device_ops dm9601_netdev_ops = {
 static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
 {
         int ret;
-        u8 mac[ETH_ALEN];
+        u8 mac[ETH_ALEN], id;
 
         ret = usbnet_get_endpoints(dev, intf);
         if (ret)
@@ -399,6 +395,24 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
                 __dm9601_set_mac_address(dev);
         }
 
+        if (dm_read_reg(dev, DM_CHIP_ID, &id) < 0) {
+                netdev_err(dev->net, "Error reading chip ID\n");
+                ret = -ENODEV;
+                goto out;
+        }
+
+        /* put dm9620 devices in dm9601 mode */
+        if (id == ID_DM9620) {
+                u8 mode;
+
+                if (dm_read_reg(dev, DM_MODE_CTRL, &mode) < 0) {
+                        netdev_err(dev->net, "Error reading MODE_CTRL\n");
+                        ret = -ENODEV;
+                        goto out;
+                }
+                dm_write_reg(dev, DM_MODE_CTRL, mode & 0x7f);
+        }
+
         /* power up phy */
         dm_write_reg(dev, DM_GPR_CTRL, 1);
         dm_write_reg(dev, DM_GPR_DATA, 0);
@@ -581,6 +595,10 @@ static const struct usb_device_id products[] = {
          USB_DEVICE(0x0a46, 0x9000),    /* DM9000E */
          .driver_info = (unsigned long)&dm9601_info,
          },
+        {
+         USB_DEVICE(0x0a46, 0x9620),    /* DM9620 USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+         },
         {},                     // END
 };
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6a1ca500e612..c8e05e27f38c 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -351,6 +351,10 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HUAWEI_INTERFACE_NDIS_CONTROL_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 2. Combined interface devices matching on class+protocol */
         {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -361,6 +365,14 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HUAWEI_NDIS_SINGLE_INTERFACE_VDF */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x37),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
+        {       /* HUAWEI_INTERFACE_NDIS_HW_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x67),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
         {       /* Pantech UML290, P4200 and more */
                 USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
@@ -433,6 +445,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x0199, 1)},    /* ZTE MF820S */
         {QMI_FIXED_INTF(0x19d2, 0x0200, 1)},
         {QMI_FIXED_INTF(0x19d2, 0x0257, 3)},    /* ZTE MF821 */
+        {QMI_FIXED_INTF(0x19d2, 0x0265, 4)},    /* ONDA MT8205 4G LTE */
         {QMI_FIXED_INTF(0x19d2, 0x0284, 4)},    /* ZTE MF880 */
         {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
         {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
@@ -459,6 +472,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3d4bf01641b4..5e33606c1366 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -380,6 +380,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
         unsigned long           lockflags;
         size_t                  size = dev->rx_urb_size;
 
+        /* prevent rx skb allocation when error ratio is high */
+        if (test_bit(EVENT_RX_KILL, &dev->flags)) {
+                usb_free_urb(urb);
+                return -ENOLINK;
+        }
+
         skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
         if (!skb) {
                 netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
@@ -539,6 +545,17 @@ block:
                 break;
         }
 
+        /* stop rx if packet error rate is high */
+        if (++dev->pkt_cnt > 30) {
+                dev->pkt_cnt = 0;
+                dev->pkt_err = 0;
+        } else {
+                if (state == rx_cleanup)
+                        dev->pkt_err++;
+                if (dev->pkt_err > 20)
+                        set_bit(EVENT_RX_KILL, &dev->flags);
+        }
+
         state = defer_bh(dev, skb, &dev->rxq, state);
 
         if (urb) {
@@ -791,6 +808,11 @@ int usbnet_open (struct net_device *net)
                    (dev->driver_info->flags & FLAG_FRAMING_AX) ? "ASIX" :
                    "simple");
 
+        /* reset rx error state */
+        dev->pkt_cnt = 0;
+        dev->pkt_err = 0;
+        clear_bit(EVENT_RX_KILL, &dev->flags);
+
         // delay posting reads until we're fully open
         tasklet_schedule (&dev->bh);
         if (info->manage_power) {
@@ -1103,13 +1125,11 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         if (info->tx_fixup) {
                 skb = info->tx_fixup (dev, skb, GFP_ATOMIC);
                 if (!skb) {
-                        if (netif_msg_tx_err(dev)) {
-                                netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
-                                goto drop;
-                        } else {
-                                /* cdc_ncm collected packet; waits for more */
+                        /* packet collected; minidriver waiting for more */
+                        if (info->flags & FLAG_MULTI_PACKET)
                                 goto not_drop;
-                        }
+                        netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
+                        goto drop;
                 }
         }
         length = skb->len;
@@ -1254,6 +1274,9 @@ static void usbnet_bh (unsigned long param)
                 }
         }
 
+        /* restart RX again after disabling due to high error rate */
+        clear_bit(EVENT_RX_KILL, &dev->flags);
+
         // waiting for all pending urbs to complete?
         if (dev->wait) {
                 if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
@@ -1448,6 +1471,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 if ((dev->driver_info->flags & FLAG_WWAN) != 0)
                         strcpy(net->name, "wwan%d");
 
+                /* devices that cannot do ARP */
+                if ((dev->driver_info->flags & FLAG_NOARP) != 0)
+                        net->flags |= IFF_NOARP;
+
                 /* maybe the remote can't receive an Ethernet MTU */
                 if (net->mtu > (dev->hard_mtu - net->hard_header_len))
                         net->mtu = dev->hard_mtu - net->hard_header_len;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index a6fcf15adc4f..35c00c5ea02a 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -26,6 +26,7 @@
 #include <linux/scatterlist.h>
 #include <linux/if_vlan.h>
 #include <linux/slab.h>
+#include <linux/cpu.h>
 
 static int napi_weight = 128;
 module_param(napi_weight, int, 0444);
@@ -123,6 +124,12 @@ struct virtnet_info {
 
         /* Does the affinity hint is set for virtqueues? */
         bool affinity_hint_set;
+
+        /* Per-cpu variable to show the mapping from CPU to virtqueue */
+        int __percpu *vq_index;
+
+        /* CPU hot plug notifier */
+        struct notifier_block nb;
 };
 
 struct skb_vnet_hdr {
@@ -1013,32 +1020,75 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
         return 0;
 }
 
-static void virtnet_set_affinity(struct virtnet_info *vi, bool set)
+static void virtnet_clean_affinity(struct virtnet_info *vi, long hcpu)
 {
         int i;
+        int cpu;
+
+        if (vi->affinity_hint_set) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        virtqueue_set_affinity(vi->rq[i].vq, -1);
+                        virtqueue_set_affinity(vi->sq[i].vq, -1);
+                }
+
+                vi->affinity_hint_set = false;
+        }
+
+        i = 0;
+        for_each_online_cpu(cpu) {
+                if (cpu == hcpu) {
+                        *per_cpu_ptr(vi->vq_index, cpu) = -1;
+                } else {
+                        *per_cpu_ptr(vi->vq_index, cpu) =
+                                ++i % vi->curr_queue_pairs;
+                }
+        }
+}
+
+static void virtnet_set_affinity(struct virtnet_info *vi)
+{
+        int i;
+        int cpu;
 
         /* In multiqueue mode, when the number of cpu is equal to the number of
          * queue pairs, we let the queue pairs to be private to one cpu by
          * setting the affinity hint to eliminate the contention.
          */
-        if ((vi->curr_queue_pairs == 1 ||
-             vi->max_queue_pairs != num_online_cpus()) && set) {
-                if (vi->affinity_hint_set)
-                        set = false;
-                else
-                        return;
+        if (vi->curr_queue_pairs == 1 ||
+            vi->max_queue_pairs != num_online_cpus()) {
+                virtnet_clean_affinity(vi, -1);
+                return;
         }
 
-        for (i = 0; i < vi->max_queue_pairs; i++) {
-                int cpu = set ? i : -1;
+        i = 0;
+        for_each_online_cpu(cpu) {
                 virtqueue_set_affinity(vi->rq[i].vq, cpu);
                 virtqueue_set_affinity(vi->sq[i].vq, cpu);
+                *per_cpu_ptr(vi->vq_index, cpu) = i;
+                i++;
         }
 
-        if (set)
-                vi->affinity_hint_set = true;
-        else
-                vi->affinity_hint_set = false;
+        vi->affinity_hint_set = true;
+}
+
+static int virtnet_cpu_callback(struct notifier_block *nfb,
+                                unsigned long action, void *hcpu)
+{
+        struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
+
+        switch(action & ~CPU_TASKS_FROZEN) {
+        case CPU_ONLINE:
+        case CPU_DOWN_FAILED:
+        case CPU_DEAD:
+                virtnet_set_affinity(vi);
+                break;
+        case CPU_DOWN_PREPARE:
+                virtnet_clean_affinity(vi, (long)hcpu);
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
 }
 
 static void virtnet_get_ringparam(struct net_device *dev,
@@ -1082,13 +1132,15 @@ static int virtnet_set_channels(struct net_device *dev,
         if (queue_pairs > vi->max_queue_pairs)
                 return -EINVAL;
 
+        get_online_cpus();
         err = virtnet_set_queues(vi, queue_pairs);
         if (!err) {
                 netif_set_real_num_tx_queues(dev, queue_pairs);
                 netif_set_real_num_rx_queues(dev, queue_pairs);
 
-                virtnet_set_affinity(vi, true);
+                virtnet_set_affinity(vi);
         }
+        put_online_cpus();
 
         return err;
 }
@@ -1127,12 +1179,19 @@ static int virtnet_change_mtu(struct net_device *dev, int new_mtu)
 
 /* To avoid contending a lock hold by a vcpu who would exit to host, select the
  * txq based on the processor id.
- * TODO: handle cpu hotplug.
  */
 static u16 virtnet_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
-        int txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) :
-                  smp_processor_id();
+        int txq;
+        struct virtnet_info *vi = netdev_priv(dev);
+
+        if (skb_rx_queue_recorded(skb)) {
+                txq = skb_get_rx_queue(skb);
+        } else {
+                txq = *__this_cpu_ptr(vi->vq_index);
+                if (txq == -1)
+                        txq = 0;
+        }
 
         while (unlikely(txq >= dev->real_num_tx_queues))
                 txq -= dev->real_num_tx_queues;
@@ -1248,7 +1307,7 @@ static void virtnet_del_vqs(struct virtnet_info *vi)
 {
         struct virtio_device *vdev = vi->vdev;
 
-        virtnet_set_affinity(vi, false);
+        virtnet_clean_affinity(vi, -1);
 
         vdev->config->del_vqs(vdev);
 
@@ -1371,7 +1430,10 @@ static int init_vqs(struct virtnet_info *vi)
         if (ret)
                 goto err_free;
 
-        virtnet_set_affinity(vi, true);
+        get_online_cpus();
+        virtnet_set_affinity(vi);
+        put_online_cpus();
+
         return 0;
 
 err_free:
@@ -1453,6 +1515,10 @@ static int virtnet_probe(struct virtio_device *vdev)
         if (vi->stats == NULL)
                 goto free;
 
+        vi->vq_index = alloc_percpu(int);
+        if (vi->vq_index == NULL)
+                goto free_stats;
+
         mutex_init(&vi->config_lock);
         vi->config_enable = true;
         INIT_WORK(&vi->config_work, virtnet_config_changed_work);
@@ -1476,7 +1542,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* Allocate/initialize the rx/tx queues, and invoke find_vqs */
         err = init_vqs(vi);
         if (err)
-                goto free_stats;
+                goto free_index;
 
         netif_set_real_num_tx_queues(dev, 1);
         netif_set_real_num_rx_queues(dev, 1);
@@ -1499,6 +1565,13 @@ static int virtnet_probe(struct virtio_device *vdev)
                 }
         }
 
+        vi->nb.notifier_call = &virtnet_cpu_callback;
+        err = register_hotcpu_notifier(&vi->nb);
+        if (err) {
+                pr_debug("virtio_net: registering cpu notifier failed\n");
+                goto free_recv_bufs;
+        }
+
         /* Assume link up if device can't report link status,
            otherwise get link status from config. */
         if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) {
@@ -1520,6 +1593,8 @@ free_recv_bufs:
 free_vqs:
         cancel_delayed_work_sync(&vi->refill);
         virtnet_del_vqs(vi);
+free_index:
+        free_percpu(vi->vq_index);
 free_stats:
         free_percpu(vi->stats);
 free:
@@ -1543,6 +1618,8 @@ static void virtnet_remove(struct virtio_device *vdev)
 {
         struct virtnet_info *vi = vdev->priv;
 
+        unregister_hotcpu_notifier(&vi->nb);
+
         /* Prevent config work handler from accessing the device. */
         mutex_lock(&vi->config_lock);
         vi->config_enable = false;
@@ -1554,6 +1631,7 @@ static void virtnet_remove(struct virtio_device *vdev)
 
         flush_work(&vi->config_work);
 
+        free_percpu(vi->vq_index);
         free_percpu(vi->stats);
         free_netdev(vi->dev);
 }
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index dc8913c6238c..12c6440d1649 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -154,8 +154,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
         if (ret & 1) { /* Link is up. */
                 printk(KERN_INFO "%s: NIC Link is Up %d Mbps\n",
                        adapter->netdev->name, adapter->link_speed);
-                if (!netif_carrier_ok(adapter->netdev))
-                        netif_carrier_on(adapter->netdev);
+                netif_carrier_on(adapter->netdev);
 
                 if (affectTxQueue) {
                         for (i = 0; i < adapter->num_tx_queues; i++)
@@ -165,8 +164,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
         } else {
                 printk(KERN_INFO "%s: NIC Link is Down\n",
                        adapter->netdev->name);
-                if (netif_carrier_ok(adapter->netdev))
-                        netif_carrier_off(adapter->netdev);
+                netif_carrier_off(adapter->netdev);
 
                 if (affectTxQueue) {
                         for (i = 0; i < adapter->num_tx_queues; i++)
@@ -3061,6 +3059,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
         netif_set_real_num_rx_queues(adapter->netdev, adapter->num_rx_queues);
 
+        netif_carrier_off(netdev);
         err = register_netdev(netdev);
 
         if (err) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 8b0d8dcd7625..56317b0fb6b6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -976,6 +976,8 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                           AR_PHY_CL_TAB_1,
                                           AR_PHY_CL_TAB_2 };
 
+        ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
+
         if (rtt) {
                 if (!ar9003_hw_rtt_restore(ah, chan))
                         run_rtt_cal = true;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index ce19c09fa8e8..3afc24bde6d6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -586,32 +586,19 @@ static void ar9003_hw_init_bb(struct ath_hw *ah,
         ath9k_hw_synth_delay(ah, chan, synthDelay);
 }
 
-static void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
 {
-        switch (rx) {
-        case 0x5:
+        if (ah->caps.tx_chainmask == 5 || ah->caps.rx_chainmask == 5)
                 REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
                             AR_PHY_SWAP_ALT_CHAIN);
-        case 0x3:
-        case 0x1:
-        case 0x2:
-        case 0x7:
-                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
-                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
-                break;
-        default:
-                break;
-        }
+
+        REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
+        REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
 
         if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) && (tx == 0x7))
-                REG_WRITE(ah, AR_SELFGEN_MASK, 0x3);
-        else
-                REG_WRITE(ah, AR_SELFGEN_MASK, tx);
+                tx = 3;
 
-        if (tx == 0x5) {
-                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
-                            AR_PHY_SWAP_ALT_CHAIN);
-        }
+        REG_WRITE(ah, AR_SELFGEN_MASK, tx);
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 86e26a19efda..42794c546a40 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -317,7 +317,6 @@ struct ath_rx {
         u32 *rxlink;
         u32 num_pkts;
         unsigned int rxfilter;
-        spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
         struct ath_buf *rx_bufptr;
@@ -328,7 +327,6 @@ struct ath_rx {
 
 int ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
-void ath_flushrecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
 int ath_rx_init(struct ath_softc *sc, int nbufs);
 void ath_rx_cleanup(struct ath_softc *sc);
@@ -646,7 +644,6 @@ void ath_ant_comb_update(struct ath_softc *sc);
 enum sc_op_flags {
         SC_OP_INVALID,
         SC_OP_BEACONS,
-        SC_OP_RXFLUSH,
         SC_OP_ANI_RUN,
         SC_OP_PRIM_STA_VIF,
         SC_OP_HW_RESET,
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 531fffd801a3..2ca355e94da6 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -147,6 +147,7 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
                                  skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(skb);
                 bf->bf_buf_addr = 0;
+                bf->bf_mpdu = NULL;
         }
 
         skb = ieee80211_beacon_get(hw, vif);
@@ -359,7 +360,6 @@ void ath9k_beacon_tasklet(unsigned long data)
                 return;
 
         bf = ath9k_beacon_generate(sc->hw, vif);
-        WARN_ON(!bf);
 
         if (sc->beacon.bmisscnt != 0) {
                 ath_dbg(common, BSTUCK, "resume beacon xmit after %u misses\n",
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 13ff9edc2401..e585fc827c50 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -861,7 +861,6 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         RXS_ERR("RX-LENGTH-ERR", rx_len_err);
         RXS_ERR("RX-OOM-ERR", rx_oom_err);
         RXS_ERR("RX-RATE-ERR", rx_rate_err);
-        RXS_ERR("RX-DROP-RXFLUSH", rx_drop_rxflush);
         RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
 
         PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 375c3b46411e..6df2ab62dcb7 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -216,7 +216,6 @@ struct ath_tx_stats {
  * @rx_oom_err:  No. of frames dropped due to OOM issues.
  * @rx_rate_err:  No. of frames dropped due to rate errors.
  * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
- * @rx_drop_rxflush: No. of frames dropped due to RX-FLUSH.
  * @rx_beacons:  No. of beacons received.
  * @rx_frags:  No. of rx-fragements received.
  */
@@ -235,7 +234,6 @@ struct ath_rx_stats {
         u32 rx_oom_err;
         u32 rx_rate_err;
         u32 rx_too_many_frags_err;
-        u32 rx_drop_rxflush;
         u32 rx_beacons;
         u32 rx_frags;
 };
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 4a9570dfba72..aac4a406a513 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -344,6 +344,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
                         endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
                                                   skb, htc_hdr->endpoint_id,
                                                   txok);
+                } else {
+                        kfree_skb(skb);
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 7f1a8e91c908..9d26fc56ca56 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -1066,6 +1066,7 @@ void ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
 bool ar9003_is_paprd_enabled(struct ath_hw *ah);
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 
 /* Hardware family op attach helpers */
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index be30a9af1528..dd91f8fdc01c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -182,7 +182,7 @@ static void ath_restart_work(struct ath_softc *sc)
         ath_start_ani(sc);
 }
 
-static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
+static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx)
 {
         struct ath_hw *ah = sc->sc_ah;
         bool ret = true;
@@ -202,14 +202,6 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
         if (!ath_drain_all_txq(sc, retry_tx))
                 ret = false;
 
-        if (!flush) {
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                        ath_rx_tasklet(sc, 1, true);
-                ath_rx_tasklet(sc, 1, false);
-        } else {
-                ath_flushrecv(sc);
-        }
-
         return ret;
 }
 
@@ -262,11 +254,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_cal_data *caldata = NULL;
         bool fastcc = true;
-        bool flush = false;
         int r;
 
         __ath_cancel_work(sc);
 
+        tasklet_disable(&sc->intr_tq);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)) {
@@ -276,11 +268,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
         if (!hchan) {
                 fastcc = false;
-                flush = true;
                 hchan = ah->curchan;
         }
 
-        if (!ath_prepare_reset(sc, retry_tx, flush))
+        if (!ath_prepare_reset(sc, retry_tx))
                 fastcc = false;
 
         ath_dbg(common, CONFIG, "Reset to %u MHz, HT40: %d fastcc: %d\n",
@@ -302,6 +293,8 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
 out:
         spin_unlock_bh(&sc->sc_pcu_lock);
+        tasklet_enable(&sc->intr_tq);
+
         return r;
 }
 
@@ -804,7 +797,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
                 ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
         }
 
-        ath_prepare_reset(sc, false, true);
+        ath_prepare_reset(sc, false);
 
         if (sc->rx.frag) {
                 dev_kfree_skb_any(sc->rx.frag);
@@ -1833,6 +1826,9 @@ static u32 fill_chainmask(u32 cap, u32 new)
 
 static bool validate_antenna_mask(struct ath_hw *ah, u32 val)
 {
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                return true;
+
         switch (val & 0x7) {
         case 0x1:
         case 0x3:
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index d4df98a938bf..90752f246970 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -254,8 +254,6 @@ rx_init_fail:
 
 static void ath_edma_start_recv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxbuflock);
-
         ath9k_hw_rxena(sc->sc_ah);
 
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_HP,
@@ -267,8 +265,6 @@ static void ath_edma_start_recv(struct ath_softc *sc)
         ath_opmode_init(sc);
 
         ath9k_hw_startpcureceive(sc->sc_ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
-
-        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -285,8 +281,6 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         int error = 0;
 
         spin_lock_init(&sc->sc_pcu_lock);
-        spin_lock_init(&sc->rx.rxbuflock);
-        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 
         common->rx_bufsize = IEEE80211_MAX_MPDU_LEN / 2 +
                              sc->sc_ah->caps.rx_status_len;
@@ -447,7 +441,6 @@ int ath_startrecv(struct ath_softc *sc)
                 return 0;
         }
 
-        spin_lock_bh(&sc->rx.rxbuflock);
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
 
@@ -468,26 +461,31 @@ start_recv:
         ath_opmode_init(sc);
         ath9k_hw_startpcureceive(ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         return 0;
 }
 
+static void ath_flushrecv(struct ath_softc *sc)
+{
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ath_rx_tasklet(sc, 1, true);
+        ath_rx_tasklet(sc, 1, false);
+}
+
 bool ath_stoprecv(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         bool stopped, reset = false;
 
-        spin_lock_bh(&sc->rx.rxbuflock);
         ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah, &reset);
 
+        ath_flushrecv(sc);
+
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_edma_stop_recv(sc);
         else
                 sc->rx.rxlink = NULL;
-        spin_unlock_bh(&sc->rx.rxbuflock);
 
         if (!(ah->ah_flags & AH_UNPLUGGED) &&
             unlikely(!stopped)) {
@@ -499,15 +497,6 @@ bool ath_stoprecv(struct ath_softc *sc)
         return stopped && !reset;
 }
 
-void ath_flushrecv(struct ath_softc *sc)
-{
-        set_bit(SC_OP_RXFLUSH, &sc->sc_flags);
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                ath_rx_tasklet(sc, 1, true);
-        ath_rx_tasklet(sc, 1, false);
-        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
-}
-
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
 {
         /* Check whether the Beacon frame has DTIM indicating buffered bc/mc */
@@ -744,6 +733,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
         }
 
+        list_del(&bf->list);
         if (!bf->bf_mpdu)
                 return bf;
 
@@ -1059,16 +1049,12 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 dma_type = DMA_FROM_DEVICE;
 
         qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
-        spin_lock_bh(&sc->rx.rxbuflock);
 
         tsf = ath9k_hw_gettsf64(ah);
         tsf_lower = tsf & 0xffffffff;
 
         do {
                 bool decrypt_error = false;
-                /* If handling rx interrupt and flush is in progress => exit */
-                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
-                        break;
 
                 memset(&rs, 0, sizeof(rs));
                 if (edma)
@@ -1111,15 +1097,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 
                 ath_debug_stat_rx(sc, &rs);
 
-                /*
-                 * If we're asked to flush receive queue, directly
-                 * chain it back at the queue without processing it.
-                 */
-                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags)) {
-                        RX_STAT_INC(rx_drop_rxflush);
-                        goto requeue_drop_frag;
-                }
-
                 memset(rxs, 0, sizeof(struct ieee80211_rx_status));
 
                 rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
@@ -1254,19 +1231,18 @@ requeue_drop_frag:
                         sc->rx.frag = NULL;
                 }
 requeue:
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+                if (flush)
+                        continue;
+
                 if (edma) {
-                        list_add_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_edma_buf_link(sc, qtype);
                 } else {
-                        list_move_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_buf_link(sc, bf);
-                        if (!flush)
-                                ath9k_hw_rxena(ah);
+                        ath9k_hw_rxena(ah);
                 }
         } while (1);
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         if (!(ah->imask & ATH9K_INT_RXEOL)) {
                 ah->imask |= (ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
                 ath9k_hw_set_interrupts(ah);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 1fbd8ecbe2ea..e5fd20994bec 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -36,6 +36,7 @@
 #include "debug.h"
 
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
+#define BRCMS_FLUSH_TIMEOUT     500 /* msec */
 
 /* Flags we support */
 #define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
@@ -708,16 +709,29 @@ static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
         wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 }
 
+static bool brcms_tx_flush_completed(struct brcms_info *wl)
+{
+        bool result;
+
+        spin_lock_bh(&wl->lock);
+        result = brcms_c_tx_flush_completed(wl->wlc);
+        spin_unlock_bh(&wl->lock);
+        return result;
+}
+
 static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct brcms_info *wl = hw->priv;
+        int ret;
 
         no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
 
-        /* wait for packet queue and dma fifos to run empty */
-        spin_lock_bh(&wl->lock);
-        brcms_c_wait_for_tx_completion(wl->wlc, drop);
-        spin_unlock_bh(&wl->lock);
+        ret = wait_event_timeout(wl->tx_flush_wq,
+                                 brcms_tx_flush_completed(wl),
+                                 msecs_to_jiffies(BRCMS_FLUSH_TIMEOUT));
+
+        brcms_dbg_mac80211(wl->wlc->hw->d11core,
+                           "ret=%d\n", jiffies_to_msecs(ret));
 }
 
 static const struct ieee80211_ops brcms_ops = {
@@ -772,6 +786,7 @@ void brcms_dpc(unsigned long data)
 
  done:
         spin_unlock_bh(&wl->lock);
+        wake_up(&wl->tx_flush_wq);
 }
 
 /*
@@ -1020,6 +1035,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
 
         atomic_set(&wl->callbacks, 0);
 
+        init_waitqueue_head(&wl->tx_flush_wq);
+
         /* setup the bottom half handler */
         tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
 
@@ -1407,9 +1424,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
 #endif
         t->ms = ms;
         t->periodic = (bool) periodic;
-        t->set = true;
-
-        atomic_inc(&t->wl->callbacks);
+        if (!t->set) {
+                t->set = true;
+                atomic_inc(&t->wl->callbacks);
+        }
 
         ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
 }
@@ -1608,13 +1626,3 @@ bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
         spin_lock_bh(&wl->lock);
         return blocked;
 }
-
-/*
- * precondition: perimeter lock has been acquired
- */
-void brcms_msleep(struct brcms_info *wl, uint ms)
-{
-        spin_unlock_bh(&wl->lock);
-        msleep(ms);
-        spin_lock_bh(&wl->lock);
-}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 9358bd5ebd35..947ccacf43e6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -68,6 +68,8 @@ struct brcms_info {
         spinlock_t lock;        /* per-device perimeter lock */
         spinlock_t isr_lock;    /* per-device ISR synchronization lock */
 
+        /* tx flush */
+        wait_queue_head_t tx_flush_wq;
 
         /* timer related fields */
         atomic_t callbacks;     /* # outstanding callback functions */
@@ -100,7 +102,6 @@ extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
 extern void brcms_free_timer(struct brcms_timer *timer);
 extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
 extern bool brcms_del_timer(struct brcms_timer *timer);
-extern void brcms_msleep(struct brcms_info *wl, uint ms);
 extern void brcms_dpc(unsigned long data);
 extern void brcms_timer(struct brcms_timer *t);
 extern void brcms_fatal_error(struct brcms_info *wl);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..8b5839008af3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1027,7 +1027,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 static bool
 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 {
-        bool morepending = false;
         struct bcma_device *core;
         struct tx_status txstatus, *txs;
         u32 s1, s2;
@@ -1041,23 +1040,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
         txs = &txstatus;
         core = wlc_hw->d11core;
         *fatal = false;
-        s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
-        while (!(*fatal)
-               && (s1 & TXS_V)) {
-                /* !give others some time to run! */
-                if (n >= max_tx_num) {
-                        morepending = true;
-                        break;
-                }
 
+        while (n < max_tx_num) {
+                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
                 if (s1 == 0xffffffff) {
                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
                                   __func__);
                         *fatal = true;
                         return false;
                 }
-                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
+                /* only process when valid */
+                if (!(s1 & TXS_V))
+                        break;
 
+                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
                 txs->status = s1 & TXS_STATUS_MASK;
                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
                 txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1065,15 +1061,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
                 txs->lasttxtime = 0;
 
                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
-
-                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
+                if (*fatal == true)
+                        return false;
                 n++;
         }
 
-        if (*fatal)
-                return false;
-
-        return morepending;
+        return n >= max_tx_num;
 }
 
 static void brcms_c_tbtt(struct brcms_c_info *wlc)
@@ -7518,25 +7511,16 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
         return wlc->band->bandunit;
 }
 
-void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
 {
-        int timeout = 20;
         int i;
 
         /* Kick DMA to send any pending AMPDU */
         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
                 if (wlc->hw->di[i])
-                        dma_txflush(wlc->hw->di[i]);
-
-        /* wait for queue and DMA fifos to run dry */
-        while (brcms_txpktpendtot(wlc) > 0) {
-                brcms_msleep(wlc->wl, 1);
-
-                if (--timeout == 0)
-                        break;
-        }
+                        dma_kick_tx(wlc->hw->di[i]);
 
-        WARN_ON_ONCE(timeout == 0);
+        return !brcms_txpktpendtot(wlc);
 }
 
 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 4fb2834f4e64..b0f14b7b8616 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -314,8 +314,6 @@ extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
 extern void brcms_c_scan_start(struct brcms_c_info *wlc);
 extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
 extern int brcms_c_get_curband(struct brcms_c_info *wlc);
-extern void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc,
-                                           bool drop);
 extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
 extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
 extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
@@ -332,5 +330,6 @@ extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
 extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
 extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
 extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
+extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
 
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 7e16d10a7f14..90b8970eadf0 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -3958,17 +3958,21 @@ il_connection_init_rx_config(struct il_priv *il)
 
         memset(&il->staging, 0, sizeof(il->staging));
 
-        if (!il->vif) {
+        switch (il->iw_mode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
                 il->staging.dev_type = RXON_DEV_TYPE_ESS;
-        } else if (il->vif->type == NL80211_IFTYPE_STATION) {
+                break;
+        case NL80211_IFTYPE_STATION:
                 il->staging.dev_type = RXON_DEV_TYPE_ESS;
                 il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
-        } else if (il->vif->type == NL80211_IFTYPE_ADHOC) {
+                break;
+        case NL80211_IFTYPE_ADHOC:
                 il->staging.dev_type = RXON_DEV_TYPE_IBSS;
                 il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
                 il->staging.filter_flags =
                     RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
-        } else {
+                break;
+        default:
                 IL_ERR("Unsupported interface type %d\n", il->vif->type);
                 return;
         }
@@ -4550,8 +4554,7 @@ out:
 EXPORT_SYMBOL(il_mac_add_interface);
 
 static void
-il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
-                      bool mode_change)
+il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
 {
         lockdep_assert_held(&il->mutex);
 
@@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
                 il_force_scan_end(il);
         }
 
-        if (!mode_change)
-                il_set_mode(il);
-
+        il_set_mode(il);
 }
 
 void
@@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
         WARN_ON(il->vif != vif);
         il->vif = NULL;
-
-        il_teardown_interface(il, vif, false);
+        il->iw_mode = NL80211_IFTYPE_UNSPECIFIED;
+        il_teardown_interface(il, vif);
         memset(il->bssid, 0, ETH_ALEN);
 
         D_MAC80211("leave\n");
@@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         }
 
         /* success */
-        il_teardown_interface(il, vif, true);
         vif->type = newtype;
         vif->p2p = false;
-        err = il_set_mode(il);
-        WARN_ON(err);
-        /*
-         * We've switched internally, but submitting to the
-         * device may have failed for some reason. Mask this
-         * error, because otherwise mac80211 will not switch
-         * (and set the interface type back) and we'll be
-         * out of sync with it.
-         */
+        il->iw_mode = newtype;
+        il_teardown_interface(il, vif);
         err = 0;
 
 out:
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index a790599fe2c2..279796419ea0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1079,6 +1079,8 @@ static void iwlagn_set_tx_status(struct iwl_priv *priv,
 {
         u16 status = le16_to_cpu(tx_resp->status.status);
 
+        info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
         info->status.rates[0].count = tx_resp->failure_frame + 1;
         info->flags |= iwl_tx_status_to_mac80211(status);
         iwlagn_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
@@ -1151,6 +1153,13 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         next_reclaimed = ssn;
                 }
 
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                                  next_reclaimed);
+                }
+
                 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
                 iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1201,28 +1210,11 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         if (!is_agg)
                                 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
 
-                        /*
-                         * W/A for FW bug - the seq_ctl isn't updated when the
-                         * queues are flushed. Fetch it from the packet itself
-                         */
-                        if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
-                                next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
-                                next_reclaimed =
-                                        SEQ_TO_SN(next_reclaimed + 0x10);
-                        }
-
                         is_offchannel_skb =
                                 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                         freed++;
                 }
 
-                if (tid != IWL_TID_NON_QOS) {
-                        priv->tid_data[sta_id][tid].next_reclaimed =
-                                next_reclaimed;
-                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
-                                           next_reclaimed);
-                }
-
                 WARN_ON(!is_agg && freed != 1);
 
                 /*
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index efe525be27dd..cdb11b3964e2 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1459,7 +1459,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         struct cfg80211_ssid req_ssid;
         int ret, auth_type = 0;
         struct cfg80211_bss *bss = NULL;
-        u8 is_scanning_required = 0, config_bands = 0;
+        u8 is_scanning_required = 0;
 
         memset(&req_ssid, 0, sizeof(struct cfg80211_ssid));
 
@@ -1478,19 +1478,6 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         /* disconnect before try to associate */
         mwifiex_deauthenticate(priv, NULL);
 
-        if (channel) {
-                if (mode == NL80211_IFTYPE_STATION) {
-                        if (channel->band == IEEE80211_BAND_2GHZ)
-                                config_bands = BAND_B | BAND_G | BAND_GN;
-                        else
-                                config_bands = BAND_A | BAND_AN;
-
-                        if (!((config_bands | priv->adapter->fw_bands) &
-                              ~priv->adapter->fw_bands))
-                                priv->adapter->config_bands = config_bands;
-                }
-        }
-
         /* As this is new association, clear locally stored
          * keys and security related flags */
         priv->sec_info.wpa_enabled = false;
@@ -1707,7 +1694,7 @@ static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
 
                 if (cfg80211_get_chandef_type(&params->chandef) !=
                                                 NL80211_CHAN_NO_HT)
-                        config_bands |= BAND_GN;
+                        config_bands |= BAND_G | BAND_GN;
         } else {
                 if (cfg80211_get_chandef_type(&params->chandef) ==
                                                 NL80211_CHAN_NO_HT)
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 13fbc4eb1595..b879e1338a54 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -161,7 +161,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 
         if (pdev) {
                 card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || card->adapter) {
+                if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
                 }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9189a32b7844..973a9d90e9ea 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
                         scan_rsp->number_of_sets);
                 ret = -1;
-                goto done;
+                goto check_next_scan;
         }
 
         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 if (!beacon_size || beacon_size > bytes_left) {
                         bss_info += bytes_left;
                         bytes_left = 0;
-                        return -1;
+                        ret = -1;
+                        goto check_next_scan;
                 }
 
                 /* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                 dev_err(priv->adapter->dev,
                                         "%s: bytes left < IE length\n",
                                         __func__);
-                                goto done;
+                                goto check_next_scan;
                         }
                         if (element_id == WLAN_EID_DS_PARAMS) {
                                 channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1753,6 +1754,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
+check_next_scan:
         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         if (list_empty(&adapter->scan_pending_q)) {
                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 60e88b58039d..f542bb8ccbc8 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -283,6 +283,20 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 if (ret)
                         goto done;
 
+                if (bss_desc) {
+                        u8 config_bands = 0;
+
+                        if (mwifiex_band_to_radio_type((u8) bss_desc->bss_band)
+                            == HostCmd_SCAN_RADIO_TYPE_BG)
+                                config_bands = BAND_B | BAND_G | BAND_GN;
+                        else
+                                config_bands = BAND_A | BAND_AN;
+
+                        if (!((config_bands | adapter->fw_bands) &
+                              ~adapter->fw_bands))
+                                adapter->config_bands = config_bands;
+                }
+
                 ret = mwifiex_check_network_compatibility(priv, bss_desc);
                 if (ret)
                         goto done;
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 21b1bbb93a7e..b80bc4612581 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -57,12 +57,12 @@ config RTL8192CU
 
 config RTLWIFI
         tristate
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
+        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
         default m
 
 config RTLWIFI_DEBUG
         bool "Additional debugging output"
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
+        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
         default y
 
 config RTL8192C_COMMON
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 4494d130b37c..0f8b05185eda 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1004,7 +1004,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                                          is_tx ? "Tx" : "Rx");
 
                                 if (is_tx) {
-                                        rtl_lps_leave(hw);
+                                        schedule_work(&rtlpriv->
+                                                      works.lps_leave_work);
                                         ppsc->last_delaylps_stamp_jiffies =
                                             jiffies;
                                 }
@@ -1014,7 +1015,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
         } else if (ETH_P_ARP == ether_type) {
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
@@ -1024,7 +1025,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                          "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
 
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index f2ecdeb3a90d..1535efda3d52 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         WARN_ON(skb_queue_empty(&rx_queue));
         while (!skb_queue_empty(&rx_queue)) {
                 _skb = skb_dequeue(&rx_queue);
-                _rtl_usb_rx_process_agg(hw, skb);
-                ieee80211_rx_irqsafe(hw, skb);
+                _rtl_usb_rx_process_agg(hw, _skb);
+                ieee80211_rx_irqsafe(hw, _skb);
         }
 }
 
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 94b79c3338c4..9d7f1723dd8f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -151,6 +151,9 @@ void xen_netbk_queue_tx_skb(struct xenvif *vif, struct sk_buff *skb);
 /* Notify xenvif that ring now has space to send an skb to the frontend */
 void xenvif_notify_tx_completion(struct xenvif *vif);
 
+/* Prevent the device from generating any further traffic. */
+void xenvif_carrier_off(struct xenvif *vif);
+
 /* Returns number of ring slots required to send an skb to the frontend */
 unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff *skb);
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b7d41f8c338a..b8c5193bd420 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -343,17 +343,22 @@ err:
         return err;
 }
 
-void xenvif_disconnect(struct xenvif *vif)
+void xenvif_carrier_off(struct xenvif *vif)
 {
         struct net_device *dev = vif->dev;
-        if (netif_carrier_ok(dev)) {
-                rtnl_lock();
-                netif_carrier_off(dev); /* discard queued packets */
-                if (netif_running(dev))
-                        xenvif_down(vif);
-                rtnl_unlock();
-                xenvif_put(vif);
-        }
+
+        rtnl_lock();
+        netif_carrier_off(dev); /* discard queued packets */
+        if (netif_running(dev))
+                xenvif_down(vif);
+        rtnl_unlock();
+        xenvif_put(vif);
+}
+
+void xenvif_disconnect(struct xenvif *vif)
+{
+        if (netif_carrier_ok(vif->dev))
+                xenvif_carrier_off(vif);
 
         atomic_dec(&vif->refcnt);
         wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f2d6b78d901d..2b9520c46e97 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -147,7 +147,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
         atomic_dec(&netbk->netfront_count);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx);
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status);
 static void make_tx_response(struct xenvif *vif,
                              struct xen_netif_tx_request *txp,
                              s8       st);
@@ -879,7 +880,7 @@ static void netbk_tx_err(struct xenvif *vif,
 
         do {
                 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                if (cons >= end)
+                if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&vif->tx, cons++);
         } while (1);
@@ -888,6 +889,13 @@ static void netbk_tx_err(struct xenvif *vif,
         xenvif_put(vif);
 }
 
+static void netbk_fatal_tx_err(struct xenvif *vif)
+{
+        netdev_err(vif->dev, "fatal error; disabling device\n");
+        xenvif_carrier_off(vif);
+        xenvif_put(vif);
+}
+
 static int netbk_count_requests(struct xenvif *vif,
                                 struct xen_netif_tx_request *first,
                                 struct xen_netif_tx_request *txp,
@@ -901,19 +909,22 @@ static int netbk_count_requests(struct xenvif *vif,
 
         do {
                 if (frags >= work_to_do) {
-                        netdev_dbg(vif->dev, "Need more frags\n");
+                        netdev_err(vif->dev, "Need more frags\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
                 if (unlikely(frags >= MAX_SKB_FRAGS)) {
-                        netdev_dbg(vif->dev, "Too many frags\n");
+                        netdev_err(vif->dev, "Too many frags\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
                 memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
                        sizeof(*txp));
                 if (txp->size > first->size) {
-                        netdev_dbg(vif->dev, "Frags galore\n");
+                        netdev_err(vif->dev, "Frag is bigger than frame.\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
@@ -921,8 +932,9 @@ static int netbk_count_requests(struct xenvif *vif,
                 frags++;
 
                 if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev, "txp->offset: %x, size: %u\n",
+                        netdev_err(vif->dev, "txp->offset: %x, size: %u\n",
                                  txp->offset, txp->size);
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
         } while ((txp++)->flags & XEN_NETTXF_more_data);
@@ -966,7 +978,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
                 pending_idx = netbk->pending_ring[index];
                 page = xen_netbk_alloc_page(netbk, skb, pending_idx);
                 if (!page)
-                        return NULL;
+                        goto err;
 
                 gop->source.u.ref = txp->gref;
                 gop->source.domid = vif->domid;
@@ -988,6 +1000,17 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
         }
 
         return gop;
+err:
+        /* Unwind, freeing all pages and sending error responses. */
+        while (i-- > start) {
+                xen_netbk_idx_release(netbk, frag_get_pending_idx(&frags[i]),
+                                      XEN_NETIF_RSP_ERROR);
+        }
+        /* The head too, if necessary. */
+        if (start)
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
+
+        return NULL;
 }
 
 static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
@@ -996,30 +1019,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 {
         struct gnttab_copy *gop = *gopp;
         u16 pending_idx = *((u16 *)skb->data);
-        struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
-        struct xenvif *vif = pending_tx_info[pending_idx].vif;
-        struct xen_netif_tx_request *txp;
         struct skb_shared_info *shinfo = skb_shinfo(skb);
         int nr_frags = shinfo->nr_frags;
         int i, err, start;
 
         /* Check status of header. */
         err = gop->status;
-        if (unlikely(err)) {
-                pending_ring_idx_t index;
-                index = pending_index(netbk->pending_prod++);
-                txp = &pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
-        }
+        if (unlikely(err))
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
         /* Skip first skb fragment if it is on same page as header fragment. */
         start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
 
         for (i = start; i < nr_frags; i++) {
                 int j, newerr;
-                pending_ring_idx_t index;
 
                 pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
 
@@ -1028,16 +1041,12 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
                 if (likely(!newerr)) {
                         /* Had a previous error? Invalidate this fragment. */
                         if (unlikely(err))
-                                xen_netbk_idx_release(netbk, pending_idx);
+                                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                         continue;
                 }
 
                 /* Error on this fragment: respond to client with an error. */
-                txp = &netbk->pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                index = pending_index(netbk->pending_prod++);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
                 /* Not the first error? Preceding frags already invalidated. */
                 if (err)
@@ -1045,10 +1054,10 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 
                 /* First error: invalidate header and preceding fragments. */
                 pending_idx = *((u16 *)skb->data);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 for (j = start; j < i; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 }
 
                 /* Remember the error: invalidate all subsequent fragments. */
@@ -1082,7 +1091,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)
 
                 /* Take an extra reference to offset xen_netbk_idx_release */
                 get_page(netbk->mmap_pages[pending_idx]);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
         }
 }
 
@@ -1095,7 +1104,8 @@ static int xen_netbk_get_extras(struct xenvif *vif,
 
         do {
                 if (unlikely(work_to_do-- <= 0)) {
-                        netdev_dbg(vif->dev, "Missing extra info\n");
+                        netdev_err(vif->dev, "Missing extra info\n");
+                        netbk_fatal_tx_err(vif);
                         return -EBADR;
                 }
 
@@ -1104,8 +1114,9 @@ static int xen_netbk_get_extras(struct xenvif *vif,
                 if (unlikely(!extra.type ||
                              extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                         vif->tx.req_cons = ++cons;
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                    "Invalid extra type: %d\n", extra.type);
+                        netbk_fatal_tx_err(vif);
                         return -EINVAL;
                 }
 
@@ -1121,13 +1132,15 @@ static int netbk_set_skb_gso(struct xenvif *vif,
                              struct xen_netif_extra_info *gso)
 {
         if (!gso->u.gso.size) {
-                netdev_dbg(vif->dev, "GSO size must not be zero.\n");
+                netdev_err(vif->dev, "GSO size must not be zero.\n");
+                netbk_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
         /* Currently only TCPv4 S.O. is supported. */
         if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
-                netdev_dbg(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netbk_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
@@ -1264,9 +1277,25 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 
                 /* Get a netif from the list with work to do. */
                 vif = poll_net_schedule_list(netbk);
+                /* This can sometimes happen because the test of
+                 * list_empty(net_schedule_list) at the top of the
+                 * loop is unlocked.  Just go back and have another
+                 * look.
+                 */
                 if (!vif)
                         continue;
 
+                if (vif->tx.sring->req_prod - vif->tx.req_cons >
+                    XEN_NETIF_TX_RING_SIZE) {
+                        netdev_err(vif->dev,
+                                   "Impossible number of requests. "
+                                   "req_prod %d, req_cons %d, size %ld\n",
+                                   vif->tx.sring->req_prod, vif->tx.req_cons,
+                                   XEN_NETIF_TX_RING_SIZE);
+                        netbk_fatal_tx_err(vif);
+                        continue;
+                }
+
                 RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
                 if (!work_to_do) {
                         xenvif_put(vif);
@@ -1294,17 +1323,14 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                         work_to_do = xen_netbk_get_extras(vif, extras,
                                                           work_to_do);
                         idx = vif->tx.req_cons;
-                        if (unlikely(work_to_do < 0)) {
-                                netbk_tx_err(vif, &txreq, idx);
+                        if (unlikely(work_to_do < 0))
                                 continue;
-                        }
                 }
 
                 ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do);
-                if (unlikely(ret < 0)) {
-                        netbk_tx_err(vif, &txreq, idx - ret);
+                if (unlikely(ret < 0))
                         continue;
-                }
+
                 idx += ret;
 
                 if (unlikely(txreq.size < ETH_HLEN)) {
@@ -1316,11 +1342,11 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 
                 /* No crossing a page as the payload mustn't fragment. */
                 if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                    "txreq.offset: %x, size: %u, end: %lu\n",
                                    txreq.offset, txreq.size,
                                    (txreq.offset&~PAGE_MASK) + txreq.size);
-                        netbk_tx_err(vif, &txreq, idx);
+                        netbk_fatal_tx_err(vif);
                         continue;
                 }
 
@@ -1348,8 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                         gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];
 
                         if (netbk_set_skb_gso(vif, skb, gso)) {
+                                /* Failure in netbk_set_skb_gso is fatal. */
                                 kfree_skb(skb);
-                                netbk_tx_err(vif, &txreq, idx);
                                 continue;
                         }
                 }
@@ -1448,7 +1474,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
                         txp->size -= data_len;
                 } else {
                         /* Schedule a response immediately. */
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 }
 
                 if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1500,7 +1526,8 @@ static void xen_netbk_tx_action(struct xen_netbk *netbk)
         xen_netbk_tx_submit(netbk);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status)
 {
         struct xenvif *vif;
         struct pending_tx_info *pending_tx_info;
@@ -1514,7 +1541,7 @@ static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
 
         vif = pending_tx_info->vif;
 
-        make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY);
+        make_tx_response(vif, &pending_tx_info->req, status);
 
         index = pending_index(netbk->pending_prod++);
         netbk->pending_ring[index] = pending_idx;
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index c31aeb01bb00..a5f3c8ca480e 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -181,12 +181,11 @@ config PINCTRL_COH901
 
 config PINCTRL_SAMSUNG
         bool
-        depends on OF && GPIOLIB
         select PINMUX
         select PINCONF
 
-config PINCTRL_EXYNOS4
-        bool "Pinctrl driver data for Exynos4 SoC"
+config PINCTRL_EXYNOS
+        bool "Pinctrl driver data for Samsung EXYNOS SoCs"
         depends on OF && GPIOLIB
         select PINCTRL_SAMSUNG
 
diff --git a/drivers/pinctrl/Makefile b/drivers/pinctrl/Makefile
index fc4606f27dc7..6e87e52eab5d 100644
--- a/drivers/pinctrl/Makefile
+++ b/drivers/pinctrl/Makefile
@@ -36,7 +36,7 @@ obj-$(CONFIG_PINCTRL_TEGRA30)	+= pinctrl-tegra30.o
 obj-$(CONFIG_PINCTRL_U300)      += pinctrl-u300.o
 obj-$(CONFIG_PINCTRL_COH901)    += pinctrl-coh901.o
 obj-$(CONFIG_PINCTRL_SAMSUNG)   += pinctrl-samsung.o
-obj-$(CONFIG_PINCTRL_EXYNOS4)   += pinctrl-exynos.o
+obj-$(CONFIG_PINCTRL_EXYNOS)    += pinctrl-exynos.o
 obj-$(CONFIG_PINCTRL_EXYNOS5440)        += pinctrl-exynos5440.o
 obj-$(CONFIG_PINCTRL_XWAY)      += pinctrl-xway.o
 obj-$(CONFIG_PINCTRL_LANTIQ)    += pinctrl-lantiq.o
diff --git a/drivers/pinctrl/mvebu/pinctrl-dove.c b/drivers/pinctrl/mvebu/pinctrl-dove.c
index 69aba3697287..428ea96a94d3 100644
--- a/drivers/pinctrl/mvebu/pinctrl-dove.c
+++ b/drivers/pinctrl/mvebu/pinctrl-dove.c
@@ -588,7 +588,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
 {
         const struct of_device_id *match =
                 of_match_device(dove_pinctrl_of_match, &pdev->dev);
-        pdev->dev.platform_data = match->data;
+        pdev->dev.platform_data = (void *)match->data;
 
         /*
          * General MPP Configuration Register is part of pdma registers.
diff --git a/drivers/pinctrl/mvebu/pinctrl-kirkwood.c b/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
index f12084e18057..cdd483df673e 100644
--- a/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
+++ b/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
@@ -66,9 +66,9 @@ static struct mvebu_mpp_mode mv88f6xxx_mpp_modes[] = {
                 MPP_VAR_FUNCTION(0x5, "sata0", "act",    V(0, 1, 1, 1, 1, 0)),
                 MPP_VAR_FUNCTION(0xb, "lcd", "vsync",    V(0, 0, 0, 0, 1, 0))),
         MPP_MODE(6,
-                MPP_VAR_FUNCTION(0x0, "sysrst", "out",   V(1, 1, 1, 1, 1, 1)),
-                MPP_VAR_FUNCTION(0x1, "spi", "mosi",     V(1, 1, 1, 1, 1, 1)),
-                MPP_VAR_FUNCTION(0x2, "ptp", "trig",     V(1, 1, 1, 1, 0, 0))),
+                MPP_VAR_FUNCTION(0x1, "sysrst", "out",   V(1, 1, 1, 1, 1, 1)),
+                MPP_VAR_FUNCTION(0x2, "spi", "mosi",     V(1, 1, 1, 1, 1, 1)),
+                MPP_VAR_FUNCTION(0x3, "ptp", "trig",     V(1, 1, 1, 1, 0, 0))),
         MPP_MODE(7,
                 MPP_VAR_FUNCTION(0x0, "gpo", NULL,       V(1, 1, 1, 1, 1, 1)),
                 MPP_VAR_FUNCTION(0x1, "pex", "rsto",     V(1, 1, 1, 1, 0, 1)),
@@ -458,7 +458,7 @@ static int kirkwood_pinctrl_probe(struct platform_device *pdev)
 {
         const struct of_device_id *match =
                 of_match_device(kirkwood_pinctrl_of_match, &pdev->dev);
-        pdev->dev.platform_data = match->data;
+        pdev->dev.platform_data = (void *)match->data;
         return mvebu_pinctrl_probe(pdev);
 }
 
diff --git a/drivers/pinctrl/pinctrl-exynos5440.c b/drivers/pinctrl/pinctrl-exynos5440.c
index de05b64f0da6..142729914c34 100644
--- a/drivers/pinctrl/pinctrl-exynos5440.c
+++ b/drivers/pinctrl/pinctrl-exynos5440.c
@@ -599,7 +599,7 @@ static int exynos5440_gpio_direction_output(struct gpio_chip *gc, unsigned offse
 }
 
 /* parse the pin numbers listed in the 'samsung,exynos5440-pins' property */
-static int __init exynos5440_pinctrl_parse_dt_pins(struct platform_device *pdev,
+static int exynos5440_pinctrl_parse_dt_pins(struct platform_device *pdev,
                         struct device_node *cfg_np, unsigned int **pin_list,
                         unsigned int *npins)
 {
@@ -630,7 +630,7 @@ static int __init exynos5440_pinctrl_parse_dt_pins(struct platform_device *pdev,
  * Parse the information about all the available pin groups and pin functions
  * from device node of the pin-controller.
  */
-static int __init exynos5440_pinctrl_parse_dt(struct platform_device *pdev,
+static int exynos5440_pinctrl_parse_dt(struct platform_device *pdev,
                                 struct exynos5440_pinctrl_priv_data *priv)
 {
         struct device *dev = &pdev->dev;
@@ -723,7 +723,7 @@ static int __init exynos5440_pinctrl_parse_dt(struct platform_device *pdev,
 }
 
 /* register the pinctrl interface with the pinctrl subsystem */
-static int __init exynos5440_pinctrl_register(struct platform_device *pdev,
+static int exynos5440_pinctrl_register(struct platform_device *pdev,
                                 struct exynos5440_pinctrl_priv_data *priv)
 {
         struct device *dev = &pdev->dev;
@@ -798,7 +798,7 @@ static int __init exynos5440_pinctrl_register(struct platform_device *pdev,
 }
 
 /* register the gpiolib interface with the gpiolib subsystem */
-static int __init exynos5440_gpiolib_register(struct platform_device *pdev,
+static int exynos5440_gpiolib_register(struct platform_device *pdev,
                                 struct exynos5440_pinctrl_priv_data *priv)
 {
         struct gpio_chip *gc;
@@ -831,7 +831,7 @@ static int __init exynos5440_gpiolib_register(struct platform_device *pdev,
 }
 
 /* unregister the gpiolib interface with the gpiolib subsystem */
-static int __init exynos5440_gpiolib_unregister(struct platform_device *pdev,
+static int exynos5440_gpiolib_unregister(struct platform_device *pdev,
                                 struct exynos5440_pinctrl_priv_data *priv)
 {
         int ret = gpiochip_remove(priv->gc);
diff --git a/drivers/pinctrl/pinctrl-mxs.c b/drivers/pinctrl/pinctrl-mxs.c
index dd227d21dcf2..23af9f1f9c35 100644
--- a/drivers/pinctrl/pinctrl-mxs.c
+++ b/drivers/pinctrl/pinctrl-mxs.c
@@ -146,7 +146,7 @@ free:
 static void mxs_dt_free_map(struct pinctrl_dev *pctldev,
                             struct pinctrl_map *map, unsigned num_maps)
 {
-        int i;
+        u32 i;
 
         for (i = 0; i < num_maps; i++) {
                 if (map[i].type == PIN_MAP_TYPE_MUX_GROUP)
@@ -203,7 +203,7 @@ static int mxs_pinctrl_enable(struct pinctrl_dev *pctldev, unsigned selector,
         void __iomem *reg;
         u8 bank, shift;
         u16 pin;
-        int i;
+        u32 i;
 
         for (i = 0; i < g->npins; i++) {
                 bank = PINID_TO_BANK(g->pins[i]);
@@ -256,7 +256,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
         void __iomem *reg;
         u8 ma, vol, pull, bank, shift;
         u16 pin;
-        int i;
+        u32 i;
 
         ma = CONFIG_TO_MA(config);
         vol = CONFIG_TO_VOL(config);
@@ -345,8 +345,7 @@ static int mxs_pinctrl_parse_group(struct platform_device *pdev,
         const char *propname = "fsl,pinmux-ids";
         char *group;
         int length = strlen(np->name) + SUFFIX_LEN;
-        int i;
-        u32 val;
+        u32 val, i;
 
         group = devm_kzalloc(&pdev->dev, length, GFP_KERNEL);
         if (!group)
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index 1bb16ffb4e41..5767b18ebdff 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -676,7 +676,7 @@ int nmk_gpio_set_mode(int gpio, int gpio_mode)
 }
 EXPORT_SYMBOL(nmk_gpio_set_mode);
 
-static int nmk_prcm_gpiocr_get_mode(struct pinctrl_dev *pctldev, int gpio)
+static int __maybe_unused nmk_prcm_gpiocr_get_mode(struct pinctrl_dev *pctldev, int gpio)
 {
         int i;
         u16 reg;
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index f6a360b86eb6..5c32e880bcb2 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -30,7 +30,6 @@
 #define PCS_MUX_BITS_NAME               "pinctrl-single,bits"
 #define PCS_REG_NAME_LEN                ((sizeof(unsigned long) * 2) + 1)
 #define PCS_OFF_DISABLED                ~0U
-#define PCS_MAX_GPIO_VALUES             2
 
 /**
  * struct pcs_pingroup - pingroups for a function
@@ -78,16 +77,6 @@ struct pcs_function {
 };
 
 /**
- * struct pcs_gpio_range - pinctrl gpio range
- * @range:      subrange of the GPIO number space
- * @gpio_func:  gpio function value in the pinmux register
- */
-struct pcs_gpio_range {
-        struct pinctrl_gpio_range range;
-        int gpio_func;
-};
-
-/**
  * struct pcs_data - wrapper for data needed by pinctrl framework
  * @pa:         pindesc array
  * @cur:        index to current element
@@ -414,26 +403,9 @@ static void pcs_disable(struct pinctrl_dev *pctldev, unsigned fselector,
 }
 
 static int pcs_request_gpio(struct pinctrl_dev *pctldev,
-                            struct pinctrl_gpio_range *range, unsigned pin)
+                        struct pinctrl_gpio_range *range, unsigned offset)
 {
-        struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
-        struct pcs_gpio_range *gpio = NULL;
-        int end, mux_bytes;
-        unsigned data;
-
-        gpio = container_of(range, struct pcs_gpio_range, range);
-        end = range->pin_base + range->npins - 1;
-        if (pin < range->pin_base || pin > end) {
-                dev_err(pctldev->dev,
-                        "pin %d isn't in the range of %d to %d\n",
-                        pin, range->pin_base, end);
-                return -EINVAL;
-        }
-        mux_bytes = pcs->width / BITS_PER_BYTE;
-        data = pcs->read(pcs->base + pin * mux_bytes) & ~pcs->fmask;
-        data |= gpio->gpio_func;
-        pcs->write(data, pcs->base + pin * mux_bytes);
-        return 0;
+        return -ENOTSUPP;
 }
 
 static struct pinmux_ops pcs_pinmux_ops = {
@@ -907,49 +879,6 @@ static void pcs_free_resources(struct pcs_device *pcs)
 
 static struct of_device_id pcs_of_match[];
 
-static int pcs_add_gpio_range(struct device_node *node, struct pcs_device *pcs)
-{
-        struct pcs_gpio_range *gpio;
-        struct device_node *child;
-        struct resource r;
-        const char name[] = "pinctrl-single";
-        u32 gpiores[PCS_MAX_GPIO_VALUES];
-        int ret, i = 0, mux_bytes = 0;
-
-        for_each_child_of_node(node, child) {
-                ret = of_address_to_resource(child, 0, &r);
-                if (ret < 0)
-                        continue;
-                memset(gpiores, 0, sizeof(u32) * PCS_MAX_GPIO_VALUES);
-                ret = of_property_read_u32_array(child, "pinctrl-single,gpio",
-                                                 gpiores, PCS_MAX_GPIO_VALUES);
-                if (ret < 0)
-                        continue;
-                gpio = devm_kzalloc(pcs->dev, sizeof(*gpio), GFP_KERNEL);
-                if (!gpio) {
-                        dev_err(pcs->dev, "failed to allocate pcs gpio\n");
-                        return -ENOMEM;
-                }
-                gpio->range.name = devm_kzalloc(pcs->dev, sizeof(name),
-                                                GFP_KERNEL);
-                if (!gpio->range.name) {
-                        dev_err(pcs->dev, "failed to allocate range name\n");
-                        return -ENOMEM;
-                }
-                memcpy((char *)gpio->range.name, name, sizeof(name));
-
-                gpio->range.id = i++;
-                gpio->range.base = gpiores[0];
-                gpio->gpio_func = gpiores[1];
-                mux_bytes = pcs->width / BITS_PER_BYTE;
-                gpio->range.pin_base = (r.start - pcs->res->start) / mux_bytes;
-                gpio->range.npins = (r.end - r.start) / mux_bytes + 1;
-
-                pinctrl_add_gpio_range(pcs->pctl, &gpio->range);
-        }
-        return 0;
-}
-
 static int pcs_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
@@ -1046,10 +975,6 @@ static int pcs_probe(struct platform_device *pdev)
                 goto free;
         }
 
-        ret = pcs_add_gpio_range(np, pcs);
-        if (ret < 0)
-                goto free;
-
         dev_info(pcs->dev, "%i pins at pa %p size %u\n",
                  pcs->desc.npins, pcs->base, pcs->size);
 
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index 498b2ba905de..d02498b30c6e 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1246,6 +1246,22 @@ static void __iomem *sirfsoc_rsc_of_iomap(void)
         return of_iomap(np, 0);
 }
 
+static int sirfsoc_gpio_of_xlate(struct gpio_chip *gc,
+       const struct of_phandle_args *gpiospec,
+       u32 *flags)
+{
+       if (gpiospec->args[0] > SIRFSOC_GPIO_NO_OF_BANKS * SIRFSOC_GPIO_BANK_SIZE)
+               return -EINVAL;
+
+       if (gc != &sgpio_bank[gpiospec->args[0] / SIRFSOC_GPIO_BANK_SIZE].chip.gc)
+               return -EINVAL;
+
+       if (flags)
+               *flags = gpiospec->args[1];
+
+       return gpiospec->args[0] % SIRFSOC_GPIO_BANK_SIZE;
+}
+
 static int sirfsoc_pinmux_probe(struct platform_device *pdev)
 {
         int ret;
@@ -1736,6 +1752,8 @@ static int sirfsoc_gpio_probe(struct device_node *np)
                 bank->chip.gc.ngpio = SIRFSOC_GPIO_BANK_SIZE;
                 bank->chip.gc.label = kstrdup(np->full_name, GFP_KERNEL);
                 bank->chip.gc.of_node = np;
+                bank->chip.gc.of_xlate = sirfsoc_gpio_of_xlate;
+                bank->chip.gc.of_gpio_n_cells = 2;
                 bank->chip.regs = regs;
                 bank->id = i;
                 bank->is_marco = is_marco;
diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 7481146a5b47..97c2be195efc 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -244,7 +244,7 @@ static int __init ibm_rtl_init(void) {
         if (force)
                 pr_warn("module loaded by force\n");
         /* first ensure that we are running on IBM HW */
-        else if (efi_enabled || !dmi_check_system(ibm_rtl_dmi_table))
+        else if (efi_enabled(EFI_BOOT) || !dmi_check_system(ibm_rtl_dmi_table))
                 return -ENODEV;
 
         /* Get the address for the Extended BIOS Data Area */
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index 71623a2ff3e8..d1f030053176 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -26,6 +26,7 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
+#include <linux/efi.h>
 #include <acpi/video.h>
 
 /*
@@ -1544,6 +1545,9 @@ static int __init samsung_init(void)
         struct samsung_laptop *samsung;
         int ret;
 
+        if (efi_enabled(EFI_BOOT))
+                return -ENODEV;
+
         quirks = &samsung_unknown;
         if (!force && !dmi_check_system(samsung_dmi_table))
                 return -ENODEV;
diff --git a/drivers/regulator/dbx500-prcmu.c b/drivers/regulator/dbx500-prcmu.c
index 261f3d2299bc..89bd2faaef8c 100644
--- a/drivers/regulator/dbx500-prcmu.c
+++ b/drivers/regulator/dbx500-prcmu.c
@@ -14,6 +14,7 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 
 #include "dbx500-prcmu.h"
 
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index b85040caaea3..cca18a3c0294 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -379,9 +379,10 @@ static struct regulator_desc regulators[] = {
 };
 
 #ifdef CONFIG_OF
-static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
+static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max77686_platform_data *pdata)
 {
+        struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
         struct of_regulator_match rmatch;
@@ -390,15 +391,15 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
         pmic_np = iodev->dev->of_node;
         regulators_np = of_find_node_by_name(pmic_np, "voltage-regulators");
         if (!regulators_np) {
-                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                dev_err(&pdev->dev, "could not find regulators sub-node\n");
                 return -EINVAL;
         }
 
         pdata->num_regulators = ARRAY_SIZE(regulators);
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
                              pdata->num_regulators, GFP_KERNEL);
         if (!rdata) {
-                dev_err(iodev->dev,
+                dev_err(&pdev->dev,
                         "could not allocate memory for regulator data\n");
                 return -ENOMEM;
         }
@@ -407,7 +408,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
                 rmatch.name = regulators[i].name;
                 rmatch.init_data = NULL;
                 rmatch.of_node = NULL;
-                of_regulator_match(iodev->dev, regulators_np, &rmatch, 1);
+                of_regulator_match(&pdev->dev, regulators_np, &rmatch, 1);
                 rdata[i].initdata = rmatch.init_data;
                 rdata[i].of_node = rmatch.of_node;
         }
@@ -417,7 +418,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
         return 0;
 }
 #else
-static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
+static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max77686_platform_data *pdata)
 {
         return 0;
@@ -440,7 +441,7 @@ static int max77686_pmic_probe(struct platform_device *pdev)
         }
 
         if (iodev->dev->of_node) {
-                ret = max77686_pmic_dt_parse_pdata(iodev, pdata);
+                ret = max77686_pmic_dt_parse_pdata(pdev, pdata);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
index d1a77512d83e..d40cf7fdb546 100644
--- a/drivers/regulator/max8907-regulator.c
+++ b/drivers/regulator/max8907-regulator.c
@@ -237,8 +237,7 @@ static int max8907_regulator_parse_dt(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        ret = of_regulator_match(pdev->dev.parent, regulators,
-                                 max8907_matches,
+        ret = of_regulator_match(&pdev->dev, regulators, max8907_matches,
                                  ARRAY_SIZE(max8907_matches));
         if (ret < 0) {
                 dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
index 02be7fcae32f..836908ce505e 100644
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -934,7 +934,7 @@ static struct regulator_desc regulators[] = {
 };
 
 #ifdef CONFIG_OF
-static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_dvs_gpio(struct platform_device *pdev,
                         struct max8997_platform_data *pdata,
                         struct device_node *pmic_np)
 {
@@ -944,7 +944,7 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
                 gpio = of_get_named_gpio(pmic_np,
                                         "max8997,pmic-buck125-dvs-gpios", i);
                 if (!gpio_is_valid(gpio)) {
-                        dev_err(iodev->dev, "invalid gpio[%d]: %d\n", i, gpio);
+                        dev_err(&pdev->dev, "invalid gpio[%d]: %d\n", i, gpio);
                         return -EINVAL;
                 }
                 pdata->buck125_gpios[i] = gpio;
@@ -952,22 +952,23 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
         return 0;
 }
 
-static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max8997_platform_data *pdata)
 {
+        struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np, *reg_np;
         struct max8997_regulator_data *rdata;
         unsigned int i, dvs_voltage_nr = 1, ret;
 
         pmic_np = iodev->dev->of_node;
         if (!pmic_np) {
-                dev_err(iodev->dev, "could not find pmic sub-node\n");
+                dev_err(&pdev->dev, "could not find pmic sub-node\n");
                 return -ENODEV;
         }
 
         regulators_np = of_find_node_by_name(pmic_np, "regulators");
         if (!regulators_np) {
-                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                dev_err(&pdev->dev, "could not find regulators sub-node\n");
                 return -EINVAL;
         }
 
@@ -976,11 +977,10 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
         for_each_child_of_node(regulators_np, reg_np)
                 pdata->num_regulators++;
 
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
                                 pdata->num_regulators, GFP_KERNEL);
         if (!rdata) {
-                dev_err(iodev->dev, "could not allocate memory for "
-                                                "regulator data\n");
+                dev_err(&pdev->dev, "could not allocate memory for regulator data\n");
                 return -ENOMEM;
         }
 
@@ -991,14 +991,14 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
                                 break;
 
                 if (i == ARRAY_SIZE(regulators)) {
-                        dev_warn(iodev->dev, "don't know how to configure "
-                                "regulator %s\n", reg_np->name);
+                        dev_warn(&pdev->dev, "don't know how to configure regulator %s\n",
+                                 reg_np->name);
                         continue;
                 }
 
                 rdata->id = i;
-                rdata->initdata = of_get_regulator_init_data(
-                                                iodev->dev, reg_np);
+                rdata->initdata = of_get_regulator_init_data(&pdev->dev,
+                                                             reg_np);
                 rdata->reg_node = reg_np;
                 rdata++;
         }
@@ -1014,7 +1014,7 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
 
         if (pdata->buck1_gpiodvs || pdata->buck2_gpiodvs ||
                                                 pdata->buck5_gpiodvs) {
-                ret = max8997_pmic_dt_parse_dvs_gpio(iodev, pdata, pmic_np);
+                ret = max8997_pmic_dt_parse_dvs_gpio(pdev, pdata, pmic_np);
                 if (ret)
                         return -EINVAL;
 
@@ -1025,8 +1025,7 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
                 } else {
                         if (pdata->buck125_default_idx >= 8) {
                                 pdata->buck125_default_idx = 0;
-                                dev_info(iodev->dev, "invalid value for "
-                                "default dvs index, using 0 instead\n");
+                                dev_info(&pdev->dev, "invalid value for default dvs index, using 0 instead\n");
                         }
                 }
 
@@ -1040,28 +1039,28 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
         if (of_property_read_u32_array(pmic_np,
                                 "max8997,pmic-buck1-dvs-voltage",
                                 pdata->buck1_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck1 voltages not specified\n");
+                dev_err(&pdev->dev, "buck1 voltages not specified\n");
                 return -EINVAL;
         }
 
         if (of_property_read_u32_array(pmic_np,
                                 "max8997,pmic-buck2-dvs-voltage",
                                 pdata->buck2_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck2 voltages not specified\n");
+                dev_err(&pdev->dev, "buck2 voltages not specified\n");
                 return -EINVAL;
         }
 
         if (of_property_read_u32_array(pmic_np,
                                 "max8997,pmic-buck5-dvs-voltage",
                                 pdata->buck5_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck5 voltages not specified\n");
+                dev_err(&pdev->dev, "buck5 voltages not specified\n");
                 return -EINVAL;
         }
 
         return 0;
 }
 #else
-static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max8997_platform_data *pdata)
 {
         return 0;
@@ -1085,7 +1084,7 @@ static int max8997_pmic_probe(struct platform_device *pdev)
         }
 
         if (iodev->dev->of_node) {
-                ret = max8997_pmic_dt_parse_pdata(iodev, pdata);
+                ret = max8997_pmic_dt_parse_pdata(pdev, pdata);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index 1f0df4046b86..0a8dd1cbee6f 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -65,7 +65,7 @@ static const struct voltage_map_desc ldo9_voltage_map_desc = {
         .min = 2800000, .step = 100000, .max = 3100000,
 };
 static const struct voltage_map_desc ldo10_voltage_map_desc = {
-        .min = 95000,   .step = 50000,  .max = 1300000,
+        .min = 950000,  .step = 50000,  .max = 1300000,
 };
 static const struct voltage_map_desc ldo1213_voltage_map_desc = {
         .min = 800000,  .step = 100000, .max = 3300000,
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 6f684916fd79..66ca769287ab 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -120,6 +120,12 @@ int of_regulator_match(struct device *dev, struct device_node *node,
         if (!dev || !node)
                 return -EINVAL;
 
+        for (i = 0; i < num_matches; i++) {
+                struct of_regulator_match *match = &matches[i];
+                match->init_data = NULL;
+                match->of_node = NULL;
+        }
+
         for_each_child_of_node(node, child) {
                 name = of_get_property(child,
                                         "regulator-compatible", NULL);
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index bd062a2ffbe2..cd9ea2ea1826 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -174,9 +174,9 @@ static struct regulator_ops s2mps11_buck_ops = {
         .min_uV         = S2MPS11_BUCK_MIN2,                    \
         .uV_step        = S2MPS11_BUCK_STEP2,                   \
         .n_voltages     = S2MPS11_BUCK_N_VOLTAGES,              \
-        .vsel_reg       = S2MPS11_REG_B9CTRL2,                  \
+        .vsel_reg       = S2MPS11_REG_B10CTRL2,                 \
         .vsel_mask      = S2MPS11_BUCK_VSEL_MASK,               \
-        .enable_reg     = S2MPS11_REG_B9CTRL1,                  \
+        .enable_reg     = S2MPS11_REG_B10CTRL1,                 \
         .enable_mask    = S2MPS11_ENABLE_MASK                   \
 }
 
diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c
index 73dce7664126..df395187c063 100644
--- a/drivers/regulator/tps65217-regulator.c
+++ b/drivers/regulator/tps65217-regulator.c
@@ -305,8 +305,8 @@ static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
         if (!regs)
                 return NULL;
 
-        count = of_regulator_match(pdev->dev.parent, regs,
-                                reg_matches, TPS65217_NUM_REGULATOR);
+        count = of_regulator_match(&pdev->dev, regs, reg_matches,
+                                   TPS65217_NUM_REGULATOR);
         of_node_put(regs);
         if ((count < 0) || (count > TPS65217_NUM_REGULATOR))
                 return NULL;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 59c3770fa77d..b0e4c0bc85c3 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -998,7 +998,7 @@ static struct tps65910_board *tps65910_parse_dt_reg_data(
                 return NULL;
         }
 
-        ret = of_regulator_match(pdev->dev.parent, regulators, matches, count);
+        ret = of_regulator_match(&pdev->dev, regulators, matches, count);
         if (ret < 0) {
                 dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
                         ret);
diff --git a/drivers/regulator/tps80031-regulator.c b/drivers/regulator/tps80031-regulator.c
index b15d711bc8c6..9019d0e7ecb6 100644
--- a/drivers/regulator/tps80031-regulator.c
+++ b/drivers/regulator/tps80031-regulator.c
@@ -728,7 +728,7 @@ static int tps80031_regulator_probe(struct platform_device *pdev)
                         }
                 }
                 rdev = regulator_register(&ri->rinfo->desc, &config);
-                if (IS_ERR_OR_NULL(rdev)) {
+                if (IS_ERR(rdev)) {
                         dev_err(&pdev->dev,
                                 "register regulator failed %s\n",
                                         ri->rinfo->desc.name);
diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
index afb7cfa85ccc..c016ad81767a 100644
--- a/drivers/rtc/rtc-isl1208.c
+++ b/drivers/rtc/rtc-isl1208.c
@@ -506,6 +506,7 @@ isl1208_rtc_interrupt(int irq, void *data)
 {
         unsigned long timeout = jiffies + msecs_to_jiffies(1000);
         struct i2c_client *client = data;
+        struct rtc_device *rtc = i2c_get_clientdata(client);
         int handled = 0, sr, err;
 
         /*
@@ -528,6 +529,8 @@ isl1208_rtc_interrupt(int irq, void *data)
         if (sr & ISL1208_REG_SR_ALM) {
                 dev_dbg(&client->dev, "alarm!\n");
 
+                rtc_update_irq(rtc, 1, RTC_IRQF | RTC_AF);
+
                 /* Clear the alarm */
                 sr &= ~ISL1208_REG_SR_ALM;
                 sr = i2c_smbus_write_byte_data(client, ISL1208_REG_SR, sr);
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 08378e3cc21c..10c1a3454e48 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -44,6 +44,7 @@
 #define RTC_YMR         0x34    /* Year match register */
 #define RTC_YLR         0x38    /* Year data load register */
 
+#define RTC_CR_EN       (1 << 0)        /* counter enable bit */
 #define RTC_CR_CWEN     (1 << 26)       /* Clockwatch enable bit */
 
 #define RTC_TCR_EN      (1 << 1) /* Periodic timer enable bit */
@@ -320,7 +321,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         struct pl031_local *ldata;
         struct pl031_vendor_data *vendor = id->data;
         struct rtc_class_ops *ops = &vendor->ops;
-        unsigned long time;
+        unsigned long time, data;
 
         ret = amba_request_regions(adev, NULL);
         if (ret)
@@ -345,10 +346,11 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         dev_dbg(&adev->dev, "designer ID = 0x%02x\n", amba_manf(adev));
         dev_dbg(&adev->dev, "revision = 0x%01x\n", amba_rev(adev));
 
+        data = readl(ldata->base + RTC_CR);
         /* Enable the clockwatch on ST Variants */
         if (vendor->clockwatch)
-                writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
-                       ldata->base + RTC_CR);
+                data |= RTC_CR_CWEN;
+        writel(data | RTC_CR_EN, ldata->base + RTC_CR);
 
         /*
          * On ST PL031 variants, the RTC reset value does not provide correct
diff --git a/drivers/rtc/rtc-vt8500.c b/drivers/rtc/rtc-vt8500.c
index 00c930f4b6f3..2730533e2d2d 100644
--- a/drivers/rtc/rtc-vt8500.c
+++ b/drivers/rtc/rtc-vt8500.c
@@ -137,7 +137,7 @@ static int vt8500_rtc_set_time(struct device *dev, struct rtc_time *tm)
                 return -EINVAL;
         }
 
-        writel((bin2bcd(tm->tm_year - 100) << DATE_YEAR_S)
+        writel((bin2bcd(tm->tm_year % 100) << DATE_YEAR_S)
                 | (bin2bcd(tm->tm_mon + 1) << DATE_MONTH_S)
                 | (bin2bcd(tm->tm_mday))
                 | ((tm->tm_year >= 200) << DATE_CENTURY_S),
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index d73fdcfeb45a..2839baa82a5a 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -633,7 +633,7 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 return -ENOMEM;
         pci_set_drvdata(pdev, pci_info);
 
-        if (efi_enabled)
+        if (efi_enabled(EFI_RUNTIME_SERVICES))
                 orom = isci_get_efi_var(pdev);
 
         if (!orom)
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index 97ac0a38e3d0..eb2753008ef0 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -174,3 +174,15 @@ int ssb_gpio_init(struct ssb_bus *bus)
 
         return -1;
 }
+
+int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        if (ssb_chipco_available(&bus->chipco) ||
+            ssb_extif_available(&bus->extif)) {
+                return gpiochip_remove(&bus->gpio);
+        } else {
+                SSB_WARN_ON(1);
+        }
+
+        return -1;
+}
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 772ad9b5c304..24dc331b4701 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -443,6 +443,15 @@ static void ssb_devices_unregister(struct ssb_bus *bus)
 
 void ssb_bus_unregister(struct ssb_bus *bus)
 {
+        int err;
+
+        err = ssb_gpio_unregister(bus);
+        if (err == -EBUSY)
+                ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
+        else if (err)
+                ssb_dprintk(KERN_ERR PFX
+                            "Can not unregister GPIO driver: %i\n", err);
+
         ssb_buses_lock();
         ssb_devices_unregister(bus);
         list_del(&bus->list);
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 6c10b66c796c..da38305a2d22 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -252,11 +252,16 @@ static inline void ssb_extif_init(struct ssb_extif *extif)
 
 #ifdef CONFIG_SSB_DRIVER_GPIO
 extern int ssb_gpio_init(struct ssb_bus *bus);
+extern int ssb_gpio_unregister(struct ssb_bus *bus);
 #else /* CONFIG_SSB_DRIVER_GPIO */
 static inline int ssb_gpio_init(struct ssb_bus *bus)
 {
         return -ENOTSUPP;
 }
+static inline int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        return 0;
+}
 #endif /* CONFIG_SSB_DRIVER_GPIO */
 
 #endif /* LINUX_SSB_PRIVATE_H_ */
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index e2695101bb99..f2aa7543d20a 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -941,6 +941,8 @@ int se_dev_set_queue_depth(struct se_device *dev, u32 queue_depth)
 
 int se_dev_set_fabric_max_sectors(struct se_device *dev, u32 fabric_max_sectors)
 {
+        int block_size = dev->dev_attrib.block_size;
+
         if (dev->export_count) {
                 pr_err("dev[%p]: Unable to change SE Device"
                         " fabric_max_sectors while export_count is %d\n",
@@ -978,8 +980,12 @@ int se_dev_set_fabric_max_sectors(struct se_device *dev, u32 fabric_max_sectors)
         /*
          * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
          */
+        if (!block_size) {
+                block_size = 512;
+                pr_warn("Defaulting to 512 for zero block_size\n");
+        }
         fabric_max_sectors = se_dev_align_max_sectors(fabric_max_sectors,
-                                                      dev->dev_attrib.block_size);
+                                                      block_size);
 
         dev->dev_attrib.fabric_max_sectors = fabric_max_sectors;
         pr_debug("dev[%p]: SE Device max_sectors changed to %u\n",
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 810263dfa4a1..c57bbbc7a7d1 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -754,6 +754,11 @@ static int target_fabric_port_link(
                 return -EFAULT;
         }
 
+        if (!(dev->dev_flags & DF_CONFIGURED)) {
+                pr_err("se_device not configured yet, cannot port link\n");
+                return -ENODEV;
+        }
+
         tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
         se_tpg = container_of(to_config_group(tpg_ci),
                                 struct se_portal_group, tpg_group);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 26a6d183ccb1..a664c664a31a 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -58,11 +58,10 @@ sbc_emulate_readcapacity(struct se_cmd *cmd)
         buf[7] = dev->dev_attrib.block_size & 0xff;
 
         rbuf = transport_kmap_data_sg(cmd);
-        if (!rbuf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-
-        memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
 
         target_complete_cmd(cmd, GOOD);
         return 0;
@@ -97,11 +96,10 @@ sbc_emulate_readcapacity_16(struct se_cmd *cmd)
                 buf[14] = 0x80;
 
         rbuf = transport_kmap_data_sg(cmd);
-        if (!rbuf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-
-        memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
 
         target_complete_cmd(cmd, GOOD);
         return 0;
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 84f9e96e8ace..2d88f087d961 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -641,11 +641,10 @@ spc_emulate_inquiry(struct se_cmd *cmd)
 
 out:
         rbuf = transport_kmap_data_sg(cmd);
-        if (!rbuf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-
-        memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
 
         if (!ret)
                 target_complete_cmd(cmd, GOOD);
@@ -851,7 +850,7 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
         char *cdb = cmd->t_task_cdb;
-        unsigned char *buf, *map_buf;
+        unsigned char buf[SE_MODE_PAGE_BUF], *rbuf;
         int type = dev->transport->get_device_type(dev);
         int ten = (cmd->t_task_cdb[0] == MODE_SENSE_10);
         bool dbd = !!(cdb[1] & 0x08);
@@ -863,26 +862,8 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
         int ret;
         int i;
 
-        map_buf = transport_kmap_data_sg(cmd);
-        if (!map_buf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-        /*
-         * If SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is not set, then we
-         * know we actually allocated a full page.  Otherwise, if the
-         * data buffer is too small, allocate a temporary buffer so we
-         * don't have to worry about overruns in all our INQUIRY
-         * emulation handling.
-         */
-        if (cmd->data_length < SE_MODE_PAGE_BUF &&
-            (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC)) {
-                buf = kzalloc(SE_MODE_PAGE_BUF, GFP_KERNEL);
-                if (!buf) {
-                        transport_kunmap_data_sg(cmd);
-                        return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                }
-        } else {
-                buf = map_buf;
-        }
+        memset(buf, 0, SE_MODE_PAGE_BUF);
+
         /*
          * Skip over MODE DATA LENGTH + MEDIUM TYPE fields to byte 3 for
          * MODE_SENSE_10 and byte 2 for MODE_SENSE (6).
@@ -934,8 +915,6 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
         if (page == 0x3f) {
                 if (subpage != 0x00 && subpage != 0xff) {
                         pr_warn("MODE_SENSE: Invalid subpage code: 0x%02x\n", subpage);
-                        kfree(buf);
-                        transport_kunmap_data_sg(cmd);
                         return TCM_INVALID_CDB_FIELD;
                 }
 
@@ -972,7 +951,6 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
                 pr_err("MODE SENSE: unimplemented page/subpage: 0x%02x/0x%02x\n",
                        page, subpage);
 
-        transport_kunmap_data_sg(cmd);
         return TCM_UNKNOWN_MODE_PAGE;
 
 set_length:
@@ -981,12 +959,12 @@ set_length:
         else
                 buf[0] = length - 1;
 
-        if (buf != map_buf) {
-                memcpy(map_buf, buf, cmd->data_length);
-                kfree(buf);
+        rbuf = transport_kmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, SE_MODE_PAGE_BUF, cmd->data_length));
+                transport_kunmap_data_sg(cmd);
         }
 
-        transport_kunmap_data_sg(cmd);
         target_complete_cmd(cmd, GOOD);
         return 0;
 }
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 4225d5e72131..8e64adf8e4d5 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -39,6 +39,7 @@
 #include <asm/unaligned.h>
 #include <linux/platform_device.h>
 #include <linux/workqueue.h>
+#include <linux/pm_runtime.h>
 
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
@@ -1025,6 +1026,49 @@ static int register_root_hub(struct usb_hcd *hcd)
         return retval;
 }
 
+/*
+ * usb_hcd_start_port_resume - a root-hub port is sending a resume signal
+ * @bus: the bus which the root hub belongs to
+ * @portnum: the port which is being resumed
+ *
+ * HCDs should call this function when they know that a resume signal is
+ * being sent to a root-hub port.  The root hub will be prevented from
+ * going into autosuspend until usb_hcd_end_port_resume() is called.
+ *
+ * The bus's private lock must be held by the caller.
+ */
+void usb_hcd_start_port_resume(struct usb_bus *bus, int portnum)
+{
+        unsigned bit = 1 << portnum;
+
+        if (!(bus->resuming_ports & bit)) {
+                bus->resuming_ports |= bit;
+                pm_runtime_get_noresume(&bus->root_hub->dev);
+        }
+}
+EXPORT_SYMBOL_GPL(usb_hcd_start_port_resume);
+
+/*
+ * usb_hcd_end_port_resume - a root-hub port has stopped sending a resume signal
+ * @bus: the bus which the root hub belongs to
+ * @portnum: the port which is being resumed
+ *
+ * HCDs should call this function when they know that a resume signal has
+ * stopped being sent to a root-hub port.  The root hub will be allowed to
+ * autosuspend again.
+ *
+ * The bus's private lock must be held by the caller.
+ */
+void usb_hcd_end_port_resume(struct usb_bus *bus, int portnum)
+{
+        unsigned bit = 1 << portnum;
+
+        if (bus->resuming_ports & bit) {
+                bus->resuming_ports &= ~bit;
+                pm_runtime_put_noidle(&bus->root_hub->dev);
+        }
+}
+EXPORT_SYMBOL_GPL(usb_hcd_end_port_resume);
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 957ed2c41482..cbf7168e3ce7 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2838,6 +2838,23 @@ void usb_enable_ltm(struct usb_device *udev)
 EXPORT_SYMBOL_GPL(usb_enable_ltm);
 
 #ifdef  CONFIG_USB_SUSPEND
+/*
+ * usb_disable_function_remotewakeup - disable usb3.0
+ * device's function remote wakeup
+ * @udev: target device
+ *
+ * Assume there's only one function on the USB 3.0
+ * device and disable remote wake for the first
+ * interface. FIXME if the interface association
+ * descriptor shows there's more than one function.
+ */
+static int usb_disable_function_remotewakeup(struct usb_device *udev)
+{
+        return usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                USB_REQ_CLEAR_FEATURE, USB_RECIP_INTERFACE,
+                                USB_INTRF_FUNC_SUSPEND, 0, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
+}
 
 /*
  * usb_port_suspend - suspend a usb device's upstream port
@@ -2955,12 +2972,19 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
                 dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
                                 port1, status);
                 /* paranoia:  "should not happen" */
-                if (udev->do_remote_wakeup)
-                        (void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
-                                USB_REQ_CLEAR_FEATURE, USB_RECIP_DEVICE,
-                                USB_DEVICE_REMOTE_WAKEUP, 0,
-                                NULL, 0,
-                                USB_CTRL_SET_TIMEOUT);
+                if (udev->do_remote_wakeup) {
+                        if (!hub_is_superspeed(hub->hdev)) {
+                                (void) usb_control_msg(udev,
+                                                usb_sndctrlpipe(udev, 0),
+                                                USB_REQ_CLEAR_FEATURE,
+                                                USB_RECIP_DEVICE,
+                                                USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                NULL, 0,
+                                                USB_CTRL_SET_TIMEOUT);
+                        } else
+                                (void) usb_disable_function_remotewakeup(udev);
+
+                }
 
                 /* Try to enable USB2 hardware LPM again */
                 if (udev->usb2_hw_lpm_capable == 1)
@@ -3052,20 +3076,30 @@ static int finish_port_resume(struct usb_device *udev)
          * udev->reset_resume
          */
         } else if (udev->actconfig && !udev->reset_resume) {
-                le16_to_cpus(&devstatus);
-                if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP)) {
-                        status = usb_control_msg(udev,
-                                        usb_sndctrlpipe(udev, 0),
-                                        USB_REQ_CLEAR_FEATURE,
+                if (!hub_is_superspeed(udev->parent)) {
+                        le16_to_cpus(&devstatus);
+                        if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP))
+                                status = usb_control_msg(udev,
+                                                usb_sndctrlpipe(udev, 0),
+                                                USB_REQ_CLEAR_FEATURE,
                                                 USB_RECIP_DEVICE,
-                                        USB_DEVICE_REMOTE_WAKEUP, 0,
-                                        NULL, 0,
-                                        USB_CTRL_SET_TIMEOUT);
-                        if (status)
-                                dev_dbg(&udev->dev,
-                                        "disable remote wakeup, status %d\n",
-                                        status);
+                                                USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                NULL, 0,
+                                                USB_CTRL_SET_TIMEOUT);
+                } else {
+                        status = usb_get_status(udev, USB_RECIP_INTERFACE, 0,
+                                        &devstatus);
+                        le16_to_cpus(&devstatus);
+                        if (!status && devstatus & (USB_INTRF_STAT_FUNC_RW_CAP
+                                        | USB_INTRF_STAT_FUNC_RW))
+                                status =
+                                        usb_disable_function_remotewakeup(udev);
                 }
+
+                if (status)
+                        dev_dbg(&udev->dev,
+                                "disable remote wakeup, status %d\n",
+                                status);
                 status = 0;
         }
         return status;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 09537b2f1002..b416a3fc9959 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -797,6 +797,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                         ehci->reset_done[i] = jiffies + msecs_to_jiffies(25);
                         set_bit(i, &ehci->resuming_ports);
                         ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
+                        usb_hcd_start_port_resume(&hcd->self, i);
                         mod_timer(&hcd->rh_timer, ehci->reset_done[i]);
                 }
         }
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 4ccb97c0678f..4d3b294f203e 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -649,7 +649,11 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
                         status = STS_PCD;
                 }
         }
-        /* FIXME autosuspend idle root hubs */
+
+        /* If a resume is in progress, make sure it can finish */
+        if (ehci->resuming_ports)
+                mod_timer(&hcd->rh_timer, jiffies + msecs_to_jiffies(25));
+
         spin_unlock_irqrestore (&ehci->lock, flags);
         return status ? retval : 0;
 }
@@ -851,6 +855,7 @@ static int ehci_hub_control (
                                 /* resume signaling for 20 msec */
                                 ehci->reset_done[wIndex] = jiffies
                                                 + msecs_to_jiffies(20);
+                                usb_hcd_start_port_resume(&hcd->self, wIndex);
                                 /* check the port again */
                                 mod_timer(&ehci_to_hcd(ehci)->rh_timer,
                                                 ehci->reset_done[wIndex]);
@@ -862,6 +867,7 @@ static int ehci_hub_control (
                                 clear_bit(wIndex, &ehci->suspended_ports);
                                 set_bit(wIndex, &ehci->port_c_suspend);
                                 ehci->reset_done[wIndex] = 0;
+                                usb_hcd_end_port_resume(&hcd->self, wIndex);
 
                                 /* stop resume signaling */
                                 temp = ehci_readl(ehci, status_reg);
@@ -950,6 +956,7 @@ static int ehci_hub_control (
                         ehci->reset_done[wIndex] = 0;
                         if (temp & PORT_PE)
                                 set_bit(wIndex, &ehci->port_c_suspend);
+                        usb_hcd_end_port_resume(&hcd->self, wIndex);
                 }
 
                 if (temp & PORT_OC)
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 3d989028c836..fd252f0cfb3a 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1197,17 +1197,26 @@ static void start_iaa_cycle(struct ehci_hcd *ehci, bool nested)
         if (ehci->async_iaa || ehci->async_unlinking)
                 return;
 
-        /* Do all the waiting QHs at once */
-        ehci->async_iaa = ehci->async_unlink;
-        ehci->async_unlink = NULL;
-
         /* If the controller isn't running, we don't have to wait for it */
         if (unlikely(ehci->rh_state < EHCI_RH_RUNNING)) {
+
+                /* Do all the waiting QHs */
+                ehci->async_iaa = ehci->async_unlink;
+                ehci->async_unlink = NULL;
+
                 if (!nested)            /* Avoid recursion */
                         end_unlink_async(ehci);
 
         /* Otherwise start a new IAA cycle */
         } else if (likely(ehci->rh_state == EHCI_RH_RUNNING)) {
+                struct ehci_qh          *qh;
+
+                /* Do only the first waiting QH (nVidia bug?) */
+                qh = ehci->async_unlink;
+                ehci->async_iaa = qh;
+                ehci->async_unlink = qh->unlink_next;
+                qh->unlink_next = NULL;
+
                 /* Make sure the unlinks are all visible to the hardware */
                 wmb();
 
@@ -1255,34 +1264,35 @@ static void end_unlink_async(struct ehci_hcd *ehci)
         }
 }
 
+static void start_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
+
 static void unlink_empty_async(struct ehci_hcd *ehci)
 {
-        struct ehci_qh          *qh, *next;
-        bool                    stopped = (ehci->rh_state < EHCI_RH_RUNNING);
+        struct ehci_qh          *qh;
+        struct ehci_qh          *qh_to_unlink = NULL;
         bool                    check_unlinks_later = false;
+        int                     count = 0;
 
-        /* Unlink all the async QHs that have been empty for a timer cycle */
-        next = ehci->async->qh_next.qh;
-        while (next) {
-                qh = next;
-                next = qh->qh_next.qh;
-
+        /* Find the last async QH which has been empty for a timer cycle */
+        for (qh = ehci->async->qh_next.qh; qh; qh = qh->qh_next.qh) {
                 if (list_empty(&qh->qtd_list) &&
                                 qh->qh_state == QH_STATE_LINKED) {
-                        if (!stopped && qh->unlink_cycle ==
-                                        ehci->async_unlink_cycle)
+                        ++count;
+                        if (qh->unlink_cycle == ehci->async_unlink_cycle)
                                 check_unlinks_later = true;
                         else
-                                single_unlink_async(ehci, qh);
+                                qh_to_unlink = qh;
                 }
         }
 
-        /* Start a new IAA cycle if any QHs are waiting for it */
-        if (ehci->async_unlink)
-                start_iaa_cycle(ehci, false);
+        /* If nothing else is being unlinked, unlink the last empty QH */
+        if (!ehci->async_iaa && !ehci->async_unlink && qh_to_unlink) {
+                start_unlink_async(ehci, qh_to_unlink);
+                --count;
+        }
 
-        /* QHs that haven't been empty for long enough will be handled later */
-        if (check_unlinks_later) {
+        /* Other QHs will be handled later */
+        if (count > 0) {
                 ehci_enable_event(ehci, EHCI_HRTIMER_ASYNC_UNLINKS, true);
                 ++ehci->async_unlink_cycle;
         }
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 69ebee73c0c1..b476daf49f6f 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -213,7 +213,7 @@ static inline unsigned char tt_start_uframe(struct ehci_hcd *ehci, __hc32 mask)
 }
 
 static const unsigned char
-max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 125, 25 };
 
 /* carryover low/fullspeed bandwidth that crosses uframe boundries */
 static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
@@ -2212,11 +2212,11 @@ static void scan_isoc(struct ehci_hcd *ehci)
         }
         ehci->now_frame = now_frame;
 
+        frame = ehci->last_iso_frame;
         for (;;) {
                 union ehci_shadow       q, *q_p;
                 __hc32                  type, *hw_p;
 
-                frame = ehci->last_iso_frame;
 restart:
                 /* scan each element in frame's queue for completions */
                 q_p = &ehci->pshadow [frame];
@@ -2321,6 +2321,9 @@ restart:
                 /* Stop when we have reached the current frame */
                 if (frame == now_frame)
                         break;
-                ehci->last_iso_frame = (frame + 1) & fmask;
+
+                /* The last frame may still have active siTDs */
+                ehci->last_iso_frame = frame;
+                frame = (frame + 1) & fmask;
         }
 }
diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
index 20dbdcbe9b0f..f904071d70df 100644
--- a/drivers/usb/host/ehci-timer.c
+++ b/drivers/usb/host/ehci-timer.c
@@ -113,14 +113,15 @@ static void ehci_poll_ASS(struct ehci_hcd *ehci)
 
         if (want != actual) {
 
-                /* Poll again later, but give up after about 20 ms */
-                if (ehci->ASS_poll_count++ < 20) {
-                        ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
-                        return;
-                }
-                ehci_dbg(ehci, "Waited too long for the async schedule status (%x/%x), giving up\n",
-                                want, actual);
+                /* Poll again later */
+                ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
+                ++ehci->ASS_poll_count;
+                return;
         }
+
+        if (ehci->ASS_poll_count > 20)
+                ehci_dbg(ehci, "ASS poll count reached %d\n",
+                                ehci->ASS_poll_count);
         ehci->ASS_poll_count = 0;
 
         /* The status is up-to-date; restart or stop the schedule as needed */
@@ -159,14 +160,14 @@ static void ehci_poll_PSS(struct ehci_hcd *ehci)
 
         if (want != actual) {
 
-                /* Poll again later, but give up after about 20 ms */
-                if (ehci->PSS_poll_count++ < 20) {
-                        ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
-                        return;
-                }
-                ehci_dbg(ehci, "Waited too long for the periodic schedule status (%x/%x), giving up\n",
-                                want, actual);
+                /* Poll again later */
+                ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
+                return;
         }
+
+        if (ehci->PSS_poll_count > 20)
+                ehci_dbg(ehci, "PSS poll count reached %d\n",
+                                ehci->PSS_poll_count);
         ehci->PSS_poll_count = 0;
 
         /* The status is up-to-date; restart or stop the schedule as needed */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a3b6d7104ae2..4c338ec03a07 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -780,6 +780,7 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
                                 "defaulting to EHCI.\n");
                 dev_warn(&xhci_pdev->dev,
                                 "USB 3.0 devices will work at USB 2.0 speeds.\n");
+                usb_disable_xhci_ports(xhci_pdev);
                 return;
         }
 
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 768d54295a20..15d13229ddbb 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -116,6 +116,7 @@ static void uhci_finish_suspend(struct uhci_hcd *uhci, int port,
                 }
         }
         clear_bit(port, &uhci->resuming_ports);
+        usb_hcd_end_port_resume(&uhci_to_hcd(uhci)->self, port);
 }
 
 /* Wait for the UHCI controller in HP's iLO2 server management chip.
@@ -167,6 +168,8 @@ static void uhci_check_ports(struct uhci_hcd *uhci)
                                 set_bit(port, &uhci->resuming_ports);
                                 uhci->ports_timeout = jiffies +
                                                 msecs_to_jiffies(25);
+                                usb_hcd_start_port_resume(
+                                                &uhci_to_hcd(uhci)->self, port);
 
                                 /* Make sure we see the port again
                                  * after the resuming period is over. */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 59fb5c677dbe..7f76a49e90d3 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1698,7 +1698,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
                                 faked_port_index + 1);
                 if (slot_id && xhci->devs[slot_id])
                         xhci_ring_device(xhci, slot_id);
-                if (bus_state->port_remote_wakeup && (1 << faked_port_index)) {
+                if (bus_state->port_remote_wakeup & (1 << faked_port_index)) {
                         bus_state->port_remote_wakeup &=
                                 ~(1 << faked_port_index);
                         xhci_test_and_clear_bit(xhci, port_array,
@@ -2589,6 +2589,8 @@ cleanup:
                                 (trb_comp_code != COMP_STALL &&
                                         trb_comp_code != COMP_BABBLE))
                                 xhci_urb_free_priv(xhci, urb_priv);
+                        else
+                                kfree(urb_priv);
 
                         usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
                         if ((urb->actual_length != urb->transfer_buffer_length &&
@@ -3108,7 +3110,7 @@ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
          * running_total.
          */
         packets_transferred = (running_total + trb_buff_len) /
-                usb_endpoint_maxp(&urb->ep->desc);
+                GET_MAX_PACKET(usb_endpoint_maxp(&urb->ep->desc));
 
         if ((total_packet_count - packets_transferred) > 31)
                 return 31 << 17;
@@ -3642,7 +3644,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 td_len = urb->iso_frame_desc[i].length;
                 td_remain_len = td_len;
                 total_packet_count = DIV_ROUND_UP(td_len,
-                                usb_endpoint_maxp(&urb->ep->desc));
+                                GET_MAX_PACKET(
+                                        usb_endpoint_maxp(&urb->ep->desc)));
                 /* A zero-length transfer still involves at least one packet. */
                 if (total_packet_count == 0)
                         total_packet_count++;
@@ -3664,9 +3667,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 td = urb_priv->td[i];
                 for (j = 0; j < trbs_per_td; j++) {
                         u32 remainder = 0;
-                        field = TRB_TBC(burst_count) | TRB_TLBPC(residue);
+                        field = 0;
 
                         if (first_trb) {
+                                field = TRB_TBC(burst_count) |
+                                        TRB_TLBPC(residue);
                                 /* Queue the isoc TRB */
                                 field |= TRB_TYPE(TRB_ISOC);
                                 /* Assume URB_ISO_ASAP is set */
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f14736f647ff..edc0f0dcad83 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
         { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
         { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
+        { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
         { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
         { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
         { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ba68835d06a6..90ceef1776c3 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -584,6 +584,7 @@ static struct usb_device_id id_table_combined [] = {
         /*
          * ELV devices:
          */
+        { USB_DEVICE(FTDI_ELV_VID, FTDI_ELV_WS300_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_USR_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_MSM1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_KL100_PID) },
@@ -670,6 +671,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
         { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MHAM_KW_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index fa5d56038276..9d359e189a64 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -147,6 +147,11 @@
 #define XSENS_CONVERTER_6_PID   0xD38E
 #define XSENS_CONVERTER_7_PID   0xD38F
 
+/**
+ * Zolix (www.zolix.com.cb) product ids
+ */
+#define FTDI_OMNI1509                   0xD491  /* Omni1509 embedded USB-serial */
+
 /*
  * NDI (www.ndigital.com) product ids
  */
@@ -204,7 +209,7 @@
 
 /*
  * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
- * All of these devices use FTDI's vendor ID (0x0403).
+ * Almost all of these devices use FTDI's vendor ID (0x0403).
  * Further IDs taken from ELV Windows .inf file.
  *
  * The previously included PID for the UO 100 module was incorrect.
@@ -212,6 +217,8 @@
  *
  * Armin Laeuger originally sent the PID for the UM 100 module.
  */
+#define FTDI_ELV_VID    0x1B1F  /* ELV AG */
+#define FTDI_ELV_WS300_PID      0xC006  /* eQ3 WS 300 PC II */
 #define FTDI_ELV_USR_PID        0xE000  /* ELV Universal-Sound-Recorder */
 #define FTDI_ELV_MSM1_PID       0xE001  /* ELV Mini-Sound-Modul */
 #define FTDI_ELV_KL100_PID      0xE002  /* ELV Kfz-Leistungsmesser KL 100 */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 0d9dac9e7f93..567bc77d6397 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -242,6 +242,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_CC864_DUAL                0x1005
 #define TELIT_PRODUCT_CC864_SINGLE              0x1006
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
+#define TELIT_PRODUCT_LE920                     0x1200
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -453,6 +454,10 @@ static void option_instat_callback(struct urb *urb);
 #define TPLINK_VENDOR_ID                        0x2357
 #define TPLINK_PRODUCT_MA180                    0x0201
 
+/* Changhong products */
+#define CHANGHONG_VENDOR_ID                     0x2077
+#define CHANGHONG_PRODUCT_CH690                 0x7001
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -534,6 +539,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
         .reserved = BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info telit_le920_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(5),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -784,6 +794,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+                .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -1318,6 +1330,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
         { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index aa148c21ea40..24662547dc5b 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -53,6 +53,7 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_G1K(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
         {DEVICE_G1K(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
         {DEVICE_G1K(0x1f45, 0x0001)},   /* Unknown Gobi QDL device */
+        {DEVICE_G1K(0x1bc7, 0x900e)},   /* Telit Gobi QDL device */
 
         /* Gobi 2000 devices */
         {USB_DEVICE(0x1410, 0xa010)},   /* Novatel Gobi 2000 QDL device */
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 105d900150c1..16b0bf055eeb 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -92,8 +92,8 @@ int usb_stor_ucr61s2b_init(struct us_data *us)
         return 0;
 }
 
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us)
+/* This places the HUAWEI usb dongles in multi-port mode */
+static int usb_stor_huawei_feature_init(struct us_data *us)
 {
         int result;
 
@@ -104,3 +104,75 @@ int usb_stor_huawei_e220_init(struct us_data *us)
         US_DEBUGP("Huawei mode set result is %d\n", result);
         return 0;
 }
+
+/*
+ * It will send a scsi switch command called rewind' to huawei dongle.
+ * When the dongle receives this command at the first time,
+ * it will reboot immediately. After rebooted, it will ignore this command.
+ * So it is  unnecessary to read its response.
+ */
+static int usb_stor_huawei_scsi_init(struct us_data *us)
+{
+        int result = 0;
+        int act_len = 0;
+        struct bulk_cb_wrap *bcbw = (struct bulk_cb_wrap *) us->iobuf;
+        char rewind_cmd[] = {0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 0x01, 0x00,
+                        0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+        bcbw->Signature = cpu_to_le32(US_BULK_CB_SIGN);
+        bcbw->Tag = 0;
+        bcbw->DataTransferLength = 0;
+        bcbw->Flags = bcbw->Lun = 0;
+        bcbw->Length = sizeof(rewind_cmd);
+        memset(bcbw->CDB, 0, sizeof(bcbw->CDB));
+        memcpy(bcbw->CDB, rewind_cmd, sizeof(rewind_cmd));
+
+        result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcbw,
+                                        US_BULK_CB_WRAP_LEN, &act_len);
+        US_DEBUGP("transfer actual length=%d, result=%d\n", act_len, result);
+        return result;
+}
+
+/*
+ * It tries to find the supported Huawei USB dongles.
+ * In Huawei, they assign the following product IDs
+ * for all of their mobile broadband dongles,
+ * including the new dongles in the future.
+ * So if the product ID is not included in this list,
+ * it means it is not Huawei's mobile broadband dongles.
+ */
+static int usb_stor_huawei_dongles_pid(struct us_data *us)
+{
+        struct usb_interface_descriptor *idesc;
+        int idProduct;
+
+        idesc = &us->pusb_intf->cur_altsetting->desc;
+        idProduct = us->pusb_dev->descriptor.idProduct;
+        /* The first port is CDROM,
+         * means the dongle in the single port mode,
+         * and a switch command is required to be sent. */
+        if (idesc && idesc->bInterfaceNumber == 0) {
+                if ((idProduct == 0x1001)
+                        || (idProduct == 0x1003)
+                        || (idProduct == 0x1004)
+                        || (idProduct >= 0x1401 && idProduct <= 0x1500)
+                        || (idProduct >= 0x1505 && idProduct <= 0x1600)
+                        || (idProduct >= 0x1c02 && idProduct <= 0x2202)) {
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+int usb_stor_huawei_init(struct us_data *us)
+{
+        int result = 0;
+
+        if (usb_stor_huawei_dongles_pid(us)) {
+                if (us->pusb_dev->descriptor.idProduct >= 0x1446)
+                        result = usb_stor_huawei_scsi_init(us);
+                else
+                        result = usb_stor_huawei_feature_init(us);
+        }
+        return result;
+}
diff --git a/drivers/usb/storage/initializers.h b/drivers/usb/storage/initializers.h
index 529327fbb06b..5376d4fc76f0 100644
--- a/drivers/usb/storage/initializers.h
+++ b/drivers/usb/storage/initializers.h
@@ -46,5 +46,5 @@ int usb_stor_euscsi_init(struct us_data *us);
  * flash reader */
 int usb_stor_ucr61s2b_init(struct us_data *us);
 
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us);
+/* This places the HUAWEI usb dongles in multi-port mode */
+int usb_stor_huawei_init(struct us_data *us);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index d305a5aa3a5d..72923b56bbf6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1527,335 +1527,10 @@ UNUSUAL_DEV(  0x1210, 0x0003, 0x0100, 0x0100,
 /* Reported by fangxiaozhi <huananhu@huawei.com>
  * This brings the HUAWEI data card devices into multi-port mode
  */
-UNUSUAL_DEV(  0x12d1, 0x1001, 0x0000, 0x0000,
+UNUSUAL_VENDOR_INTF(0x12d1, 0x08, 0x06, 0x50,
                 "HUAWEI MOBILE",
                 "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1003, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1004, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1401, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1402, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1403, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1404, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1405, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1406, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1407, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1408, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1409, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1410, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1411, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1412, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1413, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1414, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1415, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1416, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1417, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1418, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1419, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1420, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1421, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1422, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1423, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1424, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1425, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1426, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1427, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1428, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1429, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1430, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1431, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1432, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1433, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1434, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1435, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1436, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1437, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1438, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1439, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_init,
                 0),
 
 /* Reported by Vilius Bilinkevicius <vilisas AT xxx DOT lt) */
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 31b3e1a61bbd..cf09b6ba71ff 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -120,6 +120,17 @@ MODULE_PARM_DESC(quirks, "supplemental list of device IDs and their quirks");
         .useTransport = use_transport,  \
 }
 
+#define UNUSUAL_VENDOR_INTF(idVendor, cl, sc, pr, \
+                vendor_name, product_name, use_protocol, use_transport, \
+                init_function, Flags) \
+{ \
+        .vendorName = vendor_name,      \
+        .productName = product_name,    \
+        .useProtocol = use_protocol,    \
+        .useTransport = use_transport,  \
+        .initFunction = init_function,  \
+}
+
 static struct us_unusual_dev us_unusual_dev_list[] = {
 #       include "unusual_devs.h"
         { }             /* Terminating entry */
@@ -131,6 +142,7 @@ static struct us_unusual_dev for_dynamic_ids =
 #undef UNUSUAL_DEV
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
 
 #ifdef CONFIG_LOCKDEP
 
diff --git a/drivers/usb/storage/usual-tables.c b/drivers/usb/storage/usual-tables.c
index b78a526910fb..5ef8ce74aae4 100644
--- a/drivers/usb/storage/usual-tables.c
+++ b/drivers/usb/storage/usual-tables.c
@@ -41,6 +41,20 @@
 #define USUAL_DEV(useProto, useTrans) \
 { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans) }
 
+/* Define the device is matched with Vendor ID and interface descriptors */
+#define UNUSUAL_VENDOR_INTF(id_vendor, cl, sc, pr, \
+                        vendorName, productName, useProtocol, useTransport, \
+                        initFunction, flags) \
+{ \
+        .match_flags = USB_DEVICE_ID_MATCH_INT_INFO \
+                                | USB_DEVICE_ID_MATCH_VENDOR, \
+        .idVendor    = (id_vendor), \
+        .bInterfaceClass = (cl), \
+        .bInterfaceSubClass = (sc), \
+        .bInterfaceProtocol = (pr), \
+        .driver_info = (flags) \
+}
+
 struct usb_device_id usb_storage_usb_ids[] = {
 #       include "unusual_devs.h"
         { }             /* Terminating entry */
@@ -50,6 +64,7 @@ MODULE_DEVICE_TABLE(usb, usb_storage_usb_ids);
 #undef UNUSUAL_DEV
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
 
 /*
  * The table of devices to ignore
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ebd08b21b234..959b1cd89e6a 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -165,12 +165,16 @@ static void tx_poll_stop(struct vhost_net *net)
 }
 
 /* Caller must have TX VQ lock */
-static void tx_poll_start(struct vhost_net *net, struct socket *sock)
+static int tx_poll_start(struct vhost_net *net, struct socket *sock)
 {
+        int ret;
+
         if (unlikely(net->tx_poll_state != VHOST_NET_POLL_STOPPED))
-                return;
-        vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
-        net->tx_poll_state = VHOST_NET_POLL_STARTED;
+                return 0;
+        ret = vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
+        if (!ret)
+                net->tx_poll_state = VHOST_NET_POLL_STARTED;
+        return ret;
 }
 
 /* In case of DMA done not in order in lower device driver for some reason.
@@ -642,20 +646,23 @@ static void vhost_net_disable_vq(struct vhost_net *n,
                 vhost_poll_stop(n->poll + VHOST_NET_VQ_RX);
 }
 
-static void vhost_net_enable_vq(struct vhost_net *n,
+static int vhost_net_enable_vq(struct vhost_net *n,
                                 struct vhost_virtqueue *vq)
 {
         struct socket *sock;
+        int ret;
 
         sock = rcu_dereference_protected(vq->private_data,
                                          lockdep_is_held(&vq->mutex));
         if (!sock)
-                return;
+                return 0;
         if (vq == n->vqs + VHOST_NET_VQ_TX) {
                 n->tx_poll_state = VHOST_NET_POLL_STOPPED;
-                tx_poll_start(n, sock);
+                ret = tx_poll_start(n, sock);
         } else
-                vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
+                ret = vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
+
+        return ret;
 }
 
 static struct socket *vhost_net_stop_vq(struct vhost_net *n,
@@ -827,15 +834,18 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
                         r = PTR_ERR(ubufs);
                         goto err_ubufs;
                 }
-                oldubufs = vq->ubufs;
-                vq->ubufs = ubufs;
+
                 vhost_net_disable_vq(n, vq);
                 rcu_assign_pointer(vq->private_data, sock);
-                vhost_net_enable_vq(n, vq);
-
                 r = vhost_init_used(vq);
                 if (r)
-                        goto err_vq;
+                        goto err_used;
+                r = vhost_net_enable_vq(n, vq);
+                if (r)
+                        goto err_used;
+
+                oldubufs = vq->ubufs;
+                vq->ubufs = ubufs;
 
                 n->tx_packets = 0;
                 n->tx_zcopy_err = 0;
@@ -859,6 +869,11 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         mutex_unlock(&n->dev.mutex);
         return 0;
 
+err_used:
+        rcu_assign_pointer(vq->private_data, oldsock);
+        vhost_net_enable_vq(n, vq);
+        if (ubufs)
+                vhost_ubuf_put_and_wait(ubufs);
 err_ubufs:
         fput(sock->file);
 err_vq:
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index b20df5c829f5..22321cf84fbe 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -575,10 +575,8 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs)
 
         /* Must use ioctl VHOST_SCSI_SET_ENDPOINT */
         tv_tpg = vs->vs_tpg;
-        if (unlikely(!tv_tpg)) {
-                pr_err("%s endpoint not set\n", __func__);
+        if (unlikely(!tv_tpg))
                 return;
-        }
 
         mutex_lock(&vq->mutex);
         vhost_disable_notify(&vs->dev, vq);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 34389f75fe65..9759249e6d90 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -77,26 +77,38 @@ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
         init_poll_funcptr(&poll->table, vhost_poll_func);
         poll->mask = mask;
         poll->dev = dev;
+        poll->wqh = NULL;
 
         vhost_work_init(&poll->work, fn);
 }
 
 /* Start polling a file. We add ourselves to file's wait queue. The caller must
  * keep a reference to a file until after vhost_poll_stop is called. */
-void vhost_poll_start(struct vhost_poll *poll, struct file *file)
+int vhost_poll_start(struct vhost_poll *poll, struct file *file)
 {
         unsigned long mask;
+        int ret = 0;
 
         mask = file->f_op->poll(file, &poll->table);
         if (mask)
                 vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
+        if (mask & POLLERR) {
+                if (poll->wqh)
+                        remove_wait_queue(poll->wqh, &poll->wait);
+                ret = -EINVAL;
+        }
+
+        return ret;
 }
 
 /* Stop polling a file. After this function returns, it becomes safe to drop the
  * file reference. You must also flush afterwards. */
 void vhost_poll_stop(struct vhost_poll *poll)
 {
-        remove_wait_queue(poll->wqh, &poll->wait);
+        if (poll->wqh) {
+                remove_wait_queue(poll->wqh, &poll->wait);
+                poll->wqh = NULL;
+        }
 }
 
 static bool vhost_work_seq_done(struct vhost_dev *dev, struct vhost_work *work,
@@ -792,7 +804,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                 fput(filep);
 
         if (pollstart && vq->handle_kick)
-                vhost_poll_start(&vq->poll, vq->kick);
+                r = vhost_poll_start(&vq->poll, vq->kick);
 
         mutex_unlock(&vq->mutex);
 
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 2639c58b23ab..17261e277c02 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -42,7 +42,7 @@ void vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work);
 
 void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
                      unsigned long mask, struct vhost_dev *dev);
-void vhost_poll_start(struct vhost_poll *poll, struct file *file);
+int vhost_poll_start(struct vhost_poll *poll, struct file *file);
 void vhost_poll_stop(struct vhost_poll *poll);
 void vhost_poll_flush(struct vhost_poll *poll);
 void vhost_poll_queue(struct vhost_poll *poll);
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 0be4df39e953..74d77dfa5f63 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -840,7 +840,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
 
         if (irq == -1) {
                 irq = xen_allocate_irq_dynamic();
-                if (irq == -1)
+                if (irq < 0)
                         goto out;
 
                 irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
@@ -944,7 +944,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
 
         if (irq == -1) {
                 irq = xen_allocate_irq_dynamic();
-                if (irq == -1)
+                if (irq < 0)
                         goto out;
 
                 irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 97f5d264c31e..37c1f825f513 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -135,7 +135,6 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
                          struct pci_dev *dev, struct xen_pci_op *op)
 {
         struct xen_pcibk_dev_data *dev_data;
-        int otherend = pdev->xdev->otherend_id;
         int status;
 
         if (unlikely(verbose_request))
@@ -144,8 +143,9 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
         status = pci_enable_msi(dev);
 
         if (status) {
-                printk(KERN_ERR "error enable msi for guest %x status %x\n",
-                        otherend, status);
+                pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI for guest %u: err %d\n",
+                                    pci_name(dev), pdev->xdev->otherend_id,
+                                    status);
                 op->value = 0;
                 return XEN_PCI_ERR_op_failed;
         }
@@ -223,10 +223,10 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
                                                 pci_name(dev), i,
                                                 op->msix_entries[i].vector);
                 }
-        } else {
-                printk(KERN_WARNING DRV_NAME ": %s: failed to enable MSI-X: err %d!\n",
-                        pci_name(dev), result);
-        }
+        } else
+                pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI-X for guest %u: err %d!\n",
+                                    pci_name(dev), pdev->xdev->otherend_id,
+                                    result);
         kfree(entries);
 
         op->value = result;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index a8b8adc05070..5a3327b8f90d 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4534,7 +4534,7 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
         unsigned nr_extents = 0;
         int extra_reserve = 0;
         enum btrfs_reserve_flush_enum flush = BTRFS_RESERVE_FLUSH_ALL;
-        int ret;
+        int ret = 0;
         bool delalloc_lock = true;
 
         /* If we are a free space inode we need to not flush since we will be in
@@ -4579,20 +4579,18 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
         csum_bytes = BTRFS_I(inode)->csum_bytes;
         spin_unlock(&BTRFS_I(inode)->lock);
 
-        if (root->fs_info->quota_enabled) {
+        if (root->fs_info->quota_enabled)
                 ret = btrfs_qgroup_reserve(root, num_bytes +
                                            nr_extents * root->leafsize);
-                if (ret) {
-                        spin_lock(&BTRFS_I(inode)->lock);
-                        calc_csum_metadata_size(inode, num_bytes, 0);
-                        spin_unlock(&BTRFS_I(inode)->lock);
-                        if (delalloc_lock)
-                                mutex_unlock(&BTRFS_I(inode)->delalloc_mutex);
-                        return ret;
-                }
-        }
 
-        ret = reserve_metadata_bytes(root, block_rsv, to_reserve, flush);
+        /*
+         * ret != 0 here means the qgroup reservation failed, we go straight to
+         * the shared error handling then.
+         */
+        if (ret == 0)
+                ret = reserve_metadata_bytes(root, block_rsv,
+                                             to_reserve, flush);
+
         if (ret) {
                 u64 to_free = 0;
                 unsigned dropped;
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 2e8cae63d247..fdb7a8db3b57 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -288,7 +288,8 @@ out:
 void clear_em_logging(struct extent_map_tree *tree, struct extent_map *em)
 {
         clear_bit(EXTENT_FLAG_LOGGING, &em->flags);
-        try_merge_map(tree, em);
+        if (em->in_tree)
+                try_merge_map(tree, em);
 }
 
 /**
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index f76b1fd160d4..aeb84469d2c4 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -293,15 +293,24 @@ static int __btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
         struct btrfs_key key;
         struct btrfs_ioctl_defrag_range_args range;
         int num_defrag;
+        int index;
+        int ret;
 
         /* get the inode */
         key.objectid = defrag->root;
         btrfs_set_key_type(&key, BTRFS_ROOT_ITEM_KEY);
         key.offset = (u64)-1;
+
+        index = srcu_read_lock(&fs_info->subvol_srcu);
+
         inode_root = btrfs_read_fs_root_no_name(fs_info, &key);
         if (IS_ERR(inode_root)) {
-                kmem_cache_free(btrfs_inode_defrag_cachep, defrag);
-                return PTR_ERR(inode_root);
+                ret = PTR_ERR(inode_root);
+                goto cleanup;
+        }
+        if (btrfs_root_refs(&inode_root->root_item) == 0) {
+                ret = -ENOENT;
+                goto cleanup;
         }
 
         key.objectid = defrag->ino;
@@ -309,9 +318,10 @@ static int __btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
         key.offset = 0;
         inode = btrfs_iget(fs_info->sb, &key, inode_root, NULL);
         if (IS_ERR(inode)) {
-                kmem_cache_free(btrfs_inode_defrag_cachep, defrag);
-                return PTR_ERR(inode);
+                ret = PTR_ERR(inode);
+                goto cleanup;
         }
+        srcu_read_unlock(&fs_info->subvol_srcu, index);
 
         /* do a chunk of defrag */
         clear_bit(BTRFS_INODE_IN_DEFRAG, &BTRFS_I(inode)->runtime_flags);
@@ -346,6 +356,10 @@ static int __btrfs_run_defrag_inode(struct btrfs_fs_info *fs_info,
 
         iput(inode);
         return 0;
+cleanup:
+        srcu_read_unlock(&fs_info->subvol_srcu, index);
+        kmem_cache_free(btrfs_inode_defrag_cachep, defrag);
+        return ret;
 }
 
 /*
@@ -1594,9 +1608,10 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
                 if (err < 0 && num_written > 0)
                         num_written = err;
         }
-out:
+
         if (sync)
                 atomic_dec(&BTRFS_I(inode)->sync_writers);
+out:
         sb_end_write(inode->i_sb);
         current->backing_dev_info = NULL;
         return num_written ? num_written : err;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 5b22d45d3c6a..338f2597bf7f 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -515,7 +515,6 @@ static noinline int create_subvol(struct btrfs_root *root,
 
         BUG_ON(ret);
 
-        d_instantiate(dentry, btrfs_lookup_dentry(dir, dentry));
 fail:
         if (async_transid) {
                 *async_transid = trans->transid;
@@ -525,6 +524,10 @@ fail:
         }
         if (err && !ret)
                 ret = err;
+
+        if (!ret)
+                d_instantiate(dentry, btrfs_lookup_dentry(dir, dentry));
+
         return ret;
 }
 
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index f10731297040..e5ed56729607 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -836,9 +836,16 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
          * if the disk i_size is already at the inode->i_size, or
          * this ordered extent is inside the disk i_size, we're done
          */
-        if (disk_i_size == i_size || offset <= disk_i_size) {
+        if (disk_i_size == i_size)
+                goto out;
+
+        /*
+         * We still need to update disk_i_size if outstanding_isize is greater
+         * than disk_i_size.
+         */
+        if (offset <= disk_i_size &&
+            (!ordered || ordered->outstanding_isize <= disk_i_size))
                 goto out;
-        }
 
         /*
          * walk backward from this ordered extent to disk_i_size.
@@ -870,7 +877,7 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
                         break;
                 if (test->file_offset >= i_size)
                         break;
-                if (test->file_offset >= disk_i_size) {
+                if (entry_end(test) > disk_i_size) {
                         /*
                          * we don't update disk_i_size now, so record this
                          * undealt i_size. Or we will not know the real
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index bdbb94f245c9..67783e03d121 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -580,20 +580,29 @@ static int scrub_fixup_readpage(u64 inum, u64 offset, u64 root, void *fixup_ctx)
         int corrected = 0;
         struct btrfs_key key;
         struct inode *inode = NULL;
+        struct btrfs_fs_info *fs_info;
         u64 end = offset + PAGE_SIZE - 1;
         struct btrfs_root *local_root;
+        int srcu_index;
 
         key.objectid = root;
         key.type = BTRFS_ROOT_ITEM_KEY;
         key.offset = (u64)-1;
-        local_root = btrfs_read_fs_root_no_name(fixup->root->fs_info, &key);
-        if (IS_ERR(local_root))
+
+        fs_info = fixup->root->fs_info;
+        srcu_index = srcu_read_lock(&fs_info->subvol_srcu);
+
+        local_root = btrfs_read_fs_root_no_name(fs_info, &key);
+        if (IS_ERR(local_root)) {
+                srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
                 return PTR_ERR(local_root);
+        }
 
         key.type = BTRFS_INODE_ITEM_KEY;
         key.objectid = inum;
         key.offset = 0;
-        inode = btrfs_iget(fixup->root->fs_info->sb, &key, local_root, NULL);
+        inode = btrfs_iget(fs_info->sb, &key, local_root, NULL);
+        srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
         if (IS_ERR(inode))
                 return PTR_ERR(inode);
 
@@ -606,7 +615,6 @@ static int scrub_fixup_readpage(u64 inum, u64 offset, u64 root, void *fixup_ctx)
         }
 
         if (PageUptodate(page)) {
-                struct btrfs_fs_info *fs_info;
                 if (PageDirty(page)) {
                         /*
                          * we need to write the data to the defect sector. the
@@ -3180,18 +3188,25 @@ static int copy_nocow_pages_for_inode(u64 inum, u64 offset, u64 root, void *ctx)
         u64 physical_for_dev_replace;
         u64 len;
         struct btrfs_fs_info *fs_info = nocow_ctx->sctx->dev_root->fs_info;
+        int srcu_index;
 
         key.objectid = root;
         key.type = BTRFS_ROOT_ITEM_KEY;
         key.offset = (u64)-1;
+
+        srcu_index = srcu_read_lock(&fs_info->subvol_srcu);
+
         local_root = btrfs_read_fs_root_no_name(fs_info, &key);
-        if (IS_ERR(local_root))
+        if (IS_ERR(local_root)) {
+                srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
                 return PTR_ERR(local_root);
+        }
 
         key.type = BTRFS_INODE_ITEM_KEY;
         key.objectid = inum;
         key.offset = 0;
         inode = btrfs_iget(fs_info->sb, &key, local_root, NULL);
+        srcu_read_unlock(&fs_info->subvol_srcu, srcu_index);
         if (IS_ERR(inode))
                 return PTR_ERR(inode);
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index f15494699f3b..fc03aa60b684 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -333,12 +333,14 @@ start_transaction(struct btrfs_root *root, u64 num_items, int type,
                                           &root->fs_info->trans_block_rsv,
                                           num_bytes, flush);
                 if (ret)
-                        return ERR_PTR(ret);
+                        goto reserve_fail;
         }
 again:
         h = kmem_cache_alloc(btrfs_trans_handle_cachep, GFP_NOFS);
-        if (!h)
-                return ERR_PTR(-ENOMEM);
+        if (!h) {
+                ret = -ENOMEM;
+                goto alloc_fail;
+        }
 
         /*
          * If we are JOIN_NOLOCK we're already committing a transaction and
@@ -365,11 +367,7 @@ again:
         if (ret < 0) {
                 /* We must get the transaction if we are JOIN_NOLOCK. */
                 BUG_ON(type == TRANS_JOIN_NOLOCK);
-
-                if (type < TRANS_JOIN_NOLOCK)
-                        sb_end_intwrite(root->fs_info->sb);
-                kmem_cache_free(btrfs_trans_handle_cachep, h);
-                return ERR_PTR(ret);
+                goto join_fail;
         }
 
         cur_trans = root->fs_info->running_transaction;
@@ -410,6 +408,19 @@ got_it:
         if (!current->journal_info && type != TRANS_USERSPACE)
                 current->journal_info = h;
         return h;
+
+join_fail:
+        if (type < TRANS_JOIN_NOLOCK)
+                sb_end_intwrite(root->fs_info->sb);
+        kmem_cache_free(btrfs_trans_handle_cachep, h);
+alloc_fail:
+        if (num_bytes)
+                btrfs_block_rsv_release(root, &root->fs_info->trans_block_rsv,
+                                        num_bytes);
+reserve_fail:
+        if (qgroup_reserved)
+                btrfs_qgroup_free(root, qgroup_reserved);
+        return ERR_PTR(ret);
 }
 
 struct btrfs_trans_handle *btrfs_start_transaction(struct btrfs_root *root,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 15f6efdf6463..5cbb7f4b1672 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1556,7 +1556,8 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         ret = 0;
 
         /* Notify udev that device has changed */
-        btrfs_kobject_uevent(bdev, KOBJ_CHANGE);
+        if (bdev)
+                btrfs_kobject_uevent(bdev, KOBJ_CHANGE);
 
 error_brelse:
         brelse(bh);
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 7ff49852b0cb..911649a47dd5 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -503,11 +503,11 @@ static ssize_t device_write(struct file *file, const char __user *buf,
 #endif
                 return -EINVAL;
 
-#ifdef CONFIG_COMPAT
-        if (count > sizeof(struct dlm_write_request32) + DLM_RESNAME_MAXLEN)
-#else
+        /*
+         * can't compare against COMPAT/dlm_write_request32 because
+         * we don't yet know if is64bit is zero
+         */
         if (count > sizeof(struct dlm_write_request) + DLM_RESNAME_MAXLEN)
-#endif
                 return -EINVAL;
 
         kbuf = kzalloc(count + 1, GFP_NOFS);
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index b906ed17a839..9802de0f85e6 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -281,6 +281,7 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 {
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+        int lvb_needs_unlock = 0;
         int error;
 
         if (gl->gl_lksb.sb_lkid == 0) {
@@ -294,8 +295,12 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
         gfs2_update_request_times(gl);
 
         /* don't want to skip dlm_unlock writing the lvb when lock is ex */
+
+        if (gl->gl_lksb.sb_lvbptr && (gl->gl_state == LM_ST_EXCLUSIVE))
+                lvb_needs_unlock = 1;
+
         if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
-            gl->gl_lksb.sb_lvbptr && (gl->gl_state != LM_ST_EXCLUSIVE)) {
+            !lvb_needs_unlock) {
                 gfs2_glock_free(gl);
                 return;
         }
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index dd057bc6b65b..fc8dc20fdeb9 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -177,11 +177,31 @@ out_nofree:
         return mnt;
 }
 
+static int
+nfs_namespace_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+{
+        if (NFS_FH(dentry->d_inode)->size != 0)
+                return nfs_getattr(mnt, dentry, stat);
+        generic_fillattr(dentry->d_inode, stat);
+        return 0;
+}
+
+static int
+nfs_namespace_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        if (NFS_FH(dentry->d_inode)->size != 0)
+                return nfs_setattr(dentry, attr);
+        return -EACCES;
+}
+
 const struct inode_operations nfs_mountpoint_inode_operations = {
         .getattr        = nfs_getattr,
+        .setattr        = nfs_setattr,
 };
 
 const struct inode_operations nfs_referral_inode_operations = {
+        .getattr        = nfs_namespace_getattr,
+        .setattr        = nfs_namespace_setattr,
 };
 
 static void nfs_expire_automounts(struct work_struct *work)
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index acc347268124..2e9779b58b7a 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -236,11 +236,10 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
         error = nfs4_discover_server_trunking(clp, &old);
         if (error < 0)
                 goto error;
+        nfs_put_client(clp);
         if (clp != old) {
                 clp->cl_preserve_clid = true;
-                nfs_put_client(clp);
                 clp = old;
-                atomic_inc(&clp->cl_count);
         }
 
         return clp;
@@ -306,7 +305,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
                 .clientid       = new->cl_clientid,
                 .confirm        = new->cl_confirm,
         };
-        int status;
+        int status = -NFS4ERR_STALE_CLIENTID;
 
         spin_lock(&nn->nfs_client_lock);
         list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
@@ -332,40 +331,33 @@ int nfs40_walk_client_list(struct nfs_client *new,
 
                 if (prev)
                         nfs_put_client(prev);
+                prev = pos;
 
                 status = nfs4_proc_setclientid_confirm(pos, &clid, cred);
-                if (status == 0) {
+                switch (status) {
+                case -NFS4ERR_STALE_CLIENTID:
+                        break;
+                case 0:
                         nfs4_swap_callback_idents(pos, new);
 
-                        nfs_put_client(pos);
+                        prev = NULL;
                         *result = pos;
                         dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
                                 __func__, pos, atomic_read(&pos->cl_count));
-                        return 0;
-                }
-                if (status != -NFS4ERR_STALE_CLIENTID) {
-                        nfs_put_client(pos);
-                        dprintk("NFS: <-- %s status = %d, no result\n",
-                                __func__, status);
-                        return status;
+                default:
+                        goto out;
                 }
 
                 spin_lock(&nn->nfs_client_lock);
-                prev = pos;
         }
+        spin_unlock(&nn->nfs_client_lock);
 
-        /*
-         * No matching nfs_client found.  This should be impossible,
-         * because the new nfs_client has already been added to
-         * nfs_client_list by nfs_get_client().
-         *
-         * Don't BUG(), since the caller is holding a mutex.
-         */
+        /* No match found. The server lost our clientid */
+out:
         if (prev)
                 nfs_put_client(prev);
-        spin_unlock(&nn->nfs_client_lock);
-        pr_err("NFS: %s Error: no matching nfs_client found\n", __func__);
-        return -NFS4ERR_STALE_CLIENTID;
+        dprintk("NFS: <-- %s status = %d\n", __func__, status);
+        return status;
 }
 
 #ifdef CONFIG_NFS_V4_1
@@ -432,7 +424,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
 {
         struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
         struct nfs_client *pos, *n, *prev = NULL;
-        int error;
+        int status = -NFS4ERR_STALE_CLIENTID;
 
         spin_lock(&nn->nfs_client_lock);
         list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
@@ -448,14 +440,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
                                 nfs_put_client(prev);
                         prev = pos;
 
-                        error = nfs_wait_client_init_complete(pos);
-                        if (error < 0) {
+                        nfs4_schedule_lease_recovery(pos);
+                        status = nfs_wait_client_init_complete(pos);
+                        if (status < 0) {
                                 nfs_put_client(pos);
                                 spin_lock(&nn->nfs_client_lock);
                                 continue;
                         }
-
+                        status = pos->cl_cons_state;
                         spin_lock(&nn->nfs_client_lock);
+                        if (status < 0)
+                                continue;
                 }
 
                 if (pos->rpc_ops != new->rpc_ops)
@@ -473,6 +468,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
                 if (!nfs4_match_serverowners(pos, new))
                         continue;
 
+                atomic_inc(&pos->cl_count);
                 spin_unlock(&nn->nfs_client_lock);
                 dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
                         __func__, pos, atomic_read(&pos->cl_count));
@@ -481,16 +477,10 @@ int nfs41_walk_client_list(struct nfs_client *new,
                 return 0;
         }
 
-        /*
-         * No matching nfs_client found.  This should be impossible,
-         * because the new nfs_client has already been added to
-         * nfs_client_list by nfs_get_client().
-         *
-         * Don't BUG(), since the caller is holding a mutex.
-         */
+        /* No matching nfs_client found. */
         spin_unlock(&nn->nfs_client_lock);
-        pr_err("NFS: %s Error: no matching nfs_client found\n", __func__);
-        return -NFS4ERR_STALE_CLIENTID;
+        dprintk("NFS: <-- %s status = %d\n", __func__, status);
+        return status;
 }
 #endif  /* CONFIG_NFS_V4_1 */
 
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 9448c579d41a..e61f68d5ef21 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -136,16 +136,11 @@ int nfs40_discover_server_trunking(struct nfs_client *clp,
         clp->cl_confirm = clid.confirm;
 
         status = nfs40_walk_client_list(clp, result, cred);
-        switch (status) {
-        case -NFS4ERR_STALE_CLIENTID:
-                set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
-        case 0:
+        if (status == 0) {
                 /* Sustain the lease, even if it's empty.  If the clientid4
                  * goes stale it's of no use for trunking discovery. */
                 nfs4_schedule_state_renewal(*result);
-                break;
         }
-
 out:
         return status;
 }
@@ -1863,6 +1858,7 @@ again:
         case -ETIMEDOUT:
         case -EAGAIN:
                 ssleep(1);
+        case -NFS4ERR_STALE_CLIENTID:
                 dprintk("NFS: %s after status %d, retrying\n",
                         __func__, status);
                 goto again;
@@ -2022,8 +2018,18 @@ static int nfs4_reset_session(struct nfs_client *clp)
         nfs4_begin_drain_session(clp);
         cred = nfs4_get_exchange_id_cred(clp);
         status = nfs4_proc_destroy_session(clp->cl_session, cred);
-        if (status && status != -NFS4ERR_BADSESSION &&
-            status != -NFS4ERR_DEADSESSION) {
+        switch (status) {
+        case 0:
+        case -NFS4ERR_BADSESSION:
+        case -NFS4ERR_DEADSESSION:
+                break;
+        case -NFS4ERR_BACK_CHAN_BUSY:
+        case -NFS4ERR_DELAY:
+                set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+                status = 0;
+                ssleep(1);
+                goto out;
+        default:
                 status = nfs4_recovery_handle_error(clp, status);
                 goto out;
         }
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2e7e8c878e5d..b056b1628722 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2589,27 +2589,23 @@ nfs_xdev_mount(struct file_system_type *fs_type, int flags,
         struct nfs_server *server;
         struct dentry *mntroot = ERR_PTR(-ENOMEM);
         struct nfs_subversion *nfs_mod = NFS_SB(data->sb)->nfs_client->cl_nfs_mod;
-        int error;
 
-        dprintk("--> nfs_xdev_mount_common()\n");
+        dprintk("--> nfs_xdev_mount()\n");
 
         mount_info.mntfh = mount_info.cloned->fh;
 
         /* create a new volume representation */
         server = nfs_mod->rpc_ops->clone_server(NFS_SB(data->sb), data->fh, data->fattr, data->authflavor);
-        if (IS_ERR(server)) {
-                error = PTR_ERR(server);
-                goto out_err;
-        }
 
-        mntroot = nfs_fs_mount_common(server, flags, dev_name, &mount_info, nfs_mod);
-        dprintk("<-- nfs_xdev_mount_common() = 0\n");
-out:
-        return mntroot;
+        if (IS_ERR(server))
+                mntroot = ERR_CAST(server);
+        else
+                mntroot = nfs_fs_mount_common(server, flags,
+                                dev_name, &mount_info, nfs_mod);
 
-out_err:
-        dprintk("<-- nfs_xdev_mount_common() = %d [error]\n", error);
-        goto out;
+        dprintk("<-- nfs_xdev_mount() = %ld\n",
+                        IS_ERR(mntroot) ? PTR_ERR(mntroot) : 0L);
+        return mntroot;
 }
 
 #if IS_ENABLED(CONFIG_NFS_V4)
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index fdb180769485..f3859354e41a 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -664,8 +664,11 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
         if (ret < 0)
                 printk(KERN_ERR "NILFS: GC failed during preparation: "
                         "cannot read source blocks: err=%d\n", ret);
-        else
+        else {
+                if (nilfs_sb_need_update(nilfs))
+                        set_nilfs_discontinued(nilfs);
                 ret = nilfs_clean_segments(inode->i_sb, argv, kbufs);
+        }
 
         nilfs_remove_all_gcinodes(nilfs);
         clear_nilfs_gc_running(nilfs);
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 4111a40ebe1a..5f707e537171 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -86,11 +86,11 @@ xfs_destroy_ioend(
         }
 
         if (ioend->io_iocb) {
+                inode_dio_done(ioend->io_inode);
                 if (ioend->io_isasync) {
                         aio_complete(ioend->io_iocb, ioend->io_error ?
                                         ioend->io_error : ioend->io_result, 0);
                 }
-                inode_dio_done(ioend->io_inode);
         }
 
         mempool_free(ioend, xfs_ioend_pool);
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 0e92d12765d2..cdb2d3348583 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -4680,9 +4680,6 @@ __xfs_bmapi_allocate(
                         return error;
         }
 
-        if (bma->flags & XFS_BMAPI_STACK_SWITCH)
-                bma->stack_switch = 1;
-
         error = xfs_bmap_alloc(bma);
         if (error)
                 return error;
@@ -4956,6 +4953,9 @@ xfs_bmapi_write(
         bma.flist = flist;
         bma.firstblock = firstblock;
 
+        if (flags & XFS_BMAPI_STACK_SWITCH)
+                bma.stack_switch = 1;
+
         while (bno < end && n < *nmap) {
                 inhole = eof || bma.got.br_startoff > bno;
                 wasdelay = !inhole && isnullstartblock(bma.got.br_startblock);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 56d1614760cf..fbbb9eb92e32 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -487,6 +487,7 @@ _xfs_buf_find(
         struct rb_node          *parent;
         xfs_buf_t               *bp;
         xfs_daddr_t             blkno = map[0].bm_bn;
+        xfs_daddr_t             eofs;
         int                     numblks = 0;
         int                     i;
 
@@ -498,6 +499,23 @@ _xfs_buf_find(
         ASSERT(!(numbytes < (1 << btp->bt_sshift)));
         ASSERT(!(BBTOB(blkno) & (xfs_off_t)btp->bt_smask));
 
+        /*
+         * Corrupted block numbers can get through to here, unfortunately, so we
+         * have to check that the buffer falls within the filesystem bounds.
+         */
+        eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks);
+        if (blkno >= eofs) {
+                /*
+                 * XXX (dgc): we should really be returning EFSCORRUPTED here,
+                 * but none of the higher level infrastructure supports
+                 * returning a specific error on buffer lookup failures.
+                 */
+                xfs_alert(btp->bt_mount,
+                          "%s: Block out of range: block 0x%llx, EOFS 0x%llx ",
+                          __func__, blkno, eofs);
+                return NULL;
+        }
+
         /* get tree root */
         pag = xfs_perag_get(btp->bt_mount,
                                 xfs_daddr_to_agno(btp->bt_mount, blkno));
@@ -1487,6 +1505,8 @@ restart:
         while (!list_empty(&btp->bt_lru)) {
                 bp = list_first_entry(&btp->bt_lru, struct xfs_buf, b_lru);
                 if (atomic_read(&bp->b_hold) > 1) {
+                        trace_xfs_buf_wait_buftarg(bp, _RET_IP_);
+                        list_move_tail(&bp->b_lru, &btp->bt_lru);
                         spin_unlock(&btp->bt_lru_lock);
                         delay(100);
                         goto restart;
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 77b09750e92c..3f9949fee391 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -652,7 +652,10 @@ xfs_buf_item_unlock(
 
         /*
          * If the buf item isn't tracking any data, free it, otherwise drop the
-         * reference we hold to it.
+         * reference we hold to it. If we are aborting the transaction, this may
+         * be the only reference to the buf item, so we free it anyway
+         * regardless of whether it is dirty or not. A dirty abort implies a
+         * shutdown, anyway.
          */
         clean = 1;
         for (i = 0; i < bip->bli_format_count; i++) {
@@ -664,7 +667,12 @@ xfs_buf_item_unlock(
         }
         if (clean)
                 xfs_buf_item_relse(bp);
-        else
+        else if (aborted) {
+                if (atomic_dec_and_test(&bip->bli_refcount)) {
+                        ASSERT(XFS_FORCED_SHUTDOWN(lip->li_mountp));
+                        xfs_buf_item_relse(bp);
+                }
+        } else
                 atomic_dec(&bip->bli_refcount);
 
         if (!hold)
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index d0e9c74d3d96..a8bd26b82ecb 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -246,10 +246,10 @@ xfs_swap_extents(
                 goto out_unlock;
         }
 
-        error = -filemap_write_and_wait(VFS_I(ip)->i_mapping);
+        error = -filemap_write_and_wait(VFS_I(tip)->i_mapping);
         if (error)
                 goto out_unlock;
-        truncate_pagecache_range(VFS_I(ip), 0, -1);
+        truncate_pagecache_range(VFS_I(tip), 0, -1);
 
         /* Verify O_DIRECT for ftmp */
         if (VN_CACHED(VFS_I(tip)) != 0) {
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index add06b4e9a63..364818eef40e 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -351,6 +351,15 @@ xfs_iomap_prealloc_size(
                 }
                 if (shift)
                         alloc_blocks >>= shift;
+
+                /*
+                 * If we are still trying to allocate more space than is
+                 * available, squash the prealloc hard. This can happen if we
+                 * have a large file on a small filesystem and the above
+                 * lowspace thresholds are smaller than MAXEXTLEN.
+                 */
+                while (alloc_blocks >= freesp)
+                        alloc_blocks >>= 4;
         }
 
         if (alloc_blocks < mp->m_writeio_blocks)
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index da508463ff10..7d6df7c00c36 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -658,7 +658,7 @@ xfs_sb_quiet_read_verify(
                 return;
         }
         /* quietly fail */
-        xfs_buf_ioerror(bp, EFSCORRUPTED);
+        xfs_buf_ioerror(bp, EWRONGFS);
 }
 
 static void
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 2e137d4a85ae..16a812977eab 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -341,6 +341,7 @@ DEFINE_BUF_EVENT(xfs_buf_item_relse);
 DEFINE_BUF_EVENT(xfs_buf_item_iodone);
 DEFINE_BUF_EVENT(xfs_buf_item_iodone_async);
 DEFINE_BUF_EVENT(xfs_buf_error_relse);
+DEFINE_BUF_EVENT(xfs_buf_wait_buftarg);
 DEFINE_BUF_EVENT(xfs_trans_read_buf_io);
 DEFINE_BUF_EVENT(xfs_trans_read_buf_shut);
 
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 8b84916dc671..7a9498ab3c2d 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -618,18 +618,30 @@ extern int __init efi_setup_pcdp_console(char *);
 #endif
 
 /*
- * We play games with efi_enabled so that the compiler will, if possible, remove
- * EFI-related code altogether.
+ * We play games with efi_enabled so that the compiler will, if
+ * possible, remove EFI-related code altogether.
  */
+#define EFI_BOOT                0       /* Were we booted from EFI? */
+#define EFI_SYSTEM_TABLES       1       /* Can we use EFI system tables? */
+#define EFI_CONFIG_TABLES       2       /* Can we use EFI config tables? */
+#define EFI_RUNTIME_SERVICES    3       /* Can we use runtime services? */
+#define EFI_MEMMAP              4       /* Can we use EFI memory map? */
+#define EFI_64BIT               5       /* Is the firmware 64-bit? */
+
 #ifdef CONFIG_EFI
 # ifdef CONFIG_X86
-   extern int efi_enabled;
-   extern bool efi_64bit;
+extern int efi_enabled(int facility);
 # else
-#  define efi_enabled 1
+static inline int efi_enabled(int facility)
+{
+        return 1;
+}
 # endif
 #else
-# define efi_enabled 0
+static inline int efi_enabled(int facility)
+{
+        return 0;
+}
 #endif
 
 /*
diff --git a/include/linux/llist.h b/include/linux/llist.h
index a5199f6d0e82..d0ab98f73d38 100644
--- a/include/linux/llist.h
+++ b/include/linux/llist.h
@@ -125,6 +125,31 @@ static inline void init_llist_head(struct llist_head *list)
              (pos) = llist_entry((pos)->member.next, typeof(*(pos)), member))
 
 /**
+ * llist_for_each_entry_safe - iterate safely against remove over some entries
+ * of lock-less list of given type.
+ * @pos:        the type * to use as a loop cursor.
+ * @n:          another type * to use as a temporary storage.
+ * @node:       the fist entry of deleted list entries.
+ * @member:     the name of the llist_node with the struct.
+ *
+ * In general, some entries of the lock-less list can be traversed
+ * safely only after being removed from list, so start with an entry
+ * instead of list head. This variant allows removal of entries
+ * as we iterate.
+ *
+ * If being used on entries deleted from lock-less list directly, the
+ * traverse order is from the newest to the oldest added entry.  If
+ * you want to traverse from the oldest to the newest, you must
+ * reverse the order by yourself before traversing.
+ */
+#define llist_for_each_entry_safe(pos, n, node, member)         \
+        for ((pos) = llist_entry((node), typeof(*(pos)), member),       \
+             (n) = (pos)->member.next;                                  \
+             &(pos)->member != NULL;                                    \
+             (pos) = llist_entry(n, typeof(*(pos)), member),            \
+             (n) = (&(pos)->member != NULL) ? (pos)->member.next : NULL)
+
+/**
  * llist_empty - tests whether a lock-less list is empty
  * @head:       the list to test
  *
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0108a56f814e..28bd5fa2ff2e 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -429,7 +429,7 @@ extern int memcg_limited_groups_array_size;
  * the slab_mutex must be held when looping through those caches
  */
 #define for_each_memcg_cache_index(_idx)        \
-        for ((_idx) = 0; i < memcg_limited_groups_array_size; (_idx)++)
+        for ((_idx) = 0; (_idx) < memcg_limited_groups_array_size; (_idx)++)
 
 static inline bool memcg_kmem_enabled(void)
 {
diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
index 2138bd33021a..e53dcfeaee69 100644
--- a/include/linux/mfd/abx500.h
+++ b/include/linux/mfd/abx500.h
@@ -272,8 +272,6 @@ struct abx500_bm_data {
         const struct abx500_fg_parameters *fg_params;
 };
 
-extern struct abx500_bm_data ab8500_bm_data;
-
 enum {
         NTC_EXTERNAL = 0,
         NTC_INTERNAL,
diff --git a/include/linux/mfd/abx500/ab8500-bm.h b/include/linux/mfd/abx500/ab8500-bm.h
index 44310c98ee6e..9bd037df97d9 100644
--- a/include/linux/mfd/abx500/ab8500-bm.h
+++ b/include/linux/mfd/abx500/ab8500-bm.h
@@ -422,7 +422,10 @@ struct ab8500_chargalg_platform_data {
 struct ab8500_btemp;
 struct ab8500_gpadc;
 struct ab8500_fg;
+
 #ifdef CONFIG_AB8500_BM
+extern struct abx500_bm_data ab8500_bm_data;
+
 void ab8500_fg_reinit(void);
 void ab8500_charger_usb_state_changed(u8 bm_usb_state, u16 mA);
 struct ab8500_btemp *ab8500_btemp_get(void);
@@ -434,31 +437,7 @@ int ab8500_fg_inst_curr_finalize(struct ab8500_fg *di, int *res);
 int ab8500_fg_inst_curr_done(struct ab8500_fg *di);
 
 #else
-int ab8500_fg_inst_curr_done(struct ab8500_fg *di)
-{
-}
-static void ab8500_fg_reinit(void)
-{
-}
-static void ab8500_charger_usb_state_changed(u8 bm_usb_state, u16 mA)
-{
-}
-static struct ab8500_btemp *ab8500_btemp_get(void)
-{
-        return NULL;
-}
-static int ab8500_btemp_get_batctrl_temp(struct ab8500_btemp *btemp)
-{
-        return 0;
-}
-struct ab8500_fg *ab8500_fg_get(void)
-{
-        return NULL;
-}
-static int ab8500_fg_inst_curr_blocking(struct ab8500_fg *dev)
-{
-        return -ENODEV;
-}
+static struct abx500_bm_data ab8500_bm_data;
 
 static inline int ab8500_fg_inst_curr_start(struct ab8500_fg *di)
 {
diff --git a/include/linux/mfd/da9052/da9052.h b/include/linux/mfd/da9052/da9052.h
index 86dd93de6ff2..786d02eb79d2 100644
--- a/include/linux/mfd/da9052/da9052.h
+++ b/include/linux/mfd/da9052/da9052.h
@@ -99,6 +99,9 @@ struct da9052 {
         u8 chip_id;
 
         int chip_irq;
+
+        /* SOC I/O transfer related fixes for DA9052/53 */
+        int (*fix_io) (struct da9052 *da9052, unsigned char reg);
 };
 
 /* ADC API */
@@ -113,32 +116,87 @@ static inline int da9052_reg_read(struct da9052 *da9052, unsigned char reg)
         ret = regmap_read(da9052->regmap, reg, &val);
         if (ret < 0)
                 return ret;
+
+        if (da9052->fix_io) {
+                ret = da9052->fix_io(da9052, reg);
+                if (ret < 0)
+                        return ret;
+        }
+
         return val;
 }
 
 static inline int da9052_reg_write(struct da9052 *da9052, unsigned char reg,
                                     unsigned char val)
 {
-        return regmap_write(da9052->regmap, reg, val);
+        int ret;
+
+        ret = regmap_write(da9052->regmap, reg, val);
+        if (ret < 0)
+                return ret;
+
+        if (da9052->fix_io) {
+                ret = da9052->fix_io(da9052, reg);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return ret;
 }
 
 static inline int da9052_group_read(struct da9052 *da9052, unsigned char reg,
                                      unsigned reg_cnt, unsigned char *val)
 {
-        return regmap_bulk_read(da9052->regmap, reg, val, reg_cnt);
+        int ret;
+
+        ret = regmap_bulk_read(da9052->regmap, reg, val, reg_cnt);
+        if (ret < 0)
+                return ret;
+
+        if (da9052->fix_io) {
+                ret = da9052->fix_io(da9052, reg);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return ret;
 }
 
 static inline int da9052_group_write(struct da9052 *da9052, unsigned char reg,
                                       unsigned reg_cnt, unsigned char *val)
 {
-        return regmap_raw_write(da9052->regmap, reg, val, reg_cnt);
+        int ret;
+
+        ret = regmap_raw_write(da9052->regmap, reg, val, reg_cnt);
+        if (ret < 0)
+                return ret;
+
+        if (da9052->fix_io) {
+                ret = da9052->fix_io(da9052, reg);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return ret;
 }
 
 static inline int da9052_reg_update(struct da9052 *da9052, unsigned char reg,
                                      unsigned char bit_mask,
                                      unsigned char reg_val)
 {
-        return regmap_update_bits(da9052->regmap, reg, bit_mask, reg_val);
+        int ret;
+
+        ret = regmap_update_bits(da9052->regmap, reg, bit_mask, reg_val);
+        if (ret < 0)
+                return ret;
+
+        if (da9052->fix_io) {
+                ret = da9052->fix_io(da9052, reg);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return ret;
 }
 
 int da9052_device_init(struct da9052 *da9052, u8 chip_id);
diff --git a/include/linux/mfd/da9052/reg.h b/include/linux/mfd/da9052/reg.h
index b97f7309d7f6..c4dd3a8add21 100644
--- a/include/linux/mfd/da9052/reg.h
+++ b/include/linux/mfd/da9052/reg.h
@@ -34,6 +34,9 @@
 #define DA9052_STATUS_C_REG             3
 #define DA9052_STATUS_D_REG             4
 
+/* PARK REGISTER */
+#define DA9052_PARK_REGISTER            DA9052_STATUS_D_REG
+
 /* EVENT REGISTERS */
 #define DA9052_EVENT_A_REG              5
 #define DA9052_EVENT_B_REG              6
diff --git a/include/linux/mfd/rtsx_common.h b/include/linux/mfd/rtsx_common.h
index a8d393e3066b..2b13970596f5 100644
--- a/include/linux/mfd/rtsx_common.h
+++ b/include/linux/mfd/rtsx_common.h
@@ -38,6 +38,9 @@
 #define RTSX_SD_CARD                    0
 #define RTSX_MS_CARD                    1
 
+#define CLK_TO_DIV_N                    0
+#define DIV_N_TO_CLK                    1
+
 struct platform_device;
 
 struct rtsx_slot {
diff --git a/include/linux/mfd/rtsx_pci.h b/include/linux/mfd/rtsx_pci.h
index 060b721fcbfb..4b117a3f54d4 100644
--- a/include/linux/mfd/rtsx_pci.h
+++ b/include/linux/mfd/rtsx_pci.h
@@ -158,10 +158,9 @@
 #define SG_TRANS_DATA           (0x02 << 4)
 #define SG_LINK_DESC            (0x03 << 4)
 
-/* SD bank voltage */
-#define SD_IO_3V3               0
-#define SD_IO_1V8               1
-
+/* Output voltage */
+#define OUTPUT_3V3              0
+#define OUTPUT_1V8              1
 
 /* Card Clock Enable Register */
 #define SD_CLK_EN                       0x04
@@ -201,6 +200,20 @@
 #define CHANGE_CLK                      0x01
 
 /* LDO_CTL */
+#define BPP_ASIC_1V7                    0x00
+#define BPP_ASIC_1V8                    0x01
+#define BPP_ASIC_1V9                    0x02
+#define BPP_ASIC_2V0                    0x03
+#define BPP_ASIC_2V7                    0x04
+#define BPP_ASIC_2V8                    0x05
+#define BPP_ASIC_3V2                    0x06
+#define BPP_ASIC_3V3                    0x07
+#define BPP_REG_TUNED18                 0x07
+#define BPP_TUNED18_SHIFT_8402          5
+#define BPP_TUNED18_SHIFT_8411          4
+#define BPP_PAD_MASK                    0x04
+#define BPP_PAD_3V3                     0x04
+#define BPP_PAD_1V8                     0x00
 #define BPP_LDO_POWB                    0x03
 #define BPP_LDO_ON                      0x00
 #define BPP_LDO_SUSPEND                 0x02
@@ -688,7 +701,10 @@ struct pcr_ops {
         int             (*disable_auto_blink)(struct rtsx_pcr *pcr);
         int             (*card_power_on)(struct rtsx_pcr *pcr, int card);
         int             (*card_power_off)(struct rtsx_pcr *pcr, int card);
+        int             (*switch_output_voltage)(struct rtsx_pcr *pcr,
+                                                u8 voltage);
         unsigned int    (*cd_deglitch)(struct rtsx_pcr *pcr);
+        int             (*conv_clk_and_div_n)(int clk, int dir);
 };
 
 enum PDEV_STAT  {PDEV_STAT_IDLE, PDEV_STAT_RUN};
@@ -783,6 +799,7 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
                 u8 ssc_depth, bool initial_mode, bool double_clk, bool vpclk);
 int rtsx_pci_card_power_on(struct rtsx_pcr *pcr, int card);
 int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card);
+int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage);
 unsigned int rtsx_pci_card_exist(struct rtsx_pcr *pcr);
 void rtsx_pci_complete_unfinished_transfer(struct rtsx_pcr *pcr);
 
diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
index bc823c4c028b..deca87452528 100644
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -151,7 +151,7 @@ struct mmu_notifier_ops {
  * Therefore notifier chains can only be traversed when either
  *
  * 1. mmap_sem is held.
- * 2. One of the reverse map locks is held (i_mmap_mutex or anon_vma->mutex).
+ * 2. One of the reverse map locks is held (i_mmap_mutex or anon_vma->rwsem).
  * 3. No other concurrent thread can access the list (release)
  */
 struct mmu_notifier {
diff --git a/include/linux/security.h b/include/linux/security.h
index 0f6afc657f77..eee7478cda70 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -989,17 +989,29 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      tells the LSM to decrement the number of secmark labeling rules loaded
  * @req_classify_flow:
  *      Sets the flow's sid to the openreq sid.
+ * @tun_dev_alloc_security:
+ *      This hook allows a module to allocate a security structure for a TUN
+ *      device.
+ *      @security pointer to a security structure pointer.
+ *      Returns a zero on success, negative values on failure.
+ * @tun_dev_free_security:
+ *      This hook allows a module to free the security structure for a TUN
+ *      device.
+ *      @security pointer to the TUN device's security structure
  * @tun_dev_create:
  *      Check permissions prior to creating a new TUN device.
- * @tun_dev_post_create:
- *      This hook allows a module to update or allocate a per-socket security
- *      structure.
- *      @sk contains the newly created sock structure.
+ * @tun_dev_attach_queue:
+ *      Check permissions prior to attaching to a TUN device queue.
+ *      @security pointer to the TUN device's security structure.
  * @tun_dev_attach:
- *      Check permissions prior to attaching to a persistent TUN device.  This
- *      hook can also be used by the module to update any security state
+ *      This hook can be used by the module to update any security state
  *      associated with the TUN device's sock structure.
  *      @sk contains the existing sock structure.
+ *      @security pointer to the TUN device's security structure.
+ * @tun_dev_open:
+ *      This hook can be used by the module to update any security state
+ *      associated with the TUN device's security structure.
+ *      @security pointer to the TUN devices's security structure.
  *
  * Security hooks for XFRM operations.
  *
@@ -1620,9 +1632,12 @@ struct security_operations {
         void (*secmark_refcount_inc) (void);
         void (*secmark_refcount_dec) (void);
         void (*req_classify_flow) (const struct request_sock *req, struct flowi *fl);
-        int (*tun_dev_create)(void);
-        void (*tun_dev_post_create)(struct sock *sk);
-        int (*tun_dev_attach)(struct sock *sk);
+        int (*tun_dev_alloc_security) (void **security);
+        void (*tun_dev_free_security) (void *security);
+        int (*tun_dev_create) (void);
+        int (*tun_dev_attach_queue) (void *security);
+        int (*tun_dev_attach) (struct sock *sk, void *security);
+        int (*tun_dev_open) (void *security);
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -2566,9 +2581,12 @@ void security_inet_conn_established(struct sock *sk,
 int security_secmark_relabel_packet(u32 secid);
 void security_secmark_refcount_inc(void);
 void security_secmark_refcount_dec(void);
+int security_tun_dev_alloc_security(void **security);
+void security_tun_dev_free_security(void *security);
 int security_tun_dev_create(void);
-void security_tun_dev_post_create(struct sock *sk);
-int security_tun_dev_attach(struct sock *sk);
+int security_tun_dev_attach_queue(void *security);
+int security_tun_dev_attach(struct sock *sk, void *security);
+int security_tun_dev_open(void *security);
 
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct sock *sock,
@@ -2733,16 +2751,31 @@ static inline void security_secmark_refcount_dec(void)
 {
 }
 
+static inline int security_tun_dev_alloc_security(void **security)
+{
+        return 0;
+}
+
+static inline void security_tun_dev_free_security(void *security)
+{
+}
+
 static inline int security_tun_dev_create(void)
 {
         return 0;
 }
 
-static inline void security_tun_dev_post_create(struct sock *sk)
+static inline int security_tun_dev_attach_queue(void *security)
+{
+        return 0;
+}
+
+static inline int security_tun_dev_attach(struct sock *sk, void *security)
 {
+        return 0;
 }
 
-static inline int security_tun_dev_attach(struct sock *sk)
+static inline int security_tun_dev_open(void *security)
 {
         return 0;
 }
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 689b14b26c8d..4d22d0f6167a 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -357,6 +357,8 @@ struct usb_bus {
         int bandwidth_int_reqs;         /* number of Interrupt requests */
         int bandwidth_isoc_reqs;        /* number of Isoc. requests */
 
+        unsigned resuming_ports;        /* bit array: resuming root-hub ports */
+
 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
         struct mon_bus *mon_bus;        /* non-null when associated */
         int monitored;                  /* non-zero when monitored */
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 608050b2545f..0a78df5f6cfd 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -430,6 +430,9 @@ extern void usb_hcd_poll_rh_status(struct usb_hcd *hcd);
 extern void usb_wakeup_notification(struct usb_device *hdev,
                 unsigned int portnum);
 
+extern void usb_hcd_start_port_resume(struct usb_bus *bus, int portnum);
+extern void usb_hcd_end_port_resume(struct usb_bus *bus, int portnum);
+
 /* The D0/D1 toggle bits ... USE WITH CAUTION (they're almost hcd-internal) */
 #define usb_gettoggle(dev, ep, out) (((dev)->toggle[out] >> (ep)) & 1)
 #define usb_dotoggle(dev, ep, out)  ((dev)->toggle[out] ^= (1 << (ep)))
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index bd45eb7bedc8..0e5ac93bab10 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -33,6 +33,7 @@ struct usbnet {
         wait_queue_head_t       *wait;
         struct mutex            phy_mutex;
         unsigned char           suspend_count;
+        unsigned char           pkt_cnt, pkt_err;
 
         /* i/o info: pipes etc */
         unsigned                in, out;
@@ -70,6 +71,7 @@ struct usbnet {
 #               define EVENT_DEV_OPEN   7
 #               define EVENT_DEVICE_REPORT_IDLE 8
 #               define EVENT_NO_RUNTIME_PM      9
+#               define EVENT_RX_KILL    10
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
@@ -107,6 +109,7 @@ struct driver_info {
  */
 #define FLAG_MULTI_PACKET       0x2000
 #define FLAG_RX_ASSEMBLE        0x4000  /* rx packets may span >1 frames */
+#define FLAG_NOARP              0x8000  /* device can't do ARP */
 
         /* init device ... can sleep, or cause probe() failure */
         int     (*bind)(struct usbnet *, struct usb_interface *);
diff --git a/include/net/ip.h b/include/net/ip.h
index 0707fb9551aa..a68f838a132c 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -143,6 +143,8 @@ static inline struct sk_buff *ip_finish_skb(struct sock *sk, struct flowi4 *fl4)
 extern int              ip4_datagram_connect(struct sock *sk, 
                                              struct sockaddr *uaddr, int addr_len);
 
+extern void ip4_datagram_release_cb(struct sock *sk);
+
 struct ip_reply_arg {
         struct kvec iov[1];   
         int         flags;
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index d8f5b9f52169..e98aeb3da033 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -31,6 +31,8 @@ extern void nf_conntrack_cleanup(struct net *net);
 extern int nf_conntrack_proto_init(struct net *net);
 extern void nf_conntrack_proto_fini(struct net *net);
 
+extern void nf_conntrack_cleanup_end(void);
+
 extern bool
 nf_ct_get_tuple(const struct sk_buff *skb,
                 unsigned int nhoff,
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 498433dd067d..938b7fd11204 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -34,17 +34,17 @@ extern int				udpv6_connect(struct sock *sk,
                                                       struct sockaddr *uaddr,
                                                       int addr_len);
 
-extern int                      datagram_recv_ctl(struct sock *sk,
-                                                  struct msghdr *msg,
-                                                  struct sk_buff *skb);
-
-extern int                      datagram_send_ctl(struct net *net,
-                                                  struct sock *sk,
-                                                  struct msghdr *msg,
-                                                  struct flowi6 *fl6,
-                                                  struct ipv6_txoptions *opt,
-                                                  int *hlimit, int *tclass,
-                                                  int *dontfrag);
+extern int                      ip6_datagram_recv_ctl(struct sock *sk,
+                                                      struct msghdr *msg,
+                                                      struct sk_buff *skb);
+
+extern int                      ip6_datagram_send_ctl(struct net *net,
+                                                      struct sock *sk,
+                                                      struct msghdr *msg,
+                                                      struct flowi6 *fl6,
+                                                      struct ipv6_txoptions *opt,
+                                                      int *hlimit, int *tclass,
+                                                      int *dontfrag);
 
 #define         LOOPBACK4_IPV6          cpu_to_be32(0x7f000006)
 
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 50598472dc41..f738e25377ff 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -152,6 +152,12 @@
 #define USB_INTRF_FUNC_SUSPEND_LP       (1 << (8 + 0))
 #define USB_INTRF_FUNC_SUSPEND_RW       (1 << (8 + 1))
 
+/*
+ * Interface status, Figure 9-5 USB 3.0 spec
+ */
+#define USB_INTRF_STAT_FUNC_RW_CAP     1
+#define USB_INTRF_STAT_FUNC_RW         2
+
 #define USB_ENDPOINT_HALT               0       /* IN/OUT will STALL */
 
 /* Bit array elements as returned by the USB_REQ_GET_STATUS request. */
diff --git a/init/main.c b/init/main.c
index 92d728a32d51..cee4b5c66d81 100644
--- a/init/main.c
+++ b/init/main.c
@@ -604,7 +604,7 @@ asmlinkage void __init start_kernel(void)
         pidmap_init();
         anon_vma_init();
 #ifdef CONFIG_X86
-        if (efi_enabled)
+        if (efi_enabled(EFI_RUNTIME_SERVICES))
                 efi_enter_virtual_mode();
 #endif
         thread_info_cache_init();
@@ -632,7 +632,7 @@ asmlinkage void __init start_kernel(void)
         acpi_early_init(); /* before LAPIC and SMP init */
         sfi_init_late();
 
-        if (efi_enabled) {
+        if (efi_enabled(EFI_RUNTIME_SERVICES)) {
                 efi_late_init();
                 efi_free_boot_services();
         }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 301079d06f24..7b6646a8c067 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -908,6 +908,15 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
 }
 
 /*
+ * Initialize event state based on the perf_event_attr::disabled.
+ */
+static inline void perf_event__state_init(struct perf_event *event)
+{
+        event->state = event->attr.disabled ? PERF_EVENT_STATE_OFF :
+                                              PERF_EVENT_STATE_INACTIVE;
+}
+
+/*
  * Called at perf_event creation and when events are attached/detached from a
  * group.
  */
@@ -6179,8 +6188,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
         event->overflow_handler = overflow_handler;
         event->overflow_handler_context = context;
 
-        if (attr->disabled)
-                event->state = PERF_EVENT_STATE_OFF;
+        perf_event__state_init(event);
 
         pmu = NULL;
 
@@ -6609,9 +6617,17 @@ SYSCALL_DEFINE5(perf_event_open,
 
                 mutex_lock(&gctx->mutex);
                 perf_remove_from_context(group_leader);
+
+                /*
+                 * Removing from the context ends up with disabled
+                 * event. What we want here is event in the initial
+                 * startup state, ready to be add into new context.
+                 */
+                perf_event__state_init(group_leader);
                 list_for_each_entry(sibling, &group_leader->sibling_list,
                                     group_entry) {
                         perf_remove_from_context(sibling);
+                        perf_event__state_init(sibling);
                         put_ctx(gctx);
                 }
                 mutex_unlock(&gctx->mutex);
diff --git a/kernel/printk.c b/kernel/printk.c
index 357f714ddd49..267ce780abe8 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -87,12 +87,6 @@ static DEFINE_SEMAPHORE(console_sem);
 struct console *console_drivers;
 EXPORT_SYMBOL_GPL(console_drivers);
 
-#ifdef CONFIG_LOCKDEP
-static struct lockdep_map console_lock_dep_map = {
-        .name = "console_lock"
-};
-#endif
-
 /*
  * This is used for debugging the mess that is the VT code by
  * keeping track if we have the console semaphore held. It's
@@ -1924,7 +1918,6 @@ void console_lock(void)
                 return;
         console_locked = 1;
         console_may_schedule = 1;
-        mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);
 }
 EXPORT_SYMBOL(console_lock);
 
@@ -1946,7 +1939,6 @@ int console_trylock(void)
         }
         console_locked = 1;
         console_may_schedule = 0;
-        mutex_acquire(&console_lock_dep_map, 0, 1, _RET_IP_);
         return 1;
 }
 EXPORT_SYMBOL(console_trylock);
@@ -2107,7 +2099,6 @@ skip:
                 local_irq_restore(flags);
         }
         console_locked = 0;
-        mutex_release(&console_lock_dep_map, 1, _RET_IP_);
 
         /* Release the exclusive_console once it is used */
         if (unlikely(exclusive_console))
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index f6e5ec2932b4..c1cc7e17ff9d 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -40,8 +40,7 @@
 #ifdef CONFIG_RCU_NOCB_CPU
 static cpumask_var_t rcu_nocb_mask; /* CPUs to have callbacks offloaded. */
 static bool have_rcu_nocb_mask;     /* Was rcu_nocb_mask allocated? */
-static bool rcu_nocb_poll;          /* Offload kthread are to poll. */
-module_param(rcu_nocb_poll, bool, 0444);
+static bool __read_mostly rcu_nocb_poll;    /* Offload kthread are to poll. */
 static char __initdata nocb_buf[NR_CPUS * 5];
 #endif /* #ifdef CONFIG_RCU_NOCB_CPU */
 
@@ -2159,6 +2158,13 @@ static int __init rcu_nocb_setup(char *str)
 }
 __setup("rcu_nocbs=", rcu_nocb_setup);
 
+static int __init parse_rcu_nocb_poll(char *arg)
+{
+        rcu_nocb_poll = 1;
+        return 0;
+}
+early_param("rcu_nocb_poll", parse_rcu_nocb_poll);
+
 /* Is the specified CPU a no-CPUs CPU? */
 static bool is_nocb_cpu(int cpu)
 {
@@ -2366,10 +2372,11 @@ static int rcu_nocb_kthread(void *arg)
         for (;;) {
                 /* If not polling, wait for next batch of callbacks. */
                 if (!rcu_nocb_poll)
-                        wait_event(rdp->nocb_wq, rdp->nocb_head);
+                        wait_event_interruptible(rdp->nocb_wq, rdp->nocb_head);
                 list = ACCESS_ONCE(rdp->nocb_head);
                 if (!list) {
                         schedule_timeout_interruptible(1);
+                        flush_signals(current);
                         continue;
                 }
 
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 2cd3c1b4e582..7ae4c4c5420e 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -222,8 +222,8 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
                         cfs_rq->runnable_load_avg);
         SEQ_printf(m, "  .%-30s: %lld\n", "blocked_load_avg",
                         cfs_rq->blocked_load_avg);
-        SEQ_printf(m, "  .%-30s: %ld\n", "tg_load_avg",
-                        atomic64_read(&cfs_rq->tg->load_avg));
+        SEQ_printf(m, "  .%-30s: %lld\n", "tg_load_avg",
+                        (unsigned long long)atomic64_read(&cfs_rq->tg->load_avg));
         SEQ_printf(m, "  .%-30s: %lld\n", "tg_load_contrib",
                         cfs_rq->tg_load_contrib);
         SEQ_printf(m, "  .%-30s: %d\n", "tg_runnable_contrib",
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 5eea8707234a..81fa53643409 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2663,7 +2663,7 @@ static void destroy_cfs_bandwidth(struct cfs_bandwidth *cfs_b)
         hrtimer_cancel(&cfs_b->slack_timer);
 }
 
-static void unthrottle_offline_cfs_rqs(struct rq *rq)
+static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq)
 {
         struct cfs_rq *cfs_rq;
 
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 418feb01344e..4f02b2847357 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -566,7 +566,7 @@ static inline struct rt_bandwidth *sched_rt_bandwidth(struct rt_rq *rt_rq)
 static int do_balance_runtime(struct rt_rq *rt_rq)
 {
         struct rt_bandwidth *rt_b = sched_rt_bandwidth(rt_rq);
-        struct root_domain *rd = cpu_rq(smp_processor_id())->rd;
+        struct root_domain *rd = rq_of_rt_rq(rt_rq)->rd;
         int i, weight, more = 0;
         u64 rt_period;
 
diff --git a/kernel/smp.c b/kernel/smp.c
index 29dd40a9f2f4..69f38bd98b42 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -33,6 +33,7 @@ struct call_function_data {
         struct call_single_data csd;
         atomic_t                refs;
         cpumask_var_t           cpumask;
+        cpumask_var_t           cpumask_ipi;
 };
 
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data);
@@ -56,6 +57,9 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 if (!zalloc_cpumask_var_node(&cfd->cpumask, GFP_KERNEL,
                                 cpu_to_node(cpu)))
                         return notifier_from_errno(-ENOMEM);
+                if (!zalloc_cpumask_var_node(&cfd->cpumask_ipi, GFP_KERNEL,
+                                cpu_to_node(cpu)))
+                        return notifier_from_errno(-ENOMEM);
                 break;
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -65,6 +69,7 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
                 free_cpumask_var(cfd->cpumask);
+                free_cpumask_var(cfd->cpumask_ipi);
                 break;
 #endif
         };
@@ -526,6 +531,12 @@ void smp_call_function_many(const struct cpumask *mask,
                 return;
         }
 
+        /*
+         * After we put an entry into the list, data->cpumask
+         * may be cleared again when another CPU sends another IPI for
+         * a SMP function call, so data->cpumask will be zero.
+         */
+        cpumask_copy(data->cpumask_ipi, data->cpumask);
         raw_spin_lock_irqsave(&call_function.lock, flags);
         /*
          * Place entry at the _HEAD_ of the list, so that any cpu still
@@ -549,7 +560,7 @@ void smp_call_function_many(const struct cpumask *mask,
         smp_mb();
 
         /* Send a message to all CPUs in the map */
-        arch_send_call_function_ipi_mask(data->cpumask);
+        arch_send_call_function_ipi_mask(data->cpumask_ipi);
 
         /* Optionally wait for the CPUs to complete */
         if (wait)
diff --git a/lib/digsig.c b/lib/digsig.c
index 8c0e62975c88..dc2be7ed1765 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -162,6 +162,8 @@ static int digsig_verify_rsa(struct key *key,
         memset(out1, 0, head);
         memcpy(out1 + head, p, l);
 
+        kfree(p);
+
         err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, &len);
         if (err)
                 goto err;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 6001ee6347a9..b5783d81eda9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1257,6 +1257,10 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
         if (flags & FOLL_WRITE && !pmd_write(*pmd))
                 goto out;
 
+        /* Avoid dumping huge zero page */
+        if ((flags & FOLL_DUMP) && is_huge_zero_pmd(*pmd))
+                return ERR_PTR(-EFAULT);
+
         page = pmd_page(*pmd);
         VM_BUG_ON(!PageHead(page));
         if (flags & FOLL_TOUCH) {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 4f3ea0b1e57c..546db81820e4 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3033,6 +3033,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
                 if (!huge_pte_none(huge_ptep_get(ptep))) {
                         pte = huge_ptep_get_and_clear(mm, address, ptep);
                         pte = pte_mkhuge(pte_modify(pte, newprot));
+                        pte = arch_make_huge_pte(pte, vma, NULL, 0);
                         set_huge_pte_at(mm, address, ptep, pte);
                         pages++;
                 }
diff --git a/mm/migrate.c b/mm/migrate.c
index c38778610aa8..2fd8b4af4744 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -160,8 +160,10 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
         if (is_write_migration_entry(entry))
                 pte = pte_mkwrite(pte);
 #ifdef CONFIG_HUGETLB_PAGE
-        if (PageHuge(new))
+        if (PageHuge(new)) {
                 pte = pte_mkhuge(pte);
+                pte = arch_make_huge_pte(pte, vma, new, 0);
+        }
 #endif
         flush_cache_page(vma, addr, pte_pfn(pte));
         set_pte_at(mm, addr, ptep, pte);
diff --git a/mm/mmap.c b/mm/mmap.c
index 35730ee9d515..d1e4124f3d0e 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2943,7 +2943,7 @@ static void vm_lock_mapping(struct mm_struct *mm, struct address_space *mapping)
  * vma in this mm is backed by the same anon_vma or address_space.
  *
  * We can take all the locks in random order because the VM code
- * taking i_mmap_mutex or anon_vma->mutex outside the mmap_sem never
+ * taking i_mmap_mutex or anon_vma->rwsem outside the mmap_sem never
  * takes more than one of them in a row. Secondly we're protected
  * against a concurrent mm_take_all_locks() by the mm_all_locks_mutex.
  *
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 8e1d89d2b1c1..183f97a86bb2 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -738,6 +738,7 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
         struct arphdr *arphdr;
         struct ethhdr *ethhdr;
         __be32 ip_src, ip_dst;
+        uint8_t *hw_src, *hw_dst;
         uint16_t type = 0;
 
         /* pull the ethernet header */
@@ -777,9 +778,23 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
         ip_src = batadv_arp_ip_src(skb, hdr_size);
         ip_dst = batadv_arp_ip_dst(skb, hdr_size);
         if (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) ||
-            ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst))
+            ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst) ||
+            ipv4_is_zeronet(ip_src) || ipv4_is_lbcast(ip_src) ||
+            ipv4_is_zeronet(ip_dst) || ipv4_is_lbcast(ip_dst))
                 goto out;
 
+        hw_src = batadv_arp_hw_src(skb, hdr_size);
+        if (is_zero_ether_addr(hw_src) || is_multicast_ether_addr(hw_src))
+                goto out;
+
+        /* we don't care about the destination MAC address in ARP requests */
+        if (arphdr->ar_op != htons(ARPOP_REQUEST)) {
+                hw_dst = batadv_arp_hw_dst(skb, hdr_size);
+                if (is_zero_ether_addr(hw_dst) ||
+                    is_multicast_ether_addr(hw_dst))
+                        goto out;
+        }
+
         type = ntohs(arphdr->ar_op);
 out:
         return type;
@@ -1012,6 +1027,8 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
          */
         ret = !batadv_is_my_client(bat_priv, hw_dst);
 out:
+        if (ret)
+                kfree_skb(skb);
         /* if ret == false -> packet has to be delivered to the interface */
         return ret;
 }
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 25bfce0666eb..4925a02ae7e4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -249,12 +249,12 @@ static void hci_conn_disconnect(struct hci_conn *conn)
         __u8 reason = hci_proto_disconn_ind(conn);
 
         switch (conn->type) {
-        case ACL_LINK:
-                hci_acl_disconn(conn, reason);
-                break;
         case AMP_LINK:
                 hci_amp_disconn(conn, reason);
                 break;
+        default:
+                hci_acl_disconn(conn, reason);
+                break;
         }
 }
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 596660d37c5e..0f78e34220c9 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2810,14 +2810,6 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         if (conn) {
                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
-                hci_dev_lock(hdev);
-                if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
-                    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                        mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                              conn->dst_type, 0, NULL, 0,
-                                              conn->dev_class);
-                hci_dev_unlock(hdev);
-
                 /* Send to upper protocol */
                 l2cap_recv_acldata(conn, skb, flags);
                 return;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 705078a0cc39..81b44481d0d9 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2688,7 +2688,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (ev->opcode != HCI_OP_NOP)
                 del_timer(&hdev->cmd_timer);
 
-        if (ev->ncmd) {
+        if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
                         queue_work(hdev->workqueue, &hdev->cmd_work);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b2bcbe2dc328..a7352ff3fd1e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -931,7 +931,7 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->version = req->version;
         hid->country = req->country;
 
-        strncpy(hid->name, req->name, 128);
+        strncpy(hid->name, req->name, sizeof(req->name) - 1);
 
         snprintf(hid->phys, sizeof(hid->phys), "%pMR",
                  &bt_sk(session->ctrl_sock->sk)->src);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2c78208d793e..22e658322845 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3727,6 +3727,17 @@ sendresp:
 static int l2cap_connect_req(struct l2cap_conn *conn,
                              struct l2cap_cmd_hdr *cmd, u8 *data)
 {
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct hci_conn *hcon = conn->hcon;
+
+        hci_dev_lock(hdev);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+            !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
+                mgmt_device_connected(hdev, &hcon->dst, hcon->type,
+                                      hcon->dst_type, 0, NULL, 0,
+                                      hcon->dev_class);
+        hci_dev_unlock(hdev);
+
         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
         return 0;
 }
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 531a93d613d4..57f250c20e39 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -352,7 +352,7 @@ static void __sco_sock_close(struct sock *sk)
 
         case BT_CONNECTED:
         case BT_CONFIG:
-                if (sco_pi(sk)->conn) {
+                if (sco_pi(sk)->conn->hcon) {
                         sk->sk_state = BT_DISCONN;
                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
                         hci_conn_put(sco_pi(sk)->conn->hcon);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 68a9587c9694..5abefb12891d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 
         skb_pull(skb, sizeof(code));
 
+        /*
+         * The SMP context must be initialized for all other PDUs except
+         * pairing and security requests. If we get any other PDU when
+         * not initialized simply disconnect (done if this function
+         * returns an error).
+         */
+        if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
+            !conn->smp_chan) {
+                BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
+                kfree_skb(skb);
+                return -ENOTSUPP;
+        }
+
         switch (code) {
         case SMP_CMD_PAIRING_REQ:
                 reason = smp_cmd_pairing_req(conn, skb);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b29dacf900f9..e6e1cbe863f5 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1781,10 +1781,13 @@ static ssize_t pktgen_thread_write(struct file *file,
                         return -EFAULT;
                 i += len;
                 mutex_lock(&pktgen_thread_lock);
-                pktgen_add_device(t, f);
+                ret = pktgen_add_device(t, f);
                 mutex_unlock(&pktgen_thread_lock);
-                ret = count;
-                sprintf(pg_result, "OK: add_device=%s", f);
+                if (!ret) {
+                        ret = count;
+                        sprintf(pg_result, "OK: add_device=%s", f);
+                } else
+                        sprintf(pg_result, "ERROR: can not add device %s", f);
                 goto out;
         }
 
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index c31d9e8668c3..4425148d2b51 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -186,8 +186,6 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
         struct fastopen_queue *fastopenq =
             inet_csk(lsk)->icsk_accept_queue.fastopenq;
 
-        BUG_ON(!spin_is_locked(&sk->sk_lock.slock) && !sock_owned_by_user(sk));
-
         tcp_sk(sk)->fastopen_rsk = NULL;
         spin_lock_bh(&fastopenq->lock);
         fastopenq->qlen--;
diff --git a/net/core/scm.c b/net/core/scm.c
index 57fb1ee6649f..905dcc6ad1e3 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -35,6 +35,7 @@
 #include <net/sock.h>
 #include <net/compat.h>
 #include <net/scm.h>
+#include <net/cls_cgroup.h>
 
 
 /*
@@ -302,8 +303,10 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
                 }
                 /* Bump the usage count and install the file. */
                 sock = sock_from_file(fp[i], &err);
-                if (sock)
+                if (sock) {
                         sock_update_netprioidx(sock->sk, current);
+                        sock_update_classid(sock->sk, current);
+                }
                 fd_install(new_fd, get_file(fp[i]));
         }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3ab989b0de42..32443ebc3e89 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -683,7 +683,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->network_header     = old->network_header;
         new->mac_header         = old->mac_header;
         new->inner_transport_header = old->inner_transport_header;
-        new->inner_network_header = old->inner_transport_header;
+        new->inner_network_header = old->inner_network_header;
         skb_dst_copy(new, old);
         new->rxhash             = old->rxhash;
         new->ooo_okay           = old->ooo_okay;
@@ -1649,7 +1649,7 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 
 static struct page *linear_to_page(struct page *page, unsigned int *len,
                                    unsigned int *offset,
-                                   struct sk_buff *skb, struct sock *sk)
+                                   struct sock *sk)
 {
         struct page_frag *pfrag = sk_page_frag(sk);
 
@@ -1682,14 +1682,14 @@ static bool spd_can_coalesce(const struct splice_pipe_desc *spd,
 static bool spd_fill_page(struct splice_pipe_desc *spd,
                           struct pipe_inode_info *pipe, struct page *page,
                           unsigned int *len, unsigned int offset,
-                          struct sk_buff *skb, bool linear,
+                          bool linear,
                           struct sock *sk)
 {
         if (unlikely(spd->nr_pages == MAX_SKB_FRAGS))
                 return true;
 
         if (linear) {
-                page = linear_to_page(page, len, &offset, skb, sk);
+                page = linear_to_page(page, len, &offset, sk);
                 if (!page)
                         return true;
         }
@@ -1706,23 +1706,9 @@ static bool spd_fill_page(struct splice_pipe_desc *spd,
         return false;
 }
 
-static inline void __segment_seek(struct page **page, unsigned int *poff,
-                                  unsigned int *plen, unsigned int off)
-{
-        unsigned long n;
-
-        *poff += off;
-        n = *poff / PAGE_SIZE;
-        if (n)
-                *page = nth_page(*page, n);
-
-        *poff = *poff % PAGE_SIZE;
-        *plen -= off;
-}
-
 static bool __splice_segment(struct page *page, unsigned int poff,
                              unsigned int plen, unsigned int *off,
-                             unsigned int *len, struct sk_buff *skb,
+                             unsigned int *len,
                              struct splice_pipe_desc *spd, bool linear,
                              struct sock *sk,
                              struct pipe_inode_info *pipe)
@@ -1737,23 +1723,19 @@ static bool __splice_segment(struct page *page, unsigned int poff,
         }
 
         /* ignore any bits we already processed */
-        if (*off) {
-                __segment_seek(&page, &poff, &plen, *off);
-                *off = 0;
-        }
+        poff += *off;
+        plen -= *off;
+        *off = 0;
 
         do {
                 unsigned int flen = min(*len, plen);
 
-                /* the linear region may spread across several pages  */
-                flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
-
-                if (spd_fill_page(spd, pipe, page, &flen, poff, skb, linear, sk))
+                if (spd_fill_page(spd, pipe, page, &flen, poff,
+                                  linear, sk))
                         return true;
-
-                __segment_seek(&page, &poff, &plen, flen);
+                poff += flen;
+                plen -= flen;
                 *len -= flen;
-
         } while (*len && plen);
 
         return false;
@@ -1777,7 +1759,7 @@ static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
         if (__splice_segment(virt_to_page(skb->data),
                              (unsigned long) skb->data & (PAGE_SIZE - 1),
                              skb_headlen(skb),
-                             offset, len, skb, spd,
+                             offset, len, spd,
                              skb_head_is_locked(skb),
                              sk, pipe))
                 return true;
@@ -1790,7 +1772,7 @@ static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
 
                 if (__splice_segment(skb_frag_page(f),
                                      f->page_offset, skb_frag_size(f),
-                                     offset, len, skb, spd, false, sk, pipe))
+                                     offset, len, spd, false, sk, pipe))
                         return true;
         }
 
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index a0d8392491c3..a69b4e4a02b5 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -269,7 +269,11 @@ static void ah_input_done(struct crypto_async_request *base, int err)
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
-        skb_set_transport_header(skb, -ihl);
+
+        if (x->props.mode == XFRM_MODE_TUNNEL)
+                skb_reset_transport_header(skb);
+        else
+                skb_set_transport_header(skb, -ihl);
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -381,7 +385,10 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
-        skb_set_transport_header(skb, -ihl);
+        if (x->props.mode == XFRM_MODE_TUNNEL)
+                skb_reset_transport_header(skb);
+        else
+                skb_set_transport_header(skb, -ihl);
 
         err = nexthdr;
 
@@ -413,9 +420,12 @@ static void ah4_err(struct sk_buff *skb, u32 info)
         if (!x)
                 return;
 
-        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
+                atomic_inc(&flow_cache_genid);
+                rt_genid_bump(net);
+
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0);
-        else
+        } else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0);
         xfrm_state_put(x);
 }
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 424fafbc8cb0..b28e863fe0a7 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -85,3 +85,28 @@ out:
         return err;
 }
 EXPORT_SYMBOL(ip4_datagram_connect);
+
+void ip4_datagram_release_cb(struct sock *sk)
+{
+        const struct inet_sock *inet = inet_sk(sk);
+        const struct ip_options_rcu *inet_opt;
+        __be32 daddr = inet->inet_daddr;
+        struct flowi4 fl4;
+        struct rtable *rt;
+
+        if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0))
+                return;
+
+        rcu_read_lock();
+        inet_opt = rcu_dereference(inet->inet_opt);
+        if (inet_opt && inet_opt->opt.srr)
+                daddr = inet_opt->opt.faddr;
+        rt = ip_route_output_ports(sock_net(sk), &fl4, sk, daddr,
+                                   inet->inet_saddr, inet->inet_dport,
+                                   inet->inet_sport, sk->sk_protocol,
+                                   RT_CONN_FLAGS(sk), sk->sk_bound_dev_if);
+        if (!IS_ERR(rt))
+                __sk_dst_set(sk, &rt->dst);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL_GPL(ip4_datagram_release_cb);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b61e9deb7c7e..3b4f0cd2e63e 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -346,7 +346,10 @@ static int esp_input_done2(struct sk_buff *skb, int err)
 
         pskb_trim(skb, skb->len - alen - padlen - 2);
         __skb_pull(skb, hlen);
-        skb_set_transport_header(skb, -ihl);
+        if (x->props.mode == XFRM_MODE_TUNNEL)
+                skb_reset_transport_header(skb);
+        else
+                skb_set_transport_header(skb, -ihl);
 
         err = nexthdr[1];
 
@@ -499,9 +502,12 @@ static void esp4_err(struct sk_buff *skb, u32 info)
         if (!x)
                 return;
 
-        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
+                atomic_inc(&flow_cache_genid);
+                rt_genid_bump(net);
+
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0);
-        else
+        } else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0);
         xfrm_state_put(x);
 }
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 303012adf9e6..e81b1caf2ea2 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -963,8 +963,12 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         ptr--;
                 }
                 if (tunnel->parms.o_flags&GRE_CSUM) {
+                        int offset = skb_transport_offset(skb);
+
                         *ptr = 0;
-                        *(__sum16 *)ptr = ip_compute_csum((void *)(iph+1), skb->len - sizeof(struct iphdr));
+                        *(__sum16 *)ptr = csum_fold(skb_checksum(skb, offset,
+                                                                 skb->len - offset,
+                                                                 0));
                 }
         }
 
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index d3ab47e19a89..9a46daed2f3c 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -47,9 +47,12 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
         if (!x)
                 return;
 
-        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
+        if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
+                atomic_inc(&flow_cache_genid);
+                rt_genid_bump(net);
+
                 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);
-        else
+        } else
                 ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);
         xfrm_state_put(x);
 }
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 8f3d05424a3e..6f9c07268cf6 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -738,6 +738,7 @@ struct proto ping_prot = {
         .recvmsg =      ping_recvmsg,
         .bind =         ping_bind,
         .backlog_rcv =  ping_queue_rcv_skb,
+        .release_cb =   ip4_datagram_release_cb,
         .hash =         ping_v4_hash,
         .unhash =       ping_v4_unhash,
         .get_port =     ping_v4_get_port,
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 73d1e4df4bf6..6f08991409c3 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -894,6 +894,7 @@ struct proto raw_prot = {
         .recvmsg           = raw_recvmsg,
         .bind              = raw_bind,
         .backlog_rcv       = raw_rcv_skb,
+        .release_cb        = ip4_datagram_release_cb,
         .hash              = raw_hash_sk,
         .unhash            = raw_unhash_sk,
         .obj_size          = sizeof(struct raw_sock),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 844a9ef60dbd..a0fcc47fee73 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -912,6 +912,9 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
         struct dst_entry *dst = &rt->dst;
         struct fib_result res;
 
+        if (dst_metric_locked(dst, RTAX_MTU))
+                return;
+
         if (dst->dev->mtu < mtu)
                 return;
 
@@ -962,7 +965,7 @@ void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
 }
 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
 
-void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
+static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
 {
         const struct iphdr *iph = (const struct iphdr *) skb->data;
         struct flowi4 fl4;
@@ -975,6 +978,53 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
                 ip_rt_put(rt);
         }
 }
+
+void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
+{
+        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        struct flowi4 fl4;
+        struct rtable *rt;
+        struct dst_entry *dst;
+        bool new = false;
+
+        bh_lock_sock(sk);
+        rt = (struct rtable *) __sk_dst_get(sk);
+
+        if (sock_owned_by_user(sk) || !rt) {
+                __ipv4_sk_update_pmtu(skb, sk, mtu);
+                goto out;
+        }
+
+        __build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
+
+        if (!__sk_dst_check(sk, 0)) {
+                rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
+                if (IS_ERR(rt))
+                        goto out;
+
+                new = true;
+        }
+
+        __ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
+
+        dst = dst_check(&rt->dst, 0);
+        if (!dst) {
+                if (new)
+                        dst_release(&rt->dst);
+
+                rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
+                if (IS_ERR(rt))
+                        goto out;
+
+                new = true;
+        }
+
+        if (new)
+                __sk_dst_set(sk, &rt->dst);
+
+out:
+        bh_unlock_sock(sk);
+}
 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
 
 void ipv4_redirect(struct sk_buff *skb, struct net *net,
@@ -1120,7 +1170,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         if (!mtu || time_after_eq(jiffies, rt->dst.expires))
                 mtu = dst_metric_raw(dst, RTAX_MTU);
 
-        if (mtu && rt_is_output_route(rt))
+        if (mtu)
                 return mtu;
 
         mtu = dst->dev->mtu;
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 291f2ed7cc31..cdf2e707bb10 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -310,6 +310,12 @@ void tcp_slow_start(struct tcp_sock *tp)
 {
         int cnt; /* increase in packets */
         unsigned int delta = 0;
+        u32 snd_cwnd = tp->snd_cwnd;
+
+        if (unlikely(!snd_cwnd)) {
+                pr_err_once("snd_cwnd is nul, please report this bug.\n");
+                snd_cwnd = 1U;
+        }
 
         /* RFC3465: ABC Slow start
          * Increase only after a full MSS of bytes is acked
@@ -324,7 +330,7 @@ void tcp_slow_start(struct tcp_sock *tp)
         if (sysctl_tcp_max_ssthresh > 0 && tp->snd_cwnd > sysctl_tcp_max_ssthresh)
                 cnt = sysctl_tcp_max_ssthresh >> 1;     /* limited slow start */
         else
-                cnt = tp->snd_cwnd;                     /* exponential increase */
+                cnt = snd_cwnd;                         /* exponential increase */
 
         /* RFC3465: ABC
          * We MAY increase by 2 if discovered delayed ack
@@ -334,11 +340,11 @@ void tcp_slow_start(struct tcp_sock *tp)
         tp->bytes_acked = 0;
 
         tp->snd_cwnd_cnt += cnt;
-        while (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-                tp->snd_cwnd_cnt -= tp->snd_cwnd;
+        while (tp->snd_cwnd_cnt >= snd_cwnd) {
+                tp->snd_cwnd_cnt -= snd_cwnd;
                 delta++;
         }
-        tp->snd_cwnd = min(tp->snd_cwnd + delta, tp->snd_cwnd_clamp);
+        tp->snd_cwnd = min(snd_cwnd + delta, tp->snd_cwnd_clamp);
 }
 EXPORT_SYMBOL_GPL(tcp_slow_start);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 18f97ca76b00..ad70a962c20e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3504,6 +3504,11 @@ static bool tcp_process_frto(struct sock *sk, int flag)
                 }
         } else {
                 if (!(flag & FLAG_DATA_ACKED) && (tp->frto_counter == 1)) {
+                        if (!tcp_packets_in_flight(tp)) {
+                                tcp_enter_frto_loss(sk, 2, flag);
+                                return true;
+                        }
+
                         /* Prevent sending of new data. */
                         tp->snd_cwnd = min(tp->snd_cwnd,
                                            tcp_packets_in_flight(tp));
@@ -5649,8 +5654,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
          * the remote receives only the retransmitted (regular) SYNs: either
          * the original SYN-data or the corresponding SYN-ACK is lost.
          */
-        syn_drop = (cookie->len <= 0 && data &&
-                    inet_csk(sk)->icsk_retransmits);
+        syn_drop = (cookie->len <= 0 && data && tp->total_retrans);
 
         tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 54139fa514e6..eadb693eef55 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -369,11 +369,10 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
          * We do take care of PMTU discovery (RFC1191) special case :
          * we can receive locally generated ICMP messages while socket is held.
          */
-        if (sock_owned_by_user(sk) &&
-            type != ICMP_DEST_UNREACH &&
-            code != ICMP_FRAG_NEEDED)
-                NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
-
+        if (sock_owned_by_user(sk)) {
+                if (!(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED))
+                        NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
+        }
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
@@ -497,6 +496,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                  * errors returned from accept().
                  */
                 inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                 goto out;
 
         case TCP_SYN_SENT:
@@ -1501,8 +1501,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          * clogging syn queue with openreqs with exponentially increasing
          * timeout.
          */
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                 goto drop;
+        }
 
         req = inet_reqsk_alloc(&tcp_request_sock_ops);
         if (!req)
@@ -1667,6 +1669,7 @@ drop_and_release:
 drop_and_free:
         reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return 0;
 }
 EXPORT_SYMBOL(tcp_v4_conn_request);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 79c8dbe59b54..1f4d405eafba 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1952,6 +1952,7 @@ struct proto udp_prot = {
         .recvmsg           = udp_recvmsg,
         .sendpage          = udp_sendpage,
         .backlog_rcv       = __udp_queue_rcv_skb,
+        .release_cb        = ip4_datagram_release_cb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .rehash            = udp_v4_rehash,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 420e56326384..1b5d8cb9b123 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1660,6 +1660,7 @@ static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
         if (dev->addr_len != IEEE802154_ADDR_LEN)
                 return -1;
         memcpy(eui, dev->dev_addr, 8);
+        eui[0] ^= 2;
         return 0;
 }
 
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ecc35b93314b..384233188ac1 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -472,7 +472,10 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, hdr_len);
         __skb_pull(skb, ah_hlen + hdr_len);
-        skb_set_transport_header(skb, -hdr_len);
+        if (x->props.mode == XFRM_MODE_TUNNEL)
+                skb_reset_transport_header(skb);
+        else
+                skb_set_transport_header(skb, -hdr_len);
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -593,9 +596,13 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, hdr_len);
-        skb->transport_header = skb->network_header;
         __skb_pull(skb, ah_hlen + hdr_len);
 
+        if (x->props.mode == XFRM_MODE_TUNNEL)
+                skb_reset_transport_header(skb);
+        else
+                skb_set_transport_header(skb, -hdr_len);
+
         err = nexthdr;
 
 out_free:
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 8edf2601065a..7a778b9a7b85 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -380,7 +380,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
-                                datagram_recv_ctl(sk, msg, skb);
+                                ip6_datagram_recv_ctl(sk, msg, skb);
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin->sin6_scope_id = IP6CB(skb)->iif;
                 } else {
@@ -468,7 +468,8 @@ out:
 }
 
 
-int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
+int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
+                          struct sk_buff *skb)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet6_skb_parm *opt = IP6CB(skb);
@@ -597,11 +598,12 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
         return 0;
 }
+EXPORT_SYMBOL_GPL(ip6_datagram_recv_ctl);
 
-int datagram_send_ctl(struct net *net, struct sock *sk,
-                      struct msghdr *msg, struct flowi6 *fl6,
-                      struct ipv6_txoptions *opt,
-                      int *hlimit, int *tclass, int *dontfrag)
+int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
+                          struct msghdr *msg, struct flowi6 *fl6,
+                          struct ipv6_txoptions *opt,
+                          int *hlimit, int *tclass, int *dontfrag)
 {
         struct in6_pktinfo *src_info;
         struct cmsghdr *cmsg;
@@ -871,4 +873,4 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
 exit_f:
         return err;
 }
-EXPORT_SYMBOL_GPL(datagram_send_ctl);
+EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 282f3723ee19..40ffd72243a4 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -300,7 +300,10 @@ static int esp_input_done2(struct sk_buff *skb, int err)
 
         pskb_trim(skb, skb->len - alen - padlen - 2);
         __skb_pull(skb, hlen);
-        skb_set_transport_header(skb, -hdr_len);
+        if (x->props.mode == XFRM_MODE_TUNNEL)
+                skb_reset_transport_header(skb);
+        else
+                skb_set_transport_header(skb, -hdr_len);
 
         err = nexthdr[1];
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index b4a9fd51dae7..fff5bdd8b680 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -81,10 +81,22 @@ static inline struct sock *icmpv6_sk(struct net *net)
         return net->ipv6.icmp_sk[smp_processor_id()];
 }
 
+static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                       u8 type, u8 code, int offset, __be32 info)
+{
+        struct net *net = dev_net(skb->dev);
+
+        if (type == ICMPV6_PKT_TOOBIG)
+                ip6_update_pmtu(skb, net, info, 0, 0);
+        else if (type == NDISC_REDIRECT)
+                ip6_redirect(skb, net, 0, 0);
+}
+
 static int icmpv6_rcv(struct sk_buff *skb);
 
 static const struct inet6_protocol icmpv6_protocol = {
         .handler        =       icmpv6_rcv,
+        .err_handler    =       icmpv6_err,
         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 29124b7a04c8..d6de4b447250 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -365,8 +365,8 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
                 msg.msg_control = (void*)(fl->opt+1);
                 memset(&flowi6, 0, sizeof(flowi6));
 
-                err = datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt, &junk,
-                                        &junk, &junk);
+                err = ip6_datagram_send_ctl(net, sk, &msg, &flowi6, fl->opt,
+                                            &junk, &junk, &junk);
                 if (err)
                         goto done;
                 err = -EINVAL;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c727e4712751..131dd097736d 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -960,7 +960,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
         int ret;
 
         if (!ip6_tnl_xmit_ctl(t))
-                return -1;
+                goto tx_err;
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5552d13ae92f..0c7c03d50dc0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1213,10 +1213,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 if (dst_allfrag(rt->dst.path))
                         cork->flags |= IPCORK_ALLFRAG;
                 cork->length = 0;
-                exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
+                exthdrlen = (opt ? opt->opt_flen : 0);
                 length += exthdrlen;
                 transhdrlen += exthdrlen;
-                dst_exthdrlen = rt->dst.header_len;
+                dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
         } else {
                 rt = (struct rt6_info *)cork->dst;
                 fl6 = &inet->cork.fl.u.ip6;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 26dcdec9e3a5..8fd154e5f079 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1710,6 +1710,9 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                         return -EINVAL;
                 if (get_user(v, (u32 __user *)optval))
                         return -EFAULT;
+                /* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
+                if (v != RT_TABLE_DEFAULT && v >= 100000000)
+                        return -EINVAL;
                 if (sk == mrt->mroute6_sk)
                         return -EBUSY;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ee94d31c9d4d..d1e2e8ef29c5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -476,8 +476,8 @@ sticky_done:
                 msg.msg_controllen = optlen;
                 msg.msg_control = (void*)(opt+1);
 
-                retv = datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk, &junk,
-                                         &junk);
+                retv = ip6_datagram_send_ctl(net, sk, &msg, &fl6, opt, &junk,
+                                             &junk, &junk);
                 if (retv)
                         goto done;
 update:
@@ -1002,7 +1002,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 release_sock(sk);
 
                 if (skb) {
-                        int err = datagram_recv_ctl(sk, &msg, skb);
+                        int err = ip6_datagram_recv_ctl(sk, &msg, skb);
                         kfree_skb(skb);
                         if (err)
                                 return err;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6cd29b1e8b92..70fa81449997 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -507,7 +507,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         sock_recv_ts_and_drops(msg, sk, skb);
 
         if (np->rxopt.all)
-                datagram_recv_ctl(sk, msg, skb);
+                ip6_datagram_recv_ctl(sk, msg, skb);
 
         err = copied;
         if (flags & MSG_TRUNC)
@@ -822,8 +822,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e229a3bc345d..363d8b7772e8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -928,7 +928,7 @@ restart:
         dst_hold(&rt->dst);
         read_unlock_bh(&table->tb6_lock);
 
-        if (!rt->n && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!rt->n && !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL)))
                 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
         else if (!(rt->dst.flags & DST_HOST))
                 nrt = rt6_alloc_clone(rt, &fl6->daddr);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 93825dd3a7c0..4f43537197ef 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -423,6 +423,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 }
 
                 inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                 goto out;
 
         case TCP_SYN_SENT:
@@ -958,8 +959,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                 goto drop;
+        }
 
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (req == NULL)
@@ -1108,6 +1111,7 @@ drop_and_release:
 drop_and_free:
         reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return 0; /* don't send reset */
 }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index dfaa29b8b293..fb083295ff0b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -443,7 +443,7 @@ try_again:
                         ip_cmsg_recv(msg, skb);
         } else {
                 if (np->rxopt.all)
-                        datagram_recv_ctl(sk, msg, skb);
+                        ip6_datagram_recv_ctl(sk, msg, skb);
         }
 
         err = copied;
@@ -1153,8 +1153,8 @@ do_udp_sendmsg:
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1a9f3723c13c..2ac884d0e89b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -168,6 +168,51 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 
 }
 
+/* Lookup the tunnel socket, possibly involving the fs code if the socket is
+ * owned by userspace.  A struct sock returned from this function must be
+ * released using l2tp_tunnel_sock_put once you're done with it.
+ */
+struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
+{
+        int err = 0;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+
+        if (!tunnel)
+                goto out;
+
+        if (tunnel->fd >= 0) {
+                /* Socket is owned by userspace, who might be in the process
+                 * of closing it.  Look the socket up using the fd to ensure
+                 * consistency.
+                 */
+                sock = sockfd_lookup(tunnel->fd, &err);
+                if (sock)
+                        sk = sock->sk;
+        } else {
+                /* Socket is owned by kernelspace */
+                sk = tunnel->sock;
+        }
+
+out:
+        return sk;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup);
+
+/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
+void l2tp_tunnel_sock_put(struct sock *sk)
+{
+        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        if (tunnel) {
+                if (tunnel->fd >= 0) {
+                        /* Socket is owned by userspace */
+                        sockfd_put(sk->sk_socket);
+                }
+                sock_put(sk);
+        }
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
+
 /* Lookup a session by id in the global session list
  */
 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
@@ -1123,8 +1168,6 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
         struct udphdr *uh;
         struct inet_sock *inet;
         __wsum csum;
-        int old_headroom;
-        int new_headroom;
         int headroom;
         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         int udp_len;
@@ -1136,16 +1179,12 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
          */
         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                 uhlen + hdr_len;
-        old_headroom = skb_headroom(skb);
         if (skb_cow_head(skb, headroom)) {
                 kfree_skb(skb);
                 return NET_XMIT_DROP;
         }
 
-        new_headroom = skb_headroom(skb);
         skb_orphan(skb);
-        skb->truesize += new_headroom - old_headroom;
-
         /* Setup L2TP header */
         session->build_header(session, __skb_push(skb, hdr_len));
 
@@ -1607,6 +1646,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         tunnel->old_sk_destruct = sk->sk_destruct;
         sk->sk_destruct = &l2tp_tunnel_destruct;
         tunnel->sock = sk;
+        tunnel->fd = fd;
         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
 
         sk->sk_allocation = GFP_ATOMIC;
@@ -1642,24 +1682,32 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-        int err = 0;
-        struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
+        int err = -EBADF;
+        struct socket *sock = NULL;
+        struct sock *sk = NULL;
+
+        sk = l2tp_tunnel_sock_lookup(tunnel);
+        if (!sk)
+                goto out;
+
+        sock = sk->sk_socket;
+        BUG_ON(!sock);
 
         /* Force the tunnel socket to close. This will eventually
          * cause the tunnel to be deleted via the normal socket close
          * mechanisms when userspace closes the tunnel socket.
          */
-        if (sock != NULL) {
-                err = inet_shutdown(sock, 2);
+        err = inet_shutdown(sock, 2);
 
-                /* If the tunnel's socket was created by the kernel,
-                 * close the socket here since the socket was not
-                 * created by userspace.
-                 */
-                if (sock->file == NULL)
-                        err = inet_release(sock);
-        }
+        /* If the tunnel's socket was created by the kernel,
+         * close the socket here since the socket was not
+         * created by userspace.
+         */
+        if (sock->file == NULL)
+                err = inet_release(sock);
 
+        l2tp_tunnel_sock_put(sk);
+out:
         return err;
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 56d583e083a7..e62204cad4fe 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,7 +188,8 @@ struct l2tp_tunnel {
         int (*recv_payload_hook)(struct sk_buff *skb);
         void (*old_sk_destruct)(struct sock *);
         struct sock             *sock;          /* Parent socket */
-        int                     fd;
+        int                     fd;             /* Parent fd, if tunnel socket
+                                                 * was created by userspace */
 
         uint8_t                 priv[0];        /* private data */
 };
@@ -228,6 +229,8 @@ out:
         return tunnel;
 }
 
+extern struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel);
+extern void l2tp_tunnel_sock_put(struct sock *sk);
 extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
 extern struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
 extern struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 927547171bc7..8ee4a86ae996 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -554,8 +554,8 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
-                                        &hlimit, &tclass, &dontfrag);
+                err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, opt,
+                                            &hlimit, &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -646,7 +646,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                             struct msghdr *msg, size_t len, int noblock,
                             int flags, int *addr_len)
 {
-        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
         struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)msg->msg_name;
         size_t copied = 0;
         int err = -EOPNOTSUPP;
@@ -688,8 +688,8 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                         lsa->l2tp_scope_id = IP6CB(skb)->iif;
         }
 
-        if (inet->cmsg_flags)
-                ip_cmsg_recv(msg, skb);
+        if (np->rxopt.all)
+                ip6_datagram_recv_ctl(sk, msg, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 286366ef8930..716605c241f4 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -388,8 +388,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         struct l2tp_session *session;
         struct l2tp_tunnel *tunnel;
         struct pppol2tp_session *ps;
-        int old_headroom;
-        int new_headroom;
         int uhlen, headroom;
 
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -408,7 +406,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (tunnel == NULL)
                 goto abort_put_sess;
 
-        old_headroom = skb_headroom(skb);
         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
         headroom = NET_SKB_PAD +
                    sizeof(struct iphdr) + /* IP header */
@@ -418,9 +415,6 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         if (skb_cow_head(skb, headroom))
                 goto abort_put_sess_tun;
 
-        new_headroom = skb_headroom(skb);
-        skb->truesize += new_headroom - old_headroom;
-
         /* Setup PPP header */
         __skb_push(skb, sizeof(ppph));
         skb->data[0] = ppph[0];
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 47e0aca614b7..516fbc96feff 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -164,7 +164,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                         sta = sta_info_get(sdata, mac_addr);
                 else
                         sta = sta_info_get_bss(sdata, mac_addr);
-                if (!sta) {
+                /*
+                 * The ASSOC test makes sure the driver is ready to
+                 * receive the key. When wpa_supplicant has roamed
+                 * using FT, it attempts to set the key before
+                 * association has completed, this rejects that attempt
+                 * so it will set the key again after assocation.
+                 *
+                 * TODO: accept the key if we have a station entry and
+                 *       add it to the device after the station.
+                 */
+                if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
                         ieee80211_key_free(sdata->local, key);
                         err = -ENOENT;
                         goto out_unlock;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8563b9a5cac3..2ed065c09562 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1358,10 +1358,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
-                                    bool offchannel_ps_enable);
-void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool offchannel_ps_disable);
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
+void ieee80211_offchannel_return(struct ieee80211_local *local);
 void ieee80211_roc_setup(struct ieee80211_local *local);
 void ieee80211_start_next_roc(struct ieee80211_local *local);
 void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 47aeee2d8db1..2659e428b80c 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -215,6 +215,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
         skb->priority = 7;
 
         info->control.vif = &sdata->vif;
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
         ieee80211_set_qos_hdr(sdata, skb);
 }
 
@@ -246,11 +247,13 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
                 return -EAGAIN;
 
         skb = dev_alloc_skb(local->tx_headroom +
+                            IEEE80211_ENCRYPT_HEADROOM +
+                            IEEE80211_ENCRYPT_TAILROOM +
                             hdr_len +
                             2 + 15 /* PERR IE */);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->tx_headroom);
+        skb_reserve(skb, local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index a5379aea7d09..a3ad4c3c80a3 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -102,8 +102,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
-                                    bool offchannel_ps_enable)
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -134,8 +133,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                         netif_tx_stop_all_queues(sdata->dev);
-                        if (offchannel_ps_enable &&
-                            (sdata->vif.type == NL80211_IFTYPE_STATION) &&
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
                             sdata->u.mgd.associated)
                                 ieee80211_offchannel_ps_enable(sdata);
                 }
@@ -143,8 +141,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
-void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool offchannel_ps_disable)
+void ieee80211_offchannel_return(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -163,11 +160,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                         continue;
 
                 /* Tell AP we're back */
-                if (offchannel_ps_disable &&
-                    sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_disable(sdata);
-                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_disable(sdata);
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                         /*
@@ -385,7 +380,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                         local->tmp_channel = NULL;
                         ieee80211_hw_config(local, 0);
 
-                        ieee80211_offchannel_return(local, true);
+                        ieee80211_offchannel_return(local);
                 }
 
                 ieee80211_recalc_idle(local);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index d59fc6818b1c..bf82e69d0601 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -292,7 +292,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         if (!was_hw_scan) {
                 ieee80211_configure_filter(local);
                 drv_sw_scan_complete(local);
-                ieee80211_offchannel_return(local, true);
+                ieee80211_offchannel_return(local);
         }
 
         ieee80211_recalc_idle(local);
@@ -341,7 +341,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
-        ieee80211_offchannel_stop_vifs(local, true);
+        ieee80211_offchannel_stop_vifs(local);
 
         ieee80211_configure_filter(local);
 
@@ -678,12 +678,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
         local->scan_channel = NULL;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-        /*
-         * Re-enable vifs and beaconing.  Leave PS
-         * in off-channel state..will put that back
-         * on-channel at the end of scanning.
-         */
-        ieee80211_offchannel_return(local, false);
+        /* disable PS */
+        ieee80211_offchannel_return(local);
 
         *next_delay = HZ / 5;
         /* afterwards, resume scan & go to next channel */
@@ -693,8 +689,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
 static void ieee80211_scan_state_resume(struct ieee80211_local *local,
                                         unsigned long *next_delay)
 {
-        /* PS already is in off-channel mode */
-        ieee80211_offchannel_stop_vifs(local, false);
+        ieee80211_offchannel_stop_vifs(local);
 
         if (local->ops->flush) {
                 drv_flush(local, false);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e9eadc40c09c..467c1d1b66f2 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1673,10 +1673,13 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                         chanctx_conf =
                                 rcu_dereference(tmp_sdata->vif.chanctx_conf);
         }
-        if (!chanctx_conf)
-                goto fail_rcu;
 
-        chan = chanctx_conf->def.chan;
+        if (chanctx_conf)
+                chan = chanctx_conf->def.chan;
+        else if (!local->use_chanctx)
+                chan = local->_oper_channel;
+        else
+                goto fail_rcu;
 
         /*
          * Frame injection is not allowed if beaconing is not allowed
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 016d95ead930..e4a0c4fb3a7c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1376,11 +1376,12 @@ void nf_conntrack_cleanup(struct net *net)
         synchronize_net();
         nf_conntrack_proto_fini(net);
         nf_conntrack_cleanup_net(net);
+}
 
-        if (net_eq(net, &init_net)) {
-                RCU_INIT_POINTER(nf_ct_destroy, NULL);
-                nf_conntrack_cleanup_init_net();
-        }
+void nf_conntrack_cleanup_end(void)
+{
+        RCU_INIT_POINTER(nf_ct_destroy, NULL);
+        nf_conntrack_cleanup_init_net();
 }
 
 void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 363285d544a1..e7185c684816 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -575,6 +575,7 @@ static int __init nf_conntrack_standalone_init(void)
 static void __exit nf_conntrack_standalone_fini(void)
 {
         unregister_pernet_subsys(&nf_conntrack_net_ops);
+        nf_conntrack_cleanup_end();
 }
 
 module_init(nf_conntrack_standalone_init);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8d987c3573fd..7b3a9e5999c0 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -345,19 +345,27 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target,
 }
 EXPORT_SYMBOL_GPL(xt_find_revision);
 
-static char *textify_hooks(char *buf, size_t size, unsigned int mask)
+static char *
+textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
 {
-        static const char *const names[] = {
+        static const char *const inetbr_names[] = {
                 "PREROUTING", "INPUT", "FORWARD",
                 "OUTPUT", "POSTROUTING", "BROUTING",
         };
-        unsigned int i;
+        static const char *const arp_names[] = {
+                "INPUT", "FORWARD", "OUTPUT",
+        };
+        const char *const *names;
+        unsigned int i, max;
         char *p = buf;
         bool np = false;
         int res;
 
+        names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names;
+        max   = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) :
+                                           ARRAY_SIZE(inetbr_names);
         *p = '\0';
-        for (i = 0; i < ARRAY_SIZE(names); ++i) {
+        for (i = 0; i < max; ++i) {
                 if (!(mask & (1 << i)))
                         continue;
                 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
@@ -402,8 +410,10 @@ int xt_check_match(struct xt_mtchk_param *par,
                 pr_err("%s_tables: %s match: used from hooks %s, but only "
                        "valid from %s\n",
                        xt_prefix[par->family], par->match->name,
-                       textify_hooks(used, sizeof(used), par->hook_mask),
-                       textify_hooks(allow, sizeof(allow), par->match->hooks));
+                       textify_hooks(used, sizeof(used), par->hook_mask,
+                                     par->family),
+                       textify_hooks(allow, sizeof(allow), par->match->hooks,
+                                     par->family));
                 return -EINVAL;
         }
         if (par->match->proto && (par->match->proto != proto || inv_proto)) {
@@ -575,8 +585,10 @@ int xt_check_target(struct xt_tgchk_param *par,
                 pr_err("%s_tables: %s target: used from hooks %s, but only "
                        "usable from %s\n",
                        xt_prefix[par->family], par->target->name,
-                       textify_hooks(used, sizeof(used), par->hook_mask),
-                       textify_hooks(allow, sizeof(allow), par->target->hooks));
+                       textify_hooks(used, sizeof(used), par->hook_mask,
+                                     par->family),
+                       textify_hooks(allow, sizeof(allow), par->target->hooks,
+                                     par->family));
                 return -EINVAL;
         }
         if (par->target->proto && (par->target->proto != proto || inv_proto)) {
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 2a0843081840..bde009ed8d3b 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -109,7 +109,7 @@ static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
         struct xt_ct_target_info *info = par->targinfo;
         struct nf_conntrack_tuple t;
         struct nf_conn *ct;
-        int ret;
+        int ret = -EOPNOTSUPP;
 
         if (info->flags & ~XT_CT_NOTRACK)
                 return -EINVAL;
@@ -247,7 +247,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
         struct xt_ct_target_info_v1 *info = par->targinfo;
         struct nf_conntrack_tuple t;
         struct nf_conn *ct;
-        int ret;
+        int ret = -EOPNOTSUPP;
 
         if (info->flags & ~XT_CT_NOTRACK)
                 return -EINVAL;
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index a9327e2e48ce..670cbc3518de 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -35,10 +35,11 @@
 /* Must be called with rcu_read_lock. */
 static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
 {
-        if (unlikely(!vport)) {
-                kfree_skb(skb);
-                return;
-        }
+        if (unlikely(!vport))
+                goto error;
+
+        if (unlikely(skb_warn_if_lro(skb)))
+                goto error;
 
         /* Make our own copy of the packet.  Otherwise we will mangle the
          * packet for anyone who came before us (e.g. tcpdump via AF_PACKET).
@@ -50,6 +51,10 @@ static void netdev_port_receive(struct vport *vport, struct sk_buff *skb)
 
         skb_push(skb, ETH_HLEN);
         ovs_vport_receive(vport, skb);
+        return;
+
+error:
+        kfree_skb(skb);
 }
 
 /* Called with rcu_read_lock and bottom-halves disabled. */
@@ -169,9 +174,6 @@ static int netdev_send(struct vport *vport, struct sk_buff *skb)
                 goto error;
         }
 
-        if (unlikely(skb_warn_if_lro(skb)))
-                goto error;
-
         skb->dev = netdev_vport->dev;
         len = skb->len;
         dev_queue_xmit(skb);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e639645e8fec..c111bd0e083a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2361,13 +2361,15 @@ static int packet_release(struct socket *sock)
 
         packet_flush_mclist(sk);
 
-        memset(&req_u, 0, sizeof(req_u));
-
-        if (po->rx_ring.pg_vec)
+        if (po->rx_ring.pg_vec) {
+                memset(&req_u, 0, sizeof(req_u));
                 packet_set_ring(sk, &req_u, 1, 0);
+        }
 
-        if (po->tx_ring.pg_vec)
+        if (po->tx_ring.pg_vec) {
+                memset(&req_u, 0, sizeof(req_u));
                 packet_set_ring(sk, &req_u, 1, 1);
+        }
 
         fanout_release(sk);
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 298c0ddfb57e..3d2acc7a9c80 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -438,18 +438,18 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 if (q->rate) {
                         struct sk_buff_head *list = &sch->q;
 
-                        delay += packet_len_2_sched_time(skb->len, q);
-
                         if (!skb_queue_empty(list)) {
                                 /*
-                                 * Last packet in queue is reference point (now).
-                                 * First packet in queue is already in flight,
-                                 * calculate this time bonus and substract
+                                 * Last packet in queue is reference point (now),
+                                 * calculate this time bonus and subtract
                                  * from delay.
                                  */
-                                delay -= now - netem_skb_cb(skb_peek(list))->time_to_send;
+                                delay -= netem_skb_cb(skb_peek_tail(list))->time_to_send - now;
+                                delay = max_t(psched_tdiff_t, 0, delay);
                                 now = netem_skb_cb(skb_peek_tail(list))->time_to_send;
                         }
+
+                        delay += packet_len_2_sched_time(skb->len, q);
                 }
 
                 cb->time_to_send = now + delay;
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 159b9bc5d633..d8420ae614dc 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -71,7 +71,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
                 return;
 
         if (atomic_dec_and_test(&key->refcnt)) {
-                kfree(key);
+                kzfree(key);
                 SCTP_DBG_OBJCNT_DEC(keys);
         }
 }
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 17a001bac2cc..1a9c5fb77310 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -249,6 +249,8 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
 /* Final destructor for endpoint.  */
 static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 {
+        int i;
+
         SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
 
         /* Free up the HMAC transform. */
@@ -271,6 +273,9 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
         sctp_inq_free(&ep->base.inqueue);
         sctp_bind_addr_free(&ep->base.bind_addr);
 
+        for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
+                memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
+
         /* Remove and free the port */
         if (sctp_sk(ep->base.sk)->bind_hash)
                 sctp_put_port(ep->base.sk);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 379c81dee9d1..9bcdbd02d777 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -224,7 +224,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
 
 /* Free the outqueue structure and any related pending chunks.
  */
-void sctp_outq_teardown(struct sctp_outq *q)
+static void __sctp_outq_teardown(struct sctp_outq *q)
 {
         struct sctp_transport *transport;
         struct list_head *lchunk, *temp;
@@ -277,8 +277,6 @@ void sctp_outq_teardown(struct sctp_outq *q)
                 sctp_chunk_free(chunk);
         }
 
-        q->error = 0;
-
         /* Throw away any leftover control chunks. */
         list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
                 list_del_init(&chunk->list);
@@ -286,11 +284,17 @@ void sctp_outq_teardown(struct sctp_outq *q)
         }
 }
 
+void sctp_outq_teardown(struct sctp_outq *q)
+{
+        __sctp_outq_teardown(q);
+        sctp_outq_init(q->asoc, q);
+}
+
 /* Free the outqueue structure and any related pending chunks.  */
 void sctp_outq_free(struct sctp_outq *q)
 {
         /* Throw away leftover chunks. */
-        sctp_outq_teardown(q);
+        __sctp_outq_teardown(q);
 
         /* If we were kmalloc()'d, free the memory.  */
         if (q->malloced)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 618ec7e216ca..5131fcfedb03 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1779,8 +1779,10 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
 
         /* Update the content of current association. */
         sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
-        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
         sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
+        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
+                        SCTP_STATE(SCTP_STATE_ESTABLISHED));
+        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
         return SCTP_DISPOSITION_CONSUME;
 
 nomem_ev:
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e65758cb038..cedd9bf67b8c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3390,7 +3390,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
 
         ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
 out:
-        kfree(authkey);
+        kzfree(authkey);
         return ret;
 }
 
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 043889ac86c0..bf3c6e8fc401 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -366,7 +366,11 @@ int sctp_sysctl_net_register(struct net *net)
 
 void sctp_sysctl_net_unregister(struct net *net)
 {
+        struct ctl_table *table;
+
+        table = net->sctp.sysctl_header->ctl_table_arg;
         unregister_net_sysctl_table(net->sctp.sysctl_header);
+        kfree(table);
 }
 
 static struct ctl_table_header * sctp_sysctl_header;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index bfa31714581f..fb20f25ddec9 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -98,9 +98,25 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task)
         list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list);
 }
 
+static void rpc_rotate_queue_owner(struct rpc_wait_queue *queue)
+{
+        struct list_head *q = &queue->tasks[queue->priority];
+        struct rpc_task *task;
+
+        if (!list_empty(q)) {
+                task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+                if (task->tk_owner == queue->owner)
+                        list_move_tail(&task->u.tk_wait.list, q);
+        }
+}
+
 static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
 {
-        queue->priority = priority;
+        if (queue->priority != priority) {
+                /* Fairness: rotate the list when changing priority */
+                rpc_rotate_queue_owner(queue);
+                queue->priority = priority;
+        }
 }
 
 static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 0a148c9d2a5c..0f679df7d072 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -465,7 +465,7 @@ static int svc_udp_get_dest_address4(struct svc_rqst *rqstp,
 }
 
 /*
- * See net/ipv6/datagram.c : datagram_recv_ctl
+ * See net/ipv6/datagram.c : ip6_datagram_recv_ctl
  */
 static int svc_udp_get_dest_address6(struct svc_rqst *rqstp,
                                      struct cmsghdr *cmh)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 01592d7d4789..45f1618c8e23 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                                                   &iwe, IW_EV_UINT_LEN);
         }
 
-        buf = kmalloc(30, GFP_ATOMIC);
+        buf = kmalloc(31, GFP_ATOMIC);
         if (buf) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVCUSTOM;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 41eabc46f110..07c585756d2a 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2656,7 +2656,7 @@ static void xfrm_policy_fini(struct net *net)
                 WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir]));
 
                 htab = &net->xfrm.policy_bydst[dir];
-                sz = (htab->hmask + 1);
+                sz = (htab->hmask + 1) * sizeof(struct hlist_head);
                 WARN_ON(!hlist_empty(htab->table));
                 xfrm_hash_free(htab->table, sz);
         }
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 765f6fe951eb..35754cc8a9e5 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -242,11 +242,13 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
         u32 diff;
         struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
         u32 seq = ntohl(net_seq);
-        u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
+        u32 pos;
 
         if (!replay_esn->replay_window)
                 return;
 
+        pos = (replay_esn->seq - 1) % replay_esn->replay_window;
+
         if (seq > replay_esn->seq) {
                 diff = seq - replay_esn->seq;
 
diff --git a/samples/seccomp/Makefile b/samples/seccomp/Makefile
index bbbd276659ba..7203e66dcd6f 100644
--- a/samples/seccomp/Makefile
+++ b/samples/seccomp/Makefile
@@ -19,6 +19,7 @@ bpf-direct-objs := bpf-direct.o
 
 # Try to match the kernel target.
 ifndef CONFIG_64BIT
+ifndef CROSS_COMPILE
 
 # s390 has -m31 flag to build 31 bit binaries
 ifndef CONFIG_S390
@@ -35,6 +36,7 @@ HOSTLOADLIBES_bpf-direct += $(MFLAG)
 HOSTLOADLIBES_bpf-fancy += $(MFLAG)
 HOSTLOADLIBES_dropper += $(MFLAG)
 endif
+endif
 
 # Tell kbuild to always build the programs
 always := $(hostprogs-y)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 4d2c7dfdaabd..2bb08a962ce3 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -230,12 +230,12 @@ our $Inline	= qr{inline|__always_inline|noinline};
 our $Member     = qr{->$Ident|\.$Ident|\[[^]]*\]};
 our $Lval       = qr{$Ident(?:$Member)*};
 
-our $Float_hex  = qr{(?i:0x[0-9a-f]+p-?[0-9]+[fl]?)};
-our $Float_dec  = qr{(?i:((?:[0-9]+\.[0-9]*|[0-9]*\.[0-9]+)(?:e-?[0-9]+)?[fl]?))};
-our $Float_int  = qr{(?i:[0-9]+e-?[0-9]+[fl]?)};
+our $Float_hex  = qr{(?i)0x[0-9a-f]+p-?[0-9]+[fl]?};
+our $Float_dec  = qr{(?i)(?:[0-9]+\.[0-9]*|[0-9]*\.[0-9]+)(?:e-?[0-9]+)?[fl]?};
+our $Float_int  = qr{(?i)[0-9]+e-?[0-9]+[fl]?};
 our $Float      = qr{$Float_hex|$Float_dec|$Float_int};
-our $Constant   = qr{(?:$Float|(?i:(?:0x[0-9a-f]+|[0-9]+)[ul]*))};
-our $Assignment = qr{(?:\*\=|/=|%=|\+=|-=|<<=|>>=|&=|\^=|\|=|=)};
+our $Constant   = qr{$Float|(?i)(?:0x[0-9a-f]+|[0-9]+)[ul]*};
+our $Assignment = qr{\*\=|/=|%=|\+=|-=|<<=|>>=|&=|\^=|\|=|=};
 our $Compare    = qr{<=|>=|==|!=|<|>};
 our $Operators  = qr{
                         <=|>=|==|!=|
diff --git a/security/capability.c b/security/capability.c
index 0fe5a026aef8..579775088967 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -709,16 +709,31 @@ static void cap_req_classify_flow(const struct request_sock *req,
 {
 }
 
+static int cap_tun_dev_alloc_security(void **security)
+{
+        return 0;
+}
+
+static void cap_tun_dev_free_security(void *security)
+{
+}
+
 static int cap_tun_dev_create(void)
 {
         return 0;
 }
 
-static void cap_tun_dev_post_create(struct sock *sk)
+static int cap_tun_dev_attach_queue(void *security)
+{
+        return 0;
+}
+
+static int cap_tun_dev_attach(struct sock *sk, void *security)
 {
+        return 0;
 }
 
-static int cap_tun_dev_attach(struct sock *sk)
+static int cap_tun_dev_open(void *security)
 {
         return 0;
 }
@@ -1050,8 +1065,11 @@ void __init security_fixup_ops(struct security_operations *ops)
         set_to_cap_if_null(ops, secmark_refcount_inc);
         set_to_cap_if_null(ops, secmark_refcount_dec);
         set_to_cap_if_null(ops, req_classify_flow);
+        set_to_cap_if_null(ops, tun_dev_alloc_security);
+        set_to_cap_if_null(ops, tun_dev_free_security);
         set_to_cap_if_null(ops, tun_dev_create);
-        set_to_cap_if_null(ops, tun_dev_post_create);
+        set_to_cap_if_null(ops, tun_dev_open);
+        set_to_cap_if_null(ops, tun_dev_attach_queue);
         set_to_cap_if_null(ops, tun_dev_attach);
 #endif  /* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/security/security.c b/security/security.c
index daa97f4ac9d1..7b88c6aeaed4 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1254,24 +1254,42 @@ void security_secmark_refcount_dec(void)
 }
 EXPORT_SYMBOL(security_secmark_refcount_dec);
 
+int security_tun_dev_alloc_security(void **security)
+{
+        return security_ops->tun_dev_alloc_security(security);
+}
+EXPORT_SYMBOL(security_tun_dev_alloc_security);
+
+void security_tun_dev_free_security(void *security)
+{
+        security_ops->tun_dev_free_security(security);
+}
+EXPORT_SYMBOL(security_tun_dev_free_security);
+
 int security_tun_dev_create(void)
 {
         return security_ops->tun_dev_create();
 }
 EXPORT_SYMBOL(security_tun_dev_create);
 
-void security_tun_dev_post_create(struct sock *sk)
+int security_tun_dev_attach_queue(void *security)
 {
-        return security_ops->tun_dev_post_create(sk);
+        return security_ops->tun_dev_attach_queue(security);
 }
-EXPORT_SYMBOL(security_tun_dev_post_create);
+EXPORT_SYMBOL(security_tun_dev_attach_queue);
 
-int security_tun_dev_attach(struct sock *sk)
+int security_tun_dev_attach(struct sock *sk, void *security)
 {
-        return security_ops->tun_dev_attach(sk);
+        return security_ops->tun_dev_attach(sk, security);
 }
 EXPORT_SYMBOL(security_tun_dev_attach);
 
+int security_tun_dev_open(void *security)
+{
+        return security_ops->tun_dev_open(security);
+}
+EXPORT_SYMBOL(security_tun_dev_open);
+
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 61a53367d029..ef26e9611ffb 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4399,6 +4399,24 @@ static void selinux_req_classify_flow(const struct request_sock *req,
         fl->flowi_secid = req->secid;
 }
 
+static int selinux_tun_dev_alloc_security(void **security)
+{
+        struct tun_security_struct *tunsec;
+
+        tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
+        if (!tunsec)
+                return -ENOMEM;
+        tunsec->sid = current_sid();
+
+        *security = tunsec;
+        return 0;
+}
+
+static void selinux_tun_dev_free_security(void *security)
+{
+        kfree(security);
+}
+
 static int selinux_tun_dev_create(void)
 {
         u32 sid = current_sid();
@@ -4414,8 +4432,17 @@ static int selinux_tun_dev_create(void)
                             NULL);
 }
 
-static void selinux_tun_dev_post_create(struct sock *sk)
+static int selinux_tun_dev_attach_queue(void *security)
 {
+        struct tun_security_struct *tunsec = security;
+
+        return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
+                            TUN_SOCKET__ATTACH_QUEUE, NULL);
+}
+
+static int selinux_tun_dev_attach(struct sock *sk, void *security)
+{
+        struct tun_security_struct *tunsec = security;
         struct sk_security_struct *sksec = sk->sk_security;
 
         /* we don't currently perform any NetLabel based labeling here and it
@@ -4425,20 +4452,19 @@ static void selinux_tun_dev_post_create(struct sock *sk)
          * cause confusion to the TUN user that had no idea network labeling
          * protocols were being used */
 
-        /* see the comments in selinux_tun_dev_create() about why we don't use
-         * the sockcreate SID here */
-
-        sksec->sid = current_sid();
+        sksec->sid = tunsec->sid;
         sksec->sclass = SECCLASS_TUN_SOCKET;
+
+        return 0;
 }
 
-static int selinux_tun_dev_attach(struct sock *sk)
+static int selinux_tun_dev_open(void *security)
 {
-        struct sk_security_struct *sksec = sk->sk_security;
+        struct tun_security_struct *tunsec = security;
         u32 sid = current_sid();
         int err;
 
-        err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
+        err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
                            TUN_SOCKET__RELABELFROM, NULL);
         if (err)
                 return err;
@@ -4446,8 +4472,7 @@ static int selinux_tun_dev_attach(struct sock *sk)
                            TUN_SOCKET__RELABELTO, NULL);
         if (err)
                 return err;
-
-        sksec->sid = sid;
+        tunsec->sid = sid;
 
         return 0;
 }
@@ -5642,9 +5667,12 @@ static struct security_operations selinux_ops = {
         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
         .req_classify_flow =            selinux_req_classify_flow,
+        .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
+        .tun_dev_free_security =        selinux_tun_dev_free_security,
         .tun_dev_create =               selinux_tun_dev_create,
-        .tun_dev_post_create =          selinux_tun_dev_post_create,
+        .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
         .tun_dev_attach =               selinux_tun_dev_attach,
+        .tun_dev_open =                 selinux_tun_dev_open,
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index df2de54a958d..14d04e63b1f0 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -150,6 +150,6 @@ struct security_class_mapping secclass_map[] = {
             NULL } },
         { "kernel_service", { "use_as_override", "create_files_as", NULL } },
         { "tun_socket",
-          { COMMON_SOCK_PERMS, NULL } },
+          { COMMON_SOCK_PERMS, "attach_queue", NULL } },
         { NULL }
   };
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 26c7eee1c309..aa47bcabb5f6 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -110,6 +110,10 @@ struct sk_security_struct {
         u16 sclass;                     /* sock security class */
 };
 
+struct tun_security_struct {
+        u32 sid;                        /* SID for the tun device sockets */
+};
+
 struct key_security_struct {
         u32 sid;        /* SID of key */
 };
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 0b6aebacc56b..c78286f6e5d8 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -656,29 +656,43 @@ static char *driver_short_names[] = {
 #define get_azx_dev(substream) (substream->runtime->private_data)
 
 #ifdef CONFIG_X86
-static void __mark_pages_wc(struct azx *chip, void *addr, size_t size, bool on)
+static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool on)
 {
+        int pages;
+
         if (azx_snoop(chip))
                 return;
-        if (addr && size) {
-                int pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        if (!dmab || !dmab->area || !dmab->bytes)
+                return;
+
+#ifdef CONFIG_SND_DMA_SGBUF
+        if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
+                struct snd_sg_buf *sgbuf = dmab->private_data;
                 if (on)
-                        set_memory_wc((unsigned long)addr, pages);
+                        set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
                 else
-                        set_memory_wb((unsigned long)addr, pages);
+                        set_pages_array_wb(sgbuf->page_table, sgbuf->pages);
+                return;
         }
+#endif
+
+        pages = (dmab->bytes + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        if (on)
+                set_memory_wc((unsigned long)dmab->area, pages);
+        else
+                set_memory_wb((unsigned long)dmab->area, pages);
 }
 
 static inline void mark_pages_wc(struct azx *chip, struct snd_dma_buffer *buf,
                                  bool on)
 {
-        __mark_pages_wc(chip, buf->area, buf->bytes, on);
+        __mark_pages_wc(chip, buf, on);
 }
 static inline void mark_runtime_wc(struct azx *chip, struct azx_dev *azx_dev,
-                                   struct snd_pcm_runtime *runtime, bool on)
+                                   struct snd_pcm_substream *substream, bool on)
 {
         if (azx_dev->wc_marked != on) {
-                __mark_pages_wc(chip, runtime->dma_area, runtime->dma_bytes, on);
+                __mark_pages_wc(chip, snd_pcm_get_dma_buf(substream), on);
                 azx_dev->wc_marked = on;
         }
 }
@@ -689,7 +703,7 @@ static inline void mark_pages_wc(struct azx *chip, struct snd_dma_buffer *buf,
 {
 }
 static inline void mark_runtime_wc(struct azx *chip, struct azx_dev *azx_dev,
-                                   struct snd_pcm_runtime *runtime, bool on)
+                                   struct snd_pcm_substream *substream, bool on)
 {
 }
 #endif
@@ -1968,11 +1982,10 @@ static int azx_pcm_hw_params(struct snd_pcm_substream *substream,
 {
         struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
         struct azx *chip = apcm->chip;
-        struct snd_pcm_runtime *runtime = substream->runtime;
         struct azx_dev *azx_dev = get_azx_dev(substream);
         int ret;
 
-        mark_runtime_wc(chip, azx_dev, runtime, false);
+        mark_runtime_wc(chip, azx_dev, substream, false);
         azx_dev->bufsize = 0;
         azx_dev->period_bytes = 0;
         azx_dev->format_val = 0;
@@ -1980,7 +1993,7 @@ static int azx_pcm_hw_params(struct snd_pcm_substream *substream,
                                         params_buffer_bytes(hw_params));
         if (ret < 0)
                 return ret;
-        mark_runtime_wc(chip, azx_dev, runtime, true);
+        mark_runtime_wc(chip, azx_dev, substream, true);
         return ret;
 }
 
@@ -1989,7 +2002,6 @@ static int azx_pcm_hw_free(struct snd_pcm_substream *substream)
         struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
         struct azx_dev *azx_dev = get_azx_dev(substream);
         struct azx *chip = apcm->chip;
-        struct snd_pcm_runtime *runtime = substream->runtime;
         struct hda_pcm_stream *hinfo = apcm->hinfo[substream->stream];
 
         /* reset BDL address */
@@ -2002,7 +2014,7 @@ static int azx_pcm_hw_free(struct snd_pcm_substream *substream)
 
         snd_hda_codec_cleanup(apcm->codec, hinfo, substream);
 
-        mark_runtime_wc(chip, azx_dev, runtime, false);
+        mark_runtime_wc(chip, azx_dev, substream, false);
         return snd_pcm_lib_free_pages(substream);
 }
 
@@ -3613,13 +3625,12 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
         /* 5 Series/3400 */
         { PCI_DEVICE(0x8086, 0x3b56),
           .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH },
-        /* SCH */
+        /* Poulsbo */
         { PCI_DEVICE(0x8086, 0x811b),
-          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_POSFIX_LPIB }, /* Poulsbo */
+          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
+        /* Oaktrail */
         { PCI_DEVICE(0x8086, 0x080a),
-          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_POSFIX_LPIB }, /* Oaktrail */
+          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* ICH */
         { PCI_DEVICE(0x8086, 0x2668),
           .driver_data = AZX_DRIVER_ICH | AZX_DCAPS_OLD_SSYNC |
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index cf3886171109..5faaad219a7f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4694,6 +4694,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1584, 0x9077, "Uniwill P53", ALC880_FIXUP_VOL_KNOB),
         SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810),
         SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM),
+        SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST),
         SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734),
         SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU),
         SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734),
@@ -5708,6 +5709,7 @@ static const struct alc_model_fixup alc268_fixup_models[] = {
 };
 
 static const struct snd_pci_quirk alc268_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x1025, 0x015b, "Acer AOA 150 (ZG5)", ALC268_FIXUP_INV_DMIC),
         /* below is codec SSID since multiple Toshiba laptops have the
          * same PCI SSID 1179:ff00
          */
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index 1d8bb5917594..ef62c435848e 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -685,7 +685,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream,
         }
         sr_val = i;
 
-        lrclk = snd_soc_params_to_bclk(params) / params_rate(params);
+        lrclk = rates[bclk] / params_rate(params);
 
         arizona_aif_dbg(dai, "BCLK %dHz LRCLK %dHz\n",
                         rates[bclk], rates[bclk] / lrclk);
@@ -1082,6 +1082,9 @@ int arizona_init_fll(struct arizona *arizona, int id, int base, int lock_irq,
                         id, ret);
         }
 
+        regmap_update_bits(arizona->regmap, fll->base + 1,
+                           ARIZONA_FLL1_FREERUN, 0);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(arizona_init_fll);
diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
index e6cefe1ac677..d8c65f574658 100644
--- a/sound/soc/codecs/wm2200.c
+++ b/sound/soc/codecs/wm2200.c
@@ -1019,8 +1019,6 @@ static const char *wm2200_mixer_texts[] = {
         "EQR",
         "LHPF1",
         "LHPF2",
-        "LHPF3",
-        "LHPF4",
         "DSP1.1",
         "DSP1.2",
         "DSP1.3",
@@ -1053,7 +1051,6 @@ static int wm2200_mixer_values[] = {
         0x25,
         0x50,   /* EQ */
         0x51,
-        0x52,
         0x60,   /* LHPF1 */
         0x61,   /* LHPF2 */
         0x68,   /* DSP1 */
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index 7a9048dad1cd..1440b3f9b7bb 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -896,8 +896,7 @@ static const unsigned int wm5102_aec_loopback_values[] = {
 
 static const struct soc_enum wm5102_aec_loopback =
         SOC_VALUE_ENUM_SINGLE(ARIZONA_DAC_AEC_CONTROL_1,
-                              ARIZONA_AEC_LOOPBACK_SRC_SHIFT,
-                              ARIZONA_AEC_LOOPBACK_SRC_MASK,
+                              ARIZONA_AEC_LOOPBACK_SRC_SHIFT, 0xf,
                               ARRAY_SIZE(wm5102_aec_loopback_texts),
                               wm5102_aec_loopback_texts,
                               wm5102_aec_loopback_values);
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index ae80c8c28536..7a090968c4f7 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -344,8 +344,7 @@ static const unsigned int wm5110_aec_loopback_values[] = {
 
 static const struct soc_enum wm5110_aec_loopback =
         SOC_VALUE_ENUM_SINGLE(ARIZONA_DAC_AEC_CONTROL_1,
-                              ARIZONA_AEC_LOOPBACK_SRC_SHIFT,
-                              ARIZONA_AEC_LOOPBACK_SRC_MASK,
+                              ARIZONA_AEC_LOOPBACK_SRC_SHIFT, 0xf,
                               ARRAY_SIZE(wm5110_aec_loopback_texts),
                               wm5110_aec_loopback_texts,
                               wm5110_aec_loopback_values);
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 7b198c38f3ef..b6b654837585 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -324,7 +324,7 @@ static int wm_adsp_load(struct wm_adsp *dsp)
 
                 if (reg) {
                         buf = kmemdup(region->data, le32_to_cpu(region->len),
-                                      GFP_KERNEL);
+                                      GFP_KERNEL | GFP_DMA);
                         if (!buf) {
                                 adsp_err(dsp, "Out of memory\n");
                                 return -ENOMEM;
@@ -396,7 +396,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
         hdr = (void*)&firmware->data[0];
         if (memcmp(hdr->magic, "WMDR", 4) != 0) {
                 adsp_err(dsp, "%s: invalid magic\n", file);
-                return -EINVAL;
+                goto out_fw;
         }
 
         adsp_dbg(dsp, "%s: v%d.%d.%d\n", file,
@@ -439,7 +439,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
 
                 if (reg) {
                         buf = kmemdup(blk->data, le32_to_cpu(blk->len),
-                                      GFP_KERNEL);
+                                      GFP_KERNEL | GFP_DMA);
                         if (!buf) {
                                 adsp_err(dsp, "Out of memory\n");
                                 return -ENOMEM;
diff --git a/sound/soc/fsl/imx-pcm-dma.c b/sound/soc/fsl/imx-pcm-dma.c
index bf363d8d044a..500f8ce55d78 100644
--- a/sound/soc/fsl/imx-pcm-dma.c
+++ b/sound/soc/fsl/imx-pcm-dma.c
@@ -154,26 +154,7 @@ static struct snd_soc_platform_driver imx_soc_platform_mx2 = {
         .pcm_free       = imx_pcm_free,
 };
 
-static int imx_soc_platform_probe(struct platform_device *pdev)
+int imx_pcm_dma_init(struct platform_device *pdev)
 {
         return snd_soc_register_platform(&pdev->dev, &imx_soc_platform_mx2);
 }
-
-static int imx_soc_platform_remove(struct platform_device *pdev)
-{
-        snd_soc_unregister_platform(&pdev->dev);
-        return 0;
-}
-
-static struct platform_driver imx_pcm_driver = {
-        .driver = {
-                        .name = "imx-pcm-audio",
-                        .owner = THIS_MODULE,
-        },
-        .probe = imx_soc_platform_probe,
-        .remove = imx_soc_platform_remove,
-};
-
-module_platform_driver(imx_pcm_driver);
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:imx-pcm-audio");
diff --git a/sound/soc/fsl/imx-pcm-fiq.c b/sound/soc/fsl/imx-pcm-fiq.c
index 5ec362ae4d01..920f945cb2f4 100644
--- a/sound/soc/fsl/imx-pcm-fiq.c
+++ b/sound/soc/fsl/imx-pcm-fiq.c
@@ -281,7 +281,7 @@ static struct snd_soc_platform_driver imx_soc_platform_fiq = {
         .pcm_free       = imx_pcm_fiq_free,
 };
 
-static int imx_soc_platform_probe(struct platform_device *pdev)
+int imx_pcm_fiq_init(struct platform_device *pdev)
 {
         struct imx_ssi *ssi = platform_get_drvdata(pdev);
         int ret;
@@ -314,23 +314,3 @@ failed_register:
 
         return ret;
 }
-
-static int imx_soc_platform_remove(struct platform_device *pdev)
-{
-        snd_soc_unregister_platform(&pdev->dev);
-        return 0;
-}
-
-static struct platform_driver imx_pcm_driver = {
-        .driver = {
-                        .name = "imx-fiq-pcm-audio",
-                        .owner = THIS_MODULE,
-        },
-
-        .probe = imx_soc_platform_probe,
-        .remove = imx_soc_platform_remove,
-};
-
-module_platform_driver(imx_pcm_driver);
-
-MODULE_LICENSE("GPL");
diff --git a/sound/soc/fsl/imx-pcm.c b/sound/soc/fsl/imx-pcm.c
index d5cd9eff3b48..0d0625bfcb65 100644
--- a/sound/soc/fsl/imx-pcm.c
+++ b/sound/soc/fsl/imx-pcm.c
@@ -104,6 +104,38 @@ void imx_pcm_free(struct snd_pcm *pcm)
 }
 EXPORT_SYMBOL_GPL(imx_pcm_free);
 
+static int imx_pcm_probe(struct platform_device *pdev)
+{
+        if (strcmp(pdev->id_entry->name, "imx-fiq-pcm-audio") == 0)
+                return imx_pcm_fiq_init(pdev);
+
+        return imx_pcm_dma_init(pdev);
+}
+
+static int imx_pcm_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_platform(&pdev->dev);
+        return 0;
+}
+
+static struct platform_device_id imx_pcm_devtype[] = {
+        { .name = "imx-pcm-audio", },
+        { .name = "imx-fiq-pcm-audio", },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(platform, imx_pcm_devtype);
+
+static struct platform_driver imx_pcm_driver = {
+        .driver = {
+                        .name = "imx-pcm",
+                        .owner = THIS_MODULE,
+        },
+        .id_table = imx_pcm_devtype,
+        .probe = imx_pcm_probe,
+        .remove = imx_pcm_remove,
+};
+module_platform_driver(imx_pcm_driver);
+
 MODULE_DESCRIPTION("Freescale i.MX PCM driver");
 MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/fsl/imx-pcm.h b/sound/soc/fsl/imx-pcm.h
index 83c0ed7d55c9..5ae13a13a353 100644
--- a/sound/soc/fsl/imx-pcm.h
+++ b/sound/soc/fsl/imx-pcm.h
@@ -30,4 +30,22 @@ int snd_imx_pcm_mmap(struct snd_pcm_substream *substream,
 int imx_pcm_new(struct snd_soc_pcm_runtime *rtd);
 void imx_pcm_free(struct snd_pcm *pcm);
 
+#ifdef CONFIG_SND_SOC_IMX_PCM_DMA
+int imx_pcm_dma_init(struct platform_device *pdev);
+#else
+static inline int imx_pcm_dma_init(struct platform_device *pdev)
+{
+        return -ENODEV;
+}
+#endif
+
+#ifdef CONFIG_SND_SOC_IMX_PCM_FIQ
+int imx_pcm_fiq_init(struct platform_device *pdev);
+#else
+static inline int imx_pcm_fiq_init(struct platform_device *pdev)
+{
+        return -ENODEV;
+}
+#endif
+
 #endif /* _IMX_PCM_H */
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1e36bc81e5af..258acadb9e7d 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1023,7 +1023,7 @@ int dapm_regulator_event(struct snd_soc_dapm_widget *w,
 
         if (SND_SOC_DAPM_EVENT_ON(event)) {
                 if (w->invert & SND_SOC_DAPM_REGULATOR_BYPASS) {
-                        ret = regulator_allow_bypass(w->regulator, true);
+                        ret = regulator_allow_bypass(w->regulator, false);
                         if (ret != 0)
                                 dev_warn(w->dapm->dev,
                                          "ASoC: Failed to bypass %s: %d\n",
@@ -1033,7 +1033,7 @@ int dapm_regulator_event(struct snd_soc_dapm_widget *w,
                 return regulator_enable(w->regulator);
         } else {
                 if (w->invert & SND_SOC_DAPM_REGULATOR_BYPASS) {
-                        ret = regulator_allow_bypass(w->regulator, false);
+                        ret = regulator_allow_bypass(w->regulator, true);
                         if (ret != 0)
                                 dev_warn(w->dapm->dev,
                                          "ASoC: Failed to unbypass %s: %d\n",
@@ -3039,6 +3039,14 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
                                 w->name, ret);
                         return NULL;
                 }
+
+                if (w->invert & SND_SOC_DAPM_REGULATOR_BYPASS) {
+                        ret = regulator_allow_bypass(w->regulator, true);
+                        if (ret != 0)
+                                dev_warn(w->dapm->dev,
+                                         "ASoC: Failed to unbypass %s: %d\n",
+                                         w->name, ret);
+                }
                 break;
         case snd_soc_dapm_clock_supply:
 #ifdef CONFIG_CLKDEV_LOOKUP
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index ed4d89c8b52a..e90daf8cdaa8 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1331,16 +1331,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
                 }
                 channels = (hdr->bLength - 7) / csize - 1;
                 bmaControls = hdr->bmaControls;
+                if (hdr->bLength < 7 + csize) {
+                        snd_printk(KERN_ERR "usbaudio: unit %u: "
+                                   "invalid UAC_FEATURE_UNIT descriptor\n",
+                                   unitid);
+                        return -EINVAL;
+                }
         } else {
                 struct uac2_feature_unit_descriptor *ftr = _ftr;
                 csize = 4;
                 channels = (hdr->bLength - 6) / 4 - 1;
                 bmaControls = ftr->bmaControls;
-        }
-
-        if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) {
-                snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid);
-                return -EINVAL;
+                if (hdr->bLength < 6 + csize) {
+                        snd_printk(KERN_ERR "usbaudio: unit %u: "
+                                   "invalid UAC_FEATURE_UNIT descriptor\n",
+                                   unitid);
+                        return -EINVAL;
+                }
         }
 
         /* parse the source unit */
diff --git a/tools/vm/.gitignore b/tools/vm/.gitignore
new file mode 100644
index 000000000000..44f095fa2604
--- /dev/null
+++ b/tools/vm/.gitignore
@@ -0,0 +1,2 @@
+slabinfo
+page-types