1267 files changed, 17394 insertions, 12142 deletions

diff --git a/CREDITS b/CREDITS
index 9416a9a8b95e..0640e1650483 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2808,8 +2808,7 @@ S: Ottawa, Ontario
 S: Canada K2P 0X8
 
 N: Mikael Pettersson
-E: mikpe@it.uu.se
-W: http://user.it.uu.se/~mikpe/linux/
+E: mikpelinux@gmail.com
 D: Miscellaneous fixes
 
 N: Reed H. Petty
diff --git a/Documentation/ABI/stable/sysfs-bus-usb b/Documentation/ABI/stable/sysfs-bus-usb
index 2be603c52a24..a6b685724740 100644
--- a/Documentation/ABI/stable/sysfs-bus-usb
+++ b/Documentation/ABI/stable/sysfs-bus-usb
@@ -37,8 +37,8 @@ Description:
                 that the USB device has been connected to the machine.  This
                 file is read-only.
 Users:
-                PowerTOP <power@bughost.org>
-                http://www.lesswatts.org/projects/powertop/
+                PowerTOP <powertop@lists.01.org>
+                https://01.org/powertop/
 
 What:           /sys/bus/usb/device/.../power/active_duration
 Date:           January 2008
@@ -57,8 +57,8 @@ Description:
                 will give an integer percentage.  Note that this does not
                 account for counter wrap.
 Users:
-                PowerTOP <power@bughost.org>
-                http://www.lesswatts.org/projects/powertop/
+                PowerTOP <powertop@lists.01.org>
+                https://01.org/powertop/
 
 What:           /sys/bus/usb/devices/<busnum>-<port[.port]>...:<config num>-<interface num>/supports_autosuspend
 Date:           January 2008
diff --git a/Documentation/ABI/testing/sysfs-class-powercap b/Documentation/ABI/testing/sysfs-class-powercap
new file mode 100644
index 000000000000..db3b3ff70d84
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-class-powercap
@@ -0,0 +1,152 @@
+What:           /sys/class/powercap/
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                The powercap/ class sub directory belongs to the power cap
+                subsystem. Refer to
+                Documentation/power/powercap/powercap.txt for details.
+
+What:           /sys/class/powercap/<control type>
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                A <control type> is a unique name under /sys/class/powercap.
+                Here <control type> determines how the power is going to be
+                controlled. A <control type> can contain multiple power zones.
+
+What:           /sys/class/powercap/<control type>/enabled
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                This allows to enable/disable power capping for a "control type".
+                This status affects every power zone using this "control_type.
+
+What:           /sys/class/powercap/<control type>/<power zone>
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                A power zone is a single or a collection of devices, which can
+                be independently monitored and controlled. A power zone sysfs
+                entry is qualified with the name of the <control type>.
+                E.g. intel-rapl:0:1:1.
+
+What:           /sys/class/powercap/<control type>/<power zone>/<child power zone>
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Power zones may be organized in a hierarchy in which child
+                power zones provide monitoring and control for a subset of
+                devices under the parent. For example, if there is a parent
+                power zone for a whole CPU package, each CPU core in it can
+                be a child power zone.
+
+What:           /sys/class/powercap/.../<power zone>/name
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Specifies the name of this power zone.
+
+What:           /sys/class/powercap/.../<power zone>/energy_uj
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Current energy counter in micro-joules. Write "0" to reset.
+                If the counter can not be reset, then this attribute is
+                read-only.
+
+What:           /sys/class/powercap/.../<power zone>/max_energy_range_uj
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Range of the above energy counter in micro-joules.
+
+
+What:           /sys/class/powercap/.../<power zone>/power_uw
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Current power in micro-watts.
+
+What:           /sys/class/powercap/.../<power zone>/max_power_range_uw
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Range of the above power value in micro-watts.
+
+What:           /sys/class/powercap/.../<power zone>/constraint_X_name
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Each power zone can define one or more constraints. Each
+                constraint can have an optional name. Here "X" can have values
+                from 0 to max integer.
+
+What:           /sys/class/powercap/.../<power zone>/constraint_X_power_limit_uw
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Power limit in micro-watts should be applicable for
+                the time window specified by "constraint_X_time_window_us".
+                Here "X" can have values from 0 to max integer.
+
+What:           /sys/class/powercap/.../<power zone>/constraint_X_time_window_us
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Time window in micro seconds. This is used along with
+                constraint_X_power_limit_uw to define a power constraint.
+                Here "X" can have values from 0 to max integer.
+
+
+What:           /sys/class/powercap/<control type>/.../constraint_X_max_power_uw
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Maximum allowed power in micro watts for this constraint.
+                Here "X" can have values from 0 to max integer.
+
+What:           /sys/class/powercap/<control type>/.../constraint_X_min_power_uw
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Minimum allowed power in micro watts for this constraint.
+                Here "X" can have values from 0 to max integer.
+
+What:           /sys/class/powercap/.../<power zone>/constraint_X_max_time_window_us
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Maximum allowed time window in micro seconds for this
+                constraint. Here "X" can have values from 0 to max integer.
+
+What:           /sys/class/powercap/.../<power zone>/constraint_X_min_time_window_us
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description:
+                Minimum allowed time window in micro seconds for this
+                constraint. Here "X" can have values from 0 to max integer.
+
+What:           /sys/class/powercap/.../<power zone>/enabled
+Date:           September 2013
+KernelVersion:  3.13
+Contact:        linux-pm@vger.kernel.org
+Description
+                This allows to enable/disable power capping at power zone level.
+                This applies to current power zone and its children.
diff --git a/Documentation/ABI/testing/sysfs-devices-power b/Documentation/ABI/testing/sysfs-devices-power
index 9d43e7670841..efe449bdf811 100644
--- a/Documentation/ABI/testing/sysfs-devices-power
+++ b/Documentation/ABI/testing/sysfs-devices-power
@@ -1,6 +1,6 @@
 What:           /sys/devices/.../power/
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../power directory contains attributes
                 allowing the user space to check and modify some power
@@ -8,7 +8,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../power/wakeup attribute allows the user
                 space to check if the device is enabled to wake up the system
@@ -34,7 +34,7 @@ Description:
 
 What:           /sys/devices/.../power/control
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../power/control attribute allows the user
                 space to control the run-time power management of the device.
@@ -53,7 +53,7 @@ Description:
 
 What:           /sys/devices/.../power/async
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../async attribute allows the user space to
                 enable or diasble the device's suspend and resume callbacks to
@@ -79,7 +79,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_count
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_count attribute contains the number
                 of signaled wakeup events associated with the device.  This
@@ -88,7 +88,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_active_count
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_active_count attribute contains the
                 number of times the processing of wakeup events associated with
@@ -98,7 +98,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_abort_count
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_abort_count attribute contains the
                 number of times the processing of a wakeup event associated with
@@ -109,7 +109,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_expire_count
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_expire_count attribute contains the
                 number of times a wakeup event associated with the device has
@@ -119,7 +119,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_active
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_active attribute contains either 1,
                 or 0, depending on whether or not a wakeup event associated with
@@ -129,7 +129,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_total_time_ms
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_total_time_ms attribute contains
                 the total time of processing wakeup events associated with the
@@ -139,7 +139,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_max_time_ms
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_max_time_ms attribute contains
                 the maximum time of processing a single wakeup event associated
@@ -149,7 +149,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_last_time_ms
 Date:           September 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_last_time_ms attribute contains
                 the value of the monotonic clock corresponding to the time of
@@ -160,7 +160,7 @@ Description:
 
 What:           /sys/devices/.../power/wakeup_prevent_sleep_time_ms
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../wakeup_prevent_sleep_time_ms attribute
                 contains the total time the device has been preventing
@@ -189,7 +189,7 @@ Description:
 
 What:           /sys/devices/.../power/pm_qos_latency_us
 Date:           March 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../power/pm_qos_resume_latency_us attribute
                 contains the PM QoS resume latency limit for the given device,
@@ -207,7 +207,7 @@ Description:
 
 What:           /sys/devices/.../power/pm_qos_no_power_off
 Date:           September 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../power/pm_qos_no_power_off attribute
                 is used for manipulating the PM QoS "no power off" flag.  If
@@ -222,7 +222,7 @@ Description:
 
 What:           /sys/devices/.../power/pm_qos_remote_wakeup
 Date:           September 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/devices/.../power/pm_qos_remote_wakeup attribute
                 is used for manipulating the PM QoS "remote wakeup required"
diff --git a/Documentation/ABI/testing/sysfs-power b/Documentation/ABI/testing/sysfs-power
index 217772615d02..205a73878441 100644
--- a/Documentation/ABI/testing/sysfs-power
+++ b/Documentation/ABI/testing/sysfs-power
@@ -1,6 +1,6 @@
 What:           /sys/power/
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power directory will contain files that will
                 provide a unified interface to the power management
@@ -8,7 +8,7 @@ Description:
 
 What:           /sys/power/state
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/state file controls the system power state.
                 Reading from this file returns what states are supported,
@@ -22,7 +22,7 @@ Description:
 
 What:           /sys/power/disk
 Date:           September 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/disk file controls the operating mode of the
                 suspend-to-disk mechanism.  Reading from this file returns
@@ -67,7 +67,7 @@ Description:
 
 What:           /sys/power/image_size
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/image_size file controls the size of the image
                 created by the suspend-to-disk mechanism.  It can be written a
@@ -84,7 +84,7 @@ Description:
 
 What:           /sys/power/pm_trace
 Date:           August 2006
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/pm_trace file controls the code which saves the
                 last PM event point in the RTC across reboots, so that you can
@@ -133,7 +133,7 @@ Description:
 
 What:           /sys/power/pm_async
 Date:           January 2009
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/pm_async file controls the switch allowing the
                 user space to enable or disable asynchronous suspend and resume
@@ -146,7 +146,7 @@ Description:
 
 What:           /sys/power/wakeup_count
 Date:           July 2010
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/wakeup_count file allows user space to put the
                 system into a sleep state while taking into account the
@@ -161,7 +161,7 @@ Description:
 
 What:           /sys/power/reserved_size
 Date:           May 2011
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/reserved_size file allows user space to control
                 the amount of memory reserved for allocations made by device
@@ -175,7 +175,7 @@ Description:
 
 What:           /sys/power/autosleep
 Date:           April 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/autosleep file can be written one of the strings
                 returned by reads from /sys/power/state.  If that happens, a
@@ -192,7 +192,7 @@ Description:
 
 What:           /sys/power/wake_lock
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/wake_lock file allows user space to create
                 wakeup source objects and activate them on demand (if one of
@@ -219,7 +219,7 @@ Description:
 
 What:           /sys/power/wake_unlock
 Date:           February 2012
-Contact:        Rafael J. Wysocki <rjw@sisk.pl>
+Contact:        Rafael J. Wysocki <rjw@rjwysocki.net>
 Description:
                 The /sys/power/wake_unlock file allows user space to deactivate
                 wakeup sources created with the help of /sys/power/wake_lock.
diff --git a/Documentation/acpi/dsdt-override.txt b/Documentation/acpi/dsdt-override.txt
index febbb1ba4d23..784841caa6e6 100644
--- a/Documentation/acpi/dsdt-override.txt
+++ b/Documentation/acpi/dsdt-override.txt
@@ -4,4 +4,4 @@ CONFIG_ACPI_CUSTOM_DSDT builds the image into the kernel.
 
 When to use this method is described in detail on the
 Linux/ACPI home page:
-http://www.lesswatts.org/projects/acpi/overridingDSDT.php
+https://01.org/linux-acpi/documentation/overriding-dsdt
diff --git a/Documentation/block/00-INDEX b/Documentation/block/00-INDEX
index d18ecd827c40..929d9904f74b 100644
--- a/Documentation/block/00-INDEX
+++ b/Documentation/block/00-INDEX
@@ -6,6 +6,8 @@ capability.txt
         - Generic Block Device Capability (/sys/block/<device>/capability)
 cfq-iosched.txt
         - CFQ IO scheduler tunables
+cmdline-partition.txt
+        - how to specify block device partitions on kernel command line
 data-integrity.txt
         - Block data integrity
 deadline-iosched.txt
diff --git a/Documentation/block/cmdline-partition.txt b/Documentation/block/cmdline-partition.txt
index 2bbf4cc40c3f..525b9f6d7fb4 100644
--- a/Documentation/block/cmdline-partition.txt
+++ b/Documentation/block/cmdline-partition.txt
@@ -1,9 +1,9 @@
-Embedded device command line partition
+Embedded device command line partition parsing
 =====================================================================
 
-Read block device partition table from command line.
-The partition used for fixed block device (eMMC) embedded device.
-It is no MBR, save storage space. Bootloader can be easily accessed
+Support for reading the block device partition table from the command line.
+It is typically used for fixed block (eMMC) embedded devices.
+It has no MBR, so saves storage space. Bootloader can be easily accessed
 by absolute address of data on the block device.
 Users can easily change the partition.
 
diff --git a/Documentation/connector/ucon.c b/Documentation/connector/ucon.c
index 4848db8c71ff..8a4da64e02a8 100644
--- a/Documentation/connector/ucon.c
+++ b/Documentation/connector/ucon.c
@@ -71,7 +71,7 @@ static int netlink_send(int s, struct cn_msg *msg)
         nlh->nlmsg_seq = seq++;
         nlh->nlmsg_pid = getpid();
         nlh->nlmsg_type = NLMSG_DONE;
-        nlh->nlmsg_len = NLMSG_LENGTH(size - sizeof(*nlh));
+        nlh->nlmsg_len = size;
         nlh->nlmsg_flags = 0;
 
         m = NLMSG_DATA(nlh);
diff --git a/Documentation/cpu-freq/cpu-drivers.txt b/Documentation/cpu-freq/cpu-drivers.txt
index 40282e617913..8b1a4451422e 100644
--- a/Documentation/cpu-freq/cpu-drivers.txt
+++ b/Documentation/cpu-freq/cpu-drivers.txt
@@ -23,8 +23,8 @@ Contents:
 1.1  Initialization
 1.2  Per-CPU Initialization
 1.3  verify
-1.4  target or setpolicy?
-1.5  target
+1.4  target/target_index or setpolicy?
+1.5  target/target_index
 1.6  setpolicy
 2.   Frequency Table Helpers
 
@@ -56,7 +56,8 @@ cpufreq_driver.init -		A pointer to the per-CPU initialization
 cpufreq_driver.verify -         A pointer to a "verification" function.
 
 cpufreq_driver.setpolicy _or_ 
-cpufreq_driver.target -         See below on the differences.
+cpufreq_driver.target/
+target_index            -       See below on the differences.
 
 And optionally
 
@@ -66,7 +67,7 @@ cpufreq_driver.resume -		A pointer to a per-CPU resume function
                                 which is called with interrupts disabled
                                 and _before_ the pre-suspend frequency
                                 and/or policy is restored by a call to
-                                ->target or ->setpolicy.
+                                ->target/target_index or ->setpolicy.
 
 cpufreq_driver.attr -           A pointer to a NULL-terminated list of
                                 "struct freq_attr" which allow to
@@ -103,8 +104,8 @@ policy->governor		must contain the "default policy" for
                                 this CPU. A few moments later,
                                 cpufreq_driver.verify and either
                                 cpufreq_driver.setpolicy or
-                                cpufreq_driver.target is called with
-                                these values.
+                                cpufreq_driver.target/target_index is called
+                                with these values.
 
 For setting some of these values (cpuinfo.min[max]_freq, policy->min[max]), the
 frequency table helpers might be helpful. See the section 2 for more information
@@ -133,20 +134,28 @@ range) is within policy->min and policy->max. If necessary, increase
 policy->max first, and only if this is no solution, decrease policy->min.
 
 
-1.4 target or setpolicy?
+1.4 target/target_index or setpolicy?
 ----------------------------
 
 Most cpufreq drivers or even most cpu frequency scaling algorithms 
 only allow the CPU to be set to one frequency. For these, you use the
-->target call.
+->target/target_index call.
 
 Some cpufreq-capable processors switch the frequency between certain
 limits on their own. These shall use the ->setpolicy call
 
 
-1.4. target
+1.4. target/target_index
 -------------
 
+The target_index call has two arguments: struct cpufreq_policy *policy,
+and unsigned int index (into the exposed frequency table).
+
+The CPUfreq driver must set the new frequency when called here. The
+actual frequency must be determined by freq_table[index].frequency.
+
+Deprecated:
+----------
 The target call has three arguments: struct cpufreq_policy *policy,
 unsigned int target_frequency, unsigned int relation.
 
diff --git a/Documentation/cpu-freq/governors.txt b/Documentation/cpu-freq/governors.txt
index 219970ba54b7..77ec21574fb1 100644
--- a/Documentation/cpu-freq/governors.txt
+++ b/Documentation/cpu-freq/governors.txt
@@ -40,7 +40,7 @@ Most cpufreq drivers (in fact, all except one, longrun) or even most
 cpu frequency scaling algorithms only offer the CPU to be set to one
 frequency. In order to offer dynamic frequency scaling, the cpufreq
 core must be able to tell these drivers of a "target frequency". So
-these specific drivers will be transformed to offer a "->target"
+these specific drivers will be transformed to offer a "->target/target_index"
 call instead of the existing "->setpolicy" call. For "longrun", all
 stays the same, though.
 
@@ -71,7 +71,7 @@ CPU can be set to switch independently	 |	   CPU can only be set
                     /                          the limits of policy->{min,max}
                    /                                \
                   /                                  \
-        Using the ->setpolicy call,              Using the ->target call,
+        Using the ->setpolicy call,              Using the ->target/target_index call,
             the limits and the                    the frequency closest
              "policy" is set.                     to target_freq is set.
                                                   It is assured that it
diff --git a/Documentation/cpuidle/governor.txt b/Documentation/cpuidle/governor.txt
index 12c6bd50c9f6..d9020f5e847b 100644
--- a/Documentation/cpuidle/governor.txt
+++ b/Documentation/cpuidle/governor.txt
@@ -25,5 +25,4 @@ kernel configuration and platform will be selected by cpuidle.
 
 Interfaces:
 extern int cpuidle_register_governor(struct cpuidle_governor *gov);
-extern void cpuidle_unregister_governor(struct cpuidle_governor *gov);
 struct cpuidle_governor
diff --git a/Documentation/devicetree/bindings/memory.txt b/Documentation/devicetree/bindings/memory.txt
deleted file mode 100644
index eb2469365593..000000000000
--- a/Documentation/devicetree/bindings/memory.txt
+++ /dev/null
@@ -1,168 +0,0 @@
-*** Memory binding ***
-
-The /memory node provides basic information about the address and size
-of the physical memory. This node is usually filled or updated by the
-bootloader, depending on the actual memory configuration of the given
-hardware.
-
-The memory layout is described by the following node:
-
-/ {
-        #address-cells = <(n)>;
-        #size-cells = <(m)>;
-        memory {
-                device_type = "memory";
-                reg =  <(baseaddr1) (size1)
-                        (baseaddr2) (size2)
-                        ...
-                        (baseaddrN) (sizeN)>;
-        };
-        ...
-};
-
-A memory node follows the typical device tree rules for "reg" property:
-n:              number of cells used to store base address value
-m:              number of cells used to store size value
-baseaddrX:      defines a base address of the defined memory bank
-sizeX:          the size of the defined memory bank
-
-
-More than one memory bank can be defined.
-
-
-*** Reserved memory regions ***
-
-In /memory/reserved-memory node one can create child nodes describing
-particular reserved (excluded from normal use) memory regions. Such
-memory regions are usually designed for the special usage by various
-device drivers. A good example are contiguous memory allocations or
-memory sharing with other operating system on the same hardware board.
-Those special memory regions might depend on the board configuration and
-devices used on the target system.
-
-Parameters for each memory region can be encoded into the device tree
-with the following convention:
-
-[(label):] (name) {
-        compatible = "linux,contiguous-memory-region", "reserved-memory-region";
-        reg = <(address) (size)>;
-        (linux,default-contiguous-region);
-};
-
-compatible:     one or more of:
-        - "linux,contiguous-memory-region" - enables binding of this
-          region to Contiguous Memory Allocator (special region for
-          contiguous memory allocations, shared with movable system
-          memory, Linux kernel-specific).
-        - "reserved-memory-region" - compatibility is defined, given
-          region is assigned for exclusive usage for by the respective
-          devices.
-
-reg:    standard property defining the base address and size of
-        the memory region
-
-linux,default-contiguous-region: property indicating that the region
-        is the default region for all contiguous memory
-        allocations, Linux specific (optional)
-
-It is optional to specify the base address, so if one wants to use
-autoconfiguration of the base address, '0' can be specified as a base
-address in the 'reg' property.
-
-The /memory/reserved-memory node must contain the same #address-cells
-and #size-cells value as the root node.
-
-
-*** Device node's properties ***
-
-Once regions in the /memory/reserved-memory node have been defined, they
-may be referenced by other device nodes. Bindings that wish to reference
-memory regions should explicitly document their use of the following
-property:
-
-memory-region = <&phandle_to_defined_region>;
-
-This property indicates that the device driver should use the memory
-region pointed by the given phandle.
-
-
-*** Example ***
-
-This example defines a memory consisting of 4 memory banks. 3 contiguous
-regions are defined for Linux kernel, one default of all device drivers
-(named contig_mem, placed at 0x72000000, 64MiB), one dedicated to the
-framebuffer device (labelled display_mem, placed at 0x78000000, 8MiB)
-and one for multimedia processing (labelled multimedia_mem, placed at
-0x77000000, 64MiB). 'display_mem' region is then assigned to fb@12300000
-device for DMA memory allocations (Linux kernel drivers will use CMA is
-available or dma-exclusive usage otherwise). 'multimedia_mem' is
-assigned to scaler@12500000 and codec@12600000 devices for contiguous
-memory allocations when CMA driver is enabled.
-
-The reason for creating a separate region for framebuffer device is to
-match the framebuffer base address to the one configured by bootloader,
-so once Linux kernel drivers starts no glitches on the displayed boot
-logo appears. Scaller and codec drivers should share the memory
-allocations.
-
-/ {
-        #address-cells = <1>;
-        #size-cells = <1>;
-
-        /* ... */
-
-        memory {
-                reg =  <0x40000000 0x10000000
-                        0x50000000 0x10000000
-                        0x60000000 0x10000000
-                        0x70000000 0x10000000>;
-
-                reserved-memory {
-                        #address-cells = <1>;
-                        #size-cells = <1>;
-
-                        /*
-                         * global autoconfigured region for contiguous allocations
-                         * (used only with Contiguous Memory Allocator)
-                         */
-                        contig_region@0 {
-                                compatible = "linux,contiguous-memory-region";
-                                reg = <0x0 0x4000000>;
-                                linux,default-contiguous-region;
-                        };
-
-                        /*
-                         * special region for framebuffer
-                         */
-                        display_region: region@78000000 {
-                                compatible = "linux,contiguous-memory-region", "reserved-memory-region";
-                                reg = <0x78000000 0x800000>;
-                        };
-
-                        /*
-                         * special region for multimedia processing devices
-                         */
-                        multimedia_region: region@77000000 {
-                                compatible = "linux,contiguous-memory-region";
-                                reg = <0x77000000 0x4000000>;
-                        };
-                };
-        };
-
-        /* ... */
-
-        fb0: fb@12300000 {
-                status = "okay";
-                memory-region = <&display_region>;
-        };
-
-        scaler: scaler@12500000 {
-                status = "okay";
-                memory-region = <&multimedia_region>;
-        };
-
-        codec: codec@12600000 {
-                status = "okay";
-                memory-region = <&multimedia_region>;
-        };
-};
diff --git a/Documentation/devicetree/bindings/mmc/exynos-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/exynos-dw-mshc.txt
index 6d1c0988cfc7..c67b975c8906 100644
--- a/Documentation/devicetree/bindings/mmc/exynos-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/exynos-dw-mshc.txt
@@ -1,11 +1,11 @@
-* Samsung Exynos specific extensions to the Synopsis Designware Mobile
+* Samsung Exynos specific extensions to the Synopsys Designware Mobile
   Storage Host Controller
 
-The Synopsis designware mobile storage host controller is used to interface
+The Synopsys designware mobile storage host controller is used to interface
 a SoC with storage medium such as eMMC or SD/MMC cards. This file documents
-differences between the core Synopsis dw mshc controller properties described
-by synopsis-dw-mshc.txt and the properties used by the Samsung Exynos specific
-extensions to the Synopsis Designware Mobile Storage Host Controller.
+differences between the core Synopsys dw mshc controller properties described
+by synopsys-dw-mshc.txt and the properties used by the Samsung Exynos specific
+extensions to the Synopsys Designware Mobile Storage Host Controller.
 
 Required Properties:
 
diff --git a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
index 8a3d91d47b6a..c559f3f36309 100644
--- a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
@@ -1,11 +1,11 @@
-* Rockchip specific extensions to the Synopsis Designware Mobile
+* Rockchip specific extensions to the Synopsys Designware Mobile
   Storage Host Controller
 
-The Synopsis designware mobile storage host controller is used to interface
+The Synopsys designware mobile storage host controller is used to interface
 a SoC with storage medium such as eMMC or SD/MMC cards. This file documents
-differences between the core Synopsis dw mshc controller properties described
-by synopsis-dw-mshc.txt and the properties used by the Rockchip specific
-extensions to the Synopsis Designware Mobile Storage Host Controller.
+differences between the core Synopsys dw mshc controller properties described
+by synopsys-dw-mshc.txt and the properties used by the Rockchip specific
+extensions to the Synopsys Designware Mobile Storage Host Controller.
 
 Required Properties:
 
diff --git a/Documentation/devicetree/bindings/mmc/synopsis-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/synopsys-dw-mshc.txt
index cdcebea9c6f5..066a78b034ca 100644
--- a/Documentation/devicetree/bindings/mmc/synopsis-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/synopsys-dw-mshc.txt
@@ -1,14 +1,14 @@
-* Synopsis Designware Mobile Storage Host Controller
+* Synopsys Designware Mobile Storage Host Controller
 
-The Synopsis designware mobile storage host controller is used to interface
+The Synopsys designware mobile storage host controller is used to interface
 a SoC with storage medium such as eMMC or SD/MMC cards. This file documents
 differences between the core mmc properties described by mmc.txt and the
-properties used by the Synopsis Designware Mobile Storage Host Controller.
+properties used by the Synopsys Designware Mobile Storage Host Controller.
 
 Required Properties:
 
 * compatible: should be
-        - snps,dw-mshc: for controllers compliant with synopsis dw-mshc.
+        - snps,dw-mshc: for controllers compliant with synopsys dw-mshc.
 * #address-cells: should be 1.
 * #size-cells: should be 0.
 
diff --git a/Documentation/devicetree/bindings/mmc/tmio_mmc.txt b/Documentation/devicetree/bindings/mmc/tmio_mmc.txt
index df204e18e030..6a2a1160a70d 100644
--- a/Documentation/devicetree/bindings/mmc/tmio_mmc.txt
+++ b/Documentation/devicetree/bindings/mmc/tmio_mmc.txt
@@ -9,12 +9,15 @@ compulsory and any optional properties, common to all SD/MMC drivers, as
 described in mmc.txt, can be used. Additionally the following tmio_mmc-specific
 optional bindings can be used.
 
+Required properties:
+- compatible:   "renesas,sdhi-shmobile" - a generic sh-mobile SDHI unit
+                "renesas,sdhi-sh7372" - SDHI IP on SH7372 SoC
+                "renesas,sdhi-sh73a0" - SDHI IP on SH73A0 SoC
+                "renesas,sdhi-r8a73a4" - SDHI IP on R8A73A4 SoC
+                "renesas,sdhi-r8a7740" - SDHI IP on R8A7740 SoC
+                "renesas,sdhi-r8a7778" - SDHI IP on R8A7778 SoC
+                "renesas,sdhi-r8a7779" - SDHI IP on R8A7779 SoC
+                "renesas,sdhi-r8a7790" - SDHI IP on R8A7790 SoC
+
 Optional properties:
 - toshiba,mmc-wrprotect-disable: write-protect detection is unavailable
-
-When used with Renesas SDHI hardware, the following compatibility strings
-configure various model-specific properties:
-
-"renesas,sh7372-sdhi":  (default) compatible with SH7372
-"renesas,r8a7740-sdhi": compatible with R8A7740: certain MMC/SD commands have to
-                        wait for the interface to become idle.
diff --git a/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt b/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
index 2c6be0377f55..d2ea4605d078 100644
--- a/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
+++ b/Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
@@ -86,6 +86,7 @@ General Properties:
 
 Clock Properties:
 
+  - fsl,cksel        Timer reference clock source.
   - fsl,tclk-period  Timer reference clock period in nanoseconds.
   - fsl,tmr-prsc     Prescaler, divides the output clock.
   - fsl,tmr-add      Frequency compensation value.
@@ -97,7 +98,7 @@ Clock Properties:
   clock. You must choose these carefully for the clock to work right.
   Here is how to figure good values:
 
-  TimerOsc     = system clock               MHz
+  TimerOsc     = selected reference clock   MHz
   tclk_period  = desired clock period       nanoseconds
   NominalFreq  = 1000 / tclk_period         MHz
   FreqDivRatio = TimerOsc / NominalFreq     (must be greater that 1.0)
@@ -114,6 +115,20 @@ Clock Properties:
   Pulse Per Second (PPS) signal, since this will be offered to the PPS
   subsystem to synchronize the Linux clock.
 
+  Reference clock source is determined by the value, which is holded
+  in CKSEL bits in TMR_CTRL register. "fsl,cksel" property keeps the
+  value, which will be directly written in those bits, that is why,
+  according to reference manual, the next clock sources can be used:
+
+  <0> - external high precision timer reference clock (TSEC_TMR_CLK
+        input is used for this purpose);
+  <1> - eTSEC system clock;
+  <2> - eTSEC1 transmit clock;
+  <3> - RTC clock input.
+
+  When this attribute is not used, eTSEC system clock will serve as
+  IEEE 1588 timer reference clock.
+
 Example:
 
         ptp_clock@24E00 {
@@ -121,6 +136,7 @@ Example:
                 reg = <0x24E00 0xB0>;
                 interrupts = <12 0x8 13 0x8>;
                 interrupt-parent = < &ipic >;
+                fsl,cksel       = <1>;
                 fsl,tclk-period = <10>;
                 fsl,tmr-prsc    = <100>;
                 fsl,tmr-add     = <0x999999A4>;
diff --git a/Documentation/devicetree/bindings/pci/designware-pcie.txt b/Documentation/devicetree/bindings/pci/designware-pcie.txt
index eabcb4b5db6e..e216af356847 100644
--- a/Documentation/devicetree/bindings/pci/designware-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/designware-pcie.txt
@@ -1,4 +1,4 @@
-* Synopsis Designware PCIe interface
+* Synopsys Designware PCIe interface
 
 Required properties:
 - compatible: should contain "snps,dw-pcie" to identify the
diff --git a/Documentation/devicetree/bindings/tty/serial/qca,ar9330-uart.txt b/Documentation/devicetree/bindings/serial/qca,ar9330-uart.txt
index c5e032c85bf9..c5e032c85bf9 100644
--- a/Documentation/devicetree/bindings/tty/serial/qca,ar9330-uart.txt
+++ b/Documentation/devicetree/bindings/serial/qca,ar9330-uart.txt
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 1a036cd972fb..fcbb736d55fe 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -480,6 +480,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         Format: <io>,<irq>,<mode>
                         See header of drivers/net/hamradio/baycom_ser_hdx.c.
 
+        blkdevparts=    Manual partition parsing of block device(s) for
+                        embedded devices based on command line input.
+                        See Documentation/block/cmdline-partition.txt
+
         boot_delay=     Milliseconds to delay each printk during boot.
                         Values larger than 10 seconds (10000) are changed to
                         no delay (0).
@@ -1357,7 +1361,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                         pages. In the event, a node is too small to have both
                         kernelcore and Movable pages, kernelcore pages will
                         take priority and other nodes will have a larger number
-                        of kernelcore pages.  The Movable zone is used for the
+                        of Movable pages.  The Movable zone is used for the
                         allocation of pages that may be reclaimed or moved
                         by the page migration subsystem.  This means that
                         HugeTLB pages may not be allocated from this zone.
@@ -3485,6 +3489,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                 the unplug protocol
                         never -- do not unplug even if version check succeeds
 
+        xen_nopvspin    [X86,XEN]
+                        Disables the ticketlock slowpath using Xen PV
+                        optimizations.
+
         xirc2ps_cs=     [NET,PCMCIA]
                         Format:
                         <irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]
diff --git a/Documentation/power/opp.txt b/Documentation/power/opp.txt
index 425c51d56aef..b8a907dc0169 100644
--- a/Documentation/power/opp.txt
+++ b/Documentation/power/opp.txt
@@ -42,7 +42,7 @@ We can represent these as three OPPs as the following {Hz, uV} tuples:
 
 OPP library provides a set of helper functions to organize and query the OPP
 information. The library is located in drivers/base/power/opp.c and the header
-is located in include/linux/opp.h. OPP library can be enabled by enabling
+is located in include/linux/pm_opp.h. OPP library can be enabled by enabling
 CONFIG_PM_OPP from power management menuconfig menu. OPP library depends on
 CONFIG_PM as certain SoCs such as Texas Instrument's OMAP framework allows to
 optionally boot at a certain OPP without needing cpufreq.
@@ -71,14 +71,14 @@ operations until that OPP could be re-enabled if possible.
 
 OPP library facilitates this concept in it's implementation. The following
 operational functions operate only on available opps:
-opp_find_freq_{ceil, floor}, opp_get_voltage, opp_get_freq, opp_get_opp_count
-and opp_init_cpufreq_table
+opp_find_freq_{ceil, floor}, dev_pm_opp_get_voltage, dev_pm_opp_get_freq, dev_pm_opp_get_opp_count
+and dev_pm_opp_init_cpufreq_table
 
-opp_find_freq_exact is meant to be used to find the opp pointer which can then
-be used for opp_enable/disable functions to make an opp available as required.
+dev_pm_opp_find_freq_exact is meant to be used to find the opp pointer which can then
+be used for dev_pm_opp_enable/disable functions to make an opp available as required.
 
 WARNING: Users of OPP library should refresh their availability count using
-get_opp_count if opp_enable/disable functions are invoked for a device, the
+get_opp_count if dev_pm_opp_enable/disable functions are invoked for a device, the
 exact mechanism to trigger these or the notification mechanism to other
 dependent subsystems such as cpufreq are left to the discretion of the SoC
 specific framework which uses the OPP library. Similar care needs to be taken
@@ -96,24 +96,24 @@ using RCU read locks. The opp_find_freq_{exact,ceil,floor},
 opp_get_{voltage, freq, opp_count} fall into this category.
 
 opp_{add,enable,disable} are updaters which use mutex and implement it's own
-RCU locking mechanisms. opp_init_cpufreq_table acts as an updater and uses
+RCU locking mechanisms. dev_pm_opp_init_cpufreq_table acts as an updater and uses
 mutex to implment RCU updater strategy. These functions should *NOT* be called
 under RCU locks and other contexts that prevent blocking functions in RCU or
 mutex operations from working.
 
 2. Initial OPP List Registration
 ================================
-The SoC implementation calls opp_add function iteratively to add OPPs per
+The SoC implementation calls dev_pm_opp_add function iteratively to add OPPs per
 device. It is expected that the SoC framework will register the OPP entries
 optimally- typical numbers range to be less than 5. The list generated by
 registering the OPPs is maintained by OPP library throughout the device
 operation. The SoC framework can subsequently control the availability of the
-OPPs dynamically using the opp_enable / disable functions.
+OPPs dynamically using the dev_pm_opp_enable / disable functions.
 
-opp_add - Add a new OPP for a specific domain represented by the device pointer.
+dev_pm_opp_add - Add a new OPP for a specific domain represented by the device pointer.
         The OPP is defined using the frequency and voltage. Once added, the OPP
         is assumed to be available and control of it's availability can be done
-        with the opp_enable/disable functions. OPP library internally stores
+        with the dev_pm_opp_enable/disable functions. OPP library internally stores
         and manages this information in the opp struct. This function may be
         used by SoC framework to define a optimal list as per the demands of
         SoC usage environment.
@@ -124,7 +124,7 @@ opp_add - Add a new OPP for a specific domain represented by the device pointer.
          soc_pm_init()
          {
                 /* Do things */
-                r = opp_add(mpu_dev, 1000000, 900000);
+                r = dev_pm_opp_add(mpu_dev, 1000000, 900000);
                 if (!r) {
                         pr_err("%s: unable to register mpu opp(%d)\n", r);
                         goto no_cpufreq;
@@ -143,44 +143,44 @@ functions return the matching pointer representing the opp if a match is
 found, else returns error. These errors are expected to be handled by standard
 error checks such as IS_ERR() and appropriate actions taken by the caller.
 
-opp_find_freq_exact - Search for an OPP based on an *exact* frequency and
+dev_pm_opp_find_freq_exact - Search for an OPP based on an *exact* frequency and
         availability. This function is especially useful to enable an OPP which
         is not available by default.
         Example: In a case when SoC framework detects a situation where a
         higher frequency could be made available, it can use this function to
-        find the OPP prior to call the opp_enable to actually make it available.
+        find the OPP prior to call the dev_pm_opp_enable to actually make it available.
          rcu_read_lock();
-         opp = opp_find_freq_exact(dev, 1000000000, false);
+         opp = dev_pm_opp_find_freq_exact(dev, 1000000000, false);
          rcu_read_unlock();
          /* dont operate on the pointer.. just do a sanity check.. */
          if (IS_ERR(opp)) {
                 pr_err("frequency not disabled!\n");
                 /* trigger appropriate actions.. */
          } else {
-                opp_enable(dev,1000000000);
+                dev_pm_opp_enable(dev,1000000000);
          }
 
         NOTE: This is the only search function that operates on OPPs which are
         not available.
 
-opp_find_freq_floor - Search for an available OPP which is *at most* the
+dev_pm_opp_find_freq_floor - Search for an available OPP which is *at most* the
         provided frequency. This function is useful while searching for a lesser
         match OR operating on OPP information in the order of decreasing
         frequency.
         Example: To find the highest opp for a device:
          freq = ULONG_MAX;
          rcu_read_lock();
-         opp_find_freq_floor(dev, &freq);
+         dev_pm_opp_find_freq_floor(dev, &freq);
          rcu_read_unlock();
 
-opp_find_freq_ceil - Search for an available OPP which is *at least* the
+dev_pm_opp_find_freq_ceil - Search for an available OPP which is *at least* the
         provided frequency. This function is useful while searching for a
         higher match OR operating on OPP information in the order of increasing
         frequency.
         Example 1: To find the lowest opp for a device:
          freq = 0;
          rcu_read_lock();
-         opp_find_freq_ceil(dev, &freq);
+         dev_pm_opp_find_freq_ceil(dev, &freq);
          rcu_read_unlock();
         Example 2: A simplified implementation of a SoC cpufreq_driver->target:
          soc_cpufreq_target(..)
@@ -188,7 +188,7 @@ opp_find_freq_ceil - Search for an available OPP which is *at least* the
                 /* Do stuff like policy checks etc. */
                 /* Find the best frequency match for the req */
                 rcu_read_lock();
-                opp = opp_find_freq_ceil(dev, &freq);
+                opp = dev_pm_opp_find_freq_ceil(dev, &freq);
                 rcu_read_unlock();
                 if (!IS_ERR(opp))
                         soc_switch_to_freq_voltage(freq);
@@ -208,34 +208,34 @@ as thermal considerations (e.g. don't use OPPx until the temperature drops).
 
 WARNING: Do not use these functions in interrupt context.
 
-opp_enable - Make a OPP available for operation.
+dev_pm_opp_enable - Make a OPP available for operation.
         Example: Lets say that 1GHz OPP is to be made available only if the
         SoC temperature is lower than a certain threshold. The SoC framework
         implementation might choose to do something as follows:
          if (cur_temp < temp_low_thresh) {
                 /* Enable 1GHz if it was disabled */
                 rcu_read_lock();
-                opp = opp_find_freq_exact(dev, 1000000000, false);
+                opp = dev_pm_opp_find_freq_exact(dev, 1000000000, false);
                 rcu_read_unlock();
                 /* just error check */
                 if (!IS_ERR(opp))
-                        ret = opp_enable(dev, 1000000000);
+                        ret = dev_pm_opp_enable(dev, 1000000000);
                 else
                         goto try_something_else;
          }
 
-opp_disable - Make an OPP to be not available for operation
+dev_pm_opp_disable - Make an OPP to be not available for operation
         Example: Lets say that 1GHz OPP is to be disabled if the temperature
         exceeds a threshold value. The SoC framework implementation might
         choose to do something as follows:
          if (cur_temp > temp_high_thresh) {
                 /* Disable 1GHz if it was enabled */
                 rcu_read_lock();
-                opp = opp_find_freq_exact(dev, 1000000000, true);
+                opp = dev_pm_opp_find_freq_exact(dev, 1000000000, true);
                 rcu_read_unlock();
                 /* just error check */
                 if (!IS_ERR(opp))
-                        ret = opp_disable(dev, 1000000000);
+                        ret = dev_pm_opp_disable(dev, 1000000000);
                 else
                         goto try_something_else;
          }
@@ -247,7 +247,7 @@ information from the OPP structure is necessary. Once an OPP pointer is
 retrieved using the search functions, the following functions can be used by SoC
 framework to retrieve the information represented inside the OPP layer.
 
-opp_get_voltage - Retrieve the voltage represented by the opp pointer.
+dev_pm_opp_get_voltage - Retrieve the voltage represented by the opp pointer.
         Example: At a cpufreq transition to a different frequency, SoC
         framework requires to set the voltage represented by the OPP using
         the regulator framework to the Power Management chip providing the
@@ -256,15 +256,15 @@ opp_get_voltage - Retrieve the voltage represented by the opp pointer.
          {
                 /* do things */
                 rcu_read_lock();
-                opp = opp_find_freq_ceil(dev, &freq);
-                v = opp_get_voltage(opp);
+                opp = dev_pm_opp_find_freq_ceil(dev, &freq);
+                v = dev_pm_opp_get_voltage(opp);
                 rcu_read_unlock();
                 if (v)
                         regulator_set_voltage(.., v);
                 /* do other things */
          }
 
-opp_get_freq - Retrieve the freq represented by the opp pointer.
+dev_pm_opp_get_freq - Retrieve the freq represented by the opp pointer.
         Example: Lets say the SoC framework uses a couple of helper functions
         we could pass opp pointers instead of doing additional parameters to
         handle quiet a bit of data parameters.
@@ -273,8 +273,8 @@ opp_get_freq - Retrieve the freq represented by the opp pointer.
                 /* do things.. */
                  max_freq = ULONG_MAX;
                  rcu_read_lock();
-                 max_opp = opp_find_freq_floor(dev,&max_freq);
-                 requested_opp = opp_find_freq_ceil(dev,&freq);
+                 max_opp = dev_pm_opp_find_freq_floor(dev,&max_freq);
+                 requested_opp = dev_pm_opp_find_freq_ceil(dev,&freq);
                  if (!IS_ERR(max_opp) && !IS_ERR(requested_opp))
                         r = soc_test_validity(max_opp, requested_opp);
                  rcu_read_unlock();
@@ -282,25 +282,25 @@ opp_get_freq - Retrieve the freq represented by the opp pointer.
          }
          soc_test_validity(..)
          {
-                 if(opp_get_voltage(max_opp) < opp_get_voltage(requested_opp))
+                 if(dev_pm_opp_get_voltage(max_opp) < dev_pm_opp_get_voltage(requested_opp))
                          return -EINVAL;
-                 if(opp_get_freq(max_opp) < opp_get_freq(requested_opp))
+                 if(dev_pm_opp_get_freq(max_opp) < dev_pm_opp_get_freq(requested_opp))
                          return -EINVAL;
                 /* do things.. */
          }
 
-opp_get_opp_count - Retrieve the number of available opps for a device
+dev_pm_opp_get_opp_count - Retrieve the number of available opps for a device
         Example: Lets say a co-processor in the SoC needs to know the available
         frequencies in a table, the main processor can notify as following:
          soc_notify_coproc_available_frequencies()
          {
                 /* Do things */
                 rcu_read_lock();
-                num_available = opp_get_opp_count(dev);
+                num_available = dev_pm_opp_get_opp_count(dev);
                 speeds = kzalloc(sizeof(u32) * num_available, GFP_KERNEL);
                 /* populate the table in increasing order */
                 freq = 0;
-                while (!IS_ERR(opp = opp_find_freq_ceil(dev, &freq))) {
+                while (!IS_ERR(opp = dev_pm_opp_find_freq_ceil(dev, &freq))) {
                         speeds[i] = freq;
                         freq++;
                         i++;
@@ -313,7 +313,7 @@ opp_get_opp_count - Retrieve the number of available opps for a device
 
 6. Cpufreq Table Generation
 ===========================
-opp_init_cpufreq_table - cpufreq framework typically is initialized with
+dev_pm_opp_init_cpufreq_table - cpufreq framework typically is initialized with
         cpufreq_frequency_table_cpuinfo which is provided with the list of
         frequencies that are available for operation. This function provides
         a ready to use conversion routine to translate the OPP layer's internal
@@ -326,7 +326,7 @@ opp_init_cpufreq_table - cpufreq framework typically is initialized with
          soc_pm_init()
          {
                 /* Do things */
-                r = opp_init_cpufreq_table(dev, &freq_table);
+                r = dev_pm_opp_init_cpufreq_table(dev, &freq_table);
                 if (!r)
                         cpufreq_frequency_table_cpuinfo(policy, freq_table);
                 /* Do other things */
@@ -336,7 +336,7 @@ opp_init_cpufreq_table - cpufreq framework typically is initialized with
         addition to CONFIG_PM as power management feature is required to
         dynamically scale voltage and frequency in a system.
 
-opp_free_cpufreq_table - Free up the table allocated by opp_init_cpufreq_table
+dev_pm_opp_free_cpufreq_table - Free up the table allocated by dev_pm_opp_init_cpufreq_table
 
 7. Data Structures
 ==================
@@ -358,16 +358,16 @@ accessed by various functions as described above. However, the structures
 representing the actual OPPs and domains are internal to the OPP library itself
 to allow for suitable abstraction reusable across systems.
 
-struct opp - The internal data structure of OPP library which is used to
+struct dev_pm_opp - The internal data structure of OPP library which is used to
         represent an OPP. In addition to the freq, voltage, availability
         information, it also contains internal book keeping information required
         for the OPP library to operate on.  Pointer to this structure is
         provided back to the users such as SoC framework to be used as a
         identifier for OPP in the interactions with OPP layer.
 
-        WARNING: The struct opp pointer should not be parsed or modified by the
-        users. The defaults of for an instance is populated by opp_add, but the
-        availability of the OPP can be modified by opp_enable/disable functions.
+        WARNING: The struct dev_pm_opp pointer should not be parsed or modified by the
+        users. The defaults of for an instance is populated by dev_pm_opp_add, but the
+        availability of the OPP can be modified by dev_pm_opp_enable/disable functions.
 
 struct device - This is used to identify a domain to the OPP layer. The
         nature of the device and it's implementation is left to the user of
@@ -377,19 +377,19 @@ Overall, in a simplistic view, the data structure operations is represented as
 following:
 
 Initialization / modification:
-            +-----+        /- opp_enable
-opp_add --> | opp | <-------
-  |         +-----+        \- opp_disable
+            +-----+        /- dev_pm_opp_enable
+dev_pm_opp_add --> | opp | <-------
+  |         +-----+        \- dev_pm_opp_disable
   \-------> domain_info(device)
 
 Search functions:
-             /-- opp_find_freq_ceil  ---\   +-----+
-domain_info<---- opp_find_freq_exact -----> | opp |
-             \-- opp_find_freq_floor ---/   +-----+
+             /-- dev_pm_opp_find_freq_ceil  ---\   +-----+
+domain_info<---- dev_pm_opp_find_freq_exact -----> | opp |
+             \-- dev_pm_opp_find_freq_floor ---/   +-----+
 
 Retrieval functions:
-+-----+     /- opp_get_voltage
++-----+     /- dev_pm_opp_get_voltage
 | opp | <---
-+-----+     \- opp_get_freq
++-----+     \- dev_pm_opp_get_freq
 
-domain_info <- opp_get_opp_count
+domain_info <- dev_pm_opp_get_opp_count
diff --git a/Documentation/power/powercap/powercap.txt b/Documentation/power/powercap/powercap.txt
new file mode 100644
index 000000000000..1e6ef164e07a
--- /dev/null
+++ b/Documentation/power/powercap/powercap.txt
@@ -0,0 +1,236 @@
+Power Capping Framework
+==================================
+
+The power capping framework provides a consistent interface between the kernel
+and the user space that allows power capping drivers to expose the settings to
+user space in a uniform way.
+
+Terminology
+=========================
+The framework exposes power capping devices to user space via sysfs in the
+form of a tree of objects. The objects at the root level of the tree represent
+'control types', which correspond to different methods of power capping.  For
+example, the intel-rapl control type represents the Intel "Running Average
+Power Limit" (RAPL) technology, whereas the 'idle-injection' control type
+corresponds to the use of idle injection for controlling power.
+
+Power zones represent different parts of the system, which can be controlled and
+monitored using the power capping method determined by the control type the
+given zone belongs to. They each contain attributes for monitoring power, as
+well as controls represented in the form of power constraints.  If the parts of
+the system represented by different power zones are hierarchical (that is, one
+bigger part consists of multiple smaller parts that each have their own power
+controls), those power zones may also be organized in a hierarchy with one
+parent power zone containing multiple subzones and so on to reflect the power
+control topology of the system.  In that case, it is possible to apply power
+capping to a set of devices together using the parent power zone and if more
+fine grained control is required, it can be applied through the subzones.
+
+
+Example sysfs interface tree:
+
+/sys/devices/virtual/powercap
+??? intel-rapl
+    ??? intel-rapl:0
+    ?   ??? constraint_0_name
+    ?   ??? constraint_0_power_limit_uw
+    ?   ??? constraint_0_time_window_us
+    ?   ??? constraint_1_name
+    ?   ??? constraint_1_power_limit_uw
+    ?   ??? constraint_1_time_window_us
+    ?   ??? device -> ../../intel-rapl
+    ?   ??? energy_uj
+    ?   ??? intel-rapl:0:0
+    ?   ?   ??? constraint_0_name
+    ?   ?   ??? constraint_0_power_limit_uw
+    ?   ?   ??? constraint_0_time_window_us
+    ?   ?   ??? constraint_1_name
+    ?   ?   ??? constraint_1_power_limit_uw
+    ?   ?   ??? constraint_1_time_window_us
+    ?   ?   ??? device -> ../../intel-rapl:0
+    ?   ?   ??? energy_uj
+    ?   ?   ??? max_energy_range_uj
+    ?   ?   ??? name
+    ?   ?   ??? enabled
+    ?   ?   ??? power
+    ?   ?   ?   ??? async
+    ?   ?   ?   []
+    ?   ?   ??? subsystem -> ../../../../../../class/power_cap
+    ?   ?   ??? uevent
+    ?   ??? intel-rapl:0:1
+    ?   ?   ??? constraint_0_name
+    ?   ?   ??? constraint_0_power_limit_uw
+    ?   ?   ??? constraint_0_time_window_us
+    ?   ?   ??? constraint_1_name
+    ?   ?   ??? constraint_1_power_limit_uw
+    ?   ?   ??? constraint_1_time_window_us
+    ?   ?   ??? device -> ../../intel-rapl:0
+    ?   ?   ??? energy_uj
+    ?   ?   ??? max_energy_range_uj
+    ?   ?   ??? name
+    ?   ?   ??? enabled
+    ?   ?   ??? power
+    ?   ?   ?   ??? async
+    ?   ?   ?   []
+    ?   ?   ??? subsystem -> ../../../../../../class/power_cap
+    ?   ?   ??? uevent
+    ?   ??? max_energy_range_uj
+    ?   ??? max_power_range_uw
+    ?   ??? name
+    ?   ??? enabled
+    ?   ??? power
+    ?   ?   ??? async
+    ?   ?   []
+    ?   ??? subsystem -> ../../../../../class/power_cap
+    ?   ??? enabled
+    ?   ??? uevent
+    ??? intel-rapl:1
+    ?   ??? constraint_0_name
+    ?   ??? constraint_0_power_limit_uw
+    ?   ??? constraint_0_time_window_us
+    ?   ??? constraint_1_name
+    ?   ??? constraint_1_power_limit_uw
+    ?   ??? constraint_1_time_window_us
+    ?   ??? device -> ../../intel-rapl
+    ?   ??? energy_uj
+    ?   ??? intel-rapl:1:0
+    ?   ?   ??? constraint_0_name
+    ?   ?   ??? constraint_0_power_limit_uw
+    ?   ?   ??? constraint_0_time_window_us
+    ?   ?   ??? constraint_1_name
+    ?   ?   ??? constraint_1_power_limit_uw
+    ?   ?   ??? constraint_1_time_window_us
+    ?   ?   ??? device -> ../../intel-rapl:1
+    ?   ?   ??? energy_uj
+    ?   ?   ??? max_energy_range_uj
+    ?   ?   ??? name
+    ?   ?   ??? enabled
+    ?   ?   ??? power
+    ?   ?   ?   ??? async
+    ?   ?   ?   []
+    ?   ?   ??? subsystem -> ../../../../../../class/power_cap
+    ?   ?   ??? uevent
+    ?   ??? intel-rapl:1:1
+    ?   ?   ??? constraint_0_name
+    ?   ?   ??? constraint_0_power_limit_uw
+    ?   ?   ??? constraint_0_time_window_us
+    ?   ?   ??? constraint_1_name
+    ?   ?   ??? constraint_1_power_limit_uw
+    ?   ?   ??? constraint_1_time_window_us
+    ?   ?   ??? device -> ../../intel-rapl:1
+    ?   ?   ??? energy_uj
+    ?   ?   ??? max_energy_range_uj
+    ?   ?   ??? name
+    ?   ?   ??? enabled
+    ?   ?   ??? power
+    ?   ?   ?   ??? async
+    ?   ?   ?   []
+    ?   ?   ??? subsystem -> ../../../../../../class/power_cap
+    ?   ?   ??? uevent
+    ?   ??? max_energy_range_uj
+    ?   ??? max_power_range_uw
+    ?   ??? name
+    ?   ??? enabled
+    ?   ??? power
+    ?   ?   ??? async
+    ?   ?   []
+    ?   ??? subsystem -> ../../../../../class/power_cap
+    ?   ??? uevent
+    ??? power
+    ?   ??? async
+    ?   []
+    ??? subsystem -> ../../../../class/power_cap
+    ??? enabled
+    ??? uevent
+
+The above example illustrates a case in which the Intel RAPL technology,
+available in Intel® IA-64 and IA-32 Processor Architectures, is used. There is one
+control type called intel-rapl which contains two power zones, intel-rapl:0 and
+intel-rapl:1, representing CPU packages.  Each of these power zones contains
+two subzones, intel-rapl:j:0 and intel-rapl:j:1 (j = 0, 1), representing the
+"core" and the "uncore" parts of the given CPU package, respectively.  All of
+the zones and subzones contain energy monitoring attributes (energy_uj,
+max_energy_range_uj) and constraint attributes (constraint_*) allowing controls
+to be applied (the constraints in the 'package' power zones apply to the whole
+CPU packages and the subzone constraints only apply to the respective parts of
+the given package individually). Since Intel RAPL doesn't provide instantaneous
+power value, there is no power_uw attribute.
+
+In addition to that, each power zone contains a name attribute, allowing the
+part of the system represented by that zone to be identified.
+For example:
+
+cat /sys/class/power_cap/intel-rapl/intel-rapl:0/name
+package-0
+
+The Intel RAPL technology allows two constraints, short term and long term,
+with two different time windows to be applied to each power zone.  Thus for
+each zone there are 2 attributes representing the constraint names, 2 power
+limits and 2 attributes representing the sizes of the time windows. Such that,
+constraint_j_* attributes correspond to the jth constraint (j = 0,1).
+
+For example:
+        constraint_0_name
+        constraint_0_power_limit_uw
+        constraint_0_time_window_us
+        constraint_1_name
+        constraint_1_power_limit_uw
+        constraint_1_time_window_us
+
+Power Zone Attributes
+=================================
+Monitoring attributes
+----------------------
+
+energy_uj (rw): Current energy counter in micro joules. Write "0" to reset.
+If the counter can not be reset, then this attribute is read only.
+
+max_energy_range_uj (ro): Range of the above energy counter in micro-joules.
+
+power_uw (ro): Current power in micro watts.
+
+max_power_range_uw (ro): Range of the above power value in micro-watts.
+
+name (ro): Name of this power zone.
+
+It is possible that some domains have both power ranges and energy counter ranges;
+however, only one is mandatory.
+
+Constraints
+----------------
+constraint_X_power_limit_uw (rw): Power limit in micro watts, which should be
+applicable for the time window specified by "constraint_X_time_window_us".
+
+constraint_X_time_window_us (rw): Time window in micro seconds.
+
+constraint_X_name (ro): An optional name of the constraint
+
+constraint_X_max_power_uw(ro): Maximum allowed power in micro watts.
+
+constraint_X_min_power_uw(ro): Minimum allowed power in micro watts.
+
+constraint_X_max_time_window_us(ro): Maximum allowed time window in micro seconds.
+
+constraint_X_min_time_window_us(ro): Minimum allowed time window in micro seconds.
+
+Except power_limit_uw and time_window_us other fields are optional.
+
+Common zone and control type attributes
+----------------------------------------
+enabled (rw): Enable/Disable controls at zone level or for all zones using
+a control type.
+
+Power Cap Client Driver Interface
+==================================
+The API summary:
+
+Call powercap_register_control_type() to register control type object.
+Call powercap_register_zone() to register a power zone (under a given
+control type), either as a top-level power zone or as a subzone of another
+power zone registered earlier.
+The number of constraints in a power zone and the corresponding callbacks have
+to be defined prior to calling powercap_register_zone() to register that zone.
+
+To Free a power zone call powercap_unregister_zone().
+To free a control type object call powercap_unregister_control_type().
+Detailed API can be generated using kernel-doc on include/linux/powercap.h.
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index 71d8fe4e75d3..0f54333b0ff2 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -145,11 +145,13 @@ The action performed by the idle callback is totally dependent on the subsystem
 if the device can be suspended (i.e. if all of the conditions necessary for
 suspending the device are satisfied) and to queue up a suspend request for the
 device in that case.  If there is no idle callback, or if the callback returns
-0, then the PM core will attempt to carry out a runtime suspend of the device;
-in essence, it will call pm_runtime_suspend() directly.  To prevent this (for
-example, if the callback routine has started a delayed suspend), the routine
-should return a non-zero value.  Negative error return codes are ignored by the
-PM core.
+0, then the PM core will attempt to carry out a runtime suspend of the device,
+also respecting devices configured for autosuspend.  In essence this means a
+call to pm_runtime_autosuspend() (do note that drivers needs to update the
+device last busy mark, pm_runtime_mark_last_busy(), to control the delay under
+this circumstance).  To prevent this (for example, if the callback routine has
+started a delayed suspend), the routine must return a non-zero value.  Negative
+error return codes are ignored by the PM core.
 
 The helper functions provided by the PM core, described in Section 4, guarantee
 that the following constraints are met with respect to runtime PM callbacks for
@@ -308,7 +310,7 @@ drivers/base/power/runtime.c and include/linux/pm_runtime.h:
     - execute the subsystem-level idle callback for the device; returns an
       error code on failure, where -EINPROGRESS means that ->runtime_idle() is
       already being executed; if there is no callback or the callback returns 0
-      then run pm_runtime_suspend(dev) and return its result
+      then run pm_runtime_autosuspend(dev) and return its result
 
   int pm_runtime_suspend(struct device *dev);
     - execute the subsystem-level suspend callback for the device; returns 0 on
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index a46ddb85e83a..85c362d8ea34 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -28,6 +28,7 @@ ALC269/270/275/276/28x/29x
   alc269-dmic           Enable ALC269(VA) digital mic workaround
   alc271-dmic           Enable ALC271X digital mic workaround
   inv-dmic              Inverted internal mic workaround
+  headset-mic           Indicates a combined headset (headphone+mic) jack
   lenovo-dock           Enables docking station I/O for some Lenovos
   dell-headset-multi    Headset jack, which can also be used as mic-in
   dell-headset-dock     Headset jack (without mic-in), and also dock I/O
@@ -296,6 +297,12 @@ Cirrus Logic CS4206/4207
   imac27        IMac 27 Inch
   auto          BIOS setup (default)
 
+Cirrus Logic CS4208
+===================
+  mba6          MacBook Air 6,1 and 6,2
+  gpio0         Enable GPIO 0 amp
+  auto          BIOS setup (default)
+
 VIA VT17xx/VT18xx/VT20xx
 ========================
   auto          BIOS setup (default)
diff --git a/MAINTAINERS b/MAINTAINERS
index e61c2e83fc2b..45cdfa3e1067 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -237,11 +237,11 @@ F:	drivers/platform/x86/acer-wmi.c
 
 ACPI
 M:      Len Brown <lenb@kernel.org>
-M:      Rafael J. Wysocki <rjw@sisk.pl>
+M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
-Q:      http://patchwork.kernel.org/project/linux-acpi/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
+W:      https://01.org/linux-acpi
+Q:      https://patchwork.kernel.org/project/linux-acpi/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
 S:      Supported
 F:      drivers/acpi/
 F:      drivers/pnp/pnpacpi/
@@ -253,24 +253,38 @@ F:	drivers/pci/*acpi*
 F:      drivers/pci/*/*acpi*
 F:      drivers/pci/*/*/*acpi*
 
+ACPI COMPONENT ARCHITECTURE (ACPICA)
+M:      Robert Moore <robert.moore@intel.com>
+M:      Lv Zheng <lv.zheng@intel.com>
+M:      Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+L:      linux-acpi@vger.kernel.org
+L:      devel@acpica.org
+W:      https://acpica.org/
+W:      https://github.com/acpica/acpica/
+Q:      https://patchwork.kernel.org/project/linux-acpi/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
+S:      Supported
+F:      drivers/acpi/acpica/
+F:      include/acpi/
+
 ACPI FAN DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/acpi/fan.c
 
 ACPI THERMAL DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/acpi/*thermal*
 
 ACPI VIDEO DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/acpi/video.c
 
@@ -824,15 +838,21 @@ S:	Maintained
 F:      arch/arm/mach-gemini/
 
 ARM/CSR SIRFPRIMA2 MACHINE SUPPORT
-M:      Barry Song <baohua.song@csr.com>
+M:      Barry Song <baohua@kernel.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/baohua/linux.git
 S:      Maintained
 F:      arch/arm/mach-prima2/
+F:      drivers/clk/clk-prima2.c
+F:      drivers/clocksource/timer-prima2.c
+F:      drivers/clocksource/timer-marco.c
 F:      drivers/dma/sirf-dma.c
 F:      drivers/i2c/busses/i2c-sirf.c
+F:      drivers/input/misc/sirfsoc-onkey.c
+F:      drivers/irqchip/irq-sirfsoc.c
 F:      drivers/mmc/host/sdhci-sirf.c
 F:      drivers/pinctrl/sirf/
+F:      drivers/rtc/rtc-sirfsoc.c
 F:      drivers/spi/spi-sirf.c
 
 ARM/EBSA110 MACHINE SUPPORT
@@ -1003,6 +1023,7 @@ ARM/Marvell Armada 370 and Armada XP SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Gregory Clement <gregory.clement@free-electrons.com>
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-mvebu/
@@ -1010,6 +1031,7 @@ F:	arch/arm/mach-mvebu/
 ARM/Marvell Dove/Kirkwood/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-dove/
@@ -1142,6 +1164,13 @@ F:	drivers/net/ethernet/i825xx/ether1*
 F:      drivers/net/ethernet/seeq/ether3*
 F:      drivers/scsi/arm/
 
+ARM/Rockchip SoC support
+M:      Heiko Stuebner <heiko@sntech.de>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-rockchip/
+F:      drivers/*/*rockchip*
+
 ARM/SHARK MACHINE SUPPORT
 M:      Alexander Schulz <alex@shark-linux.de>
 W:      http://www.shark-linux.de/shark.html
@@ -1785,6 +1814,7 @@ F:	include/net/bluetooth/
 
 BONDING DRIVER
 M:      Jay Vosburgh <fubar@us.ibm.com>
+M:      Veaceslav Falico <vfalico@redhat.com>
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
@@ -1812,7 +1842,8 @@ S:	Supported
 F:      drivers/net/ethernet/broadcom/bnx2x/
 
 BROADCOM BCM281XX/BCM11XXX ARM ARCHITECTURE
-M:      Christian Daudt <csd@broadcom.com>
+M:      Christian Daudt <bcm@fixthebug.org>
+L:      bcm-kernel-feedback-list@broadcom.com
 T:      git git://git.github.com/broadcom/bcm11351
 S:      Maintained
 F:      arch/arm/mach-bcm/
@@ -2293,7 +2324,7 @@ S:	Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
 
 CPU FREQUENCY DRIVERS
-M:      Rafael J. Wysocki <rjw@sisk.pl>
+M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 M:      Viresh Kumar <viresh.kumar@linaro.org>
 L:      cpufreq@vger.kernel.org
 L:      linux-pm@vger.kernel.org
@@ -2324,7 +2355,7 @@ S:      Maintained
 F:      drivers/cpuidle/cpuidle-big_little.c
 
 CPUIDLE DRIVERS
-M:      Rafael J. Wysocki <rjw@sisk.pl>
+M:      Rafael J. Wysocki <rjw@rjwysocki.net>
 M:      Daniel Lezcano <daniel.lezcano@linaro.org>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
@@ -2639,6 +2670,18 @@ F:	include/linux/device-mapper.h
 F:      include/linux/dm-*.h
 F:      include/uapi/linux/dm-*.h
 
+DIGI NEO AND CLASSIC PCI PRODUCTS
+M:      Lidza Louina <lidza.louina@gmail.com>
+L:      driverdev-devel@linuxdriverproject.org
+S:      Maintained
+F:      drivers/staging/dgnc/
+
+DIGI EPCA PCI PRODUCTS
+M:      Lidza Louina <lidza.louina@gmail.com>
+L:      driverdev-devel@linuxdriverproject.org
+S:      Maintained
+F:      drivers/staging/dgap/
+
 DIOLAN U2C-12 I2C DRIVER
 M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-i2c@vger.kernel.org
@@ -2699,6 +2742,8 @@ T:	git git://git.linaro.org/people/sumitsemwal/linux-dma-buf.git
 DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 M:      Vinod Koul <vinod.koul@intel.com>
 M:      Dan Williams <dan.j.williams@intel.com>
+L:      dmaengine@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
 S:      Supported
 F:      drivers/dma/
 F:      include/linux/dma*
@@ -2802,7 +2847,7 @@ M:	Terje Bergström <tbergstrom@nvidia.com>
 L:      dri-devel@lists.freedesktop.org
 L:      linux-tegra@vger.kernel.org
 T:      git git://anongit.freedesktop.org/tegra/linux.git
-S:      Maintained
+S:      Supported
 F:      drivers/gpu/host1x/
 F:      include/uapi/drm/tegra_drm.h
 F:      Documentation/devicetree/bindings/gpu/nvidia,tegra20-host1x.txt
@@ -3534,7 +3579,7 @@ F:	fs/freevxfs/
 
 FREEZER
 M:      Pavel Machek <pavel@ucw.cz>
-M:      "Rafael J. Wysocki" <rjw@sisk.pl>
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      Documentation/power/freezing-of-tasks.txt
@@ -3605,6 +3650,12 @@ L:	linux-scsi@vger.kernel.org
 S:      Odd Fixes (e.g., new signatures)
 F:      drivers/scsi/fdomain.*
 
+GCOV BASED KERNEL PROFILING
+M:      Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+S:      Maintained
+F:      kernel/gcov/
+F:      Documentation/gcov.txt
+
 GDT SCSI DISK ARRAY CONTROLLER DRIVER
 M:      Achim Leubner <achim_leubner@adaptec.com>
 L:      linux-scsi@vger.kernel.org
@@ -3870,7 +3921,7 @@ F:	drivers/video/hgafb.c
 
 HIBERNATION (aka Software Suspend, aka swsusp)
 M:      Pavel Machek <pavel@ucw.cz>
-M:      "Rafael J. Wysocki" <rjw@sisk.pl>
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      arch/x86/power/
@@ -4320,7 +4371,7 @@ F:	drivers/video/i810/
 INTEL MENLOW THERMAL DRIVER
 M:      Sujith Thomas <sujith.thomas@intel.com>
 L:      platform-driver-x86@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      https://01.org/linux-acpi
 S:      Supported
 F:      drivers/platform/x86/intel_menlow.c
 
@@ -4332,7 +4383,10 @@ F:	arch/x86/kernel/microcode_intel.c
 
 INTEL I/OAT DMA DRIVER
 M:      Dan Williams <dan.j.williams@intel.com>
-S:      Maintained
+M:      Dave Jiang <dave.jiang@intel.com>
+L:      dmaengine@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
+S:      Supported
 F:      drivers/dma/ioat*
 
 INTEL IOMMU (VT-d)
@@ -4457,6 +4511,13 @@ L:	linux-serial@vger.kernel.org
 S:      Maintained
 F:      drivers/tty/serial/ioc3_serial.c
 
+IOMMU DRIVERS
+M:      Joerg Roedel <joro@8bytes.org>
+L:      iommu@lists.linux-foundation.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
+S:      Maintained
+F:      drivers/iommu/
+
 IP MASQUERADING
 M:      Juanjo Ciarlante <jjciarla@raiz.uncu.edu.ar>
 S:      Maintained
@@ -6595,7 +6656,7 @@ S:	Obsolete
 F:      drivers/net/wireless/prism54/
 
 PROMISE SATA TX2/TX4 CONTROLLER LIBATA DRIVER
-M:      Mikael Pettersson <mikpe@it.uu.se>
+M:      Mikael Pettersson <mikpelinux@gmail.com>
 L:      linux-ide@vger.kernel.org
 S:      Maintained
 F:      drivers/ata/sata_promise.*
@@ -7258,9 +7319,9 @@ F:	include/linux/sched.h
 F:      include/uapi/linux/sched.h
 
 SCORE ARCHITECTURE
-M:      Chen Liqin <liqin.chen@sunplusct.com>
+M:      Chen Liqin <liqin.linux@gmail.com>
 M:      Lennox Wu <lennox.wu@gmail.com>
-W:      http://www.sunplusct.com
+W:      http://www.sunplus.com
 S:      Supported
 F:      arch/score/
 
@@ -7790,6 +7851,13 @@ F:	Documentation/sound/alsa/soc/
 F:      sound/soc/
 F:      include/sound/soc*
 
+SOUND - DMAENGINE HELPERS
+M:      Lars-Peter Clausen <lars@metafoo.de>
+S:      Supported
+F:      include/sound/dmaengine_pcm.h
+F:      sound/core/pcm_dmaengine.c
+F:      sound/soc/soc-generic-dmaengine-pcm.c
+
 SPARC + UltraSPARC (sparc/sparc64)
 M:      "David S. Miller" <davem@davemloft.net>
 L:      sparclinux@vger.kernel.org
@@ -8069,7 +8137,7 @@ F:	drivers/sh/
 SUSPEND TO RAM
 M:      Len Brown <len.brown@intel.com>
 M:      Pavel Machek <pavel@ucw.cz>
-M:      "Rafael J. Wysocki" <rjw@sisk.pl>
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      Documentation/power/
@@ -8262,14 +8330,72 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/rc/ttusbir.c
 
-TEGRA SUPPORT
+TEGRA ARCHITECTURE SUPPORT
 M:      Stephen Warren <swarren@wwwdotorg.org>
+M:      Thierry Reding <thierry.reding@gmail.com>
 L:      linux-tegra@vger.kernel.org
 Q:      http://patchwork.ozlabs.org/project/linux-tegra/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/swarren/linux-tegra.git
 S:      Supported
 N:      [^a-z]tegra
 
+TEGRA ASOC DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      sound/soc/tegra/
+
+TEGRA CLOCK DRIVER
+M:      Peter De Schrijver <pdeschrijver@nvidia.com>
+M:      Prashant Gaikwad <pgaikwad@nvidia.com>
+S:      Supported
+F:      drivers/clk/tegra/
+
+TEGRA DMA DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/dma/tegra20-apb-dma.c
+
+TEGRA GPIO DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      drivers/gpio/gpio-tegra.c
+
+TEGRA I2C DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/i2c/busses/i2c-tegra.c
+
+TEGRA IOMMU DRIVERS
+M:      Hiroshi Doyu <hdoyu@nvidia.com>
+S:      Supported
+F:      drivers/iommu/tegra*
+
+TEGRA KBC DRIVER
+M:      Rakesh Iyer <riyer@nvidia.com>
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/input/keyboard/tegra-kbc.c
+
+TEGRA PINCTRL DRIVER
+M:      Stephen Warren <swarren@wwwdotorg.org>
+S:      Supported
+F:      drivers/pinctrl/pinctrl-tegra*
+
+TEGRA PWM DRIVER
+M:      Thierry Reding <thierry.reding@gmail.com>
+S:      Supported
+F:      drivers/pwm/pwm-tegra.c
+
+TEGRA SERIAL DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/tty/serial/serial-tegra.c
+
+TEGRA SPI DRIVER
+M:      Laxman Dewangan <ldewangan@nvidia.com>
+S:      Supported
+F:      drivers/spi/spi-tegra*
+
 TEHUTI ETHERNET DRIVER
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
@@ -8724,9 +8850,8 @@ F:	Documentation/hid/hiddev.txt
 F:      drivers/hid/usbhid/
 
 USB/IP DRIVERS
-M:      Matt Mooney <mfm@muteddisk.com>
 L:      linux-usb@vger.kernel.org
-S:      Maintained
+S:      Orphan
 F:      drivers/staging/usbip/
 
 USB ISP116X DRIVER
@@ -9366,6 +9491,7 @@ F:	arch/arm64/include/asm/xen/
 
 XEN NETWORK BACKEND DRIVER
 M:      Ian Campbell <ian.campbell@citrix.com>
+M:      Wei Liu <wei.liu2@citrix.com>
 L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
 L:      netdev@vger.kernel.org
 S:      Supported
diff --git a/Makefile b/Makefile
index 8d0668f473ba..868c0eb67b08 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc7
 NAME = One Giant Leap for Frogkind
 
 # *DOCUMENTATION*
diff --git a/arch/Kconfig b/arch/Kconfig
index 1feb169274fe..af2cc6eabcc7 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -286,9 +286,6 @@ config HAVE_PERF_USER_STACK_DUMP
 config HAVE_ARCH_JUMP_LABEL
         bool
 
-config HAVE_ARCH_MUTEX_CPU_RELAX
-        bool
-
 config HAVE_RCU_TABLE_FREE
         bool
 
diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
index f158197ac5b0..b6a8c2dfbe6e 100644
--- a/arch/arc/include/asm/spinlock.h
+++ b/arch/arc/include/asm/spinlock.h
@@ -45,7 +45,14 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
 
 static inline void arch_spin_unlock(arch_spinlock_t *lock)
 {
-        lock->slock = __ARCH_SPIN_LOCK_UNLOCKED__;
+        unsigned int tmp = __ARCH_SPIN_LOCK_UNLOCKED__;
+
+        __asm__ __volatile__(
+        "       ex  %0, [%1]            \n"
+        : "+r" (tmp)
+        : "r"(&(lock->slock))
+        : "memory");
+
         smp_mb();
 }
 
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index 32420824375b..30c9baffa96f 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -43,7 +43,7 @@
  * Because it essentially checks if buffer end is within limit and @len is
  * non-ngeative, which implies that buffer start will be within limit too.
  *
- * The reason for rewriting being, for majorit yof cases, @len is generally
+ * The reason for rewriting being, for majority of cases, @len is generally
  * compile time constant, causing first sub-expression to be compile time
  * subsumed.
  *
@@ -53,7 +53,7 @@
  *
  */
 #define __user_ok(addr, sz)     (((sz) <= TASK_SIZE) && \
-                                 (((addr)+(sz)) <= get_fs()))
+                                 ((addr) <= (get_fs() - (sz))))
 #define __access_ok(addr, sz)   (unlikely(__kernel_ok) || \
                                  likely(__user_ok((addr), (sz))))
 
diff --git a/arch/arc/kernel/ptrace.c b/arch/arc/kernel/ptrace.c
index 333238564b67..5d76706139dd 100644
--- a/arch/arc/kernel/ptrace.c
+++ b/arch/arc/kernel/ptrace.c
@@ -102,7 +102,7 @@ static int genregs_set(struct task_struct *target,
         REG_IGNORE_ONE(pad2);
         REG_IN_CHUNK(callee, efa, cregs);       /* callee_regs[r25..r13] */
         REG_IGNORE_ONE(efa);                    /* efa update invalid */
-        REG_IN_ONE(stop_pc, &ptregs->ret);      /* stop_pc: PC update */
+        REG_IGNORE_ONE(stop_pc);                        /* PC updated via @ret */
 
         return ret;
 }
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index ee6ef2f60a28..7e95e1a86510 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -101,7 +101,6 @@ SYSCALL_DEFINE0(rt_sigreturn)
 {
         struct rt_sigframe __user *sf;
         unsigned int magic;
-        int err;
         struct pt_regs *regs = current_pt_regs();
 
         /* Always make any pending restarted system calls return -EINTR */
@@ -119,15 +118,16 @@ SYSCALL_DEFINE0(rt_sigreturn)
         if (!access_ok(VERIFY_READ, sf, sizeof(*sf)))
                 goto badframe;
 
-        err = restore_usr_regs(regs, sf);
-        err |= __get_user(magic, &sf->sigret_magic);
-        if (err)
+        if (__get_user(magic, &sf->sigret_magic))
                 goto badframe;
 
         if (unlikely(is_do_ss_needed(magic)))
                 if (restore_altstack(&sf->uc.uc_stack))
                         goto badframe;
 
+        if (restore_usr_regs(regs, sf))
+                goto badframe;
+
         /* Don't restart from sigreturn */
         syscall_wont_restart(regs);
 
@@ -191,6 +191,15 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info,
                 return 1;
 
         /*
+         * w/o SA_SIGINFO, struct ucontext is partially populated (only
+         * uc_mcontext/uc_sigmask) for kernel's normal user state preservation
+         * during signal handler execution. This works for SA_SIGINFO as well
+         * although the semantics are now overloaded (the same reg state can be
+         * inspected by userland: but are they allowed to fiddle with it ?
+         */
+        err |= stash_usr_regs(sf, regs, set);
+
+        /*
          * SA_SIGINFO requires 3 args to signal handler:
          *  #1: sig-no (common to any handler)
          *  #2: struct siginfo
@@ -213,14 +222,6 @@ setup_rt_frame(int signo, struct k_sigaction *ka, siginfo_t *info,
                 magic = MAGIC_SIGALTSTK;
         }
 
-        /*
-         * w/o SA_SIGINFO, struct ucontext is partially populated (only
-         * uc_mcontext/uc_sigmask) for kernel's normal user state preservation
-         * during signal handler execution. This works for SA_SIGINFO as well
-         * although the semantics are now overloaded (the same reg state can be
-         * inspected by userland: but are they allowed to fiddle with it ?
-         */
-        err |= stash_usr_regs(sf, regs, set);
         err |= __put_user(magic, &sf->sigret_magic);
         if (err)
                 return err;
diff --git a/arch/arc/kernel/time.c b/arch/arc/kernel/time.c
index 0e51e69cf30d..3fde7de3ea67 100644
--- a/arch/arc/kernel/time.c
+++ b/arch/arc/kernel/time.c
@@ -227,12 +227,9 @@ void __attribute__((weak)) arc_local_timer_setup(unsigned int cpu)
 {
         struct clock_event_device *clk = &per_cpu(arc_clockevent_device, cpu);
 
-        clockevents_calc_mult_shift(clk, arc_get_core_freq(), 5);
-
-        clk->max_delta_ns = clockevent_delta2ns(ARC_TIMER_MAX, clk);
         clk->cpumask = cpumask_of(cpu);
-
-        clockevents_register_device(clk);
+        clockevents_config_and_register(clk, arc_get_core_freq(),
+                                        0, ARC_TIMER_MAX);
 
         /*
          * setup the per-cpu timer IRQ handler - for all cpus
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index 28d170060747..7ff5b5c183bb 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -245,6 +245,12 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
                 regs->status32 &= ~STATUS_DE_MASK;
         } else {
                 regs->ret += state.instr_len;
+
+                /* handle zero-overhead-loop */
+                if ((regs->ret == regs->lp_end) && (regs->lp_count)) {
+                        regs->ret = regs->lp_start;
+                        regs->lp_count--;
+                }
         }
 
         return 0;
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 3f7714d8d2d2..1ad6fb6c094d 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -2217,8 +2217,7 @@ config NEON
 
 config KERNEL_MODE_NEON
         bool "Support for NEON in kernel mode"
-        default n
-        depends on NEON
+        depends on NEON && AEABI
         help
           Say Y to include support for NEON in kernel mode.
 
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index a37a50f575a2..db50b626be98 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -296,10 +296,15 @@ archprepare:
 # Convert bzImage to zImage
 bzImage: zImage
 
-zImage Image xipImage bootpImage uImage: vmlinux
+BOOT_TARGETS    = zImage Image xipImage bootpImage uImage
+INSTALL_TARGETS = zinstall uinstall install
+
+PHONY += bzImage $(BOOT_TARGETS) $(INSTALL_TARGETS)
+
+$(BOOT_TARGETS): vmlinux
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
-zinstall uinstall install: vmlinux
+$(INSTALL_TARGETS):
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
 
 %.dtb: | scripts
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index 84aa2caf07ed..ec2f8065f955 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -95,24 +95,24 @@ initrd:
         @test "$(INITRD)" != "" || \
         (echo You must specify INITRD; exit -1)
 
-install: $(obj)/Image
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+install:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
         $(obj)/Image System.map "$(INSTALL_PATH)"
 
-zinstall: $(obj)/zImage
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+zinstall:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
         $(obj)/zImage System.map "$(INSTALL_PATH)"
 
-uinstall: $(obj)/uImage
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+uinstall:
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
         $(obj)/uImage System.map "$(INSTALL_PATH)"
 
 zi:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
         $(obj)/zImage System.map "$(INSTALL_PATH)"
 
 i:
-        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
+        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh "$(KERNELRELEASE)" \
         $(obj)/Image System.map "$(INSTALL_PATH)"
 
 subdir-     := bootp compressed dts
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index e95af3f5433b..802720e3e8fd 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -41,6 +41,8 @@ dtb-$(CONFIG_ARCH_AT91)	+= sama5d33ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d34ek.dtb
 dtb-$(CONFIG_ARCH_AT91) += sama5d35ek.dtb
 
+dtb-$(CONFIG_ARCH_ATLAS6) += atlas6-evb.dtb
+
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2835-rpi-b.dtb
 dtb-$(CONFIG_ARCH_BCM) += bcm11351-brt.dtb \
         bcm28155-ap.dtb
diff --git a/arch/arm/boot/dts/armada-370-netgear-rn102.dts b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
index 05e4485a8225..8ac2ac1f69cc 100644
--- a/arch/arm/boot/dts/armada-370-netgear-rn102.dts
+++ b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
@@ -27,6 +27,25 @@
         };
 
         soc {
+                ranges = <MBUS_ID(0xf0, 0x01) 0 0xd0000000 0x100000
+                          MBUS_ID(0x01, 0xe0) 0 0xfff00000 0x100000>;
+
+                pcie-controller {
+                        status = "okay";
+
+                        /* Connected to Marvell SATA controller */
+                        pcie@1,0 {
+                                /* Port 0, Lane 0 */
+                                status = "okay";
+                        };
+
+                        /* Connected to FL1009 USB 3.0 controller */
+                        pcie@2,0 {
+                                /* Port 1, Lane 0 */
+                                status = "okay";
+                        };
+                };
+
                 internal-regs {
                         serial@12000 {
                                 clock-frequency = <200000000>;
@@ -57,6 +76,11 @@
                                         marvell,pins = "mpp56";
                                         marvell,function = "gpio";
                                 };
+
+                                poweroff: poweroff {
+                                        marvell,pins = "mpp8";
+                                        marvell,function = "gpio";
+                                };
                         };
 
                         mdio {
@@ -89,22 +113,6 @@
                                         pwm_polarity = <0>;
                                 };
                         };
-
-                        pcie-controller {
-                                status = "okay";
-
-                                /* Connected to Marvell SATA controller */
-                                pcie@1,0 {
-                                        /* Port 0, Lane 0 */
-                                        status = "okay";
-                                };
-
-                                /* Connected to FL1009 USB 3.0 controller */
-                                pcie@2,0 {
-                                        /* Port 1, Lane 0 */
-                                        status = "okay";
-                                };
-                        };
                 };
         };
 
@@ -160,7 +168,7 @@
                 button@1 {
                         label = "Power Button";
                         linux,code = <116>;     /* KEY_POWER */
-                        gpios = <&gpio1 30 1>;
+                        gpios = <&gpio1 30 0>;
                 };
 
                 button@2 {
@@ -176,4 +184,11 @@
                 };
         };
 
+        gpio_poweroff {
+                compatible = "gpio-poweroff";
+                pinctrl-0 = <&poweroff>;
+                pinctrl-names = "default";
+                gpios = <&gpio0 8 1>;
+        };
+
 };
diff --git a/arch/arm/boot/dts/armada-xp.dtsi b/arch/arm/boot/dts/armada-xp.dtsi
index def125c0eeaa..3058522f5aad 100644
--- a/arch/arm/boot/dts/armada-xp.dtsi
+++ b/arch/arm/boot/dts/armada-xp.dtsi
@@ -70,6 +70,8 @@
 
                         timer@20300 {
                                 compatible = "marvell,armada-xp-timer";
+                                clocks = <&coreclk 2>, <&refclk>;
+                                clock-names = "nbclk", "fixed";
                         };
 
                         coreclk: mvebu-sar@18230 {
@@ -169,4 +171,13 @@
                         };
                 };
         };
+
+        clocks {
+                /* 25 MHz reference crystal */
+                refclk: oscillator {
+                        compatible = "fixed-clock";
+                        #clock-cells = <0>;
+                        clock-frequency = <25000000>;
+                };
+        };
 };
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index cf78ac0b04b1..e74dc15efa9d 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -190,12 +190,12 @@
                                                          AT91_PIOA 8 AT91_PERIPH_A AT91_PINCTRL_NONE>;  /* PA8 periph A */
                                         };
 
-                                        pinctrl_uart2_rts: uart2_rts-0 {
+                                        pinctrl_usart2_rts: usart2_rts-0 {
                                                 atmel,pins =
                                                         <AT91_PIOB 0 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PB0 periph B */
                                         };
 
-                                        pinctrl_uart2_cts: uart2_cts-0 {
+                                        pinctrl_usart2_cts: usart2_cts-0 {
                                                 atmel,pins =
                                                         <AT91_PIOB 1 AT91_PERIPH_B AT91_PINCTRL_NONE>;  /* PB1 periph B */
                                         };
@@ -556,6 +556,7 @@
                                 interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
                                 dmas = <&dma0 1 AT91_DMA_CFG_PER_ID(0)>;
                                 dma-names = "rxtx";
+                                pinctrl-names = "default";
                                 #address-cells = <1>;
                                 #size-cells = <0>;
                                 status = "disabled";
@@ -567,6 +568,7 @@
                                 interrupts = <26 IRQ_TYPE_LEVEL_HIGH 0>;
                                 dmas = <&dma1 1 AT91_DMA_CFG_PER_ID(0)>;
                                 dma-names = "rxtx";
+                                pinctrl-names = "default";
                                 #address-cells = <1>;
                                 #size-cells = <0>;
                                 status = "disabled";
diff --git a/arch/arm/boot/dts/atlas6.dtsi b/arch/arm/boot/dts/atlas6.dtsi
index 8678e0c11119..6db4f81d4795 100644
--- a/arch/arm/boot/dts/atlas6.dtsi
+++ b/arch/arm/boot/dts/atlas6.dtsi
@@ -181,6 +181,8 @@
                                 interrupts = <17>;
                                 fifosize = <128>;
                                 clocks = <&clks 13>;
+                                sirf,uart-dma-rx-channel = <21>;
+                                sirf,uart-dma-tx-channel = <2>;
                         };
 
                         uart1: uart@b0060000 {
@@ -199,6 +201,8 @@
                                 interrupts = <19>;
                                 fifosize = <128>;
                                 clocks = <&clks 15>;
+                                sirf,uart-dma-rx-channel = <6>;
+                                sirf,uart-dma-tx-channel = <7>;
                         };
 
                         usp0: usp@b0080000 {
@@ -206,7 +210,10 @@
                                 compatible = "sirf,prima2-usp";
                                 reg = <0xb0080000 0x10000>;
                                 interrupts = <20>;
+                                fifosize = <128>;
                                 clocks = <&clks 28>;
+                                sirf,usp-dma-rx-channel = <17>;
+                                sirf,usp-dma-tx-channel = <18>;
                         };
 
                         usp1: usp@b0090000 {
@@ -214,7 +221,10 @@
                                 compatible = "sirf,prima2-usp";
                                 reg = <0xb0090000 0x10000>;
                                 interrupts = <21>;
+                                fifosize = <128>;
                                 clocks = <&clks 29>;
+                                sirf,usp-dma-rx-channel = <14>;
+                                sirf,usp-dma-tx-channel = <15>;
                         };
 
                         dmac0: dma-controller@b00b0000 {
@@ -237,6 +247,8 @@
                                 compatible = "sirf,prima2-vip";
                                 reg = <0xb00C0000 0x10000>;
                                 clocks = <&clks 31>;
+                                interrupts = <14>;
+                                sirf,vip-dma-rx-channel = <16>;
                         };
 
                         spi0: spi@b00d0000 {
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 7d7cc777ff7b..bbac42a78ce5 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -96,6 +96,11 @@
                              <1 14 0xf08>,
                              <1 11 0xf08>,
                              <1 10 0xf08>;
+                /* Unfortunately we need this since some versions of U-Boot
+                 * on Exynos don't set the CNTFRQ register, so we need the
+                 * value from DT.
+                 */
+                clock-frequency = <24000000>;
         };
 
         mct@101C0000 {
diff --git a/arch/arm/boot/dts/integratorcp.dts b/arch/arm/boot/dts/integratorcp.dts
index ff1aea0ee043..72693a69f830 100644
--- a/arch/arm/boot/dts/integratorcp.dts
+++ b/arch/arm/boot/dts/integratorcp.dts
@@ -9,11 +9,6 @@
         model = "ARM Integrator/CP";
         compatible = "arm,integrator-cp";
 
-        aliases {
-                arm,timer-primary = &timer2;
-                arm,timer-secondary = &timer1;
-        };
-
         chosen {
                 bootargs = "root=/dev/ram0 console=ttyAMA0,38400n8 earlyprintk";
         };
@@ -24,14 +19,18 @@
         };
 
         timer0: timer@13000000 {
+                /* TIMER0 runs @ 25MHz */
                 compatible = "arm,integrator-cp-timer";
+                status = "disabled";
         };
 
         timer1: timer@13000100 {
+                /* TIMER1 runs @ 1MHz */
                 compatible = "arm,integrator-cp-timer";
         };
 
         timer2: timer@13000200 {
+                /* TIMER2 runs @ 1MHz */
                 compatible = "arm,integrator-cp-timer";
         };
 
diff --git a/arch/arm/boot/dts/kirkwood.dtsi b/arch/arm/boot/dts/kirkwood.dtsi
index cf7aeaf89e9c..1335b2e1bed4 100644
--- a/arch/arm/boot/dts/kirkwood.dtsi
+++ b/arch/arm/boot/dts/kirkwood.dtsi
@@ -13,6 +13,7 @@
                 cpu@0 {
                         device_type = "cpu";
                         compatible = "marvell,feroceon";
+                        reg = <0>;
                         clocks = <&core_clk 1>, <&core_clk 3>, <&gate_clk 11>;
                         clock-names = "cpu_clk", "ddrclk", "powersave";
                 };
@@ -167,7 +168,7 @@
                 xor@60900 {
                         compatible = "marvell,orion-xor";
                         reg = <0x60900 0x100
-                               0xd0B00 0x100>;
+                               0x60B00 0x100>;
                         status = "okay";
                         clocks = <&gate_clk 16>;
 
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 0c514dc8460c..2816bf612672 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -11,7 +11,7 @@
 
 / {
         model = "TI OMAP3 BeagleBoard xM";
-        compatible = "ti,omap3-beagle-xm", "ti,omap3-beagle", "ti,omap3";
+        compatible = "ti,omap3-beagle-xm", "ti,omap36xx", "ti,omap3";
 
         cpus {
                 cpu@0 {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 7d95cda1fae4..b41bd57f4328 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -108,7 +108,7 @@
                         #address-cells = <1>;
                         #size-cells = <0>;
                         pinctrl-single,register-width = <16>;
-                        pinctrl-single,function-mask = <0x7f1f>;
+                        pinctrl-single,function-mask = <0xff1f>;
                 };
 
                 omap3_pmx_wkup: pinmux@0x48002a00 {
@@ -117,7 +117,7 @@
                         #address-cells = <1>;
                         #size-cells = <0>;
                         pinctrl-single,register-width = <16>;
-                        pinctrl-single,function-mask = <0x7f1f>;
+                        pinctrl-single,function-mask = <0xff1f>;
                 };
 
                 gpio1: gpio@48310000 {
diff --git a/arch/arm/boot/dts/prima2.dtsi b/arch/arm/boot/dts/prima2.dtsi
index bbeb623fc2c6..27ed9f5144bc 100644
--- a/arch/arm/boot/dts/prima2.dtsi
+++ b/arch/arm/boot/dts/prima2.dtsi
@@ -171,7 +171,8 @@
                         compatible = "simple-bus";
                         #address-cells = <1>;
                         #size-cells = <1>;
-                        ranges = <0xb0000000 0xb0000000 0x180000>;
+                        ranges = <0xb0000000 0xb0000000 0x180000>,
+                               <0x56000000 0x56000000 0x1b00000>;
 
                         timer@b0020000 {
                                 compatible = "sirf,prima2-tick";
@@ -196,25 +197,32 @@
                         uart0: uart@b0050000 {
                                 cell-index = <0>;
                                 compatible = "sirf,prima2-uart";
-                                reg = <0xb0050000 0x10000>;
+                                reg = <0xb0050000 0x1000>;
                                 interrupts = <17>;
+                                fifosize = <128>;
                                 clocks = <&clks 13>;
+                                sirf,uart-dma-rx-channel = <21>;
+                                sirf,uart-dma-tx-channel = <2>;
                         };
 
                         uart1: uart@b0060000 {
                                 cell-index = <1>;
                                 compatible = "sirf,prima2-uart";
-                                reg = <0xb0060000 0x10000>;
+                                reg = <0xb0060000 0x1000>;
                                 interrupts = <18>;
+                                fifosize = <32>;
                                 clocks = <&clks 14>;
                         };
 
                         uart2: uart@b0070000 {
                                 cell-index = <2>;
                                 compatible = "sirf,prima2-uart";
-                                reg = <0xb0070000 0x10000>;
+                                reg = <0xb0070000 0x1000>;
                                 interrupts = <19>;
+                                fifosize = <128>;
                                 clocks = <&clks 15>;
+                                sirf,uart-dma-rx-channel = <6>;
+                                sirf,uart-dma-tx-channel = <7>;
                         };
 
                         usp0: usp@b0080000 {
@@ -222,7 +230,10 @@
                                 compatible = "sirf,prima2-usp";
                                 reg = <0xb0080000 0x10000>;
                                 interrupts = <20>;
+                                fifosize = <128>;
                                 clocks = <&clks 28>;
+                                sirf,usp-dma-rx-channel = <17>;
+                                sirf,usp-dma-tx-channel = <18>;
                         };
 
                         usp1: usp@b0090000 {
@@ -230,7 +241,10 @@
                                 compatible = "sirf,prima2-usp";
                                 reg = <0xb0090000 0x10000>;
                                 interrupts = <21>;
+                                fifosize = <128>;
                                 clocks = <&clks 29>;
+                                sirf,usp-dma-rx-channel = <14>;
+                                sirf,usp-dma-tx-channel = <15>;
                         };
 
                         usp2: usp@b00a0000 {
@@ -238,7 +252,10 @@
                                 compatible = "sirf,prima2-usp";
                                 reg = <0xb00a0000 0x10000>;
                                 interrupts = <22>;
+                                fifosize = <128>;
                                 clocks = <&clks 30>;
+                                sirf,usp-dma-rx-channel = <10>;
+                                sirf,usp-dma-tx-channel = <11>;
                         };
 
                         dmac0: dma-controller@b00b0000 {
@@ -261,6 +278,8 @@
                                 compatible = "sirf,prima2-vip";
                                 reg = <0xb00C0000 0x10000>;
                                 clocks = <&clks 31>;
+                                interrupts = <14>;
+                                sirf,vip-dma-rx-channel = <16>;
                         };
 
                         spi0: spi@b00d0000 {
diff --git a/arch/arm/boot/dts/r8a73a4.dtsi b/arch/arm/boot/dts/r8a73a4.dtsi
index 6c26caa880f2..658fcc537576 100644
--- a/arch/arm/boot/dts/r8a73a4.dtsi
+++ b/arch/arm/boot/dts/r8a73a4.dtsi
@@ -193,7 +193,7 @@
         };
 
         sdhi0: sdhi@ee100000 {
-                compatible = "renesas,r8a73a4-sdhi";
+                compatible = "renesas,sdhi-r8a73a4";
                 reg = <0 0xee100000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 165 4>;
@@ -202,7 +202,7 @@
         };
 
         sdhi1: sdhi@ee120000 {
-                compatible = "renesas,r8a73a4-sdhi";
+                compatible = "renesas,sdhi-r8a73a4";
                 reg = <0 0xee120000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 166 4>;
@@ -211,7 +211,7 @@
         };
 
         sdhi2: sdhi@ee140000 {
-                compatible = "renesas,r8a73a4-sdhi";
+                compatible = "renesas,sdhi-r8a73a4";
                 reg = <0 0xee140000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 167 4>;
diff --git a/arch/arm/boot/dts/r8a7778.dtsi b/arch/arm/boot/dts/r8a7778.dtsi
index 45ac404ab6d8..3577aba82583 100644
--- a/arch/arm/boot/dts/r8a7778.dtsi
+++ b/arch/arm/boot/dts/r8a7778.dtsi
@@ -96,6 +96,5 @@
         pfc: pfc@fffc0000 {
                 compatible = "renesas,pfc-r8a7778";
                 reg = <0xfffc000 0x118>;
-                #gpio-range-cells = <3>;
         };
 };
diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
index 23a62447359c..ebbe507fcbfa 100644
--- a/arch/arm/boot/dts/r8a7779.dtsi
+++ b/arch/arm/boot/dts/r8a7779.dtsi
@@ -188,7 +188,6 @@
         pfc: pfc@fffc0000 {
                 compatible = "renesas,pfc-r8a7779";
                 reg = <0xfffc0000 0x23c>;
-                #gpio-range-cells = <3>;
         };
 
         thermal@ffc48000 {
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index 3b879e7c697c..413b4c29e782 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -148,11 +148,10 @@
         pfc: pfc@e6060000 {
                 compatible = "renesas,pfc-r8a7790";
                 reg = <0 0xe6060000 0 0x250>;
-                #gpio-range-cells = <3>;
         };
 
         sdhi0: sdhi@ee100000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                 reg = <0 0xee100000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 165 4>;
@@ -161,7 +160,7 @@
         };
 
         sdhi1: sdhi@ee120000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                 reg = <0 0xee120000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 166 4>;
@@ -170,7 +169,7 @@
         };
 
         sdhi2: sdhi@ee140000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                 reg = <0 0xee140000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 167 4>;
@@ -179,7 +178,7 @@
         };
 
         sdhi3: sdhi@ee160000 {
-                compatible = "renesas,r8a7790-sdhi";
+                compatible = "renesas,sdhi-r8a7790";
                 reg = <0 0xee160000 0 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 168 4>;
diff --git a/arch/arm/boot/dts/sh73a0.dtsi b/arch/arm/boot/dts/sh73a0.dtsi
index ba59a5875a10..3955c7606a6f 100644
--- a/arch/arm/boot/dts/sh73a0.dtsi
+++ b/arch/arm/boot/dts/sh73a0.dtsi
@@ -196,7 +196,7 @@
         };
 
         sdhi0: sdhi@ee100000 {
-                compatible = "renesas,r8a7740-sdhi";
+                compatible = "renesas,sdhi-r8a7740";
                 reg = <0xee100000 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 83 4
@@ -208,7 +208,7 @@
 
         /* SDHI1 and SDHI2 have no CD pins, no need for CD IRQ */
         sdhi1: sdhi@ee120000 {
-                compatible = "renesas,r8a7740-sdhi";
+                compatible = "renesas,sdhi-r8a7740";
                 reg = <0xee120000 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 88 4
@@ -219,7 +219,7 @@
         };
 
         sdhi2: sdhi@ee140000 {
-                compatible = "renesas,r8a7740-sdhi";
+                compatible = "renesas,sdhi-r8a7740";
                 reg = <0xee140000 0x100>;
                 interrupt-parent = <&gic>;
                 interrupts = <0 104 4
diff --git a/arch/arm/boot/install.sh b/arch/arm/boot/install.sh
index 06ea7d42ce8e..2a45092a40e3 100644
--- a/arch/arm/boot/install.sh
+++ b/arch/arm/boot/install.sh
@@ -20,6 +20,20 @@
 #   $4 - default install path (blank if root directory)
 #
 
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
+
 # User may have a custom install script
 if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
 if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
diff --git a/arch/arm/common/edma.c b/arch/arm/common/edma.c
index 117f955a2a06..8e1a0245907f 100644
--- a/arch/arm/common/edma.c
+++ b/arch/arm/common/edma.c
@@ -269,6 +269,11 @@ static const struct edmacc_param dummy_paramset = {
         .ccnt = 1,
 };
 
+static const struct of_device_id edma_of_ids[] = {
+        { .compatible = "ti,edma3", },
+        {}
+};
+
 /*****************************************************************************/
 
 static void map_dmach_queue(unsigned ctlr, unsigned ch_no,
@@ -560,14 +565,38 @@ static int reserve_contiguous_slots(int ctlr, unsigned int id,
 static int prepare_unused_channel_list(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
-        int i, ctlr;
+        int i, count, ctlr;
+        struct of_phandle_args  dma_spec;
 
+        if (dev->of_node) {
+                count = of_property_count_strings(dev->of_node, "dma-names");
+                if (count < 0)
+                        return 0;
+                for (i = 0; i < count; i++) {
+                        if (of_parse_phandle_with_args(dev->of_node, "dmas",
+                                                       "#dma-cells", i,
+                                                       &dma_spec))
+                                continue;
+
+                        if (!of_match_node(edma_of_ids, dma_spec.np)) {
+                                of_node_put(dma_spec.np);
+                                continue;
+                        }
+
+                        clear_bit(EDMA_CHAN_SLOT(dma_spec.args[0]),
+                                  edma_cc[0]->edma_unused);
+                        of_node_put(dma_spec.np);
+                }
+                return 0;
+        }
+
+        /* For non-OF case */
         for (i = 0; i < pdev->num_resources; i++) {
                 if ((pdev->resource[i].flags & IORESOURCE_DMA) &&
                                 (int)pdev->resource[i].start >= 0) {
                         ctlr = EDMA_CTLR(pdev->resource[i].start);
                         clear_bit(EDMA_CHAN_SLOT(pdev->resource[i].start),
-                                        edma_cc[ctlr]->edma_unused);
+                                  edma_cc[ctlr]->edma_unused);
                 }
         }
 
@@ -1762,11 +1791,6 @@ static int edma_probe(struct platform_device *pdev)
         return 0;
 }
 
-static const struct of_device_id edma_of_ids[] = {
-        { .compatible = "ti,edma3", },
-        {}
-};
-
 static struct platform_driver edma_driver = {
         .driver = {
                 .name   = "edma",
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index 370236dd1a03..990250965f2c 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -51,7 +51,8 @@ void mcpm_cpu_power_down(void)
 {
         phys_reset_t phys_reset;
 
-        BUG_ON(!platform_ops);
+        if (WARN_ON_ONCE(!platform_ops || !platform_ops->power_down))
+                return;
         BUG_ON(!irqs_disabled());
 
         /*
@@ -93,7 +94,8 @@ void mcpm_cpu_suspend(u64 expected_residency)
 {
         phys_reset_t phys_reset;
 
-        BUG_ON(!platform_ops);
+        if (WARN_ON_ONCE(!platform_ops || !platform_ops->suspend))
+                return;
         BUG_ON(!irqs_disabled());
 
         /* Very similar to mcpm_cpu_power_down() */
diff --git a/arch/arm/common/sharpsl_param.c b/arch/arm/common/sharpsl_param.c
index d56c932580eb..025f6ce38596 100644
--- a/arch/arm/common/sharpsl_param.c
+++ b/arch/arm/common/sharpsl_param.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <asm/mach/sharpsl_param.h>
+#include <asm/memory.h>
 
 /*
  * Certain hardware parameters determined at the time of device manufacture,
@@ -25,8 +26,10 @@
  */
 #ifdef CONFIG_ARCH_SA1100
 #define PARAM_BASE      0xe8ffc000
+#define param_start(x)  (void *)(x)
 #else
 #define PARAM_BASE      0xa0000a00
+#define param_start(x)  __va(x)
 #endif
 #define MAGIC_CHG(a,b,c,d) ( ( d << 24 ) | ( c << 16 )  | ( b << 8 ) | a )
 
@@ -41,7 +44,7 @@ EXPORT_SYMBOL(sharpsl_param);
 
 void sharpsl_save_param(void)
 {
-        memcpy(&sharpsl_param, (void *)PARAM_BASE, sizeof(struct sharpsl_param_info));
+        memcpy(&sharpsl_param, param_start(PARAM_BASE), sizeof(struct sharpsl_param_info));
 
         if (sharpsl_param.comadj_keyword != COMADJ_MAGIC)
                 sharpsl_param.comadj=-1;
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index f3935b46df29..119fc378fc52 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -135,6 +135,7 @@ CONFIG_MMC=y
 CONFIG_MMC_ARMMMCI=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_ESDHC_IMX=y
 CONFIG_MMC_SDHCI_TEGRA=y
 CONFIG_MMC_SDHCI_SPEAR=y
 CONFIG_MMC_OMAP=y
diff --git a/arch/arm/crypto/aes-armv4.S b/arch/arm/crypto/aes-armv4.S
index 19d6cd6f29f9..3a14ea8fe97e 100644
--- a/arch/arm/crypto/aes-armv4.S
+++ b/arch/arm/crypto/aes-armv4.S
@@ -148,7 +148,7 @@ AES_Te:
 @                const AES_KEY *key) {
 .align  5
 ENTRY(AES_encrypt)
-        sub     r3,pc,#8                @ AES_encrypt
+        adr     r3,AES_encrypt
         stmdb   sp!,{r1,r4-r12,lr}
         mov     r12,r0          @ inp
         mov     r11,r2
@@ -381,7 +381,7 @@ _armv4_AES_encrypt:
 .align  5
 ENTRY(private_AES_set_encrypt_key)
 _armv4_AES_set_encrypt_key:
-        sub     r3,pc,#8                @ AES_set_encrypt_key
+        adr     r3,_armv4_AES_set_encrypt_key
         teq     r0,#0
         moveq   r0,#-1
         beq     .Labrt
@@ -843,7 +843,7 @@ AES_Td:
 @                const AES_KEY *key) {
 .align  5
 ENTRY(AES_decrypt)
-        sub     r3,pc,#8                @ AES_decrypt
+        adr     r3,AES_decrypt
         stmdb   sp!,{r1,r4-r12,lr}
         mov     r12,r0          @ inp
         mov     r11,r2
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index d3db39860b9c..59ceae8f3c95 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -31,5 +31,4 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += timex.h
 generic-y += trace_clock.h
-generic-y += types.h
 generic-y += unaligned.h
diff --git a/arch/arm/include/asm/jump_label.h b/arch/arm/include/asm/jump_label.h
index bfc198c75913..863c892b4aaa 100644
--- a/arch/arm/include/asm/jump_label.h
+++ b/arch/arm/include/asm/jump_label.h
@@ -16,7 +16,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:\n\t"
+        asm_volatile_goto("1:\n\t"
                  JUMP_LABEL_NOP "\n\t"
                  ".pushsection __jump_table,  \"aw\"\n\t"
                  ".word 1b, %l[l_yes], %c0\n\t"
diff --git a/arch/arm/include/asm/mcpm.h b/arch/arm/include/asm/mcpm.h
index 0f7b7620e9a5..fc82a88f5b69 100644
--- a/arch/arm/include/asm/mcpm.h
+++ b/arch/arm/include/asm/mcpm.h
@@ -76,8 +76,11 @@ int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster);
  *
  * This must be called with interrupts disabled.
  *
- * This does not return.  Re-entry in the kernel is expected via
- * mcpm_entry_point.
+ * On success this does not return.  Re-entry in the kernel is expected
+ * via mcpm_entry_point.
+ *
+ * This will return if mcpm_platform_register() has not been called
+ * previously in which case the caller should take appropriate action.
  */
 void mcpm_cpu_power_down(void);
 
@@ -98,8 +101,11 @@ void mcpm_cpu_power_down(void);
  *
  * This must be called with interrupts disabled.
  *
- * This does not return.  Re-entry in the kernel is expected via
- * mcpm_entry_point.
+ * On success this does not return.  Re-entry in the kernel is expected
+ * via mcpm_entry_point.
+ *
+ * This will return if mcpm_platform_register() has not been called
+ * previously in which case the caller should take appropriate action.
  */
 void mcpm_cpu_suspend(u64 expected_residency);
 
diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h
index f1d96d4e8092..73ddd7239b33 100644
--- a/arch/arm/include/asm/syscall.h
+++ b/arch/arm/include/asm/syscall.h
@@ -57,6 +57,9 @@ static inline void syscall_get_arguments(struct task_struct *task,
                                          unsigned int i, unsigned int n,
                                          unsigned long *args)
 {
+        if (n == 0)
+                return;
+
         if (i + n > SYSCALL_MAX_ARGS) {
                 unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i;
                 unsigned int n_bad = n + i - SYSCALL_MAX_ARGS;
@@ -81,6 +84,9 @@ static inline void syscall_set_arguments(struct task_struct *task,
                                          unsigned int i, unsigned int n,
                                          const unsigned long *args)
 {
+        if (n == 0)
+                return;
+
         if (i + n > SYSCALL_MAX_ARGS) {
                 pr_warning("%s called with max args %d, handling only %d\n",
                            __func__, i + n, SYSCALL_MAX_ARGS);
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 7e1f76027f66..72abdc541f38 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -19,6 +19,13 @@
 #include <asm/unified.h>
 #include <asm/compiler.h>
 
+#if __LINUX_ARM_ARCH__ < 6
+#include <asm-generic/uaccess-unaligned.h>
+#else
+#define __get_user_unaligned __get_user
+#define __put_user_unaligned __put_user
+#endif
+
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
 
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 74ad15d1a065..bc6bd9683ba4 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -442,10 +442,10 @@ local_restart:
         ldrcc   pc, [tbl, scno, lsl #2]         @ call sys_* routine
 
         add     r1, sp, #S_OFF
-        cmp     scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
+2:      cmp     scno, #(__ARM_NR_BASE - __NR_SYSCALL_BASE)
         eor     r0, scno, #__NR_SYSCALL_BASE    @ put OS number back
         bcs     arm_syscall
-2:      mov     why, #0                         @ no longer a real syscall
+        mov     why, #0                         @ no longer a real syscall
         b       sys_ni_syscall                  @ not private func
 
 #if defined(CONFIG_OABI_COMPAT) || !defined(CONFIG_AEABI)
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index de23a9beed13..39f89fbd5111 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -329,10 +329,10 @@
 #ifdef CONFIG_CONTEXT_TRACKING
         .if     \save
         stmdb   sp!, {r0-r3, ip, lr}
-        bl      user_exit
+        bl      context_tracking_user_exit
         ldmia   sp!, {r0-r3, ip, lr}
         .else
-        bl      user_exit
+        bl      context_tracking_user_exit
         .endif
 #endif
         .endm
@@ -341,10 +341,10 @@
 #ifdef CONFIG_CONTEXT_TRACKING
         .if     \save
         stmdb   sp!, {r0-r3, ip, lr}
-        bl      user_enter
+        bl      context_tracking_user_enter
         ldmia   sp!, {r0-r3, ip, lr}
         .else
-        bl      user_enter
+        bl      context_tracking_user_enter
         .endif
 #endif
         .endm
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 2c7cc1e03473..476de57dcef2 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -487,7 +487,26 @@ __fixup_smp:
         mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
         and     r0, r0, #0xc0000000     @ multiprocessing extensions and
         teq     r0, #0x80000000         @ not part of a uniprocessor system?
-        moveq   pc, lr                  @ yes, assume SMP
+        bne    __fixup_smp_on_up        @ no, assume UP
+
+        @ Core indicates it is SMP. Check for Aegis SOC where a single
+        @ Cortex-A9 CPU is present but SMP operations fault.
+        mov     r4, #0x41000000
+        orr     r4, r4, #0x0000c000
+        orr     r4, r4, #0x00000090
+        teq     r3, r4                  @ Check for ARM Cortex-A9
+        movne   pc, lr                  @ Not ARM Cortex-A9,
+
+        @ If a future SoC *does* use 0x0 as the PERIPH_BASE, then the
+        @ below address check will need to be #ifdef'd or equivalent
+        @ for the Aegis platform.
+        mrc     p15, 4, r0, c15, c0     @ get SCU base address
+        teq     r0, #0x0                @ '0' on actual UP A9 hardware
+        beq     __fixup_smp_on_up       @ So its an A9 UP
+        ldr     r0, [r0, #4]            @ read SCU Config
+        and     r0, r0, #0x3            @ number of CPUs
+        teq     r0, #0x0                @ is 1?
+        movne   pc, lr
 
 __fixup_smp_on_up:
         adr     r0, 1f
diff --git a/arch/arm/kvm/reset.c b/arch/arm/kvm/reset.c
index 71e08baee209..c02ba4af599f 100644
--- a/arch/arm/kvm/reset.c
+++ b/arch/arm/kvm/reset.c
@@ -58,14 +58,14 @@ static const struct kvm_irq_level a15_vtimer_irq = {
  */
 int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
 {
-        struct kvm_regs *cpu_reset;
+        struct kvm_regs *reset_regs;
         const struct kvm_irq_level *cpu_vtimer_irq;
 
         switch (vcpu->arch.target) {
         case KVM_ARM_TARGET_CORTEX_A15:
                 if (vcpu->vcpu_id > a15_max_cpu_idx)
                         return -EINVAL;
-                cpu_reset = &a15_regs_reset;
+                reset_regs = &a15_regs_reset;
                 vcpu->arch.midr = read_cpuid_id();
                 cpu_vtimer_irq = &a15_vtimer_irq;
                 break;
@@ -74,7 +74,7 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
         }
 
         /* Reset core registers */
-        memcpy(&vcpu->arch.regs, cpu_reset, sizeof(vcpu->arch.regs));
+        memcpy(&vcpu->arch.regs, reset_regs, sizeof(vcpu->arch.regs));
 
         /* Reset CP15 registers */
         kvm_reset_coprocs(vcpu);
diff --git a/arch/arm/mach-at91/Makefile b/arch/arm/mach-at91/Makefile
index 3b0a9538093c..c1b737097c95 100644
--- a/arch/arm/mach-at91/Makefile
+++ b/arch/arm/mach-at91/Makefile
@@ -98,7 +98,6 @@ obj-y				+= leds.o
 # Power Management
 obj-$(CONFIG_PM)                += pm.o
 obj-$(CONFIG_AT91_SLOW_CLOCK)   += pm_slowclock.o
-obj-$(CONFIG_CPU_IDLE)  += cpuidle.o
 
 ifeq ($(CONFIG_PM_DEBUG),y)
 CFLAGS_pm.o += -DDEBUG
diff --git a/arch/arm/mach-at91/at91rm9200.c b/arch/arm/mach-at91/at91rm9200.c
index 4aad93d54d6f..25805f2f6010 100644
--- a/arch/arm/mach-at91/at91rm9200.c
+++ b/arch/arm/mach-at91/at91rm9200.c
@@ -27,6 +27,7 @@
 #include "generic.h"
 #include "clock.h"
 #include "sam9_smc.h"
+#include "pm.h"
 
 /* --------------------------------------------------------------------
  *  Clocks
@@ -327,6 +328,7 @@ static void __init at91rm9200_ioremap_registers(void)
 {
         at91rm9200_ioremap_st(AT91RM9200_BASE_ST);
         at91_ioremap_ramc(0, AT91RM9200_BASE_MC, 256);
+        at91_pm_set_standby(at91rm9200_standby);
 }
 
 static void __init at91rm9200_initialize(void)
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index 180b3024bec3..f607deb40f4d 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -93,7 +93,7 @@ static irqreturn_t at91rm9200_timer_interrupt(int irq, void *dev_id)
 
 static struct irqaction at91rm9200_timer_irq = {
         .name           = "at91_tick",
-        .flags          = IRQF_SHARED | IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
+        .flags          = IRQF_SHARED | IRQF_TIMER | IRQF_IRQPOLL,
         .handler        = at91rm9200_timer_interrupt,
         .irq            = NR_IRQS_LEGACY + AT91_ID_SYS,
 };
diff --git a/arch/arm/mach-at91/at91sam9260.c b/arch/arm/mach-at91/at91sam9260.c
index 5de6074b4f4f..f8629a3fa245 100644
--- a/arch/arm/mach-at91/at91sam9260.c
+++ b/arch/arm/mach-at91/at91sam9260.c
@@ -28,6 +28,7 @@
 #include "generic.h"
 #include "clock.h"
 #include "sam9_smc.h"
+#include "pm.h"
 
 /* --------------------------------------------------------------------
  *  Clocks
@@ -342,6 +343,7 @@ static void __init at91sam9260_ioremap_registers(void)
         at91sam926x_ioremap_pit(AT91SAM9260_BASE_PIT);
         at91sam9_ioremap_smc(0, AT91SAM9260_BASE_SMC);
         at91_ioremap_matrix(AT91SAM9260_BASE_MATRIX);
+        at91_pm_set_standby(at91sam9_sdram_standby);
 }
 
 static void __init at91sam9260_initialize(void)
diff --git a/arch/arm/mach-at91/at91sam9261.c b/arch/arm/mach-at91/at91sam9261.c
index 0e0793241ab7..1f3867a17a28 100644
--- a/arch/arm/mach-at91/at91sam9261.c
+++ b/arch/arm/mach-at91/at91sam9261.c
@@ -27,6 +27,7 @@
 #include "generic.h"
 #include "clock.h"
 #include "sam9_smc.h"
+#include "pm.h"
 
 /* --------------------------------------------------------------------
  *  Clocks
@@ -284,6 +285,7 @@ static void __init at91sam9261_ioremap_registers(void)
         at91sam926x_ioremap_pit(AT91SAM9261_BASE_PIT);
         at91sam9_ioremap_smc(0, AT91SAM9261_BASE_SMC);
         at91_ioremap_matrix(AT91SAM9261_BASE_MATRIX);
+        at91_pm_set_standby(at91sam9_sdram_standby);
 }
 
 static void __init at91sam9261_initialize(void)
diff --git a/arch/arm/mach-at91/at91sam9263.c b/arch/arm/mach-at91/at91sam9263.c
index 6ce7d1850893..90d455d294a1 100644
--- a/arch/arm/mach-at91/at91sam9263.c
+++ b/arch/arm/mach-at91/at91sam9263.c
@@ -26,6 +26,7 @@
 #include "generic.h"
 #include "clock.h"
 #include "sam9_smc.h"
+#include "pm.h"
 
 /* --------------------------------------------------------------------
  *  Clocks
@@ -321,6 +322,7 @@ static void __init at91sam9263_ioremap_registers(void)
         at91sam9_ioremap_smc(0, AT91SAM9263_BASE_SMC0);
         at91sam9_ioremap_smc(1, AT91SAM9263_BASE_SMC1);
         at91_ioremap_matrix(AT91SAM9263_BASE_MATRIX);
+        at91_pm_set_standby(at91sam9_sdram_standby);
 }
 
 static void __init at91sam9263_initialize(void)
diff --git a/arch/arm/mach-at91/at91sam926x_time.c b/arch/arm/mach-at91/at91sam926x_time.c
index 3a4bc2e1a65e..bb392320a0dd 100644
--- a/arch/arm/mach-at91/at91sam926x_time.c
+++ b/arch/arm/mach-at91/at91sam926x_time.c
@@ -171,7 +171,7 @@ static irqreturn_t at91sam926x_pit_interrupt(int irq, void *dev_id)
 
 static struct irqaction at91sam926x_pit_irq = {
         .name           = "at91_tick",
-        .flags          = IRQF_SHARED | IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
+        .flags          = IRQF_SHARED | IRQF_TIMER | IRQF_IRQPOLL,
         .handler        = at91sam926x_pit_interrupt,
         .irq            = NR_IRQS_LEGACY + AT91_ID_SYS,
 };
diff --git a/arch/arm/mach-at91/at91sam9g45.c b/arch/arm/mach-at91/at91sam9g45.c
index 474ee04d24b9..e9bf0b8f40eb 100644
--- a/arch/arm/mach-at91/at91sam9g45.c
+++ b/arch/arm/mach-at91/at91sam9g45.c
@@ -26,6 +26,7 @@
 #include "generic.h"
 #include "clock.h"
 #include "sam9_smc.h"
+#include "pm.h"
 
 /* --------------------------------------------------------------------
  *  Clocks
@@ -370,6 +371,7 @@ static void __init at91sam9g45_ioremap_registers(void)
         at91sam926x_ioremap_pit(AT91SAM9G45_BASE_PIT);
         at91sam9_ioremap_smc(0, AT91SAM9G45_BASE_SMC);
         at91_ioremap_matrix(AT91SAM9G45_BASE_MATRIX);
+        at91_pm_set_standby(at91_ddr_standby);
 }
 
 static void __init at91sam9g45_initialize(void)
diff --git a/arch/arm/mach-at91/at91sam9g45_reset.S b/arch/arm/mach-at91/at91sam9g45_reset.S
index 721a1a34dd1d..c40c1e2ef80f 100644
--- a/arch/arm/mach-at91/at91sam9g45_reset.S
+++ b/arch/arm/mach-at91/at91sam9g45_reset.S
@@ -16,11 +16,17 @@
 #include "at91_rstc.h"
                         .arm
 
+/*
+ * at91_ramc_base is an array void*
+ * init at NULL if only one DDR controler is present in or DT
+ */
                         .globl  at91sam9g45_restart
 
 at91sam9g45_restart:
                         ldr     r5, =at91_ramc_base             @ preload constants
                         ldr     r0, [r5]
+                        ldr     r5, [r5, #4]                    @ ddr1
+                        cmp     r5, #0
                         ldr     r4, =at91_rstc_base
                         ldr     r1, [r4]
 
@@ -30,6 +36,8 @@ at91sam9g45_restart:
 
                         .balign 32                              @ align to cache line
 
+                        strne   r2, [r5, #AT91_DDRSDRC_RTR]     @ disable DDR1 access
+                        strne   r3, [r5, #AT91_DDRSDRC_LPR]     @ power down DDR1
                         str     r2, [r0, #AT91_DDRSDRC_RTR]     @ disable DDR0 access
                         str     r3, [r0, #AT91_DDRSDRC_LPR]     @ power down DDR0
                         str     r4, [r1, #AT91_RSTC_CR]         @ reset processor
diff --git a/arch/arm/mach-at91/at91sam9rl.c b/arch/arm/mach-at91/at91sam9rl.c
index d4ec0d9a9872..88995af09c04 100644
--- a/arch/arm/mach-at91/at91sam9rl.c
+++ b/arch/arm/mach-at91/at91sam9rl.c
@@ -27,6 +27,7 @@
 #include "generic.h"
 #include "clock.h"
 #include "sam9_smc.h"
+#include "pm.h"
 
 /* --------------------------------------------------------------------
  *  Clocks
@@ -287,6 +288,7 @@ static void __init at91sam9rl_ioremap_registers(void)
         at91sam926x_ioremap_pit(AT91SAM9RL_BASE_PIT);
         at91sam9_ioremap_smc(0, AT91SAM9RL_BASE_SMC);
         at91_ioremap_matrix(AT91SAM9RL_BASE_MATRIX);
+        at91_pm_set_standby(at91sam9_sdram_standby);
 }
 
 static void __init at91sam9rl_initialize(void)
diff --git a/arch/arm/mach-at91/at91x40_time.c b/arch/arm/mach-at91/at91x40_time.c
index 2919eba41ff4..c0e637adf65d 100644
--- a/arch/arm/mach-at91/at91x40_time.c
+++ b/arch/arm/mach-at91/at91x40_time.c
@@ -57,7 +57,7 @@ static irqreturn_t at91x40_timer_interrupt(int irq, void *dev_id)
 
 static struct irqaction at91x40_timer_irq = {
         .name           = "at91_tick",
-        .flags          = IRQF_DISABLED | IRQF_TIMER,
+        .flags          = IRQF_TIMER,
         .handler        = at91x40_timer_interrupt
 };
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 15afb5d9271f..9986542e8060 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -39,6 +39,8 @@
 #include "at91_rstc.h"
 #include "at91_shdwc.h"
 
+static void (*at91_pm_standby)(void);
+
 static void __init show_reset_status(void)
 {
         static char reset[] __initdata = "reset";
@@ -266,14 +268,8 @@ static int at91_pm_enter(suspend_state_t state)
                          * For ARM 926 based chips, this requirement is weaker
                          * as at91sam9 can access a RAM in self-refresh mode.
                          */
-                        if (cpu_is_at91rm9200())
-                                at91rm9200_standby();
-                        else if (cpu_is_at91sam9g45())
-                                at91sam9g45_standby();
-                        else if (cpu_is_at91sam9263())
-                                at91sam9263_standby();
-                        else
-                                at91sam9_standby();
+                        if (at91_pm_standby)
+                                at91_pm_standby();
                         break;
 
                 case PM_SUSPEND_ON:
@@ -314,6 +310,18 @@ static const struct platform_suspend_ops at91_pm_ops = {
         .end    = at91_pm_end,
 };
 
+static struct platform_device at91_cpuidle_device = {
+        .name = "cpuidle-at91",
+};
+
+void at91_pm_set_standby(void (*at91_standby)(void))
+{
+        if (at91_standby) {
+                at91_cpuidle_device.dev.platform_data = at91_standby;
+                at91_pm_standby = at91_standby;
+        }
+}
+
 static int __init at91_pm_init(void)
 {
 #ifdef CONFIG_AT91_SLOW_CLOCK
@@ -325,6 +333,9 @@ static int __init at91_pm_init(void)
         /* AT91RM9200 SDRAM low-power mode cannot be used with self-refresh. */
         if (cpu_is_at91rm9200())
                 at91_ramc_write(0, AT91RM9200_SDRAMC_LPR, 0);
+        
+        if (at91_cpuidle_device.dev.platform_data)
+                platform_device_register(&at91_cpuidle_device);
 
         suspend_set_ops(&at91_pm_ops);
 
diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
index 2f5908f0b8c5..3ed190ce062b 100644
--- a/arch/arm/mach-at91/pm.h
+++ b/arch/arm/mach-at91/pm.h
@@ -11,9 +11,13 @@
 #ifndef __ARCH_ARM_MACH_AT91_PM
 #define __ARCH_ARM_MACH_AT91_PM
 
+#include <asm/proc-fns.h>
+
 #include <mach/at91_ramc.h>
 #include <mach/at91rm9200_sdramc.h>
 
+extern void at91_pm_set_standby(void (*at91_standby)(void));
+
 /*
  * The AT91RM9200 goes into self-refresh mode with this command, and will
  * terminate self-refresh automatically on the next SDRAM access.
@@ -45,16 +49,18 @@ static inline void at91rm9200_standby(void)
 /* We manage both DDRAM/SDRAM controllers, we need more than one value to
  * remember.
  */
-static inline void at91sam9g45_standby(void)
+static inline void at91_ddr_standby(void)
 {
         /* Those two values allow us to delay self-refresh activation
          * to the maximum. */
-        u32 lpr0, lpr1;
-        u32 saved_lpr0, saved_lpr1;
+        u32 lpr0, lpr1 = 0;
+        u32 saved_lpr0, saved_lpr1 = 0;
 
-        saved_lpr1 = at91_ramc_read(1, AT91_DDRSDRC_LPR);
-        lpr1 = saved_lpr1 & ~AT91_DDRSDRC_LPCB;
-        lpr1 |= AT91_DDRSDRC_LPCB_SELF_REFRESH;
+        if (at91_ramc_base[1]) {
+                saved_lpr1 = at91_ramc_read(1, AT91_DDRSDRC_LPR);
+                lpr1 = saved_lpr1 & ~AT91_DDRSDRC_LPCB;
+                lpr1 |= AT91_DDRSDRC_LPCB_SELF_REFRESH;
+        }
 
         saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR);
         lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB;
@@ -62,25 +68,29 @@ static inline void at91sam9g45_standby(void)
 
         /* self-refresh mode now */
         at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0);
-        at91_ramc_write(1, AT91_DDRSDRC_LPR, lpr1);
+        if (at91_ramc_base[1])
+                at91_ramc_write(1, AT91_DDRSDRC_LPR, lpr1);
 
         cpu_do_idle();
 
         at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0);
-        at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
+        if (at91_ramc_base[1])
+                at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
 }
 
 /* We manage both DDRAM/SDRAM controllers, we need more than one value to
  * remember.
  */
-static inline void at91sam9263_standby(void)
+static inline void at91sam9_sdram_standby(void)
 {
-        u32 lpr0, lpr1;
-        u32 saved_lpr0, saved_lpr1;
+        u32 lpr0, lpr1 = 0;
+        u32 saved_lpr0, saved_lpr1 = 0;
 
-        saved_lpr1 = at91_ramc_read(1, AT91_SDRAMC_LPR);
-        lpr1 = saved_lpr1 & ~AT91_SDRAMC_LPCB;
-        lpr1 |= AT91_SDRAMC_LPCB_SELF_REFRESH;
+        if (at91_ramc_base[1]) {
+                saved_lpr1 = at91_ramc_read(1, AT91_SDRAMC_LPR);
+                lpr1 = saved_lpr1 & ~AT91_SDRAMC_LPCB;
+                lpr1 |= AT91_SDRAMC_LPCB_SELF_REFRESH;
+        }
 
         saved_lpr0 = at91_ramc_read(0, AT91_SDRAMC_LPR);
         lpr0 = saved_lpr0 & ~AT91_SDRAMC_LPCB;
@@ -88,27 +98,14 @@ static inline void at91sam9263_standby(void)
 
         /* self-refresh mode now */
         at91_ramc_write(0, AT91_SDRAMC_LPR, lpr0);
-        at91_ramc_write(1, AT91_SDRAMC_LPR, lpr1);
+        if (at91_ramc_base[1])
+                at91_ramc_write(1, AT91_SDRAMC_LPR, lpr1);
 
         cpu_do_idle();
 
         at91_ramc_write(0, AT91_SDRAMC_LPR, saved_lpr0);
-        at91_ramc_write(1, AT91_SDRAMC_LPR, saved_lpr1);
-}
-
-static inline void at91sam9_standby(void)
-{
-        u32 saved_lpr, lpr;
-
-        saved_lpr = at91_ramc_read(0, AT91_SDRAMC_LPR);
-
-        lpr = saved_lpr & ~AT91_SDRAMC_LPCB;
-        at91_ramc_write(0, AT91_SDRAMC_LPR, lpr |
-                        AT91_SDRAMC_LPCB_SELF_REFRESH);
-
-        cpu_do_idle();
-
-        at91_ramc_write(0, AT91_SDRAMC_LPR, saved_lpr);
+        if (at91_ramc_base[1])
+                at91_ramc_write(1, AT91_SDRAMC_LPR, saved_lpr1);
 }
 
 #endif
diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
index b17fbcf4d9e8..094b3459c288 100644
--- a/arch/arm/mach-at91/setup.c
+++ b/arch/arm/mach-at91/setup.c
@@ -23,6 +23,7 @@
 #include "at91_shdwc.h"
 #include "soc.h"
 #include "generic.h"
+#include "pm.h"
 
 struct at91_init_soc __initdata at91_boot_soc;
 
@@ -376,15 +377,16 @@ static void at91_dt_rstc(void)
 }
 
 static struct of_device_id ramc_ids[] = {
-        { .compatible = "atmel,at91rm9200-sdramc" },
-        { .compatible = "atmel,at91sam9260-sdramc" },
-        { .compatible = "atmel,at91sam9g45-ddramc" },
+        { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
+        { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
+        { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
         { /*sentinel*/ }
 };
 
 static void at91_dt_ramc(void)
 {
         struct device_node *np;
+        const struct of_device_id *of_id;
 
         np = of_find_matching_node(NULL, ramc_ids);
         if (!np)
@@ -396,6 +398,12 @@ static void at91_dt_ramc(void)
         /* the controller may have 2 banks */
         at91_ramc_base[1] = of_iomap(np, 1);
 
+        of_id = of_match_node(ramc_ids, np);
+        if (!of_id)
+                pr_warn("AT91: ramc no standby function available\n");
+        else
+                at91_pm_set_standby(of_id->data);
+
         of_node_put(np);
 }
 
diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
index e026b19b23ea..a075b3e0c5c7 100644
--- a/arch/arm/mach-davinci/Kconfig
+++ b/arch/arm/mach-davinci/Kconfig
@@ -40,7 +40,6 @@ config ARCH_DAVINCI_DA850
         bool "DA850/OMAP-L138/AM18x based system"
         select ARCH_DAVINCI_DA8XX
         select ARCH_HAS_CPUFREQ
-        select CPU_FREQ_TABLE
         select CP_INTC
 
 config ARCH_DAVINCI_DA8XX
diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
index 92b7f770615a..4078ba93776b 100644
--- a/arch/arm/mach-davinci/board-dm365-evm.c
+++ b/arch/arm/mach-davinci/board-dm365-evm.c
@@ -176,7 +176,7 @@ static struct at24_platform_data eeprom_info = {
         .context        = (void *)0x7f00,
 };
 
-static struct snd_platform_data dm365_evm_snd_data = {
+static struct snd_platform_data dm365_evm_snd_data __maybe_unused = {
         .asp_chan_q = EVENTQ_3,
 };
 
diff --git a/arch/arm/mach-davinci/include/mach/serial.h b/arch/arm/mach-davinci/include/mach/serial.h
index 52b8571b2e70..ce402cd21fa0 100644
--- a/arch/arm/mach-davinci/include/mach/serial.h
+++ b/arch/arm/mach-davinci/include/mach/serial.h
@@ -15,8 +15,6 @@
 
 #include <mach/hardware.h>
 
-#include <linux/platform_device.h>
-
 #define DAVINCI_UART0_BASE      (IO_PHYS + 0x20000)
 #define DAVINCI_UART1_BASE      (IO_PHYS + 0x20400)
 #define DAVINCI_UART2_BASE      (IO_PHYS + 0x20800)
@@ -39,6 +37,8 @@
 #define UART_DM646X_SCR_TX_WATERMARK    0x08
 
 #ifndef __ASSEMBLY__
+#include <linux/platform_device.h>
+
 extern int davinci_serial_init(struct platform_device *);
 #endif
 
diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
index ba95e5db2501..c17407b16d7c 100644
--- a/arch/arm/mach-exynos/common.c
+++ b/arch/arm/mach-exynos/common.c
@@ -30,6 +30,7 @@
 #include <linux/clk-provider.h>
 #include <linux/irqchip/arm-gic.h>
 #include <linux/irqchip/chained_irq.h>
+#include <linux/platform_device.h>
 
 #include <asm/proc-fns.h>
 #include <asm/exception.h>
@@ -294,6 +295,16 @@ void exynos5_restart(enum reboot_mode mode, const char *cmd)
         __raw_writel(val, addr);
 }
 
+static struct platform_device exynos_cpuidle = {
+        .name           = "exynos_cpuidle",
+        .id             = -1,
+};
+
+void __init exynos_cpuidle_init(void)
+{
+        platform_device_register(&exynos_cpuidle);
+}
+
 void __init exynos_init_late(void)
 {
         if (of_machine_is_compatible("samsung,exynos5440"))
diff --git a/arch/arm/mach-exynos/common.h b/arch/arm/mach-exynos/common.h
index 8646a141ae46..b2ac1885d381 100644
--- a/arch/arm/mach-exynos/common.h
+++ b/arch/arm/mach-exynos/common.h
@@ -22,6 +22,7 @@ struct map_desc;
 void exynos_init_io(void);
 void exynos4_restart(enum reboot_mode mode, const char *cmd);
 void exynos5_restart(enum reboot_mode mode, const char *cmd);
+void exynos_cpuidle_init(void);
 void exynos_init_late(void);
 
 void exynos_firmware_init(void);
diff --git a/arch/arm/mach-exynos/cpuidle.c b/arch/arm/mach-exynos/cpuidle.c
index ac139226d63c..ddbfe8709fe7 100644
--- a/arch/arm/mach-exynos/cpuidle.c
+++ b/arch/arm/mach-exynos/cpuidle.c
@@ -15,6 +15,7 @@
 #include <linux/io.h>
 #include <linux/export.h>
 #include <linux/time.h>
+#include <linux/platform_device.h>
 
 #include <asm/proc-fns.h>
 #include <asm/smp_scu.h>
@@ -192,7 +193,7 @@ static void __init exynos5_core_down_clk(void)
         __raw_writel(tmp, EXYNOS5_PWR_CTRL2);
 }
 
-static int __init exynos4_init_cpuidle(void)
+static int exynos_cpuidle_probe(struct platform_device *pdev)
 {
         int cpu_id, ret;
         struct cpuidle_device *device;
@@ -205,7 +206,7 @@ static int __init exynos4_init_cpuidle(void)
 
         ret = cpuidle_register_driver(&exynos4_idle_driver);
         if (ret) {
-                printk(KERN_ERR "CPUidle failed to register driver\n");
+                dev_err(&pdev->dev, "failed to register cpuidle driver\n");
                 return ret;
         }
 
@@ -219,11 +220,20 @@ static int __init exynos4_init_cpuidle(void)
 
                 ret = cpuidle_register_device(device);
                 if (ret) {
-                        printk(KERN_ERR "CPUidle register device failed\n");
+                        dev_err(&pdev->dev, "failed to register cpuidle device\n");
                         return ret;
                 }
         }
 
         return 0;
 }
-device_initcall(exynos4_init_cpuidle);
+
+static struct platform_driver exynos_cpuidle_driver = {
+        .probe  = exynos_cpuidle_probe,
+        .driver = {
+                .name = "exynos_cpuidle",
+                .owner = THIS_MODULE,
+        },
+};
+
+module_platform_driver(exynos_cpuidle_driver);
diff --git a/arch/arm/mach-exynos/mach-exynos4-dt.c b/arch/arm/mach-exynos/mach-exynos4-dt.c
index 0099c6c13bba..53a3dc37a730 100644
--- a/arch/arm/mach-exynos/mach-exynos4-dt.c
+++ b/arch/arm/mach-exynos/mach-exynos4-dt.c
@@ -25,6 +25,8 @@
 
 static void __init exynos4_dt_machine_init(void)
 {
+        exynos_cpuidle_init();
+
         of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
 }
 
diff --git a/arch/arm/mach-exynos/mach-exynos5-dt.c b/arch/arm/mach-exynos/mach-exynos5-dt.c
index f874b773ca13..c9f7dd1cdc8f 100644
--- a/arch/arm/mach-exynos/mach-exynos5-dt.c
+++ b/arch/arm/mach-exynos/mach-exynos5-dt.c
@@ -47,6 +47,8 @@ static void __init exynos5_dt_machine_init(void)
                 }
         }
 
+        exynos_cpuidle_init();
+
         of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
 }
 
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 90372a21087f..699aabe296e1 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -25,7 +25,7 @@
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/phy.h>
 #include <linux/reboot.h>
 #include <linux/regmap.h>
@@ -226,7 +226,7 @@ static void __init imx6q_opp_check_1p2ghz(struct device *cpu_dev)
         val = readl_relaxed(base + OCOTP_CFG3);
         val >>= OCOTP_CFG3_SPEED_SHIFT;
         if ((val & 0x3) != OCOTP_CFG3_SPEED_1P2GHZ)
-                if (opp_disable(cpu_dev, 1200000000))
+                if (dev_pm_opp_disable(cpu_dev, 1200000000))
                         pr_warn("failed to disable 1.2 GHz OPP\n");
 
 put_node:
diff --git a/arch/arm/mach-integrator/pci_v3.h b/arch/arm/mach-integrator/pci_v3.h
index 755fd29fed4a..06a9e2e7d007 100644
--- a/arch/arm/mach-integrator/pci_v3.h
+++ b/arch/arm/mach-integrator/pci_v3.h
@@ -1,2 +1,9 @@
 /* Simple oneliner include to the PCIv3 early init */
+#ifdef CONFIG_PCI
 extern int pci_v3_early_init(void);
+#else
+static inline int pci_v3_early_init(void)
+{
+        return 0;
+}
+#endif
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 4c24303ec481..58adf2fd9cfc 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -140,6 +140,7 @@ int __init coherency_init(void)
                 coherency_base = of_iomap(np, 0);
                 coherency_cpu_base = of_iomap(np, 1);
                 set_cpu_coherent(cpu_logical_map(smp_processor_id()), 0);
+                of_node_put(np);
         }
 
         return 0;
@@ -147,9 +148,14 @@ int __init coherency_init(void)
 
 static int __init coherency_late_init(void)
 {
-        if (of_find_matching_node(NULL, of_coherency_table))
+        struct device_node *np;
+
+        np = of_find_matching_node(NULL, of_coherency_table);
+        if (np) {
                 bus_register_notifier(&platform_bus_type,
                                       &mvebu_hwcc_platform_nb);
+                of_node_put(np);
+        }
         return 0;
 }
 
diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
index 3cc4bef6401c..27fc4f049474 100644
--- a/arch/arm/mach-mvebu/pmsu.c
+++ b/arch/arm/mach-mvebu/pmsu.c
@@ -67,6 +67,7 @@ int __init armada_370_xp_pmsu_init(void)
                 pr_info("Initializing Power Management Service Unit\n");
                 pmsu_mp_base = of_iomap(np, 0);
                 pmsu_reset_base = of_iomap(np, 1);
+                of_node_put(np);
         }
 
         return 0;
diff --git a/arch/arm/mach-mvebu/system-controller.c b/arch/arm/mach-mvebu/system-controller.c
index f875124ff4f9..5175083cdb34 100644
--- a/arch/arm/mach-mvebu/system-controller.c
+++ b/arch/arm/mach-mvebu/system-controller.c
@@ -98,6 +98,7 @@ static int __init mvebu_system_controller_init(void)
                 BUG_ON(!match);
                 system_controller_base = of_iomap(np, 0);
                 mvebu_sc = (struct mvebu_system_controller *)match->data;
+                of_node_put(np);
         }
 
         return 0;
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 39c78387ddec..87162e1b94a5 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -129,6 +129,24 @@ DT_MACHINE_START(OMAP3_DT, "Generic OMAP3 (Flattened Device Tree)")
         .restart        = omap3xxx_restart,
 MACHINE_END
 
+static const char *omap36xx_boards_compat[] __initdata = {
+        "ti,omap36xx",
+        NULL,
+};
+
+DT_MACHINE_START(OMAP36XX_DT, "Generic OMAP36xx (Flattened Device Tree)")
+        .reserve        = omap_reserve,
+        .map_io         = omap3_map_io,
+        .init_early     = omap3630_init_early,
+        .init_irq       = omap_intc_of_init,
+        .handle_irq     = omap3_intc_handle_irq,
+        .init_machine   = omap_generic_init,
+        .init_late      = omap3_init_late,
+        .init_time      = omap3_sync32k_timer_init,
+        .dt_compat      = omap36xx_boards_compat,
+        .restart        = omap3xxx_restart,
+MACHINE_END
+
 static const char *omap3_gp_boards_compat[] __initdata = {
         "ti,omap3-beagle",
         "timll,omap3-devkit8000",
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index f26918467efc..6432ab8d9207 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -25,7 +25,7 @@
 #include <linux/gpio.h>
 #include <linux/input.h>
 #include <linux/gpio_keys.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/cpu.h>
 
 #include <linux/mtd/mtd.h>
@@ -522,11 +522,11 @@ static int __init beagle_opp_init(void)
                         return -ENODEV;
                 }
                 /* Enable MPU 1GHz and lower opps */
-                r = opp_enable(mpu_dev, 800000000);
+                r = dev_pm_opp_enable(mpu_dev, 800000000);
                 /* TODO: MPU 1GHz needs SR and ABB */
 
                 /* Enable IVA 800MHz and lower opps */
-                r |= opp_enable(iva_dev, 660000000);
+                r |= dev_pm_opp_enable(iva_dev, 660000000);
                 /* TODO: DSP 800MHz needs SR and ABB */
                 if (r) {
                         pr_err("%s: failed to enable higher opp %d\n",
@@ -535,8 +535,8 @@ static int __init beagle_opp_init(void)
                          * Cleanup - disable the higher freqs - we dont care
                          * about the results
                          */
-                        opp_disable(mpu_dev, 800000000);
-                        opp_disable(iva_dev, 660000000);
+                        dev_pm_opp_disable(mpu_dev, 800000000);
+                        dev_pm_opp_disable(iva_dev, 660000000);
                 }
         }
         return 0;
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index c3270c0f1fce..f6fe388af989 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -167,38 +167,47 @@ static struct lp55xx_led_config rx51_lp5523_led_config[] = {
                 .name           = "lp5523:kb1",
                 .chan_nr        = 0,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb2",
                 .chan_nr        = 1,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb3",
                 .chan_nr        = 2,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb4",
                 .chan_nr        = 3,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:b",
                 .chan_nr        = 4,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:g",
                 .chan_nr        = 5,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:r",
                 .chan_nr        = 6,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb5",
                 .chan_nr        = 7,
                 .led_current    = 50,
+                .max_current    = 100,
         }, {
                 .name           = "lp5523:kb6",
                 .chan_nr        = 8,
                 .led_current    = 50,
+                .max_current    = 100,
         }
 };
 
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 64b5a8346982..8b6876c98ce1 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -272,9 +272,19 @@ static int omap2_onenand_setup_async(void __iomem *onenand_base)
         struct gpmc_timings t;
         int ret;
 
-        if (gpmc_onenand_data->of_node)
+        if (gpmc_onenand_data->of_node) {
                 gpmc_read_settings_dt(gpmc_onenand_data->of_node,
                                       &onenand_async);
+                if (onenand_async.sync_read || onenand_async.sync_write) {
+                        if (onenand_async.sync_write)
+                                gpmc_onenand_data->flags |=
+                                        ONENAND_SYNC_READWRITE;
+                        else
+                                gpmc_onenand_data->flags |= ONENAND_SYNC_READ;
+                        onenand_async.sync_read = false;
+                        onenand_async.sync_write = false;
+                }
+        }
 
         omap2_onenand_set_async_mode(onenand_base);
 
diff --git a/arch/arm/mach-omap2/mux.h b/arch/arm/mach-omap2/mux.h
index 5d2080ef7923..16f78a990d04 100644
--- a/arch/arm/mach-omap2/mux.h
+++ b/arch/arm/mach-omap2/mux.h
@@ -28,7 +28,7 @@
 #define OMAP_PULL_UP                    (1 << 4)
 #define OMAP_ALTELECTRICALSEL           (1 << 5)
 
-/* 34xx specific mux bit defines */
+/* omap3/4/5 specific mux bit defines */
 #define OMAP_INPUT_EN                   (1 << 8)
 #define OMAP_OFF_EN                     (1 << 9)
 #define OMAP_OFFOUT_EN                  (1 << 10)
@@ -36,8 +36,6 @@
 #define OMAP_OFF_PULL_EN                (1 << 12)
 #define OMAP_OFF_PULL_UP                (1 << 13)
 #define OMAP_WAKEUP_EN                  (1 << 14)
-
-/* 44xx specific mux bit defines */
 #define OMAP_WAKEUP_EVENT               (1 << 15)
 
 /* Active pin states */
diff --git a/arch/arm/mach-omap2/omap-pm.h b/arch/arm/mach-omap2/omap-pm.h
index 67faa7b8fe92..1d777e63e05c 100644
--- a/arch/arm/mach-omap2/omap-pm.h
+++ b/arch/arm/mach-omap2/omap-pm.h
@@ -17,7 +17,7 @@
 #include <linux/device.h>
 #include <linux/cpufreq.h>
 #include <linux/clk.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 
 /*
  * agent_id values for use with omap_pm_set_min_bus_tput():
diff --git a/arch/arm/mach-omap2/opp.c b/arch/arm/mach-omap2/opp.c
index bd41d59a7cab..ec21e6eb03e1 100644
--- a/arch/arm/mach-omap2/opp.c
+++ b/arch/arm/mach-omap2/opp.c
@@ -17,7 +17,7 @@
  * GNU General Public License for more details.
  */
 #include <linux/module.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/cpu.h>
 
 #include "omap_device.h"
@@ -81,14 +81,14 @@ int __init omap_init_opp_table(struct omap_opp_def *opp_def,
                         dev = &oh->od->pdev->dev;
                 }
 
-                r = opp_add(dev, opp_def->freq, opp_def->u_volt);
+                r = dev_pm_opp_add(dev, opp_def->freq, opp_def->u_volt);
                 if (r) {
                         dev_err(dev, "%s: add OPP %ld failed for %s [%d] result=%d\n",
                                 __func__, opp_def->freq,
                                 opp_def->hwmod_name, i, r);
                 } else {
                         if (!opp_def->default_available)
-                                r = opp_disable(dev, opp_def->freq);
+                                r = dev_pm_opp_disable(dev, opp_def->freq);
                         if (r)
                                 dev_err(dev, "%s: disable %ld failed for %s [%d] result=%d\n",
                                         __func__, opp_def->freq,
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index e742118fcfd2..2f569b3c3092 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -13,7 +13,7 @@
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/err.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/export.h>
 #include <linux/suspend.h>
 #include <linux/cpu.h>
@@ -131,7 +131,7 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
 {
         struct voltagedomain *voltdm;
         struct clk *clk;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long freq, bootup_volt;
         struct device *dev;
 
@@ -172,7 +172,7 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
         clk_put(clk);
 
         rcu_read_lock();
-        opp = opp_find_freq_ceil(dev, &freq);
+        opp = dev_pm_opp_find_freq_ceil(dev, &freq);
         if (IS_ERR(opp)) {
                 rcu_read_unlock();
                 pr_err("%s: unable to find boot up OPP for vdd_%s\n",
@@ -180,7 +180,7 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
                 goto exit;
         }
 
-        bootup_volt = opp_get_voltage(opp);
+        bootup_volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
         if (!bootup_volt) {
                 pr_err("%s: unable to find voltage corresponding to the bootup OPP for vdd_%s\n",
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index fa74a0625da1..ead48fa5715e 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -628,7 +628,7 @@ void __init omap4_local_timer_init(void)
 #endif /* CONFIG_HAVE_ARM_TWD */
 #endif /* CONFIG_ARCH_OMAP4 */
 
-#ifdef CONFIG_SOC_OMAP5
+#if defined(CONFIG_SOC_OMAP5) || defined(CONFIG_SOC_DRA7XX)
 void __init omap5_realtime_timer_init(void)
 {
         omap4_sync32k_timer_init();
@@ -636,7 +636,7 @@ void __init omap5_realtime_timer_init(void)
 
         clocksource_of_init();
 }
-#endif /* CONFIG_SOC_OMAP5 */
+#endif /* CONFIG_SOC_OMAP5 || CONFIG_SOC_DRA7XX */
 
 /**
  * omap_timer_init - build and register timer device with an
diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig
index a8427115ee07..96100dbf5a2e 100644
--- a/arch/arm/mach-pxa/Kconfig
+++ b/arch/arm/mach-pxa/Kconfig
@@ -615,14 +615,12 @@ endmenu
 config PXA25x
         bool
         select CPU_XSCALE
-        select CPU_FREQ_TABLE if CPU_FREQ
         help
           Select code specific to PXA21x/25x/26x variants
 
 config PXA27x
         bool
         select CPU_XSCALE
-        select CPU_FREQ_TABLE if CPU_FREQ
         help
           Select code specific to PXA27x variants
 
@@ -635,7 +633,6 @@ config CPU_PXA26x
 config PXA3xx
         bool
         select CPU_XSC3
-        select CPU_FREQ_TABLE if CPU_FREQ
         help
           Select code specific to PXA3xx variants
 
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index f25b6119e028..d4ea142c4edd 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -42,74 +42,31 @@ EXPORT_SYMBOL(reset_status);
 /*
  * This table is setup for a 3.6864MHz Crystal.
  */
-static const unsigned short cclk_frequency_100khz[NR_FREQS] = {
-         590,   /*  59.0 MHz */
-         737,   /*  73.7 MHz */
-         885,   /*  88.5 MHz */
-        1032,   /* 103.2 MHz */
-        1180,   /* 118.0 MHz */
-        1327,   /* 132.7 MHz */
-        1475,   /* 147.5 MHz */
-        1622,   /* 162.2 MHz */
-        1769,   /* 176.9 MHz */
-        1917,   /* 191.7 MHz */
-        2064,   /* 206.4 MHz */
-        2212,   /* 221.2 MHz */
-        2359,   /* 235.9 MHz */
-        2507,   /* 250.7 MHz */
-        2654,   /* 265.4 MHz */
-        2802    /* 280.2 MHz */
+struct cpufreq_frequency_table sa11x0_freq_table[NR_FREQS+1] = {
+        { .frequency = 59000,   /*  59.0 MHz */},
+        { .frequency = 73700,   /*  73.7 MHz */},
+        { .frequency = 88500,   /*  88.5 MHz */},
+        { .frequency = 103200,  /* 103.2 MHz */},
+        { .frequency = 118000,  /* 118.0 MHz */},
+        { .frequency = 132700,  /* 132.7 MHz */},
+        { .frequency = 147500,  /* 147.5 MHz */},
+        { .frequency = 162200,  /* 162.2 MHz */},
+        { .frequency = 176900,  /* 176.9 MHz */},
+        { .frequency = 191700,  /* 191.7 MHz */},
+        { .frequency = 206400,  /* 206.4 MHz */},
+        { .frequency = 221200,  /* 221.2 MHz */},
+        { .frequency = 235900,  /* 235.9 MHz */},
+        { .frequency = 250700,  /* 250.7 MHz */},
+        { .frequency = 265400,  /* 265.4 MHz */},
+        { .frequency = 280200,  /* 280.2 MHz */},
+        { .frequency = CPUFREQ_TABLE_END, },
 };
 
-/* rounds up(!)  */
-unsigned int sa11x0_freq_to_ppcr(unsigned int khz)
-{
-        int i;
-
-        khz /= 100;
-
-        for (i = 0; i < NR_FREQS; i++)
-                if (cclk_frequency_100khz[i] >= khz)
-                        break;
-
-        return i;
-}
-
-unsigned int sa11x0_ppcr_to_freq(unsigned int idx)
-{
-        unsigned int freq = 0;
-        if (idx < NR_FREQS)
-                freq = cclk_frequency_100khz[idx] * 100;
-        return freq;
-}
-
-
-/* make sure that only the "userspace" governor is run -- anything else wouldn't make sense on
- * this platform, anyway.
- */
-int sa11x0_verify_speed(struct cpufreq_policy *policy)
-{
-        unsigned int tmp;
-        if (policy->cpu)
-                return -EINVAL;
-
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq, policy->cpuinfo.max_freq);
-
-        /* make sure that at least one frequency is within the policy */
-        tmp = cclk_frequency_100khz[sa11x0_freq_to_ppcr(policy->min)] * 100;
-        if (tmp > policy->max)
-                policy->max = tmp;
-
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq, policy->cpuinfo.max_freq);
-
-        return 0;
-}
-
 unsigned int sa11x0_getspeed(unsigned int cpu)
 {
         if (cpu)
                 return 0;
-        return cclk_frequency_100khz[PPCR & 0xf] * 100;
+        return sa11x0_freq_table[PPCR & 0xf].frequency;
 }
 
 /*
diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
index 9a33695c9492..0d92e119b36b 100644
--- a/arch/arm/mach-sa1100/generic.h
+++ b/arch/arm/mach-sa1100/generic.h
@@ -3,6 +3,7 @@
  *
  * Author: Nicolas Pitre
  */
+#include <linux/cpufreq.h>
 #include <linux/reboot.h>
 
 extern void sa1100_timer_init(void);
@@ -19,12 +20,8 @@ extern void sa11x0_init_late(void);
 extern void sa1110_mb_enable(void);
 extern void sa1110_mb_disable(void);
 
-struct cpufreq_policy;
-
-extern unsigned int sa11x0_freq_to_ppcr(unsigned int khz);
-extern int sa11x0_verify_speed(struct cpufreq_policy *policy);
+extern struct cpufreq_frequency_table sa11x0_freq_table[];
 extern unsigned int sa11x0_getspeed(unsigned int cpu);
-extern unsigned int sa11x0_ppcr_to_freq(unsigned int idx);
 
 struct flash_platform_data;
 struct resource;
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 5bd1479d3deb..7f8f6076d360 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -1108,9 +1108,9 @@ static const struct pinctrl_map eva_pinctrl_map[] = {
         PIN_MAP_MUX_GROUP_DEFAULT("asoc-simple-card.1", "pfc-r8a7740",
                                   "fsib_mclk_in", "fsib"),
         /* GETHER */
-        PIN_MAP_MUX_GROUP_DEFAULT("sh-eth", "pfc-r8a7740",
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7740-gether", "pfc-r8a7740",
                                   "gether_mii", "gether"),
-        PIN_MAP_MUX_GROUP_DEFAULT("sh-eth", "pfc-r8a7740",
+        PIN_MAP_MUX_GROUP_DEFAULT("r8a7740-gether", "pfc-r8a7740",
                                   "gether_int", "gether"),
         /* HDMI */
         PIN_MAP_MUX_GROUP_DEFAULT("sh-mobile-hdmi", "pfc-r8a7740",
diff --git a/arch/arm/mach-shmobile/board-lager.c b/arch/arm/mach-shmobile/board-lager.c
index ffb6f0ac7606..5930af8d434f 100644
--- a/arch/arm/mach-shmobile/board-lager.c
+++ b/arch/arm/mach-shmobile/board-lager.c
@@ -29,6 +29,7 @@
 #include <linux/pinctrl/machine.h>
 #include <linux/platform_data/gpio-rcar.h>
 #include <linux/platform_device.h>
+#include <linux/phy.h>
 #include <linux/regulator/fixed.h>
 #include <linux/regulator/machine.h>
 #include <linux/sh_eth.h>
@@ -155,6 +156,30 @@ static void __init lager_add_standard_devices(void)
                                           &ether_pdata, sizeof(ether_pdata));
 }
 
+/*
+ * Ether LEDs on the Lager board are named LINK and ACTIVE which corresponds
+ * to non-default 01 setting of the Micrel KSZ8041 PHY control register 1 bits
+ * 14-15. We have to set them back to 01 from the default 00 value each time
+ * the PHY is reset. It's also important because the PHY's LED0 signal is
+ * connected to SoC's ETH_LINK signal and in the PHY's default mode it will
+ * bounce on and off after each packet, which we apparently want to avoid.
+ */
+static int lager_ksz8041_fixup(struct phy_device *phydev)
+{
+        u16 phyctrl1 = phy_read(phydev, 0x1e);
+
+        phyctrl1 &= ~0xc000;
+        phyctrl1 |= 0x4000;
+        return phy_write(phydev, 0x1e, phyctrl1);
+}
+
+static void __init lager_init(void)
+{
+        lager_add_standard_devices();
+
+        phy_register_fixup_for_id("r8a7790-ether-ff:01", lager_ksz8041_fixup);
+}
+
 static const char *lager_boards_compat_dt[] __initdata = {
         "renesas,lager",
         NULL,
@@ -163,6 +188,6 @@ static const char *lager_boards_compat_dt[] __initdata = {
 DT_MACHINE_START(LAGER_DT, "lager")
         .init_early     = r8a7790_init_delay,
         .init_time      = r8a7790_timer_init,
-        .init_machine   = lager_add_standard_devices,
+        .init_machine   = lager_init,
         .dt_compat      = lager_boards_compat_dt,
 MACHINE_END
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index 99a28d628297..7a3fc1af6944 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -34,7 +34,6 @@ config UX500_SOC_COMMON
 
 config UX500_SOC_DB8500
         bool
-        select CPU_FREQ_TABLE if CPU_FREQ
         select MFD_DB8500_PRCMU
         select PINCTRL_DB8500
         select PINCTRL_DB8540
diff --git a/arch/arm/mach-vexpress/Kconfig b/arch/arm/mach-vexpress/Kconfig
index 365795447804..c77170c04fd0 100644
--- a/arch/arm/mach-vexpress/Kconfig
+++ b/arch/arm/mach-vexpress/Kconfig
@@ -66,10 +66,22 @@ config ARCH_VEXPRESS_DCSCB
           This is needed to provide CPU and cluster power management
           on RTSM implementing big.LITTLE.
 
+config ARCH_VEXPRESS_SPC
+        bool "Versatile Express Serial Power Controller (SPC)"
+        select ARCH_HAS_CPUFREQ
+        select ARCH_HAS_OPP
+        select PM_OPP
+        help
+          The TC2 (A15x2 A7x3) versatile express core tile integrates a logic
+          block called Serial Power Controller (SPC) that provides the interface
+          between the dual cluster test-chip and the M3 microcontroller that
+          carries out power management.
+
 config ARCH_VEXPRESS_TC2_PM
         bool "Versatile Express TC2 power management"
         depends on MCPM
         select ARM_CCI
+        select ARCH_VEXPRESS_SPC
         help
           Support for CPU and cluster power management on Versatile Express
           with a TC2 (A15x2 A7x3) big.LITTLE core tile.
diff --git a/arch/arm/mach-vexpress/Makefile b/arch/arm/mach-vexpress/Makefile
index 505e64ab3eae..0997e0b7494c 100644
--- a/arch/arm/mach-vexpress/Makefile
+++ b/arch/arm/mach-vexpress/Makefile
@@ -8,7 +8,8 @@ obj-y					:= v2m.o
 obj-$(CONFIG_ARCH_VEXPRESS_CA9X4)       += ct-ca9x4.o
 obj-$(CONFIG_ARCH_VEXPRESS_DCSCB)       += dcscb.o      dcscb_setup.o
 CFLAGS_dcscb.o                          += -march=armv7-a
-obj-$(CONFIG_ARCH_VEXPRESS_TC2_PM)      += tc2_pm.o spc.o
+obj-$(CONFIG_ARCH_VEXPRESS_SPC)         += spc.o
+obj-$(CONFIG_ARCH_VEXPRESS_TC2_PM)      += tc2_pm.o
 CFLAGS_tc2_pm.o                         += -march=armv7-a
 obj-$(CONFIG_SMP)                       += platsmp.o
 obj-$(CONFIG_HOTPLUG_CPU)               += hotplug.o
diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
index eefb029197ca..033d34dcbd3f 100644
--- a/arch/arm/mach-vexpress/spc.c
+++ b/arch/arm/mach-vexpress/spc.c
@@ -17,14 +17,31 @@
  * GNU General Public License for more details.
  */
 
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/cpu.h>
+#include <linux/delay.h>
 #include <linux/err.h>
+#include <linux/interrupt.h>
 #include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/pm_opp.h>
 #include <linux/slab.h>
+#include <linux/semaphore.h>
 
 #include <asm/cacheflush.h>
 
 #define SPCLOG "vexpress-spc: "
 
+#define PERF_LVL_A15            0x00
+#define PERF_REQ_A15            0x04
+#define PERF_LVL_A7             0x08
+#define PERF_REQ_A7             0x0c
+#define COMMS                   0x10
+#define COMMS_REQ               0x14
+#define PWC_STATUS              0x18
+#define PWC_FLAG                0x1c
+
 /* SPC wake-up IRQs status and mask */
 #define WAKE_INT_MASK           0x24
 #define WAKE_INT_RAW            0x28
@@ -36,12 +53,45 @@
 #define A15_BX_ADDR0            0x68
 #define A7_BX_ADDR0             0x78
 
+/* SPC system config interface registers */
+#define SYSCFG_WDATA            0x70
+#define SYSCFG_RDATA            0x74
+
+/* A15/A7 OPP virtual register base */
+#define A15_PERFVAL_BASE        0xC10
+#define A7_PERFVAL_BASE         0xC30
+
+/* Config interface control bits */
+#define SYSCFG_START            (1 << 31)
+#define SYSCFG_SCC              (6 << 20)
+#define SYSCFG_STAT             (14 << 20)
+
 /* wake-up interrupt masks */
 #define GBL_WAKEUP_INT_MSK      (0x3 << 10)
 
 /* TC2 static dual-cluster configuration */
 #define MAX_CLUSTERS            2
 
+/*
+ * Even though the SPC takes max 3-5 ms to complete any OPP/COMMS
+ * operation, the operation could start just before jiffie is about
+ * to be incremented. So setting timeout value of 20ms = 2jiffies@100Hz
+ */
+#define TIMEOUT_US      20000
+
+#define MAX_OPPS        8
+#define CA15_DVFS       0
+#define CA7_DVFS        1
+#define SPC_SYS_CFG     2
+#define STAT_COMPLETE(type)     ((1 << 0) << (type << 2))
+#define STAT_ERR(type)          ((1 << 1) << (type << 2))
+#define RESPONSE_MASK(type)     (STAT_COMPLETE(type) | STAT_ERR(type))
+
+struct ve_spc_opp {
+        unsigned long freq;
+        unsigned long u_volt;
+};
+
 struct ve_spc_drvdata {
         void __iomem *baseaddr;
         /*
@@ -49,6 +99,12 @@ struct ve_spc_drvdata {
          * It corresponds to A15 processors MPIDR[15:8] bitfield
          */
         u32 a15_clusid;
+        uint32_t cur_rsp_mask;
+        uint32_t cur_rsp_stat;
+        struct semaphore sem;
+        struct completion done;
+        struct ve_spc_opp *opps[MAX_CLUSTERS];
+        int num_opps[MAX_CLUSTERS];
 };
 
 static struct ve_spc_drvdata *info;
@@ -157,8 +213,197 @@ void ve_spc_powerdown(u32 cluster, bool enable)
         writel_relaxed(enable, info->baseaddr + pwdrn_reg);
 }
 
-int __init ve_spc_init(void __iomem *baseaddr, u32 a15_clusid)
+static int ve_spc_get_performance(int cluster, u32 *freq)
+{
+        struct ve_spc_opp *opps = info->opps[cluster];
+        u32 perf_cfg_reg = 0;
+        u32 perf;
+
+        perf_cfg_reg = cluster_is_a15(cluster) ? PERF_LVL_A15 : PERF_LVL_A7;
+
+        perf = readl_relaxed(info->baseaddr + perf_cfg_reg);
+        if (perf >= info->num_opps[cluster])
+                return -EINVAL;
+
+        opps += perf;
+        *freq = opps->freq;
+
+        return 0;
+}
+
+/* find closest match to given frequency in OPP table */
+static int ve_spc_round_performance(int cluster, u32 freq)
+{
+        int idx, max_opp = info->num_opps[cluster];
+        struct ve_spc_opp *opps = info->opps[cluster];
+        u32 fmin = 0, fmax = ~0, ftmp;
+
+        freq /= 1000; /* OPP entries in kHz */
+        for (idx = 0; idx < max_opp; idx++, opps++) {
+                ftmp = opps->freq;
+                if (ftmp >= freq) {
+                        if (ftmp <= fmax)
+                                fmax = ftmp;
+                } else {
+                        if (ftmp >= fmin)
+                                fmin = ftmp;
+                }
+        }
+        if (fmax != ~0)
+                return fmax * 1000;
+        else
+                return fmin * 1000;
+}
+
+static int ve_spc_find_performance_index(int cluster, u32 freq)
+{
+        int idx, max_opp = info->num_opps[cluster];
+        struct ve_spc_opp *opps = info->opps[cluster];
+
+        for (idx = 0; idx < max_opp; idx++, opps++)
+                if (opps->freq == freq)
+                        break;
+        return (idx == max_opp) ? -EINVAL : idx;
+}
+
+static int ve_spc_waitforcompletion(int req_type)
+{
+        int ret = wait_for_completion_interruptible_timeout(
+                        &info->done, usecs_to_jiffies(TIMEOUT_US));
+        if (ret == 0)
+                ret = -ETIMEDOUT;
+        else if (ret > 0)
+                ret = info->cur_rsp_stat & STAT_COMPLETE(req_type) ? 0 : -EIO;
+        return ret;
+}
+
+static int ve_spc_set_performance(int cluster, u32 freq)
+{
+        u32 perf_cfg_reg, perf_stat_reg;
+        int ret, perf, req_type;
+
+        if (cluster_is_a15(cluster)) {
+                req_type = CA15_DVFS;
+                perf_cfg_reg = PERF_LVL_A15;
+                perf_stat_reg = PERF_REQ_A15;
+        } else {
+                req_type = CA7_DVFS;
+                perf_cfg_reg = PERF_LVL_A7;
+                perf_stat_reg = PERF_REQ_A7;
+        }
+
+        perf = ve_spc_find_performance_index(cluster, freq);
+
+        if (perf < 0)
+                return perf;
+
+        if (down_timeout(&info->sem, usecs_to_jiffies(TIMEOUT_US)))
+                return -ETIME;
+
+        init_completion(&info->done);
+        info->cur_rsp_mask = RESPONSE_MASK(req_type);
+
+        writel(perf, info->baseaddr + perf_cfg_reg);
+        ret = ve_spc_waitforcompletion(req_type);
+
+        info->cur_rsp_mask = 0;
+        up(&info->sem);
+
+        return ret;
+}
+
+static int ve_spc_read_sys_cfg(int func, int offset, uint32_t *data)
+{
+        int ret;
+
+        if (down_timeout(&info->sem, usecs_to_jiffies(TIMEOUT_US)))
+                return -ETIME;
+
+        init_completion(&info->done);
+        info->cur_rsp_mask = RESPONSE_MASK(SPC_SYS_CFG);
+
+        /* Set the control value */
+        writel(SYSCFG_START | func | offset >> 2, info->baseaddr + COMMS);
+        ret = ve_spc_waitforcompletion(SPC_SYS_CFG);
+
+        if (ret == 0)
+                *data = readl(info->baseaddr + SYSCFG_RDATA);
+
+        info->cur_rsp_mask = 0;
+        up(&info->sem);
+
+        return ret;
+}
+
+static irqreturn_t ve_spc_irq_handler(int irq, void *data)
+{
+        struct ve_spc_drvdata *drv_data = data;
+        uint32_t status = readl_relaxed(drv_data->baseaddr + PWC_STATUS);
+
+        if (info->cur_rsp_mask & status) {
+                info->cur_rsp_stat = status;
+                complete(&drv_data->done);
+        }
+
+        return IRQ_HANDLED;
+}
+
+/*
+ *  +--------------------------+
+ *  | 31      20 | 19        0 |
+ *  +--------------------------+
+ *  |   u_volt   |  freq(kHz)  |
+ *  +--------------------------+
+ */
+#define MULT_FACTOR     20
+#define VOLT_SHIFT      20
+#define FREQ_MASK       (0xFFFFF)
+static int ve_spc_populate_opps(uint32_t cluster)
 {
+        uint32_t data = 0, off, ret, idx;
+        struct ve_spc_opp *opps;
+
+        opps = kzalloc(sizeof(*opps) * MAX_OPPS, GFP_KERNEL);
+        if (!opps)
+                return -ENOMEM;
+
+        info->opps[cluster] = opps;
+
+        off = cluster_is_a15(cluster) ? A15_PERFVAL_BASE : A7_PERFVAL_BASE;
+        for (idx = 0; idx < MAX_OPPS; idx++, off += 4, opps++) {
+                ret = ve_spc_read_sys_cfg(SYSCFG_SCC, off, &data);
+                if (!ret) {
+                        opps->freq = (data & FREQ_MASK) * MULT_FACTOR;
+                        opps->u_volt = data >> VOLT_SHIFT;
+                } else {
+                        break;
+                }
+        }
+        info->num_opps[cluster] = idx;
+
+        return ret;
+}
+
+static int ve_init_opp_table(struct device *cpu_dev)
+{
+        int cluster = topology_physical_package_id(cpu_dev->id);
+        int idx, ret = 0, max_opp = info->num_opps[cluster];
+        struct ve_spc_opp *opps = info->opps[cluster];
+
+        for (idx = 0; idx < max_opp; idx++, opps++) {
+                ret = dev_pm_opp_add(cpu_dev, opps->freq * 1000, opps->u_volt);
+                if (ret) {
+                        dev_warn(cpu_dev, "failed to add opp %lu %lu\n",
+                                 opps->freq, opps->u_volt);
+                        return ret;
+                }
+        }
+        return ret;
+}
+
+int __init ve_spc_init(void __iomem *baseaddr, u32 a15_clusid, int irq)
+{
+        int ret;
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info) {
                 pr_err(SPCLOG "unable to allocate mem\n");
@@ -168,6 +413,25 @@ int __init ve_spc_init(void __iomem *baseaddr, u32 a15_clusid)
         info->baseaddr = baseaddr;
         info->a15_clusid = a15_clusid;
 
+        if (irq <= 0) {
+                pr_err(SPCLOG "Invalid IRQ %d\n", irq);
+                kfree(info);
+                return -EINVAL;
+        }
+
+        init_completion(&info->done);
+
+        readl_relaxed(info->baseaddr + PWC_STATUS);
+
+        ret = request_irq(irq, ve_spc_irq_handler, IRQF_TRIGGER_HIGH
+                                | IRQF_ONESHOT, "vexpress-spc", info);
+        if (ret) {
+                pr_err(SPCLOG "IRQ %d request failed\n", irq);
+                kfree(info);
+                return -ENODEV;
+        }
+
+        sema_init(&info->sem, 1);
         /*
          * Multi-cluster systems may need this data when non-coherent, during
          * cluster power-up/power-down. Make sure driver info reaches main
@@ -178,3 +442,103 @@ int __init ve_spc_init(void __iomem *baseaddr, u32 a15_clusid)
 
         return 0;
 }
+
+struct clk_spc {
+        struct clk_hw hw;
+        int cluster;
+};
+
+#define to_clk_spc(spc) container_of(spc, struct clk_spc, hw)
+static unsigned long spc_recalc_rate(struct clk_hw *hw,
+                unsigned long parent_rate)
+{
+        struct clk_spc *spc = to_clk_spc(hw);
+        u32 freq;
+
+        if (ve_spc_get_performance(spc->cluster, &freq))
+                return -EIO;
+
+        return freq * 1000;
+}
+
+static long spc_round_rate(struct clk_hw *hw, unsigned long drate,
+                unsigned long *parent_rate)
+{
+        struct clk_spc *spc = to_clk_spc(hw);
+
+        return ve_spc_round_performance(spc->cluster, drate);
+}
+
+static int spc_set_rate(struct clk_hw *hw, unsigned long rate,
+                unsigned long parent_rate)
+{
+        struct clk_spc *spc = to_clk_spc(hw);
+
+        return ve_spc_set_performance(spc->cluster, rate / 1000);
+}
+
+static struct clk_ops clk_spc_ops = {
+        .recalc_rate = spc_recalc_rate,
+        .round_rate = spc_round_rate,
+        .set_rate = spc_set_rate,
+};
+
+static struct clk *ve_spc_clk_register(struct device *cpu_dev)
+{
+        struct clk_init_data init;
+        struct clk_spc *spc;
+
+        spc = kzalloc(sizeof(*spc), GFP_KERNEL);
+        if (!spc) {
+                pr_err("could not allocate spc clk\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
+        spc->hw.init = &init;
+        spc->cluster = topology_physical_package_id(cpu_dev->id);
+
+        init.name = dev_name(cpu_dev);
+        init.ops = &clk_spc_ops;
+        init.flags = CLK_IS_ROOT | CLK_GET_RATE_NOCACHE;
+        init.num_parents = 0;
+
+        return devm_clk_register(cpu_dev, &spc->hw);
+}
+
+static int __init ve_spc_clk_init(void)
+{
+        int cpu;
+        struct clk *clk;
+
+        if (!info)
+                return 0; /* Continue only if SPC is initialised */
+
+        if (ve_spc_populate_opps(0) || ve_spc_populate_opps(1)) {
+                pr_err("failed to build OPP table\n");
+                return -ENODEV;
+        }
+
+        for_each_possible_cpu(cpu) {
+                struct device *cpu_dev = get_cpu_device(cpu);
+                if (!cpu_dev) {
+                        pr_warn("failed to get cpu%d device\n", cpu);
+                        continue;
+                }
+                clk = ve_spc_clk_register(cpu_dev);
+                if (IS_ERR(clk)) {
+                        pr_warn("failed to register cpu%d clock\n", cpu);
+                        continue;
+                }
+                if (clk_register_clkdev(clk, NULL, dev_name(cpu_dev))) {
+                        pr_warn("failed to register cpu%d clock lookup\n", cpu);
+                        continue;
+                }
+
+                if (ve_init_opp_table(cpu_dev))
+                        pr_warn("failed to initialise cpu%d opp table\n", cpu);
+        }
+
+        platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0);
+        return 0;
+}
+module_init(ve_spc_clk_init);
diff --git a/arch/arm/mach-vexpress/spc.h b/arch/arm/mach-vexpress/spc.h
index 5f7e4a446a17..dbd44c3720f9 100644
--- a/arch/arm/mach-vexpress/spc.h
+++ b/arch/arm/mach-vexpress/spc.h
@@ -15,7 +15,7 @@
 #ifndef __SPC_H_
 #define __SPC_H_
 
-int __init ve_spc_init(void __iomem *base, u32 a15_clusid);
+int __init ve_spc_init(void __iomem *base, u32 a15_clusid, int irq);
 void ve_spc_global_wakeup_irq(bool set);
 void ve_spc_cpu_wakeup_irq(u32 cluster, u32 cpu, bool set);
 void ve_spc_set_resume_addr(u32 cluster, u32 cpu, u32 addr);
diff --git a/arch/arm/mach-vexpress/tc2_pm.c b/arch/arm/mach-vexpress/tc2_pm.c
index 7aeb5d60e484..d38130aba464 100644
--- a/arch/arm/mach-vexpress/tc2_pm.c
+++ b/arch/arm/mach-vexpress/tc2_pm.c
@@ -16,6 +16,7 @@
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/of_address.h>
+#include <linux/of_irq.h>
 #include <linux/spinlock.h>
 #include <linux/errno.h>
 #include <linux/irqchip/arm-gic.h>
@@ -131,6 +132,16 @@ static void tc2_pm_down(u64 residency)
         } else
                 BUG();
 
+        /*
+         * If the CPU is committed to power down, make sure
+         * the power controller will be in charge of waking it
+         * up upon IRQ, ie IRQ lines are cut from GIC CPU IF
+         * to the CPU by disabling the GIC CPU IF to prevent wfi
+         * from completing execution behind power controller back
+         */
+        if (!skip_wfi)
+                gic_cpu_if_down();
+
         if (last_man && __mcpm_outbound_enter_critical(cpu, cluster)) {
                 arch_spin_unlock(&tc2_pm_lock);
 
@@ -231,7 +242,6 @@ static void tc2_pm_suspend(u64 residency)
         cpu = MPIDR_AFFINITY_LEVEL(mpidr, 0);
         cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
         ve_spc_set_resume_addr(cluster, cpu, virt_to_phys(mcpm_entry_point));
-        gic_cpu_if_down();
         tc2_pm_down(residency);
 }
 
@@ -302,7 +312,7 @@ static void __naked tc2_pm_power_up_setup(unsigned int affinity_level)
 
 static int __init tc2_pm_init(void)
 {
-        int ret;
+        int ret, irq;
         void __iomem *scc;
         u32 a15_cluster_id, a7_cluster_id, sys_info;
         struct device_node *np;
@@ -327,13 +337,15 @@ static int __init tc2_pm_init(void)
         tc2_nr_cpus[a15_cluster_id] = (sys_info >> 16) & 0xf;
         tc2_nr_cpus[a7_cluster_id] = (sys_info >> 20) & 0xf;
 
+        irq = irq_of_parse_and_map(np, 0);
+
         /*
          * A subset of the SCC registers is also used to communicate
          * with the SPC (power controller). We need to be able to
          * drive it very early in the boot process to power up
          * processors, so we initialize the SPC driver here.
          */
-        ret = ve_spc_init(scc + SPC_BASE, a15_cluster_id);
+        ret = ve_spc_init(scc + SPC_BASE, a15_cluster_id, irq);
         if (ret)
                 return ret;
 
diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c
index 5f252569c689..9a7bd137c8fd 100644
--- a/arch/arm/mach-zynq/common.c
+++ b/arch/arm/mach-zynq/common.c
@@ -44,6 +44,10 @@ static struct of_device_id zynq_of_bus_ids[] __initdata = {
         {}
 };
 
+static struct platform_device zynq_cpuidle_device = {
+        .name = "cpuidle-zynq",
+};
+
 /**
  * zynq_init_machine - System specific initialization, intended to be
  *                     called from board specific initialization.
@@ -56,6 +60,8 @@ static void __init zynq_init_machine(void)
         l2x0_of_init(0x02060000, 0xF0F0FFFF);
 
         of_platform_bus_probe(NULL, zynq_of_bus_ids, NULL);
+
+        platform_device_register(&zynq_cpuidle_device);
 }
 
 static void __init zynq_timer_init(void)
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index f5e1a8471714..1272ed202dde 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1232,7 +1232,8 @@ __iommu_create_mapping(struct device *dev, struct page **pages, size_t size)
                                 break;
 
                 len = (j - i) << PAGE_SHIFT;
-                ret = iommu_map(mapping->domain, iova, phys, len, 0);
+                ret = iommu_map(mapping->domain, iova, phys, len,
+                                IOMMU_READ|IOMMU_WRITE);
                 if (ret < 0)
                         goto fail;
                 iova += len;
@@ -1431,6 +1432,27 @@ static int arm_iommu_get_sgtable(struct device *dev, struct sg_table *sgt,
                                          GFP_KERNEL);
 }
 
+static int __dma_direction_to_prot(enum dma_data_direction dir)
+{
+        int prot;
+
+        switch (dir) {
+        case DMA_BIDIRECTIONAL:
+                prot = IOMMU_READ | IOMMU_WRITE;
+                break;
+        case DMA_TO_DEVICE:
+                prot = IOMMU_READ;
+                break;
+        case DMA_FROM_DEVICE:
+                prot = IOMMU_WRITE;
+                break;
+        default:
+                prot = 0;
+        }
+
+        return prot;
+}
+
 /*
  * Map a part of the scatter-gather list into contiguous io address space
  */
@@ -1444,6 +1466,7 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
         int ret = 0;
         unsigned int count;
         struct scatterlist *s;
+        int prot;
 
         size = PAGE_ALIGN(size);
         *handle = DMA_ERROR_CODE;
@@ -1460,7 +1483,9 @@ static int __map_sg_chunk(struct device *dev, struct scatterlist *sg,
                         !dma_get_attr(DMA_ATTR_SKIP_CPU_SYNC, attrs))
                         __dma_page_cpu_to_dev(sg_page(s), s->offset, s->length, dir);
 
-                ret = iommu_map(mapping->domain, iova, phys, len, 0);
+                prot = __dma_direction_to_prot(dir);
+
+                ret = iommu_map(mapping->domain, iova, phys, len, prot);
                 if (ret < 0)
                         goto fail;
                 count += len >> PAGE_SHIFT;
@@ -1665,19 +1690,7 @@ static dma_addr_t arm_coherent_iommu_map_page(struct device *dev, struct page *p
         if (dma_addr == DMA_ERROR_CODE)
                 return dma_addr;
 
-        switch (dir) {
-        case DMA_BIDIRECTIONAL:
-                prot = IOMMU_READ | IOMMU_WRITE;
-                break;
-        case DMA_TO_DEVICE:
-                prot = IOMMU_READ;
-                break;
-        case DMA_FROM_DEVICE:
-                prot = IOMMU_WRITE;
-                break;
-        default:
-                prot = 0;
-        }
+        prot = __dma_direction_to_prot(dir);
 
         ret = iommu_map(mapping->domain, dma_addr, page_to_phys(page), len, prot);
         if (ret < 0)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index febaee7ca57b..18ec4c504abf 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -17,7 +17,6 @@
 #include <linux/nodemask.h>
 #include <linux/initrd.h>
 #include <linux/of_fdt.h>
-#include <linux/of_reserved_mem.h>
 #include <linux/highmem.h>
 #include <linux/gfp.h>
 #include <linux/memblock.h>
@@ -379,8 +378,6 @@ void __init arm_memblock_init(struct meminfo *mi,
         if (mdesc->reserve)
                 mdesc->reserve();
 
-        early_init_dt_scan_reserved_mem();
-
         /*
          * reserve memory for DMA contigouos allocations,
          * must come from DMA area inside low memory
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index f50d223a0bd3..99b44e0e8d86 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -930,4 +930,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter)
                 module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug
index 1a6bfe954d49..835c559786bd 100644
--- a/arch/arm64/Kconfig.debug
+++ b/arch/arm64/Kconfig.debug
@@ -6,13 +6,6 @@ config FRAME_POINTER
         bool
         default y
 
-config DEBUG_STACK_USAGE
-        bool "Enable stack utilization instrumentation"
-        depends on DEBUG_KERNEL
-        help
-          Enables the display of the minimum amount of free stack which each
-          task has ever had available in the sysrq-T output.
-
 config EARLY_PRINTK
         bool "Early printk support"
         default y
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 5b3e83217b03..31c81e9b792e 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -42,7 +42,7 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_WIRELESS is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
-# CONFIG_BLK_DEV is not set
+CONFIG_BLK_DEV=y
 CONFIG_SCSI=y
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
@@ -72,6 +72,7 @@ CONFIG_LOGO=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS=y
 # CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
 # CONFIG_EXT3_FS_XATTR is not set
 CONFIG_FUSE_FS=y
@@ -90,3 +91,5 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_INFO=y
 # CONFIG_FTRACE is not set
 CONFIG_ATOMIC64_SELFTEST=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_BLK=y
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index edb3d5c73a32..7ecc2b23882e 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -166,9 +166,10 @@ do {									\
 
 #define get_user(x, ptr)                                                \
 ({                                                                      \
+        __typeof__(*(ptr)) __user *__p = (ptr);                         \
         might_fault();                                                  \
-        access_ok(VERIFY_READ, (ptr), sizeof(*(ptr))) ?                 \
-                __get_user((x), (ptr)) :                                \
+        access_ok(VERIFY_READ, __p, sizeof(*__p)) ?                     \
+                __get_user((x), __p) :                                  \
                 ((x) = 0, -EFAULT);                                     \
 })
 
@@ -227,9 +228,10 @@ do {									\
 
 #define put_user(x, ptr)                                                \
 ({                                                                      \
+        __typeof__(*(ptr)) __user *__p = (ptr);                         \
         might_fault();                                                  \
-        access_ok(VERIFY_WRITE, (ptr), sizeof(*(ptr))) ?                \
-                __put_user((x), (ptr)) :                                \
+        access_ok(VERIFY_WRITE, __p, sizeof(*__p)) ?                    \
+                __put_user((x), __p) :                                  \
                 -EFAULT;                                                \
 })
 
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 1f2e4d5a5c0f..bb785d23dbde 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -80,8 +80,10 @@ void fpsimd_thread_switch(struct task_struct *next)
 
 void fpsimd_flush_thread(void)
 {
+        preempt_disable();
         memset(&current->thread.fpsimd_state, 0, sizeof(struct fpsimd_state));
         fpsimd_load_state(&current->thread.fpsimd_state);
+        preempt_enable();
 }
 
 #ifdef CONFIG_KERNEL_MODE_NEON
diff --git a/arch/arm64/mm/tlb.S b/arch/arm64/mm/tlb.S
index 8ae80a18e8ec..19da91e0cd27 100644
--- a/arch/arm64/mm/tlb.S
+++ b/arch/arm64/mm/tlb.S
@@ -35,7 +35,7 @@
  */
 ENTRY(__cpu_flush_user_tlb_range)
         vma_vm_mm x3, x2                        // get vma->vm_mm
-        mmid    x3, x3                          // get vm_mm->context.id
+        mmid    w3, x3                          // get vm_mm->context.id
         dsb     sy
         lsr     x0, x0, #12                     // align address
         lsr     x1, x1, #12
diff --git a/arch/avr32/include/asm/Kbuild b/arch/avr32/include/asm/Kbuild
index d22af851f3f6..fd7980743890 100644
--- a/arch/avr32/include/asm/Kbuild
+++ b/arch/avr32/include/asm/Kbuild
@@ -1,5 +1,19 @@
 
 generic-y       += clkdev.h
+generic-y       += cputime.h
+generic-y       += delay.h
+generic-y       += device.h
+generic-y       += div64.h
+generic-y       += emergency-restart.h
 generic-y       += exec.h
-generic-y       += trace_clock.h
+generic-y       += futex.h
+generic-y       += irq_regs.h
 generic-y       += param.h
+generic-y       += local.h
+generic-y       += local64.h
+generic-y       += percpu.h
+generic-y       += scatterlist.h
+generic-y       += sections.h
+generic-y       += topology.h
+generic-y       += trace_clock.h
+generic-y       += xor.h
diff --git a/arch/avr32/include/asm/cputime.h b/arch/avr32/include/asm/cputime.h
deleted file mode 100644
index e87e0f81cbeb..000000000000
--- a/arch/avr32/include/asm/cputime.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_CPUTIME_H
-#define __ASM_AVR32_CPUTIME_H
-
-#include <asm-generic/cputime.h>
-
-#endif /* __ASM_AVR32_CPUTIME_H */
diff --git a/arch/avr32/include/asm/delay.h b/arch/avr32/include/asm/delay.h
deleted file mode 100644
index 9670e127b7b2..000000000000
--- a/arch/avr32/include/asm/delay.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/delay.h>
diff --git a/arch/avr32/include/asm/device.h b/arch/avr32/include/asm/device.h
deleted file mode 100644
index d8f9872b0e2d..000000000000
--- a/arch/avr32/include/asm/device.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Arch specific extensions to struct device
- *
- * This file is released under the GPLv2
- */
-#include <asm-generic/device.h>
-
diff --git a/arch/avr32/include/asm/div64.h b/arch/avr32/include/asm/div64.h
deleted file mode 100644
index d7ddd4fdeca6..000000000000
--- a/arch/avr32/include/asm/div64.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_DIV64_H
-#define __ASM_AVR32_DIV64_H
-
-#include <asm-generic/div64.h>
-
-#endif /* __ASM_AVR32_DIV64_H */
diff --git a/arch/avr32/include/asm/emergency-restart.h b/arch/avr32/include/asm/emergency-restart.h
deleted file mode 100644
index 3e7e014776ba..000000000000
--- a/arch/avr32/include/asm/emergency-restart.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_EMERGENCY_RESTART_H
-#define __ASM_AVR32_EMERGENCY_RESTART_H
-
-#include <asm-generic/emergency-restart.h>
-
-#endif /* __ASM_AVR32_EMERGENCY_RESTART_H */
diff --git a/arch/avr32/include/asm/futex.h b/arch/avr32/include/asm/futex.h
deleted file mode 100644
index 10419f14a68a..000000000000
--- a/arch/avr32/include/asm/futex.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_FUTEX_H
-#define __ASM_AVR32_FUTEX_H
-
-#include <asm-generic/futex.h>
-
-#endif /* __ASM_AVR32_FUTEX_H */
diff --git a/arch/avr32/include/asm/irq_regs.h b/arch/avr32/include/asm/irq_regs.h
deleted file mode 100644
index 3dd9c0b70270..000000000000
--- a/arch/avr32/include/asm/irq_regs.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/irq_regs.h>
diff --git a/arch/avr32/include/asm/local.h b/arch/avr32/include/asm/local.h
deleted file mode 100644
index 1c1619694da3..000000000000
--- a/arch/avr32/include/asm/local.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_LOCAL_H
-#define __ASM_AVR32_LOCAL_H
-
-#include <asm-generic/local.h>
-
-#endif /* __ASM_AVR32_LOCAL_H */
diff --git a/arch/avr32/include/asm/local64.h b/arch/avr32/include/asm/local64.h
deleted file mode 100644
index 36c93b5cc239..000000000000
--- a/arch/avr32/include/asm/local64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/local64.h>
diff --git a/arch/avr32/include/asm/percpu.h b/arch/avr32/include/asm/percpu.h
deleted file mode 100644
index 69227b4cd0d4..000000000000
--- a/arch/avr32/include/asm/percpu.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_PERCPU_H
-#define __ASM_AVR32_PERCPU_H
-
-#include <asm-generic/percpu.h>
-
-#endif /* __ASM_AVR32_PERCPU_H */
diff --git a/arch/avr32/include/asm/scatterlist.h b/arch/avr32/include/asm/scatterlist.h
deleted file mode 100644
index a5902d9834e8..000000000000
--- a/arch/avr32/include/asm/scatterlist.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_SCATTERLIST_H
-#define __ASM_AVR32_SCATTERLIST_H
-
-#include <asm-generic/scatterlist.h>
-
-#endif /* __ASM_AVR32_SCATTERLIST_H */
diff --git a/arch/avr32/include/asm/sections.h b/arch/avr32/include/asm/sections.h
deleted file mode 100644
index aa14252e4181..000000000000
--- a/arch/avr32/include/asm/sections.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_SECTIONS_H
-#define __ASM_AVR32_SECTIONS_H
-
-#include <asm-generic/sections.h>
-
-#endif /* __ASM_AVR32_SECTIONS_H */
diff --git a/arch/avr32/include/asm/topology.h b/arch/avr32/include/asm/topology.h
deleted file mode 100644
index 5b766cbb4806..000000000000
--- a/arch/avr32/include/asm/topology.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_AVR32_TOPOLOGY_H
-#define __ASM_AVR32_TOPOLOGY_H
-
-#include <asm-generic/topology.h>
-
-#endif /* __ASM_AVR32_TOPOLOGY_H */
diff --git a/arch/avr32/include/asm/xor.h b/arch/avr32/include/asm/xor.h
deleted file mode 100644
index 99c87aa0af4f..000000000000
--- a/arch/avr32/include/asm/xor.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_XOR_H
-#define _ASM_XOR_H
-
-#include <asm-generic/xor.h>
-
-#endif
diff --git a/arch/avr32/kernel/process.c b/arch/avr32/kernel/process.c
index c2731003edef..42a53e740a7e 100644
--- a/arch/avr32/kernel/process.c
+++ b/arch/avr32/kernel/process.c
@@ -289,7 +289,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
                 memset(childregs, 0, sizeof(struct pt_regs));
                 p->thread.cpu_context.r0 = arg;
                 p->thread.cpu_context.r1 = usp; /* fn */
-                p->thread.cpu_context.r2 = syscall_return;
+                p->thread.cpu_context.r2 = (unsigned long)syscall_return;
                 p->thread.cpu_context.pc = (unsigned long)ret_from_kernel_thread;
                 childregs->sr = MODE_SUPERVISOR;
         } else {
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index 869a1c6ffeee..12f828ad5058 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -98,7 +98,14 @@ static void comparator_mode(enum clock_event_mode mode,
         case CLOCK_EVT_MODE_SHUTDOWN:
                 sysreg_write(COMPARE, 0);
                 pr_debug("%s: stop\n", evdev->name);
-                cpu_idle_poll_ctrl(false);
+                if (evdev->mode == CLOCK_EVT_MODE_ONESHOT ||
+                    evdev->mode == CLOCK_EVT_MODE_RESUME) {
+                        /*
+                         * Only disable idle poll if we have forced that
+                         * in a previous call.
+                         */
+                        cpu_idle_poll_ctrl(false);
+                }
                 break;
         default:
                 BUG();
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index f78c9a2c7e28..eb382aedd9a2 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -1429,7 +1429,6 @@ source "drivers/cpufreq/Kconfig"
 config BFIN_CPU_FREQ
         bool
         depends on CPU_FREQ
-        select CPU_FREQ_TABLE
         default y
 
 config CPU_VOLTAGE
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index 02380bed189c..9c957c81c688 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -130,13 +130,11 @@ config SVINTO_SIM
 
 config ETRAXFS
         bool "ETRAX-FS-V32"
-        select CPU_FREQ_TABLE if CPU_FREQ
         help
           Support CRIS V32.
 
 config CRIS_MACH_ARTPEC3
         bool "ARTPEC-3"
-        select CPU_FREQ_TABLE if CPU_FREQ
         help
           Support Axis ARTPEC-3.
 
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 5eb71d22c3d5..59d52e3aef12 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -882,40 +882,10 @@ __init void prefill_possible_map(void)
                 set_cpu_possible(i, true);
 }
 
-static int _acpi_map_lsapic(acpi_handle handle, int *pcpu)
+static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 {
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-        union acpi_object *obj;
-        struct acpi_madt_local_sapic *lsapic;
         cpumask_t tmp_map;
-        int cpu, physid;
-
-        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_MAT", NULL, &buffer)))
-                return -EINVAL;
-
-        if (!buffer.length || !buffer.pointer)
-                return -EINVAL;
-
-        obj = buffer.pointer;
-        if (obj->type != ACPI_TYPE_BUFFER)
-        {
-                kfree(buffer.pointer);
-                return -EINVAL;
-        }
-
-        lsapic = (struct acpi_madt_local_sapic *)obj->buffer.pointer;
-
-        if ((lsapic->header.type != ACPI_MADT_TYPE_LOCAL_SAPIC) ||
-            (!(lsapic->lapic_flags & ACPI_MADT_ENABLED))) {
-                kfree(buffer.pointer);
-                return -EINVAL;
-        }
-
-        physid = ((lsapic->id << 8) | (lsapic->eid));
-
-        kfree(buffer.pointer);
-        buffer.length = ACPI_ALLOCATE_BUFFER;
-        buffer.pointer = NULL;
+        int cpu;
 
         cpumask_complement(&tmp_map, cpu_present_mask);
         cpu = cpumask_first(&tmp_map);
@@ -934,9 +904,9 @@ static int _acpi_map_lsapic(acpi_handle handle, int *pcpu)
 }
 
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int *pcpu)
+int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 {
-        return _acpi_map_lsapic(handle, pcpu);
+        return _acpi_map_lsapic(handle, physid, pcpu);
 }
 EXPORT_SYMBOL(acpi_map_lsapic);
 
diff --git a/arch/mips/alchemy/board-mtx1.c b/arch/mips/alchemy/board-mtx1.c
index 4a9baa9f6330..9969dbab19e3 100644
--- a/arch/mips/alchemy/board-mtx1.c
+++ b/arch/mips/alchemy/board-mtx1.c
@@ -276,7 +276,7 @@ static struct platform_device mtx1_pci_host = {
         .resource       = alchemy_pci_host_res,
 };
 
-static struct __initdata platform_device * mtx1_devs[] = {
+static struct platform_device *mtx1_devs[] __initdata = {
         &mtx1_pci_host,
         &mtx1_gpio_leds,
         &mtx1_wdt,
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 51680d15ca8e..d445d060e346 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -187,7 +187,7 @@
 
 /*
  * MIPS32, MIPS64, VR5500, IDT32332, IDT32334 and maybe a few other
- * pre-MIPS32/MIPS53 processors have CLO, CLZ.  The IDT RC64574 is 64-bit and
+ * pre-MIPS32/MIPS64 processors have CLO, CLZ.  The IDT RC64574 is 64-bit and
  * has CLO and CLZ but not DCLO nor DCLZ.  For 64-bit kernels
  * cpu_has_clo_clz also indicates the availability of DCLO and DCLZ.
  */
diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h
index 4d6d77ed9b9d..e194f957ca8c 100644
--- a/arch/mips/include/asm/jump_label.h
+++ b/arch/mips/include/asm/jump_label.h
@@ -22,7 +22,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:\tnop\n\t"
+        asm_volatile_goto("1:\tnop\n\t"
                 "nop\n\t"
                 ".pushsection __jump_table,  \"aw\"\n\t"
                 WORD_INSN " 1b, %l[l_yes], %0\n\t"
diff --git a/arch/mips/kernel/octeon_switch.S b/arch/mips/kernel/octeon_switch.S
index 4204d76af854..029e002a4ea0 100644
--- a/arch/mips/kernel/octeon_switch.S
+++ b/arch/mips/kernel/octeon_switch.S
@@ -73,7 +73,7 @@
 3:
 
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
         LONG_L  t9, TASK_STACK_CANARY(a1)
         LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 38af83f84c4a..20b7b040e76f 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -67,7 +67,7 @@ LEAF(resume)
 1:
 
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
         LONG_L  t9, TASK_STACK_CANARY(a1)
         LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index 921238a6bd26..078de5eaca8f 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -69,7 +69,7 @@
 1:
 
 #if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        PTR_L   t8, __stack_chk_guard
+        PTR_LA  t8, __stack_chk_guard
         LONG_L  t9, TASK_STACK_CANARY(a1)
         LONG_S  t9, 0(t8)
 #endif
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 627883bc6d5f..bc6f96fcb529 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -609,6 +609,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
                         r4k_blast_scache();
                 else
                         blast_scache_range(addr, addr + size);
+                preempt_enable();
                 __sync();
                 return;
         }
@@ -650,6 +651,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
                          */
                         blast_inv_scache_range(addr, addr + size);
                 }
+                preempt_enable();
                 __sync();
                 return;
         }
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index f25a7e9f8cbc..5f8b95512580 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -308,12 +308,10 @@ static void mips_dma_sync_sg_for_cpu(struct device *dev,
 {
         int i;
 
-        /* Make sure that gcc doesn't leave the empty loop body.  */
-        for (i = 0; i < nelems; i++, sg++) {
-                if (cpu_needs_post_dma_flush(dev))
+        if (cpu_needs_post_dma_flush(dev))
+                for (i = 0; i < nelems; i++, sg++)
                         __dma_sync(sg_page(sg), sg->offset, sg->length,
                                    direction);
-        }
 }
 
 static void mips_dma_sync_sg_for_device(struct device *dev,
@@ -321,12 +319,10 @@ static void mips_dma_sync_sg_for_device(struct device *dev,
 {
         int i;
 
-        /* Make sure that gcc doesn't leave the empty loop body.  */
-        for (i = 0; i < nelems; i++, sg++) {
-                if (!plat_device_is_coherent(dev))
+        if (!plat_device_is_coherent(dev))
+                for (i = 0; i < nelems; i++, sg++)
                         __dma_sync(sg_page(sg), sg->offset, sg->length,
                                    direction);
-        }
 }
 
 int mips_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
diff --git a/arch/openrisc/include/asm/prom.h b/arch/openrisc/include/asm/prom.h
index eb59bfe23e85..93c9980e1b6b 100644
--- a/arch/openrisc/include/asm/prom.h
+++ b/arch/openrisc/include/asm/prom.h
@@ -14,53 +14,9 @@
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
  */
-
-#include <linux/of.h>   /* linux/of.h gets to determine #include ordering */
-
 #ifndef _ASM_OPENRISC_PROM_H
 #define _ASM_OPENRISC_PROM_H
-#ifdef __KERNEL__
-#ifndef __ASSEMBLY__
 
-#include <linux/types.h>
-#include <asm/irq.h>
-#include <linux/irqdomain.h>
-#include <linux/atomic.h>
-#include <linux/of_irq.h>
-#include <linux/of_fdt.h>
-#include <linux/of_address.h>
-#include <linux/proc_fs.h>
-#include <linux/platform_device.h>
 #define HAVE_ARCH_DEVTREE_FIXUPS
 
-/* Other Prototypes */
-extern int early_uartlite_console(void);
-
-/* Parse the ibm,dma-window property of an OF node into the busno, phys and
- * size parameters.
- */
-void of_parse_dma_window(struct device_node *dn, const void *dma_window_prop,
-                unsigned long *busno, unsigned long *phys, unsigned long *size);
-
-extern void kdump_move_device_tree(void);
-
-/* Get the MAC address */
-extern const void *of_get_mac_address(struct device_node *np);
-
-/**
- * of_irq_map_pci - Resolve the interrupt for a PCI device
- * @pdev:       the device whose interrupt is to be resolved
- * @out_irq:    structure of_irq filled by this function
- *
- * This function resolves the PCI interrupt for a given PCI device. If a
- * device-node exists for a given pci_dev, it will use normal OF tree
- * walking. If not, it will implement standard swizzling and walk up the
- * PCI tree until an device-node is found, at which point it will finish
- * resolving using the OF tree walking.
- */
-struct pci_dev;
-extern int of_irq_map_pci(struct pci_dev *pdev, struct of_irq *out_irq);
-
-#endif /* __ASSEMBLY__ */
-#endif /* __KERNEL__ */
 #endif /* _ASM_OPENRISC_PROM_H */
diff --git a/arch/parisc/configs/712_defconfig b/arch/parisc/configs/712_defconfig
index 0f90569b9d85..9387cc2693f6 100644
--- a/arch/parisc/configs/712_defconfig
+++ b/arch/parisc/configs/712_defconfig
@@ -40,6 +40,8 @@ CONFIG_IP_NF_QUEUE=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/configs/a500_defconfig b/arch/parisc/configs/a500_defconfig
index b647b182dacc..90025322b75e 100644
--- a/arch/parisc/configs/a500_defconfig
+++ b/arch/parisc/configs/a500_defconfig
@@ -79,6 +79,8 @@ CONFIG_IP_DCCP=m
 CONFIG_LLC2=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/b180_defconfig b/arch/parisc/configs/b180_defconfig
index e289f5bf3148..f1a0c25bef8d 100644
--- a/arch/parisc/configs/b180_defconfig
+++ b/arch/parisc/configs/b180_defconfig
@@ -4,6 +4,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
 CONFIG_MODVERSIONS=y
@@ -27,6 +28,8 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_LRO is not set
 CONFIG_IPV6=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index 311ca367b622..ec1b014952b6 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -5,6 +5,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 CONFIG_KALLSYMS_ALL=y
@@ -39,6 +40,8 @@ CONFIG_NETFILTER_DEBUG=y
 CONFIG_IP_NF_QUEUE=m
 CONFIG_NET_PKTGEN=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_BLK_DEV_UMEM=m
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index f11006361297..e1c8d2015c89 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -62,6 +62,8 @@ CONFIG_TIPC=m
 CONFIG_LLC2=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
diff --git a/arch/parisc/configs/default_defconfig b/arch/parisc/configs/default_defconfig
index dfe88f6c95c4..ba61495e1fa4 100644
--- a/arch/parisc/configs/default_defconfig
+++ b/arch/parisc/configs/default_defconfig
@@ -49,6 +49,8 @@ CONFIG_INET6_ESP=y
 CONFIG_INET6_IPCOMP=y
 CONFIG_LLC2=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
 CONFIG_PARPORT=y
diff --git a/arch/parisc/include/asm/traps.h b/arch/parisc/include/asm/traps.h
index 1945f995f2df..4736020ba5ea 100644
--- a/arch/parisc/include/asm/traps.h
+++ b/arch/parisc/include/asm/traps.h
@@ -6,7 +6,7 @@ struct pt_regs;
 
 /* traps.c */
 void parisc_terminate(char *msg, struct pt_regs *regs,
-                int code, unsigned long offset);
+                int code, unsigned long offset) __noreturn __cold;
 
 /* mm/fault.c */
 void do_page_fault(struct pt_regs *regs, unsigned long code,
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 37aabd772fbb..d2d58258aea6 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -195,6 +195,8 @@ common_stext:
         ldw             MEM_PDC_HI(%r0),%r6
         depd            %r6, 31, 32, %r3        /* move to upper word */
 
+        mfctl           %cr30,%r6               /* PCX-W2 firmware bug */
+
         ldo             PDC_PSW(%r0),%arg0              /* 21 */
         ldo             PDC_PSW_SET_DEFAULTS(%r0),%arg1 /* 2 */
         ldo             PDC_PSW_WIDE_BIT(%r0),%arg2     /* 2 */
@@ -203,6 +205,8 @@ common_stext:
         copy            %r0,%arg3
 
 stext_pdc_ret:
+        mtctl           %r6,%cr30               /* restore task thread info */
+
         /* restore rfi target address*/
         ldd             TI_TASK-THREAD_SZ_ALGN(%sp), %r10
         tophys_r1       %r10
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 8a252f2d6c08..2b96602e812f 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -72,7 +72,6 @@ enum ipi_message_type {
         IPI_NOP=0,
         IPI_RESCHEDULE=1,
         IPI_CALL_FUNC,
-        IPI_CALL_FUNC_SINGLE,
         IPI_CPU_START,
         IPI_CPU_STOP,
         IPI_CPU_TEST
@@ -164,11 +163,6 @@ ipi_interrupt(int irq, void *dev_id)
                                 generic_smp_call_function_interrupt();
                                 break;
 
-                        case IPI_CALL_FUNC_SINGLE:
-                                smp_debug(100, KERN_DEBUG "CPU%d IPI_CALL_FUNC_SINGLE\n", this_cpu);
-                                generic_smp_call_function_single_interrupt();
-                                break;
-
                         case IPI_CPU_START:
                                 smp_debug(100, KERN_DEBUG "CPU%d IPI_CPU_START\n", this_cpu);
                                 break;
@@ -260,7 +254,7 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 
 void arch_send_call_function_single_ipi(int cpu)
 {
-        send_IPI_single(cpu, IPI_CALL_FUNC_SINGLE);
+        send_IPI_single(cpu, IPI_CALL_FUNC);
 }
 
 /*
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 04e47c6a4562..1cd1d0c83b6d 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -291,11 +291,6 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)
         do_exit(SIGSEGV);
 }
 
-int syscall_ipi(int (*syscall) (struct pt_regs *), struct pt_regs *regs)
-{
-        return syscall(regs);
-}
-
 /* gdb uses break 4,8 */
 #define GDB_BREAK_INSN 0x10004
 static void handle_gdb_break(struct pt_regs *regs, int wot)
@@ -805,14 +800,14 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
         else {
 
             /*
-             * The kernel should never fault on its own address space.
+             * The kernel should never fault on its own address space,
+             * unless pagefault_disable() was called before.
              */
 
-            if (fault_space == 0) 
+            if (fault_space == 0 && !in_atomic())
             {
                 pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
                 parisc_terminate("Kernel Fault", regs, code, fault_address);
-        
             }
         }
 
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index ac4370b1ca40..b5507ec06b84 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -56,7 +56,7 @@
 #ifdef __KERNEL__
 #include <linux/module.h>
 #include <linux/compiler.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #define s_space "%%sr1"
 #define d_space "%%sr2"
 #else
@@ -524,4 +524,17 @@ EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(copy_from_user);
 EXPORT_SYMBOL(copy_in_user);
 EXPORT_SYMBOL(memcpy);
+
+long probe_kernel_read(void *dst, const void *src, size_t size)
+{
+        unsigned long addr = (unsigned long)src;
+
+        if (size < 0 || addr < PAGE_SIZE)
+                return -EFAULT;
+
+        /* check for I/O space F_EXTEND(0xfff00000) access as well? */
+
+        return __probe_kernel_read(dst, src, size);
+}
+
 #endif
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index d10d27a720c0..0293588d5b8c 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -171,17 +171,25 @@ void do_page_fault(struct pt_regs *regs, unsigned long code,
                               unsigned long address)
 {
         struct vm_area_struct *vma, *prev_vma;
-        struct task_struct *tsk = current;
-        struct mm_struct *mm = tsk->mm;
+        struct task_struct *tsk;
+        struct mm_struct *mm;
         unsigned long acc_type;
         int fault;
-        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+        unsigned int flags;
 
-        if (in_atomic() || !mm)
+        if (in_atomic())
                 goto no_context;
 
+        tsk = current;
+        mm = tsk->mm;
+        if (!mm)
+                goto no_context;
+
+        flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
         if (user_mode(regs))
                 flags |= FAULT_FLAG_USER;
+
+        acc_type = parisc_acctyp(code, regs->iir);
         if (acc_type & VM_WRITE)
                 flags |= FAULT_FLAG_WRITE;
 retry:
@@ -196,8 +204,6 @@ retry:
 
 good_area:
 
-        acc_type = parisc_acctyp(code,regs->iir);
-
         if ((vma->vm_flags & acc_type) != acc_type)
                 goto bad_area;
 
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 6a15c968d214..15ca2255f438 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -74,7 +74,7 @@ src-wlib-$(CONFIG_8xx) += mpc8xx.c planetcore.c
 src-wlib-$(CONFIG_PPC_82xx) += pq2.c fsl-soc.c planetcore.c
 src-wlib-$(CONFIG_EMBEDDED6xx) += mv64x60.c mv64x60_i2c.c ugecon.c
 
-src-plat-y := of.c
+src-plat-y := of.c epapr.c
 src-plat-$(CONFIG_40x) += fixed-head.S ep405.c cuboot-hotfoot.c \
                                 treeboot-walnut.c cuboot-acadia.c \
                                 cuboot-kilauea.c simpleboot.c \
@@ -97,7 +97,7 @@ src-plat-$(CONFIG_EMBEDDED6xx) += cuboot-pq2.c cuboot-mpc7448hpc2.c \
                                         prpmc2800.c
 src-plat-$(CONFIG_AMIGAONE) += cuboot-amigaone.c
 src-plat-$(CONFIG_PPC_PS3) += ps3-head.S ps3-hvcall.S ps3.c
-src-plat-$(CONFIG_EPAPR_BOOT) += epapr.c
+src-plat-$(CONFIG_EPAPR_BOOT) += epapr.c epapr-wrapper.c
 
 src-wlib := $(sort $(src-wlib-y))
 src-plat := $(sort $(src-plat-y))
diff --git a/arch/powerpc/boot/epapr-wrapper.c b/arch/powerpc/boot/epapr-wrapper.c
new file mode 100644
index 000000000000..c10191006673
--- /dev/null
+++ b/arch/powerpc/boot/epapr-wrapper.c
@@ -0,0 +1,9 @@
+extern void epapr_platform_init(unsigned long r3, unsigned long r4,
+                                unsigned long r5, unsigned long r6,
+                                unsigned long r7);
+
+void platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+                   unsigned long r6, unsigned long r7)
+{
+        epapr_platform_init(r3, r4, r5, r6, r7);
+}
diff --git a/arch/powerpc/boot/epapr.c b/arch/powerpc/boot/epapr.c
index 06c1961bd124..02e91aa2194a 100644
--- a/arch/powerpc/boot/epapr.c
+++ b/arch/powerpc/boot/epapr.c
@@ -48,8 +48,8 @@ static void platform_fixups(void)
                        fdt_addr, fdt_totalsize((void *)fdt_addr), ima_size);
 }
 
-void platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
-                   unsigned long r6, unsigned long r7)
+void epapr_platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+                         unsigned long r6, unsigned long r7)
 {
         epapr_magic = r6;
         ima_size = r7;
diff --git a/arch/powerpc/boot/of.c b/arch/powerpc/boot/of.c
index 61d9899aa0d0..62e2f43ec1df 100644
--- a/arch/powerpc/boot/of.c
+++ b/arch/powerpc/boot/of.c
@@ -26,6 +26,9 @@
 
 static unsigned long claim_base;
 
+void epapr_platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+                         unsigned long r6, unsigned long r7);
+
 static void *of_try_claim(unsigned long size)
 {
         unsigned long addr = 0;
@@ -61,7 +64,7 @@ static void of_image_hdr(const void *hdr)
         }
 }
 
-void platform_init(unsigned long a1, unsigned long a2, void *promptr)
+static void of_platform_init(unsigned long a1, unsigned long a2, void *promptr)
 {
         platform_ops.image_hdr = of_image_hdr;
         platform_ops.malloc = of_try_claim;
@@ -81,3 +84,14 @@ void platform_init(unsigned long a1, unsigned long a2, void *promptr)
                 loader_info.initrd_size = a2;
         }
 }
+
+void platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+                   unsigned long r6, unsigned long r7)
+{
+        /* Detect OF vs. ePAPR boot */
+        if (r5)
+                of_platform_init(r3, r4, (void *)r5);
+        else
+                epapr_platform_init(r3, r4, r5, r6, r7);
+}
+
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index 6761c746048d..cd7af841ba05 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -148,18 +148,18 @@ make_space=y
 
 case "$platform" in
 pseries)
-    platformo=$object/of.o
+    platformo="$object/of.o $object/epapr.o"
     link_address='0x4000000'
     ;;
 maple)
-    platformo=$object/of.o
+    platformo="$object/of.o $object/epapr.o"
     link_address='0x400000'
     ;;
 pmac|chrp)
-    platformo=$object/of.o
+    platformo="$object/of.o $object/epapr.o"
     ;;
 coff)
-    platformo="$object/crt0.o $object/of.o"
+    platformo="$object/crt0.o $object/of.o $object/epapr.o"
     lds=$object/zImage.coff.lds
     link_address='0x500000'
     pie=
@@ -253,6 +253,7 @@ treeboot-iss4xx-mpic)
     platformo="$object/treeboot-iss4xx.o"
     ;;
 epapr)
+    platformo="$object/epapr.o $object/epapr-wrapper.o"
     link_address='0x20000000'
     pie=-pie
     ;;
diff --git a/arch/powerpc/include/asm/irq.h b/arch/powerpc/include/asm/irq.h
index 0e40843a1c6e..41f13cec8a8f 100644
--- a/arch/powerpc/include/asm/irq.h
+++ b/arch/powerpc/include/asm/irq.h
@@ -69,9 +69,9 @@ extern struct thread_info *softirq_ctx[NR_CPUS];
 
 extern void irq_ctx_init(void);
 extern void call_do_softirq(struct thread_info *tp);
-extern int call_handle_irq(int irq, void *p1,
-                           struct thread_info *tp, void *func);
+extern void call_do_irq(struct pt_regs *regs, struct thread_info *tp);
 extern void do_IRQ(struct pt_regs *regs);
+extern void __do_irq(struct pt_regs *regs);
 
 int irq_choose_cpu(const struct cpumask *mask);
 
diff --git a/arch/powerpc/include/asm/jump_label.h b/arch/powerpc/include/asm/jump_label.h
index ae098c438f00..f016bb699b5f 100644
--- a/arch/powerpc/include/asm/jump_label.h
+++ b/arch/powerpc/include/asm/jump_label.h
@@ -19,7 +19,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:\n\t"
+        asm_volatile_goto("1:\n\t"
                  "nop\n\t"
                  ".pushsection __jump_table,  \"aw\"\n\t"
                  JUMP_ENTRY_TYPE "1b, %l[l_yes], %c0\n\t"
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index e378cccfca55..ce4de5aed7b5 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -149,8 +149,6 @@ typedef struct {
 
 struct thread_struct {
         unsigned long   ksp;            /* Kernel stack pointer */
-        unsigned long   ksp_limit;      /* if ksp <= ksp_limit stack overflow */
-
 #ifdef CONFIG_PPC64
         unsigned long   ksp_vsid;
 #endif
@@ -162,6 +160,7 @@ struct thread_struct {
 #endif
 #ifdef CONFIG_PPC32
         void            *pgdir;         /* root of page-table tree */
+        unsigned long   ksp_limit;      /* if ksp <= ksp_limit stack overflow */
 #endif
 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
         /*
@@ -321,7 +320,6 @@ struct thread_struct {
 #else
 #define INIT_THREAD  { \
         .ksp = INIT_SP, \
-        .ksp_limit = INIT_SP_LIMIT, \
         .regs = (struct pt_regs *)INIT_SP - 1, /* XXX bogus, I think */ \
         .fs = KERNEL_DS, \
         .fpr = {{0}}, \
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index d8958be5f31a..502c7a4e73f7 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -80,10 +80,11 @@ int main(void)
         DEFINE(TASKTHREADPPR, offsetof(struct task_struct, thread.ppr));
 #else
         DEFINE(THREAD_INFO, offsetof(struct task_struct, stack));
+        DEFINE(THREAD_INFO_GAP, _ALIGN_UP(sizeof(struct thread_info), 16));
+        DEFINE(KSP_LIMIT, offsetof(struct thread_struct, ksp_limit));
 #endif /* CONFIG_PPC64 */
 
         DEFINE(KSP, offsetof(struct thread_struct, ksp));
-        DEFINE(KSP_LIMIT, offsetof(struct thread_struct, ksp_limit));
         DEFINE(PT_REGS, offsetof(struct thread_struct, regs));
 #ifdef CONFIG_BOOKE
         DEFINE(THREAD_NORMSAVES, offsetof(struct thread_struct, normsave[0]));
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 0adab06ce5c0..572bb5b95f35 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -661,7 +661,7 @@ struct iommu_table *iommu_init_table(struct iommu_table *tbl, int nid)
         /* number of bytes needed for the bitmap */
         sz = BITS_TO_LONGS(tbl->it_size) * sizeof(unsigned long);
 
-        page = alloc_pages_node(nid, GFP_ATOMIC, get_order(sz));
+        page = alloc_pages_node(nid, GFP_KERNEL, get_order(sz));
         if (!page)
                 panic("iommu_init_table: Can't allocate %ld bytes\n", sz);
         tbl->it_map = page_address(page);
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index c69440cef7af..c7cb8c232d2f 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -441,50 +441,6 @@ void migrate_irqs(void)
 }
 #endif
 
-static inline void handle_one_irq(unsigned int irq)
-{
-        struct thread_info *curtp, *irqtp;
-        unsigned long saved_sp_limit;
-        struct irq_desc *desc;
-
-        desc = irq_to_desc(irq);
-        if (!desc)
-                return;
-
-        /* Switch to the irq stack to handle this */
-        curtp = current_thread_info();
-        irqtp = hardirq_ctx[smp_processor_id()];
-
-        if (curtp == irqtp) {
-                /* We're already on the irq stack, just handle it */
-                desc->handle_irq(irq, desc);
-                return;
-        }
-
-        saved_sp_limit = current->thread.ksp_limit;
-
-        irqtp->task = curtp->task;
-        irqtp->flags = 0;
-
-        /* Copy the softirq bits in preempt_count so that the
-         * softirq checks work in the hardirq context. */
-        irqtp->preempt_count = (irqtp->preempt_count & ~SOFTIRQ_MASK) |
-                               (curtp->preempt_count & SOFTIRQ_MASK);
-
-        current->thread.ksp_limit = (unsigned long)irqtp +
-                _ALIGN_UP(sizeof(struct thread_info), 16);
-
-        call_handle_irq(irq, desc, irqtp, desc->handle_irq);
-        current->thread.ksp_limit = saved_sp_limit;
-        irqtp->task = NULL;
-
-        /* Set any flag that may have been set on the
-         * alternate stack
-         */
-        if (irqtp->flags)
-                set_bits(irqtp->flags, &curtp->flags);
-}
-
 static inline void check_stack_overflow(void)
 {
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
@@ -501,9 +457,9 @@ static inline void check_stack_overflow(void)
 #endif
 }
 
-void do_IRQ(struct pt_regs *regs)
+void __do_irq(struct pt_regs *regs)
 {
-        struct pt_regs *old_regs = set_irq_regs(regs);
+        struct irq_desc *desc;
         unsigned int irq;
 
         irq_enter();
@@ -519,18 +475,57 @@ void do_IRQ(struct pt_regs *regs)
          */
         irq = ppc_md.get_irq();
 
-        /* We can hard enable interrupts now */
+        /* We can hard enable interrupts now to allow perf interrupts */
         may_hard_irq_enable();
 
         /* And finally process it */
-        if (irq != NO_IRQ)
-                handle_one_irq(irq);
-        else
+        if (unlikely(irq == NO_IRQ))
                 __get_cpu_var(irq_stat).spurious_irqs++;
+        else {
+                desc = irq_to_desc(irq);
+                if (likely(desc))
+                        desc->handle_irq(irq, desc);
+        }
 
         trace_irq_exit(regs);
 
         irq_exit();
+}
+
+void do_IRQ(struct pt_regs *regs)
+{
+        struct pt_regs *old_regs = set_irq_regs(regs);
+        struct thread_info *curtp, *irqtp, *sirqtp;
+
+        /* Switch to the irq stack to handle this */
+        curtp = current_thread_info();
+        irqtp = hardirq_ctx[raw_smp_processor_id()];
+        sirqtp = softirq_ctx[raw_smp_processor_id()];
+
+        /* Already there ? */
+        if (unlikely(curtp == irqtp || curtp == sirqtp)) {
+                __do_irq(regs);
+                set_irq_regs(old_regs);
+                return;
+        }
+
+        /* Prepare the thread_info in the irq stack */
+        irqtp->task = curtp->task;
+        irqtp->flags = 0;
+
+        /* Copy the preempt_count so that the [soft]irq checks work. */
+        irqtp->preempt_count = curtp->preempt_count;
+
+        /* Switch stack and call */
+        call_do_irq(regs, irqtp);
+
+        /* Restore stack limit */
+        irqtp->task = NULL;
+
+        /* Copy back updates to the thread_info */
+        if (irqtp->flags)
+                set_bits(irqtp->flags, &curtp->flags);
+
         set_irq_regs(old_regs);
 }
 
@@ -592,28 +587,22 @@ void irq_ctx_init(void)
                 memset((void *)softirq_ctx[i], 0, THREAD_SIZE);
                 tp = softirq_ctx[i];
                 tp->cpu = i;
-                tp->preempt_count = 0;
 
                 memset((void *)hardirq_ctx[i], 0, THREAD_SIZE);
                 tp = hardirq_ctx[i];
                 tp->cpu = i;
-                tp->preempt_count = HARDIRQ_OFFSET;
         }
 }
 
 static inline void do_softirq_onstack(void)
 {
         struct thread_info *curtp, *irqtp;
-        unsigned long saved_sp_limit = current->thread.ksp_limit;
 
         curtp = current_thread_info();
         irqtp = softirq_ctx[smp_processor_id()];
         irqtp->task = curtp->task;
         irqtp->flags = 0;
-        current->thread.ksp_limit = (unsigned long)irqtp +
-                                    _ALIGN_UP(sizeof(struct thread_info), 16);
         call_do_softirq(irqtp);
-        current->thread.ksp_limit = saved_sp_limit;
         irqtp->task = NULL;
 
         /* Set any flag that may have been set on the
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index 777d999f563b..2b0ad9845363 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -36,26 +36,41 @@
 
         .text
 
+/*
+ * We store the saved ksp_limit in the unused part
+ * of the STACK_FRAME_OVERHEAD
+ */
 _GLOBAL(call_do_softirq)
         mflr    r0
         stw     r0,4(r1)
+        lwz     r10,THREAD+KSP_LIMIT(r2)
+        addi    r11,r3,THREAD_INFO_GAP
         stwu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r3)
         mr      r1,r3
+        stw     r10,8(r1)
+        stw     r11,THREAD+KSP_LIMIT(r2)
         bl      __do_softirq
+        lwz     r10,8(r1)
         lwz     r1,0(r1)
         lwz     r0,4(r1)
+        stw     r10,THREAD+KSP_LIMIT(r2)
         mtlr    r0
         blr
 
-_GLOBAL(call_handle_irq)
+_GLOBAL(call_do_irq)
         mflr    r0
         stw     r0,4(r1)
-        mtctr   r6
-        stwu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r5)
-        mr      r1,r5
-        bctrl
+        lwz     r10,THREAD+KSP_LIMIT(r2)
+        addi    r11,r3,THREAD_INFO_GAP
+        stwu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r4)
+        mr      r1,r4
+        stw     r10,8(r1)
+        stw     r11,THREAD+KSP_LIMIT(r2)
+        bl      __do_irq
+        lwz     r10,8(r1)
         lwz     r1,0(r1)
         lwz     r0,4(r1)
+        stw     r10,THREAD+KSP_LIMIT(r2)
         mtlr    r0
         blr
 
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index 971d7e78aff2..e59caf874d05 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -40,14 +40,12 @@ _GLOBAL(call_do_softirq)
         mtlr    r0
         blr
 
-_GLOBAL(call_handle_irq)
-        ld      r8,0(r6)
+_GLOBAL(call_do_irq)
         mflr    r0
         std     r0,16(r1)
-        mtctr   r8
-        stdu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r5)
-        mr      r1,r5
-        bctrl
+        stdu    r1,THREAD_SIZE-STACK_FRAME_OVERHEAD(r4)
+        mr      r1,r4
+        bl      .__do_irq
         ld      r1,0(r1)
         ld      r0,16(r1)
         mtlr    r0
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 6f428da53e20..96d2fdf3aa9e 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1000,9 +1000,10 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
         kregs = (struct pt_regs *) sp;
         sp -= STACK_FRAME_OVERHEAD;
         p->thread.ksp = sp;
+#ifdef CONFIG_PPC32
         p->thread.ksp_limit = (unsigned long)task_stack_page(p) +
                                 _ALIGN_UP(sizeof(struct thread_info), 16);
-
+#endif
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
         p->thread.ptrace_bps[0] = NULL;
 #endif
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 12e656ffe60e..5fe2842e8bab 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -196,6 +196,8 @@ static int __initdata mem_reserve_cnt;
 
 static cell_t __initdata regbuf[1024];
 
+static bool rtas_has_query_cpu_stopped;
+
 
 /*
  * Error results ... some OF calls will return "-1" on error, some
@@ -1574,6 +1576,11 @@ static void __init prom_instantiate_rtas(void)
         prom_setprop(rtas_node, "/rtas", "linux,rtas-entry",
                      &val, sizeof(val));
 
+        /* Check if it supports "query-cpu-stopped-state" */
+        if (prom_getprop(rtas_node, "query-cpu-stopped-state",
+                         &val, sizeof(val)) != PROM_ERROR)
+                rtas_has_query_cpu_stopped = true;
+
 #if defined(CONFIG_PPC_POWERNV) && defined(__BIG_ENDIAN__)
         /* PowerVN takeover hack */
         prom_rtas_data = base;
@@ -1815,6 +1822,18 @@ static void __init prom_hold_cpus(void)
                 = (void *) LOW_ADDR(__secondary_hold_acknowledge);
         unsigned long secondary_hold = LOW_ADDR(__secondary_hold);
 
+        /*
+         * On pseries, if RTAS supports "query-cpu-stopped-state",
+         * we skip this stage, the CPUs will be started by the
+         * kernel using RTAS.
+         */
+        if ((of_platform == PLATFORM_PSERIES ||
+             of_platform == PLATFORM_PSERIES_LPAR) &&
+            rtas_has_query_cpu_stopped) {
+                prom_printf("prom_hold_cpus: skipped\n");
+                return;
+        }
+
         prom_debug("prom_hold_cpus: start...\n");
         prom_debug("    1) spinloop       = 0x%x\n", (unsigned long)spinloop);
         prom_debug("    1) *spinloop      = 0x%x\n", *spinloop);
@@ -3011,6 +3030,8 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
          * On non-powermacs, put all CPUs in spin-loops.
          *
          * PowerMacs use a different mechanism to spin CPUs
+         *
+         * (This must be done after instanciating RTAS)
          */
         if (of_platform != PLATFORM_POWERMAC &&
             of_platform != PLATFORM_OPAL)
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 27a90b99ef67..b4e667663d9b 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -17,6 +17,7 @@
 #include <asm/machdep.h>
 #include <asm/smp.h>
 #include <asm/pmc.h>
+#include <asm/firmware.h>
 
 #include "cacheinfo.h"
 
@@ -179,15 +180,25 @@ SYSFS_PMCSETUP(spurr, SPRN_SPURR);
 SYSFS_PMCSETUP(dscr, SPRN_DSCR);
 SYSFS_PMCSETUP(pir, SPRN_PIR);
 
+/*
+  Lets only enable read for phyp resources and
+  enable write when needed with a separate function.
+  Lets be conservative and default to pseries.
+*/
 static DEVICE_ATTR(mmcra, 0600, show_mmcra, store_mmcra);
 static DEVICE_ATTR(spurr, 0400, show_spurr, NULL);
 static DEVICE_ATTR(dscr, 0600, show_dscr, store_dscr);
-static DEVICE_ATTR(purr, 0600, show_purr, store_purr);
+static DEVICE_ATTR(purr, 0400, show_purr, store_purr);
 static DEVICE_ATTR(pir, 0400, show_pir, NULL);
 
 unsigned long dscr_default = 0;
 EXPORT_SYMBOL(dscr_default);
 
+static void add_write_permission_dev_attr(struct device_attribute *attr)
+{
+        attr->attr.mode |= 0200;
+}
+
 static ssize_t show_dscr_default(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
@@ -394,8 +405,11 @@ static void register_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_MMCRA))
                 device_create_file(s, &dev_attr_mmcra);
 
-        if (cpu_has_feature(CPU_FTR_PURR))
+        if (cpu_has_feature(CPU_FTR_PURR)) {
+                if (!firmware_has_feature(FW_FEATURE_LPAR))
+                        add_write_permission_dev_attr(&dev_attr_purr);
                 device_create_file(s, &dev_attr_purr);
+        }
 
         if (cpu_has_feature(CPU_FTR_SPURR))
                 device_create_file(s, &dev_attr_spurr);
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index 7b60b9851469..cd809eaa8b5c 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -79,6 +79,11 @@ _GLOBAL(tm_abort)
         TABORT(R3)
         blr
 
+        .section        ".toc","aw"
+DSCR_DEFAULT:
+        .tc dscr_default[TC],dscr_default
+
+        .section        ".text"
 
 /* void tm_reclaim(struct thread_struct *thread,
  *                 unsigned long orig_msr,
@@ -123,6 +128,7 @@ _GLOBAL(tm_reclaim)
         mr      r15, r14
         ori     r15, r15, MSR_FP
         li      r16, MSR_RI
+        ori     r16, r16, MSR_EE /* IRQs hard off */
         andc    r15, r15, r16
         oris    r15, r15, MSR_VEC@h
 #ifdef CONFIG_VSX
@@ -187,11 +193,18 @@ dont_backup_fp:
         std     r1, PACATMSCRATCH(r13)
         ld      r1, PACAR1(r13)
 
+        /* Store the PPR in r11 and reset to decent value */
+        std     r11, GPR11(r1)                  /* Temporary stash */
+        mfspr   r11, SPRN_PPR
+        HMT_MEDIUM
+
         /* Now get some more GPRS free */
         std     r7, GPR7(r1)                    /* Temporary stash */
         std     r12, GPR12(r1)                  /* ''   ''    ''   */
         ld      r12, STACK_PARAM(0)(r1)         /* Param 0, thread_struct * */
 
+        std     r11, THREAD_TM_PPR(r12)         /* Store PPR and free r11 */
+
         addi    r7, r12, PT_CKPT_REGS           /* Thread's ckpt_regs */
 
         /* Make r7 look like an exception frame so that we
@@ -203,15 +216,19 @@ dont_backup_fp:
         SAVE_GPR(0, r7)                         /* user r0 */
         SAVE_GPR(2, r7)                 /* user r2 */
         SAVE_4GPRS(3, r7)                       /* user r3-r6 */
-        SAVE_4GPRS(8, r7)                       /* user r8-r11 */
+        SAVE_GPR(8, r7)                         /* user r8 */
+        SAVE_GPR(9, r7)                         /* user r9 */
+        SAVE_GPR(10, r7)                        /* user r10 */
         ld      r3, PACATMSCRATCH(r13)          /* user r1 */
         ld      r4, GPR7(r1)                    /* user r7 */
-        ld      r5, GPR12(r1)                   /* user r12 */
-        GET_SCRATCH0(6)                         /* user r13 */
+        ld      r5, GPR11(r1)                   /* user r11 */
+        ld      r6, GPR12(r1)                   /* user r12 */
+        GET_SCRATCH0(8)                         /* user r13 */
         std     r3, GPR1(r7)
         std     r4, GPR7(r7)
-        std     r5, GPR12(r7)
-        std     r6, GPR13(r7)
+        std     r5, GPR11(r7)
+        std     r6, GPR12(r7)
+        std     r8, GPR13(r7)
 
         SAVE_NVGPRS(r7)                         /* user r14-r31 */
 
@@ -234,14 +251,12 @@ dont_backup_fp:
         std     r6, _XER(r7)
 
 
-        /* ******************** TAR, PPR, DSCR ********** */
+        /* ******************** TAR, DSCR ********** */
         mfspr   r3, SPRN_TAR
-        mfspr   r4, SPRN_PPR
-        mfspr   r5, SPRN_DSCR
+        mfspr   r4, SPRN_DSCR
 
         std     r3, THREAD_TM_TAR(r12)
-        std     r4, THREAD_TM_PPR(r12)
-        std     r5, THREAD_TM_DSCR(r12)
+        std     r4, THREAD_TM_DSCR(r12)
 
         /* MSR and flags:  We don't change CRs, and we don't need to alter
          * MSR.
@@ -258,7 +273,7 @@ dont_backup_fp:
         std     r3, THREAD_TM_TFHAR(r12)
         std     r4, THREAD_TM_TFIAR(r12)
 
-        /* AMR and PPR are checkpointed too, but are unsupported by Linux. */
+        /* AMR is checkpointed too, but is unsupported by Linux. */
 
         /* Restore original MSR/IRQ state & clear TM mode */
         ld      r14, TM_FRAME_L0(r1)            /* Orig MSR */
@@ -274,6 +289,12 @@ dont_backup_fp:
         mtcr    r4
         mtlr    r0
         ld      r2, 40(r1)
+
+        /* Load system default DSCR */
+        ld      r4, DSCR_DEFAULT@toc(r2)
+        ld      r0, 0(r4)
+        mtspr   SPRN_DSCR, r0
+
         blr
 
 
@@ -358,25 +379,24 @@ dont_restore_fp:
 
 restore_gprs:
 
-        /* ******************** TAR, PPR, DSCR ********** */
-        ld      r4, THREAD_TM_TAR(r3)
-        ld      r5, THREAD_TM_PPR(r3)
-        ld      r6, THREAD_TM_DSCR(r3)
+        /* ******************** CR,LR,CCR,MSR ********** */
+        ld      r4, _CTR(r7)
+        ld      r5, _LINK(r7)
+        ld      r6, _CCR(r7)
+        ld      r8, _XER(r7)
 
-        mtspr   SPRN_TAR,       r4
-        mtspr   SPRN_PPR,       r5
-        mtspr   SPRN_DSCR,      r6
+        mtctr   r4
+        mtlr    r5
+        mtcr    r6
+        mtxer   r8
 
-        /* ******************** CR,LR,CCR,MSR ********** */
-        ld      r3, _CTR(r7)
-        ld      r4, _LINK(r7)
-        ld      r5, _CCR(r7)
-        ld      r6, _XER(r7)
+        /* ******************** TAR ******************** */
+        ld      r4, THREAD_TM_TAR(r3)
+        mtspr   SPRN_TAR,       r4
 
-        mtctr   r3
-        mtlr    r4
-        mtcr    r5
-        mtxer   r6
+        /* Load up the PPR and DSCR in GPRs only at this stage */
+        ld      r5, THREAD_TM_DSCR(r3)
+        ld      r6, THREAD_TM_PPR(r3)
 
         /* Clear the MSR RI since we are about to change R1.  EE is already off
          */
@@ -384,19 +404,26 @@ restore_gprs:
         mtmsrd  r4, 1
 
         REST_4GPRS(0, r7)                       /* GPR0-3 */
-        REST_GPR(4, r7)                         /* GPR4-6 */
-        REST_GPR(5, r7)
-        REST_GPR(6, r7)
+        REST_GPR(4, r7)                         /* GPR4 */
         REST_4GPRS(8, r7)                       /* GPR8-11 */
         REST_2GPRS(12, r7)                      /* GPR12-13 */
 
         REST_NVGPRS(r7)                         /* GPR14-31 */
 
-        ld      r7, GPR7(r7)                    /* GPR7 */
+        /* Load up PPR and DSCR here so we don't run with user values for long
+         */
+        mtspr   SPRN_DSCR, r5
+        mtspr   SPRN_PPR, r6
+
+        REST_GPR(5, r7)                         /* GPR5-7 */
+        REST_GPR(6, r7)
+        ld      r7, GPR7(r7)
 
         /* Commit register state as checkpointed state: */
         TRECHKPT
 
+        HMT_MEDIUM
+
         /* Our transactional state has now changed.
          *
          * Now just get out of here.  Transactional (current) state will be
@@ -419,6 +446,12 @@ restore_gprs:
         mtcr    r4
         mtlr    r0
         ld      r2, 40(r1)
+
+        /* Load system default DSCR */
+        ld      r4, DSCR_DEFAULT@toc(r2)
+        ld      r0, 0(r4)
+        mtspr   SPRN_DSCR, r0
+
         blr
 
         /* ****************************************************************** */
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index 78a350670de3..d38cc08b16c7 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -1530,11 +1530,15 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
         const char *cp;
 
         dn = dev->of_node;
-        if (!dn)
-                return -ENODEV;
+        if (!dn) {
+                strcat(buf, "\n");
+                return strlen(buf);
+        }
         cp = of_get_property(dn, "compatible", NULL);
-        if (!cp)
-                return -ENODEV;
+        if (!cp) {
+                strcat(buf, "\n");
+                return strlen(buf);
+        }
 
         return sprintf(buf, "vio:T%sS%s\n", vio_dev->type, cp);
 }
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 294b7af28cdd..c71103b8a748 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1066,7 +1066,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
 BEGIN_FTR_SECTION
         mfspr   r8, SPRN_DSCR
         ld      r7, HSTATE_DSCR(r13)
-        std     r8, VCPU_DSCR(r7)
+        std     r8, VCPU_DSCR(r9)
         mtspr   SPRN_DSCR, r7
 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206)
 
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index 1c6a9d729df4..c65593abae8e 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -332,6 +332,13 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
         unsigned long hva;
         int pfnmap = 0;
         int tsize = BOOK3E_PAGESZ_4K;
+        int ret = 0;
+        unsigned long mmu_seq;
+        struct kvm *kvm = vcpu_e500->vcpu.kvm;
+
+        /* used to check for invalidations in progress */
+        mmu_seq = kvm->mmu_notifier_seq;
+        smp_rmb();
 
         /*
          * Translate guest physical to true physical, acquiring
@@ -449,6 +456,12 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
                 gvaddr &= ~((tsize_pages << PAGE_SHIFT) - 1);
         }
 
+        spin_lock(&kvm->mmu_lock);
+        if (mmu_notifier_retry(kvm, mmu_seq)) {
+                ret = -EAGAIN;
+                goto out;
+        }
+
         kvmppc_e500_ref_setup(ref, gtlbe, pfn);
 
         kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize,
@@ -457,10 +470,13 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
         /* Clear i-cache for new pages */
         kvmppc_mmu_flush_icache(pfn);
 
+out:
+        spin_unlock(&kvm->mmu_lock);
+
         /* Drop refcount on page, so that mmu notifiers can clear it */
         kvm_release_pfn_clean(pfn);
 
-        return 0;
+        return ret;
 }
 
 /* XXX only map the one-one case, for now use TLB0 */
diff --git a/arch/powerpc/lib/checksum_64.S b/arch/powerpc/lib/checksum_64.S
index 167f72555d60..57a072065057 100644
--- a/arch/powerpc/lib/checksum_64.S
+++ b/arch/powerpc/lib/checksum_64.S
@@ -226,19 +226,35 @@ _GLOBAL(csum_partial)
         blr
 
 
-        .macro source
+        .macro srcnr
 100:
         .section __ex_table,"a"
         .align 3
-        .llong 100b,.Lsrc_error
+        .llong 100b,.Lsrc_error_nr
         .previous
         .endm
 
-        .macro dest
+        .macro source
+150:
+        .section __ex_table,"a"
+        .align 3
+        .llong 150b,.Lsrc_error
+        .previous
+        .endm
+
+        .macro dstnr
 200:
         .section __ex_table,"a"
         .align 3
-        .llong 200b,.Ldest_error
+        .llong 200b,.Ldest_error_nr
+        .previous
+        .endm
+
+        .macro dest
+250:
+        .section __ex_table,"a"
+        .align 3
+        .llong 250b,.Ldest_error
         .previous
         .endm
 
@@ -269,16 +285,16 @@ _GLOBAL(csum_partial_copy_generic)
         rldicl. r6,r3,64-1,64-2         /* r6 = (r3 & 0x3) >> 1 */
         beq     .Lcopy_aligned
 
-        li      r7,4
-        sub     r6,r7,r6
+        li      r9,4
+        sub     r6,r9,r6
         mtctr   r6
 
 1:
-source; lhz     r6,0(r3)                /* align to doubleword */
+srcnr;  lhz     r6,0(r3)                /* align to doubleword */
         subi    r5,r5,2
         addi    r3,r3,2
         adde    r0,r0,r6
-dest;   sth     r6,0(r4)
+dstnr;  sth     r6,0(r4)
         addi    r4,r4,2
         bdnz    1b
 
@@ -392,10 +408,10 @@ dest;	std	r16,56(r4)
 
         mtctr   r6
 3:
-source; ld      r6,0(r3)
+srcnr;  ld      r6,0(r3)
         addi    r3,r3,8
         adde    r0,r0,r6
-dest;   std     r6,0(r4)
+dstnr;  std     r6,0(r4)
         addi    r4,r4,8
         bdnz    3b
 
@@ -405,10 +421,10 @@ dest;	std	r6,0(r4)
         srdi.   r6,r5,2
         beq     .Lcopy_tail_halfword
 
-source; lwz     r6,0(r3)
+srcnr;  lwz     r6,0(r3)
         addi    r3,r3,4
         adde    r0,r0,r6
-dest;   stw     r6,0(r4)
+dstnr;  stw     r6,0(r4)
         addi    r4,r4,4
         subi    r5,r5,4
 
@@ -416,10 +432,10 @@ dest;	stw	r6,0(r4)
         srdi.   r6,r5,1
         beq     .Lcopy_tail_byte
 
-source; lhz     r6,0(r3)
+srcnr;  lhz     r6,0(r3)
         addi    r3,r3,2
         adde    r0,r0,r6
-dest;   sth     r6,0(r4)
+dstnr;  sth     r6,0(r4)
         addi    r4,r4,2
         subi    r5,r5,2
 
@@ -427,10 +443,10 @@ dest;	sth	r6,0(r4)
         andi.   r6,r5,1
         beq     .Lcopy_finish
 
-source; lbz     r6,0(r3)
+srcnr;  lbz     r6,0(r3)
         sldi    r9,r6,8                 /* Pad the byte out to 16 bits */
         adde    r0,r0,r9
-dest;   stb     r6,0(r4)
+dstnr;  stb     r6,0(r4)
 
 .Lcopy_finish:
         addze   r0,r0                   /* add in final carry */
@@ -440,6 +456,11 @@ dest;	stb	r6,0(r4)
         blr
 
 .Lsrc_error:
+        ld      r14,STK_REG(R14)(r1)
+        ld      r15,STK_REG(R15)(r1)
+        ld      r16,STK_REG(R16)(r1)
+        addi    r1,r1,STACKFRAMESIZE
+.Lsrc_error_nr:
         cmpdi   0,r7,0
         beqlr
         li      r6,-EFAULT
@@ -447,6 +468,11 @@ dest;	stb	r6,0(r4)
         blr
 
 .Ldest_error:
+        ld      r14,STK_REG(R14)(r1)
+        ld      r15,STK_REG(R15)(r1)
+        ld      r16,STK_REG(R16)(r1)
+        addi    r1,r1,STACKFRAMESIZE
+.Ldest_error_nr:
         cmpdi   0,r8,0
         beqlr
         li      r6,-EFAULT
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index a7ee978fb860..b1faa1593c90 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1505,6 +1505,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                  */
                 if ((ra == 1) && !(regs->msr & MSR_PR) \
                         && (val3 >= (regs->gpr[1] - STACK_INT_FRAME_SIZE))) {
+#ifdef CONFIG_PPC32
                         /*
                          * Check if we will touch kernel sack overflow
                          */
@@ -1513,7 +1514,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                                 err = -EINVAL;
                                 break;
                         }
-
+#endif /* CONFIG_PPC32 */
                         /*
                          * Check if we already set since that means we'll
                          * lose the previous value.
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index d0cd9e4c6837..8ed035d2edb5 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -300,5 +300,9 @@ void vmemmap_free(unsigned long start, unsigned long end)
 {
 }
 
+void register_page_bootmem_memmap(unsigned long section_nr,
+                                  struct page *start_page, unsigned long size)
+{
+}
 #endif /* CONFIG_SPARSEMEM_VMEMMAP */
 
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 1cf9c5b67f24..3fa93dc7fe75 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -297,12 +297,21 @@ void __init paging_init(void)
 }
 #endif /* ! CONFIG_NEED_MULTIPLE_NODES */
 
+static void __init register_page_bootmem_info(void)
+{
+        int i;
+
+        for_each_online_node(i)
+                register_page_bootmem_info_node(NODE_DATA(i));
+}
+
 void __init mem_init(void)
 {
 #ifdef CONFIG_SWIOTLB
         swiotlb_init(0);
 #endif
 
+        register_page_bootmem_info();
         high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
         set_max_mapnr(max_pfn);
         free_all_bootmem();
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index bf56e33f8257..2345bdb4d917 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -691,4 +691,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter)
                 module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/powerpc/perf/power8-pmu.c b/arch/powerpc/perf/power8-pmu.c
index 2ee4a707f0df..a3f7abd2f13f 100644
--- a/arch/powerpc/perf/power8-pmu.c
+++ b/arch/powerpc/perf/power8-pmu.c
@@ -199,6 +199,7 @@
 #define MMCR1_UNIT_SHIFT(pmc)           (60 - (4 * ((pmc) - 1)))
 #define MMCR1_COMBINE_SHIFT(pmc)        (35 - ((pmc) - 1))
 #define MMCR1_PMCSEL_SHIFT(pmc)         (24 - (((pmc) - 1)) * 8)
+#define MMCR1_FAB_SHIFT                 36
 #define MMCR1_DC_QUAL_SHIFT             47
 #define MMCR1_IC_QUAL_SHIFT             46
 
@@ -388,8 +389,8 @@ static int power8_compute_mmcr(u64 event[], int n_ev,
                  * the threshold bits are used for the match value.
                  */
                 if (event_is_fab_match(event[i])) {
-                        mmcr1 |= (event[i] >> EVENT_THR_CTL_SHIFT) &
-                                  EVENT_THR_CTL_MASK;
+                        mmcr1 |= ((event[i] >> EVENT_THR_CTL_SHIFT) &
+                                  EVENT_THR_CTL_MASK) << MMCR1_FAB_SHIFT;
                 } else {
                         val = (event[i] >> EVENT_THR_CTL_SHIFT) & EVENT_THR_CTL_MASK;
                         mmcra |= val << MMCRA_THR_CTL_SHIFT;
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 1c1771a40250..24f58cb0a543 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -233,18 +233,24 @@ static void __init smp_init_pseries(void)
 
         alloc_bootmem_cpumask_var(&of_spin_mask);
 
-        /* Mark threads which are still spinning in hold loops. */
-        if (cpu_has_feature(CPU_FTR_SMT)) {
-                for_each_present_cpu(i) { 
-                        if (cpu_thread_in_core(i) == 0)
-                                cpumask_set_cpu(i, of_spin_mask);
-                }
-        } else {
-                cpumask_copy(of_spin_mask, cpu_present_mask);
+        /*
+         * Mark threads which are still spinning in hold loops
+         *
+         * We know prom_init will not have started them if RTAS supports
+         * query-cpu-stopped-state.
+         */
+        if (rtas_token("query-cpu-stopped-state") == RTAS_UNKNOWN_SERVICE) {
+                if (cpu_has_feature(CPU_FTR_SMT)) {
+                        for_each_present_cpu(i) {
+                                if (cpu_thread_in_core(i) == 0)
+                                        cpumask_set_cpu(i, of_spin_mask);
+                        }
+                } else
+                        cpumask_copy(of_spin_mask, cpu_present_mask);
+
+                cpumask_clear_cpu(boot_cpuid, of_spin_mask);
         }
 
-        cpumask_clear_cpu(boot_cpuid, of_spin_mask);
-
         /* Non-lpar has additional take/give timebase */
         if (rtas_token("freeze-time-base") != RTAS_UNKNOWN_SERVICE) {
                 smp_ops->give_timebase = rtas_give_timebase;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index dcc6ac2d8026..7143793859fa 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -93,6 +93,7 @@ config S390
         select ARCH_INLINE_WRITE_UNLOCK_IRQ
         select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
         select ARCH_SAVE_PAGE_KEYS if HIBERNATION
+        select ARCH_USE_CMPXCHG_LOCKREF
         select ARCH_WANT_IPC_PARSE_VERSION
         select BUILDTIME_EXTABLE_SORT
         select CLONE_BACKWARDS2
@@ -102,7 +103,6 @@ config S390
         select GENERIC_TIME_VSYSCALL_OLD
         select HAVE_ALIGNED_STRUCT_PAGE if SLUB
         select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
-        select HAVE_ARCH_MUTEX_CPU_RELAX
         select HAVE_ARCH_SECCOMP_FILTER
         select HAVE_ARCH_TRACEHOOK
         select HAVE_ARCH_TRANSPARENT_HUGEPAGE if 64BIT
diff --git a/arch/s390/include/asm/jump_label.h b/arch/s390/include/asm/jump_label.h
index 6c32190dc73e..346b1c85ffb4 100644
--- a/arch/s390/include/asm/jump_label.h
+++ b/arch/s390/include/asm/jump_label.h
@@ -15,7 +15,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("0:    brcl 0,0\n"
+        asm_volatile_goto("0:   brcl 0,0\n"
                 ".pushsection __jump_table, \"aw\"\n"
                 ASM_ALIGN "\n"
                 ASM_PTR " 0b, %l[label], %0\n"
diff --git a/arch/s390/include/asm/mutex.h b/arch/s390/include/asm/mutex.h
index 688271f5f2e4..458c1f7fbc18 100644
--- a/arch/s390/include/asm/mutex.h
+++ b/arch/s390/include/asm/mutex.h
@@ -7,5 +7,3 @@
  */
 
 #include <asm-generic/mutex-dec.h>
-
-#define arch_mutex_cpu_relax()  barrier()
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 9b60a36c348d..2204400d0bd5 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -748,7 +748,9 @@ static inline void pgste_set_key(pte_t *ptep, pgste_t pgste, pte_t entry)
 
 static inline void pgste_set_pte(pte_t *ptep, pte_t entry)
 {
-        if (!MACHINE_HAS_ESOP && (pte_val(entry) & _PAGE_WRITE)) {
+        if (!MACHINE_HAS_ESOP &&
+            (pte_val(entry) & _PAGE_PRESENT) &&
+            (pte_val(entry) & _PAGE_WRITE)) {
                 /*
                  * Without enhanced suppression-on-protection force
                  * the dirty bit on for all writable ptes.
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 0eb37505cab1..ca7821f07260 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -198,6 +198,8 @@ static inline void cpu_relax(void)
         barrier();
 }
 
+#define arch_mutex_cpu_relax()  barrier()
+
 static inline void psw_set_key(unsigned int key)
 {
         asm volatile("spka 0(%0)" : : "d" (key));
diff --git a/arch/s390/include/asm/spinlock.h b/arch/s390/include/asm/spinlock.h
index 701fe8c59e1f..83e5d216105e 100644
--- a/arch/s390/include/asm/spinlock.h
+++ b/arch/s390/include/asm/spinlock.h
@@ -44,6 +44,11 @@ extern void arch_spin_lock_wait_flags(arch_spinlock_t *, unsigned long flags);
 extern int arch_spin_trylock_retry(arch_spinlock_t *);
 extern void arch_spin_relax(arch_spinlock_t *lock);
 
+static inline int arch_spin_value_unlocked(arch_spinlock_t lock)
+{
+        return lock.owner_cpu == 0;
+}
+
 static inline void arch_spin_lock(arch_spinlock_t *lp)
 {
         int old;
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 8ad8af915032..819b94d22720 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -71,30 +71,30 @@ static inline void local_tick_enable(unsigned long long comp)
 
 typedef unsigned long long cycles_t;
 
-static inline unsigned long long get_tod_clock(void)
-{
-        unsigned long long clk;
-
-#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
-        asm volatile(".insn s,0xb27c0000,%0" : "=Q" (clk) : : "cc");
-#else
-        asm volatile("stck %0" : "=Q" (clk) : : "cc");
-#endif
-        return clk;
-}
-
 static inline void get_tod_clock_ext(char *clk)
 {
         asm volatile("stcke %0" : "=Q" (*clk) : : "cc");
 }
 
-static inline unsigned long long get_tod_clock_xt(void)
+static inline unsigned long long get_tod_clock(void)
 {
         unsigned char clk[16];
         get_tod_clock_ext(clk);
         return *((unsigned long long *)&clk[1]);
 }
 
+static inline unsigned long long get_tod_clock_fast(void)
+{
+#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
+        unsigned long long clk;
+
+        asm volatile("stckf %0" : "=Q" (clk) : : "cc");
+        return clk;
+#else
+        return get_tod_clock();
+#endif
+}
+
 static inline cycles_t get_cycles(void)
 {
         return (cycles_t) get_tod_clock() >> 2;
@@ -125,7 +125,7 @@ extern u64 sched_clock_base_cc;
  */
 static inline unsigned long long get_tod_clock_monotonic(void)
 {
-        return get_tod_clock_xt() - sched_clock_base_cc;
+        return get_tod_clock() - sched_clock_base_cc;
 }
 
 /**
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 1389b637dae5..adaa9e9478d8 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -99,7 +99,7 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
                         break;
                 }
         }
-        return err;
+        return err ? -EFAULT : 0;
 }
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
@@ -148,7 +148,7 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
                         break;
                 }
         }
-        return err;
+        return err ? -EFAULT : 0;
 }
 
 static int save_sigregs32(struct pt_regs *regs, _sigregs32 __user *sregs)
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index c84f33d51f7b..7dd21720e5b0 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -40,28 +40,26 @@ static inline void *load_real_addr(void *addr)
 }
 
 /*
- * Copy up to one page to vmalloc or real memory
+ * Copy real to virtual or real memory
  */
-static ssize_t copy_page_real(void *buf, void *src, size_t csize)
+static int copy_from_realmem(void *dest, void *src, size_t count)
 {
-        size_t size;
+        unsigned long size;
+        int rc;
 
-        if (is_vmalloc_addr(buf)) {
-                BUG_ON(csize >= PAGE_SIZE);
-                /* If buf is not page aligned, copy first part */
-                size = min(roundup(__pa(buf), PAGE_SIZE) - __pa(buf), csize);
-                if (size) {
-                        if (memcpy_real(load_real_addr(buf), src, size))
-                                return -EFAULT;
-                        buf += size;
-                        src += size;
-                }
-                /* Copy second part */
-                size = csize - size;
-                return (size) ? memcpy_real(load_real_addr(buf), src, size) : 0;
-        } else {
-                return memcpy_real(buf, src, csize);
-        }
+        if (!count)
+                return 0;
+        if (!is_vmalloc_or_module_addr(dest))
+                return memcpy_real(dest, src, count);
+        do {
+                size = min(count, PAGE_SIZE - (__pa(dest) & ~PAGE_MASK));
+                if (memcpy_real(load_real_addr(dest), src, size))
+                        return -EFAULT;
+                count -= size;
+                dest += size;
+                src += size;
+        } while (count);
+        return 0;
 }
 
 /*
@@ -114,7 +112,7 @@ static ssize_t copy_oldmem_page_kdump(char *buf, size_t csize,
                 rc = copy_to_user_real((void __force __user *) buf,
                                        (void *) src, csize);
         else
-                rc = copy_page_real(buf, (void *) src, csize);
+                rc = copy_from_realmem(buf, (void *) src, csize);
         return (rc == 0) ? rc : csize;
 }
 
@@ -210,7 +208,7 @@ int copy_from_oldmem(void *dest, void *src, size_t count)
         if (OLDMEM_BASE) {
                 if ((unsigned long) src < OLDMEM_SIZE) {
                         copied = min(count, OLDMEM_SIZE - (unsigned long) src);
-                        rc = memcpy_real(dest, src + OLDMEM_BASE, copied);
+                        rc = copy_from_realmem(dest, src + OLDMEM_BASE, copied);
                         if (rc)
                                 return rc;
                 }
@@ -223,7 +221,7 @@ int copy_from_oldmem(void *dest, void *src, size_t count)
                                 return rc;
                 }
         }
-        return memcpy_real(dest + copied, src + copied, count - copied);
+        return copy_from_realmem(dest + copied, src + copied, count - copied);
 }
 
 /*
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index f1279dc2e1bc..17d62fe5d7b7 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -867,7 +867,7 @@ static inline void
 debug_finish_entry(debug_info_t * id, debug_entry_t* active, int level,
                         int exception)
 {
-        active->id.stck = get_tod_clock();
+        active->id.stck = get_tod_clock_fast();
         active->id.fields.cpuid = smp_processor_id();
         active->caller = __builtin_return_address(0);
         active->id.fields.exception = exception;
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index cc30d1fb000c..0dc2b6d0a1ec 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -266,6 +266,7 @@ sysc_sigpending:
         tm      __TI_flags+3(%r12),_TIF_SYSCALL
         jno     sysc_return
         lm      %r2,%r7,__PT_R2(%r11)   # load svc arguments
+        l       %r10,__TI_sysc_table(%r12)      # 31 bit system call table
         xr      %r8,%r8                 # svc 0 returns -ENOSYS
         clc     __PT_INT_CODE+2(2,%r11),BASED(.Lnr_syscalls+2)
         jnl     sysc_nr_ok              # invalid svc number -> do svc 0
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 2b2188b97c6a..e5b43c97a834 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -297,6 +297,7 @@ sysc_sigpending:
         tm      __TI_flags+7(%r12),_TIF_SYSCALL
         jno     sysc_return
         lmg     %r2,%r7,__PT_R2(%r11)   # load svc arguments
+        lg      %r10,__TI_sysc_table(%r12)      # address of system call table
         lghi    %r8,0                   # svc 0 returns -ENOSYS
         llgh    %r1,__PT_INT_CODE+2(%r11)       # load new svc number
         cghi    %r1,NR_syscalls
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 0ce9fb245034..d86e64eddb42 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -67,6 +67,11 @@ static int __kprobes is_prohibited_opcode(kprobe_opcode_t *insn)
         case 0xac:      /* stnsm */
         case 0xad:      /* stosm */
                 return -EINVAL;
+        case 0xc6:
+                switch (insn[0] & 0x0f) {
+                case 0x00: /* exrl   */
+                        return -EINVAL;
+                }
         }
         switch (insn[0]) {
         case 0x0101:    /* pr    */
@@ -180,7 +185,6 @@ static int __kprobes is_insn_relative_long(kprobe_opcode_t *insn)
                 break;
         case 0xc6:
                 switch (insn[0] & 0x0f) {
-                case 0x00: /* exrl   */
                 case 0x02: /* pfdrl  */
                 case 0x04: /* cghrl  */
                 case 0x05: /* chrl   */
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 7f35cb33e510..7f1f7ac5cf7f 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -385,7 +385,7 @@ static int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu)
         }
 
         if ((!rc) && (vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch)) {
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch)) {
                 if ((!psw_extint_disabled(vcpu)) &&
                         (vcpu->arch.sie_block->gcr[0] & 0x800ul))
                         rc = 1;
@@ -425,7 +425,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
                 goto no_timer;
         }
 
-        now = get_tod_clock() + vcpu->arch.sie_block->epoch;
+        now = get_tod_clock_fast() + vcpu->arch.sie_block->epoch;
         if (vcpu->arch.sie_block->ckc < now) {
                 __unset_cpu_idle(vcpu);
                 return 0;
@@ -515,7 +515,7 @@ void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
         }
 
         if ((vcpu->arch.sie_block->ckc <
-                get_tod_clock() + vcpu->arch.sie_block->epoch))
+                get_tod_clock_fast() + vcpu->arch.sie_block->epoch))
                 __try_deliver_ckc_interrupt(vcpu);
 
         if (atomic_read(&fi->active)) {
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index 57c87d7d7ede..a9f3d0042d58 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -44,7 +44,7 @@ static void __udelay_disabled(unsigned long long usecs)
         do {
                 set_clock_comparator(end);
                 vtime_stop_cpu();
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
         lockdep_on();
         __ctl_load(cr0, 0, 0);
         __ctl_load(cr6, 6, 6);
@@ -55,7 +55,7 @@ static void __udelay_enabled(unsigned long long usecs)
 {
         u64 clock_saved, end;
 
-        end = get_tod_clock() + (usecs << 12);
+        end = get_tod_clock_fast() + (usecs << 12);
         do {
                 clock_saved = 0;
                 if (end < S390_lowcore.clock_comparator) {
@@ -65,7 +65,7 @@ static void __udelay_enabled(unsigned long long usecs)
                 vtime_stop_cpu();
                 if (clock_saved)
                         local_tick_enable(clock_saved);
-        } while (get_tod_clock() < end);
+        } while (get_tod_clock_fast() < end);
 }
 
 /*
@@ -109,8 +109,8 @@ void udelay_simple(unsigned long long usecs)
 {
         u64 end;
 
-        end = get_tod_clock() + (usecs << 12);
-        while (get_tod_clock() < end)
+        end = get_tod_clock_fast() + (usecs << 12);
+        while (get_tod_clock_fast() < end)
                 cpu_relax();
 }
 
@@ -120,10 +120,10 @@ void __ndelay(unsigned long long nsecs)
 
         nsecs <<= 9;
         do_div(nsecs, 125);
-        end = get_tod_clock() + nsecs;
+        end = get_tod_clock_fast() + nsecs;
         if (nsecs & ~0xfffUL)
                 __udelay(nsecs >> 12);
-        while (get_tod_clock() < end)
+        while (get_tod_clock_fast() < end)
                 barrier();
 }
 EXPORT_SYMBOL(__ndelay);
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 709239285869..a5df511e27a2 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -881,7 +881,9 @@ void bpf_jit_free(struct sk_filter *fp)
         struct bpf_binary_header *header = (void *)addr;
 
         if (fp->bpf_func == sk_run_filter)
-                return;
+                goto free_filter;
         set_memory_rw(addr, header->pages);
         module_free(NULL, header);
+free_filter:
+        kfree(fp);
 }
diff --git a/arch/score/Kconfig b/arch/score/Kconfig
index a1be70db75fe..305f7ee1f382 100644
--- a/arch/score/Kconfig
+++ b/arch/score/Kconfig
@@ -2,6 +2,7 @@ menu "Machine selection"
 
 config SCORE
        def_bool y
+       select HAVE_GENERIC_HARDIRQS
        select GENERIC_IRQ_SHOW
        select GENERIC_IOMAP
        select GENERIC_ATOMIC64
@@ -110,3 +111,6 @@ source "security/Kconfig"
 source "crypto/Kconfig"
 
 source "lib/Kconfig"
+
+config NO_IOMEM
+       def_bool y
diff --git a/arch/score/Makefile b/arch/score/Makefile
index 974aefe86123..9e3e060290e0 100644
--- a/arch/score/Makefile
+++ b/arch/score/Makefile
@@ -20,8 +20,8 @@ cflags-y += -G0 -pipe -mel -mnhwloop -D__SCOREEL__ \
 #
 KBUILD_AFLAGS += $(cflags-y)
 KBUILD_CFLAGS += $(cflags-y)
-KBUILD_AFLAGS_MODULE += -mlong-calls
-KBUILD_CFLAGS_MODULE += -mlong-calls
+KBUILD_AFLAGS_MODULE +=
+KBUILD_CFLAGS_MODULE +=
 LDFLAGS += --oformat elf32-littlescore
 LDFLAGS_vmlinux += -G0 -static -nostdlib
 
diff --git a/arch/score/include/asm/checksum.h b/arch/score/include/asm/checksum.h
index f909ac3144a4..961bd64015a8 100644
--- a/arch/score/include/asm/checksum.h
+++ b/arch/score/include/asm/checksum.h
@@ -184,48 +184,57 @@ static inline __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
                                 __wsum sum)
 {
         __asm__ __volatile__(
-                ".set\tnoreorder\t\t\t# csum_ipv6_magic\n\t"
-                ".set\tnoat\n\t"
-                "addu\t%0, %5\t\t\t# proto (long in network byte order)\n\t"
-                "sltu\t$1, %0, %5\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %6\t\t\t# csum\n\t"
-                "sltu\t$1, %0, %6\n\t"
-                "lw\t%1, 0(%2)\t\t\t# four words source address\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 4(%2)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 8(%2)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 12(%2)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 0(%3)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 4(%3)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 8(%3)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "lw\t%1, 12(%3)\n\t"
-                "addu\t%0, $1\n\t"
-                "addu\t%0, %1\n\t"
-                "sltu\t$1, %0, %1\n\t"
-                "addu\t%0, $1\t\t\t# Add final carry\n\t"
-                ".set\tnoat\n\t"
-                ".set\tnoreorder"
+                ".set\tvolatile\t\t\t# csum_ipv6_magic\n\t"
+                "add\t%0, %0, %5\t\t\t# proto (long in network byte order)\n\t"
+                "cmp.c\t%5, %0\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %6\t\t\t# csum\n\t"
+                "cmp.c\t%6, %0\n\t"
+                "lw\t%1, [%2, 0]\t\t\t# four words source address\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "1:lw\t%1, [%2, 4]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%2,8]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%2, 12]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0,%1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%3, 0]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%3, 4]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%3, 8]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "lw\t%1, [%3, 12]\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:add\t%0, %0, %1\n\t"
+                "cmp.c\t%1, %0\n\t"
+                "bleu 1f\n\t"
+                "addi\t%0, 0x1\n\t"
+                "1:\n\t"
+                ".set\toptimize"
                 : "=r" (sum), "=r" (proto)
                 : "r" (saddr), "r" (daddr),
                   "0" (htonl(len)), "1" (htonl(proto)), "r" (sum));
diff --git a/arch/score/include/asm/io.h b/arch/score/include/asm/io.h
index fbbfd7132e3b..574c8827abe2 100644
--- a/arch/score/include/asm/io.h
+++ b/arch/score/include/asm/io.h
@@ -5,5 +5,4 @@
 
 #define virt_to_bus     virt_to_phys
 #define bus_to_virt     phys_to_virt
-
 #endif /* _ASM_SCORE_IO_H */
diff --git a/arch/score/include/asm/pgalloc.h b/arch/score/include/asm/pgalloc.h
index 059a61b7071b..716b3fd1d863 100644
--- a/arch/score/include/asm/pgalloc.h
+++ b/arch/score/include/asm/pgalloc.h
@@ -2,7 +2,7 @@
 #define _ASM_SCORE_PGALLOC_H
 
 #include <linux/mm.h>
-
+#include <linux/highmem.h>
 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
         pte_t *pte)
 {
diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
index 7234ed09b7b7..befb87d30a89 100644
--- a/arch/score/kernel/entry.S
+++ b/arch/score/kernel/entry.S
@@ -264,7 +264,7 @@ resume_kernel:
         disable_irq
         lw      r8, [r28, TI_PRE_COUNT]
         cmpz.c  r8
-        bne     r8, restore_all
+        bne     restore_all
 need_resched:
         lw      r8, [r28, TI_FLAGS]
         andri.c r9, r8, _TIF_NEED_RESCHED
@@ -415,7 +415,7 @@ ENTRY(handle_sys)
         sw      r9, [r0, PT_EPC]
 
         cmpi.c  r27, __NR_syscalls      # check syscall number
-        bgeu    illegal_syscall
+        bcs     illegal_syscall
 
         slli    r8, r27, 2              # get syscall routine
         la      r11, sys_call_table
diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
index f4c6d02421d3..a1519ad3d49d 100644
--- a/arch/score/kernel/process.c
+++ b/arch/score/kernel/process.c
@@ -78,8 +78,8 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
         p->thread.reg0 = (unsigned long) childregs;
         if (unlikely(p->flags & PF_KTHREAD)) {
                 memset(childregs, 0, sizeof(struct pt_regs));
-                p->thread->reg12 = usp;
-                p->thread->reg13 = arg;
+                p->thread.reg12 = usp;
+                p->thread.reg13 = arg;
                 p->thread.reg3 = (unsigned long) ret_from_kernel_thread;
         } else {
                 *childregs = *current_pt_regs();
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 2137ad667438..78c4fdb91bc5 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -506,12 +506,17 @@ config SUN_OPENPROMFS
           Only choose N if you know in advance that you will not need to modify
           OpenPROM settings on the running system.
 
-# Makefile helper
+# Makefile helpers
 config SPARC64_PCI
         bool
         default y
         depends on SPARC64 && PCI
 
+config SPARC64_PCI_MSI
+        bool
+        default y
+        depends on SPARC64_PCI && PCI_MSI
+
 endmenu
 
 menu "Executable file formats"
diff --git a/arch/sparc/include/asm/floppy_64.h b/arch/sparc/include/asm/floppy_64.h
index e204f902e6c9..7c90c50c200d 100644
--- a/arch/sparc/include/asm/floppy_64.h
+++ b/arch/sparc/include/asm/floppy_64.h
@@ -254,7 +254,7 @@ static int sun_fd_request_irq(void)
                 once = 1;
 
                 error = request_irq(FLOPPY_IRQ, sparc_floppy_irq,
-                                    IRQF_DISABLED, "floppy", NULL);
+                                    0, "floppy", NULL);
 
                 return ((error == 0) ? 0 : -1);
         }
diff --git a/arch/sparc/include/asm/jump_label.h b/arch/sparc/include/asm/jump_label.h
index 5080d16a832f..ec2e2e2aba7d 100644
--- a/arch/sparc/include/asm/jump_label.h
+++ b/arch/sparc/include/asm/jump_label.h
@@ -9,7 +9,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-                asm goto("1:\n\t"
+                asm_volatile_goto("1:\n\t"
                          "nop\n\t"
                          "nop\n\t"
                          ".pushsection __jump_table,  \"aw\"\n\t"
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index d432fb20358e..d15cc1794b0e 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -1,3 +1,4 @@
+
 #
 # Makefile for the linux kernel.
 #
@@ -99,7 +100,7 @@ obj-$(CONFIG_STACKTRACE)     += stacktrace.o
 obj-$(CONFIG_SPARC64_PCI)    += pci.o pci_common.o psycho_common.o
 obj-$(CONFIG_SPARC64_PCI)    += pci_psycho.o pci_sabre.o pci_schizo.o
 obj-$(CONFIG_SPARC64_PCI)    += pci_sun4v.o pci_sun4v_asm.o pci_fire.o
-obj-$(CONFIG_PCI_MSI)        += pci_msi.o
+obj-$(CONFIG_SPARC64_PCI_MSI) += pci_msi.o
 
 obj-$(CONFIG_COMPAT)         += sys32.o sys_sparc32.o signal32.o
 
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 62d6b153ffa2..dff60abbea01 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -849,9 +849,8 @@ void ldom_reboot(const char *boot_command)
         if (boot_command && strlen(boot_command)) {
                 unsigned long len;
 
-                strcpy(full_boot_str, "boot ");
-                strlcpy(full_boot_str + strlen("boot "), boot_command,
-                        sizeof(full_boot_str + strlen("boot ")));
+                snprintf(full_boot_str, sizeof(full_boot_str), "boot %s",
+                         boot_command);
                 len = strlen(full_boot_str);
 
                 if (reboot_data_supported) {
diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
index 54df554b82d9..e01d75d40329 100644
--- a/arch/sparc/kernel/ldc.c
+++ b/arch/sparc/kernel/ldc.c
@@ -1249,12 +1249,12 @@ int ldc_bind(struct ldc_channel *lp, const char *name)
         snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
         snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
 
-        err = request_irq(lp->cfg.rx_irq, ldc_rx, IRQF_DISABLED,
+        err = request_irq(lp->cfg.rx_irq, ldc_rx, 0,
                           lp->rx_irq_name, lp);
         if (err)
                 return err;
 
-        err = request_irq(lp->cfg.tx_irq, ldc_tx, IRQF_DISABLED,
+        err = request_irq(lp->cfg.tx_irq, ldc_tx, 0,
                           lp->tx_irq_name, lp);
         if (err) {
                 free_irq(lp->cfg.rx_irq, lp);
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 9c7be59e6f5a..218b6b23c378 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -808,4 +808,5 @@ void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter)
                 module_free(NULL, fp->bpf_func);
+        kfree(fp);
 }
diff --git a/arch/tile/include/asm/atomic.h b/arch/tile/include/asm/atomic.h
index d385eaadece7..709798460763 100644
--- a/arch/tile/include/asm/atomic.h
+++ b/arch/tile/include/asm/atomic.h
@@ -166,7 +166,7 @@ static inline int atomic_cmpxchg(atomic_t *v, int o, int n)
  *
  * Atomically sets @v to @i and returns old @v
  */
-static inline u64 atomic64_xchg(atomic64_t *v, u64 n)
+static inline long long atomic64_xchg(atomic64_t *v, long long n)
 {
         return xchg64(&v->counter, n);
 }
@@ -180,7 +180,8 @@ static inline u64 atomic64_xchg(atomic64_t *v, u64 n)
  * Atomically checks if @v holds @o and replaces it with @n if so.
  * Returns the old value at @v.
  */
-static inline u64 atomic64_cmpxchg(atomic64_t *v, u64 o, u64 n)
+static inline long long atomic64_cmpxchg(atomic64_t *v, long long o,
+                                        long long n)
 {
         return cmpxchg64(&v->counter, o, n);
 }
diff --git a/arch/tile/include/asm/atomic_32.h b/arch/tile/include/asm/atomic_32.h
index 0d0395b1b152..1ad4a1f7d42b 100644
--- a/arch/tile/include/asm/atomic_32.h
+++ b/arch/tile/include/asm/atomic_32.h
@@ -80,7 +80,7 @@ static inline void atomic_set(atomic_t *v, int n)
 /* A 64bit atomic type */
 
 typedef struct {
-        u64 __aligned(8) counter;
+        long long counter;
 } atomic64_t;
 
 #define ATOMIC64_INIT(val) { (val) }
@@ -91,14 +91,14 @@ typedef struct {
  *
  * Atomically reads the value of @v.
  */
-static inline u64 atomic64_read(const atomic64_t *v)
+static inline long long atomic64_read(const atomic64_t *v)
 {
         /*
          * Requires an atomic op to read both 32-bit parts consistently.
          * Casting away const is safe since the atomic support routines
          * do not write to memory if the value has not been modified.
          */
-        return _atomic64_xchg_add((u64 *)&v->counter, 0);
+        return _atomic64_xchg_add((long long *)&v->counter, 0);
 }
 
 /**
@@ -108,7 +108,7 @@ static inline u64 atomic64_read(const atomic64_t *v)
  *
  * Atomically adds @i to @v.
  */
-static inline void atomic64_add(u64 i, atomic64_t *v)
+static inline void atomic64_add(long long i, atomic64_t *v)
 {
         _atomic64_xchg_add(&v->counter, i);
 }
@@ -120,7 +120,7 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
  *
  * Atomically adds @i to @v and returns @i + @v
  */
-static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
+static inline long long atomic64_add_return(long long i, atomic64_t *v)
 {
         smp_mb();  /* barrier for proper semantics */
         return _atomic64_xchg_add(&v->counter, i) + i;
@@ -135,7 +135,8 @@ static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
  * Atomically adds @a to @v, so long as @v was not already @u.
  * Returns non-zero if @v was not @u, and zero otherwise.
  */
-static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
+static inline long long atomic64_add_unless(atomic64_t *v, long long a,
+                                        long long u)
 {
         smp_mb();  /* barrier for proper semantics */
         return _atomic64_xchg_add_unless(&v->counter, a, u) != u;
@@ -151,7 +152,7 @@ static inline u64 atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
  * atomic64_set() can't be just a raw store, since it would be lost if it
  * fell between the load and store of one of the other atomic ops.
  */
-static inline void atomic64_set(atomic64_t *v, u64 n)
+static inline void atomic64_set(atomic64_t *v, long long n)
 {
         _atomic64_xchg(&v->counter, n);
 }
@@ -236,11 +237,13 @@ extern struct __get_user __atomic_xchg_add_unless(volatile int *p,
 extern struct __get_user __atomic_or(volatile int *p, int *lock, int n);
 extern struct __get_user __atomic_andn(volatile int *p, int *lock, int n);
 extern struct __get_user __atomic_xor(volatile int *p, int *lock, int n);
-extern u64 __atomic64_cmpxchg(volatile u64 *p, int *lock, u64 o, u64 n);
-extern u64 __atomic64_xchg(volatile u64 *p, int *lock, u64 n);
-extern u64 __atomic64_xchg_add(volatile u64 *p, int *lock, u64 n);
-extern u64 __atomic64_xchg_add_unless(volatile u64 *p,
-                                      int *lock, u64 o, u64 n);
+extern long long __atomic64_cmpxchg(volatile long long *p, int *lock,
+                                        long long o, long long n);
+extern long long __atomic64_xchg(volatile long long *p, int *lock, long long n);
+extern long long __atomic64_xchg_add(volatile long long *p, int *lock,
+                                        long long n);
+extern long long __atomic64_xchg_add_unless(volatile long long *p,
+                                        int *lock, long long o, long long n);
 
 /* Return failure from the atomic wrappers. */
 struct __get_user __atomic_bad_address(int __user *addr);
diff --git a/arch/tile/include/asm/cmpxchg.h b/arch/tile/include/asm/cmpxchg.h
index 4001d5eab4bb..0ccda3c425be 100644
--- a/arch/tile/include/asm/cmpxchg.h
+++ b/arch/tile/include/asm/cmpxchg.h
@@ -35,10 +35,10 @@ int _atomic_xchg(int *ptr, int n);
 int _atomic_xchg_add(int *v, int i);
 int _atomic_xchg_add_unless(int *v, int a, int u);
 int _atomic_cmpxchg(int *ptr, int o, int n);
-u64 _atomic64_xchg(u64 *v, u64 n);
-u64 _atomic64_xchg_add(u64 *v, u64 i);
-u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u);
-u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
+long long _atomic64_xchg(long long *v, long long n);
+long long _atomic64_xchg_add(long long *v, long long i);
+long long _atomic64_xchg_add_unless(long long *v, long long a, long long u);
+long long _atomic64_cmpxchg(long long *v, long long o, long long n);
 
 #define xchg(ptr, n)                                                    \
         ({                                                              \
@@ -53,7 +53,8 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                 if (sizeof(*(ptr)) != 4)                                \
                         __cmpxchg_called_with_bad_pointer();            \
                 smp_mb();                                               \
-                (typeof(*(ptr)))_atomic_cmpxchg((int *)ptr, (int)o, (int)n); \
+                (typeof(*(ptr)))_atomic_cmpxchg((int *)ptr, (int)o,     \
+                                                (int)n);                \
         })
 
 #define xchg64(ptr, n)                                                  \
@@ -61,7 +62,8 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                 if (sizeof(*(ptr)) != 8)                                \
                         __xchg_called_with_bad_pointer();               \
                 smp_mb();                                               \
-                (typeof(*(ptr)))_atomic64_xchg((u64 *)(ptr), (u64)(n)); \
+                (typeof(*(ptr)))_atomic64_xchg((long long *)(ptr),      \
+                                                (long long)(n));        \
         })
 
 #define cmpxchg64(ptr, o, n)                                            \
@@ -69,7 +71,8 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                 if (sizeof(*(ptr)) != 8)                                \
                         __cmpxchg_called_with_bad_pointer();            \
                 smp_mb();                                               \
-                (typeof(*(ptr)))_atomic64_cmpxchg((u64 *)ptr, (u64)o, (u64)n); \
+                (typeof(*(ptr)))_atomic64_cmpxchg((long long *)ptr,     \
+                                        (long long)o, (long long)n);    \
         })
 
 #else
@@ -81,10 +84,11 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                 switch (sizeof(*(ptr))) {                               \
                 case 4:                                                 \
                         __x = (typeof(__x))(unsigned long)              \
-                                __insn_exch4((ptr), (u32)(unsigned long)(n)); \
+                                __insn_exch4((ptr),                     \
+                                        (u32)(unsigned long)(n));       \
                         break;                                          \
                 case 8:                                                 \
-                        __x = (typeof(__x))                     \
+                        __x = (typeof(__x))                             \
                                 __insn_exch((ptr), (unsigned long)(n)); \
                         break;                                          \
                 default:                                                \
@@ -103,10 +107,12 @@ u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n);
                 switch (sizeof(*(ptr))) {                               \
                 case 4:                                                 \
                         __x = (typeof(__x))(unsigned long)              \
-                                __insn_cmpexch4((ptr), (u32)(unsigned long)(n)); \
+                                __insn_cmpexch4((ptr),                  \
+                                        (u32)(unsigned long)(n));       \
                         break;                                          \
                 case 8:                                                 \
-                        __x = (typeof(__x))__insn_cmpexch((ptr), (u64)(n)); \
+                        __x = (typeof(__x))__insn_cmpexch((ptr),        \
+                                                (long long)(n));        \
                         break;                                          \
                 default:                                                \
                         __cmpxchg_called_with_bad_pointer();            \
diff --git a/arch/tile/include/asm/percpu.h b/arch/tile/include/asm/percpu.h
index 63294f5a8efb..4f7ae39fa202 100644
--- a/arch/tile/include/asm/percpu.h
+++ b/arch/tile/include/asm/percpu.h
@@ -15,9 +15,37 @@
 #ifndef _ASM_TILE_PERCPU_H
 #define _ASM_TILE_PERCPU_H
 
-register unsigned long __my_cpu_offset __asm__("tp");
-#define __my_cpu_offset __my_cpu_offset
-#define set_my_cpu_offset(tp) (__my_cpu_offset = (tp))
+register unsigned long my_cpu_offset_reg asm("tp");
+
+#ifdef CONFIG_PREEMPT
+/*
+ * For full preemption, we can't just use the register variable
+ * directly, since we need barrier() to hazard against it, causing the
+ * compiler to reload anything computed from a previous "tp" value.
+ * But we also don't want to use volatile asm, since we'd like the
+ * compiler to be able to cache the value across multiple percpu reads.
+ * So we use a fake stack read as a hazard against barrier().
+ * The 'U' constraint is like 'm' but disallows postincrement.
+ */
+static inline unsigned long __my_cpu_offset(void)
+{
+        unsigned long tp;
+        register unsigned long *sp asm("sp");
+        asm("move %0, tp" : "=r" (tp) : "U" (*sp));
+        return tp;
+}
+#define __my_cpu_offset __my_cpu_offset()
+#else
+/*
+ * We don't need to hazard against barrier() since "tp" doesn't ever
+ * change with PREEMPT_NONE, and with PREEMPT_VOLUNTARY it only
+ * changes at function call points, at which we are already re-reading
+ * the value of "tp" due to "my_cpu_offset_reg" being a global variable.
+ */
+#define __my_cpu_offset my_cpu_offset_reg
+#endif
+
+#define set_my_cpu_offset(tp) (my_cpu_offset_reg = (tp))
 
 #include <asm-generic/percpu.h>
 
diff --git a/arch/tile/kernel/hardwall.c b/arch/tile/kernel/hardwall.c
index df27a1fd94a3..531f4c365351 100644
--- a/arch/tile/kernel/hardwall.c
+++ b/arch/tile/kernel/hardwall.c
@@ -66,7 +66,7 @@ static struct hardwall_type hardwall_types[] = {
                 0,
                 "udn",
                 LIST_HEAD_INIT(hardwall_types[HARDWALL_UDN].list),
-                __SPIN_LOCK_INITIALIZER(hardwall_types[HARDWALL_UDN].lock),
+                __SPIN_LOCK_UNLOCKED(hardwall_types[HARDWALL_UDN].lock),
                 NULL
         },
 #ifndef __tilepro__
@@ -77,7 +77,7 @@ static struct hardwall_type hardwall_types[] = {
                 1,  /* disabled pending hypervisor support */
                 "idn",
                 LIST_HEAD_INIT(hardwall_types[HARDWALL_IDN].list),
-                __SPIN_LOCK_INITIALIZER(hardwall_types[HARDWALL_IDN].lock),
+                __SPIN_LOCK_UNLOCKED(hardwall_types[HARDWALL_IDN].lock),
                 NULL
         },
         {  /* access to user-space IPI */
@@ -87,7 +87,7 @@ static struct hardwall_type hardwall_types[] = {
                 0,
                 "ipi",
                 LIST_HEAD_INIT(hardwall_types[HARDWALL_IPI].list),
-                __SPIN_LOCK_INITIALIZER(hardwall_types[HARDWALL_IPI].lock),
+                __SPIN_LOCK_UNLOCKED(hardwall_types[HARDWALL_IPI].lock),
                 NULL
         },
 #endif
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index 088d5c141e68..2cbe6d5dd6b0 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -815,6 +815,9 @@ STD_ENTRY(interrupt_return)
         }
         bzt     r28, 1f
         bnz     r29, 1f
+        /* Disable interrupts explicitly for preemption. */
+        IRQ_DISABLE(r20,r21)
+        TRACE_IRQS_OFF
         jal     preempt_schedule_irq
         FEEDBACK_REENTER(interrupt_return)
 1:
diff --git a/arch/tile/kernel/intvec_64.S b/arch/tile/kernel/intvec_64.S
index ec755d3f3734..b8fc497f2437 100644
--- a/arch/tile/kernel/intvec_64.S
+++ b/arch/tile/kernel/intvec_64.S
@@ -841,6 +841,9 @@ STD_ENTRY(interrupt_return)
         }
         beqzt   r28, 1f
         bnez    r29, 1f
+        /* Disable interrupts explicitly for preemption. */
+        IRQ_DISABLE(r20,r21)
+        TRACE_IRQS_OFF
         jal     preempt_schedule_irq
         FEEDBACK_REENTER(interrupt_return)
 1:
diff --git a/arch/tile/kernel/stack.c b/arch/tile/kernel/stack.c
index 362284af3afd..c93977a62116 100644
--- a/arch/tile/kernel/stack.c
+++ b/arch/tile/kernel/stack.c
@@ -23,6 +23,7 @@
 #include <linux/mmzone.h>
 #include <linux/dcache.h>
 #include <linux/fs.h>
+#include <linux/string.h>
 #include <asm/backtrace.h>
 #include <asm/page.h>
 #include <asm/ucontext.h>
@@ -332,21 +333,18 @@ static void describe_addr(struct KBacktraceIterator *kbt,
         }
 
         if (vma->vm_file) {
-                char *s;
                 p = d_path(&vma->vm_file->f_path, buf, bufsize);
                 if (IS_ERR(p))
                         p = "?";
-                s = strrchr(p, '/');
-                if (s)
-                        p = s+1;
+                name = kbasename(p);
         } else {
-                p = "anon";
+                name = "anon";
         }
 
         /* Generate a string description of the vma info. */
-        namelen = strlen(p);
+        namelen = strlen(name);
         remaining = (bufsize - 1) - namelen;
-        memmove(buf, p, namelen);
+        memmove(buf, name, namelen);
         snprintf(buf + namelen, remaining, "[%lx+%lx] ",
                  vma->vm_start, vma->vm_end - vma->vm_start);
 }
diff --git a/arch/tile/lib/atomic_32.c b/arch/tile/lib/atomic_32.c
index 759efa337be8..c89b211fd9e7 100644
--- a/arch/tile/lib/atomic_32.c
+++ b/arch/tile/lib/atomic_32.c
@@ -107,19 +107,19 @@ unsigned long _atomic_xor(volatile unsigned long *p, unsigned long mask)
 EXPORT_SYMBOL(_atomic_xor);
 
 
-u64 _atomic64_xchg(u64 *v, u64 n)
+long long _atomic64_xchg(long long *v, long long n)
 {
         return __atomic64_xchg(v, __atomic_setup(v), n);
 }
 EXPORT_SYMBOL(_atomic64_xchg);
 
-u64 _atomic64_xchg_add(u64 *v, u64 i)
+long long _atomic64_xchg_add(long long *v, long long i)
 {
         return __atomic64_xchg_add(v, __atomic_setup(v), i);
 }
 EXPORT_SYMBOL(_atomic64_xchg_add);
 
-u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u)
+long long _atomic64_xchg_add_unless(long long *v, long long a, long long u)
 {
         /*
          * Note: argument order is switched here since it is easier
@@ -130,7 +130,7 @@ u64 _atomic64_xchg_add_unless(u64 *v, u64 a, u64 u)
 }
 EXPORT_SYMBOL(_atomic64_xchg_add_unless);
 
-u64 _atomic64_cmpxchg(u64 *v, u64 o, u64 n)
+long long _atomic64_cmpxchg(long long *v, long long o, long long n)
 {
         return __atomic64_cmpxchg(v, __atomic_setup(v), o, n);
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index dcdb5130cf85..0c11032e2e91 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -856,7 +856,7 @@ source "kernel/Kconfig.preempt"
 
 config X86_UP_APIC
         bool "Local APIC support on uniprocessors"
-        depends on X86_32 && !SMP && !X86_32_NON_STANDARD
+        depends on X86_32 && !SMP && !X86_32_NON_STANDARD && !PCI_MSI
         ---help---
           A local APIC (Advanced Programmable Interrupt Controller) is an
           integrated interrupt controller in the CPU. If you have a single-CPU
@@ -881,11 +881,11 @@ config X86_UP_IOAPIC
 
 config X86_LOCAL_APIC
         def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC || PCI_MSI
 
 config X86_IO_APIC
         def_bool y
-        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI
 
 config X86_VISWS_APIC
         def_bool y
@@ -1029,6 +1029,7 @@ config X86_REBOOTFIXUPS
 
 config MICROCODE
         tristate "CPU microcode loading support"
+        depends on CPU_SUP_AMD || CPU_SUP_INTEL
         select FW_LOADER
         ---help---
 
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index b1977bad5435..c8c1e700c26e 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -26,6 +26,7 @@
 #include <acpi/pdc_intel.h>
 
 #include <asm/numa.h>
+#include <asm/fixmap.h>
 #include <asm/processor.h>
 #include <asm/mmu.h>
 #include <asm/mpspec.h>
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index d3f5c63078d8..89270b4318db 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -374,7 +374,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
                  * Catch too early usage of this before alternatives
                  * have run.
                  */
-                asm goto("1: jmp %l[t_warn]\n"
+                asm_volatile_goto("1: jmp %l[t_warn]\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
                          " .long 1b - .\n"
@@ -388,7 +388,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
 
 #endif
 
-                asm goto("1: jmp %l[t_no]\n"
+                asm_volatile_goto("1: jmp %l[t_no]\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
                          " .long 1b - .\n"
@@ -453,7 +453,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
  * have. Thus, we force the jump to the widest, 4-byte, signed relative
  * offset even though the last would often fit in less bytes.
  */
-                asm goto("1: .byte 0xe9\n .long %l[t_dynamic] - 2f\n"
+                asm_volatile_goto("1: .byte 0xe9\n .long %l[t_dynamic] - 2f\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
                          " .long 1b - .\n"              /* src offset */
diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h
index 64507f35800c..6a2cefb4395a 100644
--- a/arch/x86/include/asm/jump_label.h
+++ b/arch/x86/include/asm/jump_label.h
@@ -18,7 +18,7 @@
 
 static __always_inline bool arch_static_branch(struct static_key *key)
 {
-        asm goto("1:"
+        asm_volatile_goto("1:"
                 ".byte " __stringify(STATIC_KEY_INIT_NOP) "\n\t"
                 ".pushsection __jump_table,  \"aw\" \n\t"
                 _ASM_ALIGN "\n\t"
diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
index 626cf70082d7..3142a94c7b4b 100644
--- a/arch/x86/include/asm/mpspec.h
+++ b/arch/x86/include/asm/mpspec.h
@@ -94,7 +94,7 @@ static inline void early_reserve_e820_mpc_new(void) { }
 #define default_get_smp_config x86_init_uint_noop
 #endif
 
-void generic_processor_info(int apicid, int version);
+int generic_processor_info(int apicid, int version);
 #ifdef CONFIG_ACPI
 extern void mp_register_ioapic(int id, u32 address, u32 gsi_base);
 extern void mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger,
diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h
index cb7502852acb..e139b13f2a33 100644
--- a/arch/x86/include/asm/msr.h
+++ b/arch/x86/include/asm/msr.h
@@ -218,10 +218,14 @@ void msrs_free(struct msr *msrs);
 #ifdef CONFIG_SMP
 int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h);
 int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h);
+int rdmsrl_on_cpu(unsigned int cpu, u32 msr_no, u64 *q);
+int wrmsrl_on_cpu(unsigned int cpu, u32 msr_no, u64 q);
 void rdmsr_on_cpus(const struct cpumask *mask, u32 msr_no, struct msr *msrs);
 void wrmsr_on_cpus(const struct cpumask *mask, u32 msr_no, struct msr *msrs);
 int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h);
 int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h);
+int rdmsrl_safe_on_cpu(unsigned int cpu, u32 msr_no, u64 *q);
+int wrmsrl_safe_on_cpu(unsigned int cpu, u32 msr_no, u64 q);
 int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]);
 int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]);
 #else  /*  CONFIG_SMP  */
@@ -235,6 +239,16 @@ static inline int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
         wrmsr(msr_no, l, h);
         return 0;
 }
+static inline int rdmsrl_on_cpu(unsigned int cpu, u32 msr_no, u64 *q)
+{
+        rdmsrl(msr_no, *q);
+        return 0;
+}
+static inline int wrmsrl_on_cpu(unsigned int cpu, u32 msr_no, u64 q)
+{
+        wrmsrl(msr_no, q);
+        return 0;
+}
 static inline void rdmsr_on_cpus(const struct cpumask *m, u32 msr_no,
                                 struct msr *msrs)
 {
@@ -254,6 +268,14 @@ static inline int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 {
         return wrmsr_safe(msr_no, l, h);
 }
+static inline int rdmsrl_safe_on_cpu(unsigned int cpu, u32 msr_no, u64 *q)
+{
+        return rdmsrl_safe(msr_no, q);
+}
+static inline int wrmsrl_safe_on_cpu(unsigned int cpu, u32 msr_no, u64 q)
+{
+        return wrmsrl_safe(msr_no, q);
+}
 static inline int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8])
 {
         return rdmsr_safe_regs(regs);
diff --git a/arch/x86/include/asm/mutex_64.h b/arch/x86/include/asm/mutex_64.h
index e7e6751648ed..07537a44216e 100644
--- a/arch/x86/include/asm/mutex_64.h
+++ b/arch/x86/include/asm/mutex_64.h
@@ -20,7 +20,7 @@
 static inline void __mutex_fastpath_lock(atomic_t *v,
                                          void (*fail_fn)(atomic_t *))
 {
-        asm volatile goto(LOCK_PREFIX "   decl %0\n"
+        asm_volatile_goto(LOCK_PREFIX "   decl %0\n"
                           "   jns %l[exit]\n"
                           : : "m" (v->counter)
                           : "memory", "cc"
@@ -75,7 +75,7 @@ static inline int __mutex_fastpath_lock_retval(atomic_t *count)
 static inline void __mutex_fastpath_unlock(atomic_t *v,
                                            void (*fail_fn)(atomic_t *))
 {
-        asm volatile goto(LOCK_PREFIX "   incl %0\n"
+        asm_volatile_goto(LOCK_PREFIX "   incl %0\n"
                           "   jg %l[exit]\n"
                           : : "m" (v->counter)
                           : "memory", "cc"
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 6aef9fbc09b7..b913915e8e63 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -79,30 +79,38 @@ static inline int phys_to_machine_mapping_valid(unsigned long pfn)
         return get_phys_to_machine(pfn) != INVALID_P2M_ENTRY;
 }
 
-static inline unsigned long mfn_to_pfn(unsigned long mfn)
+static inline unsigned long mfn_to_pfn_no_overrides(unsigned long mfn)
 {
         unsigned long pfn;
-        int ret = 0;
+        int ret;
 
         if (xen_feature(XENFEAT_auto_translated_physmap))
                 return mfn;
 
-        if (unlikely(mfn >= machine_to_phys_nr)) {
-                pfn = ~0;
-                goto try_override;
-        }
-        pfn = 0;
+        if (unlikely(mfn >= machine_to_phys_nr))
+                return ~0;
+
         /*
          * The array access can fail (e.g., device space beyond end of RAM).
          * In such cases it doesn't matter what we return (we return garbage),
          * but we must handle the fault without crashing!
          */
         ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
-try_override:
-        /* ret might be < 0 if there are no entries in the m2p for mfn */
         if (ret < 0)
-                pfn = ~0;
-        else if (get_phys_to_machine(pfn) != mfn)
+                return ~0;
+
+        return pfn;
+}
+
+static inline unsigned long mfn_to_pfn(unsigned long mfn)
+{
+        unsigned long pfn;
+
+        if (xen_feature(XENFEAT_auto_translated_physmap))
+                return mfn;
+
+        pfn = mfn_to_pfn_no_overrides(mfn);
+        if (get_phys_to_machine(pfn) != mfn) {
                 /*
                  * If this appears to be a foreign mfn (because the pfn
                  * doesn't map back to the mfn), then check the local override
@@ -111,6 +119,7 @@ try_override:
                  * m2p_find_override_pfn returns ~0 if it doesn't find anything.
                  */
                 pfn = m2p_find_override_pfn(mfn, ~0);
+        }
 
         /* 
          * pfn is ~0 if there are no entries in the m2p for mfn or if the
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 40c76604199f..6c0b43bd024b 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -189,24 +189,31 @@ static int __init acpi_parse_madt(struct acpi_table_header *table)
         return 0;
 }
 
-static void acpi_register_lapic(int id, u8 enabled)
+/**
+ * acpi_register_lapic - register a local apic and generates a logic cpu number
+ * @id: local apic id to register
+ * @enabled: this cpu is enabled or not
+ *
+ * Returns the logic cpu number which maps to the local apic
+ */
+static int acpi_register_lapic(int id, u8 enabled)
 {
         unsigned int ver = 0;
 
         if (id >= MAX_LOCAL_APIC) {
                 printk(KERN_INFO PREFIX "skipped apicid that is too big\n");
-                return;
+                return -EINVAL;
         }
 
         if (!enabled) {
                 ++disabled_cpus;
-                return;
+                return -EINVAL;
         }
 
         if (boot_cpu_physical_apicid != -1U)
                 ver = apic_version[boot_cpu_physical_apicid];
 
-        generic_processor_info(id, ver);
+        return generic_processor_info(id, ver);
 }
 
 static int __init
@@ -614,84 +621,27 @@ static void acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
 #endif
 }
 
-static int _acpi_map_lsapic(acpi_handle handle, int *pcpu)
+static int _acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 {
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-        union acpi_object *obj;
-        struct acpi_madt_local_apic *lapic;
-        cpumask_var_t tmp_map, new_map;
-        u8 physid;
         int cpu;
-        int retval = -ENOMEM;
-
-        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_MAT", NULL, &buffer)))
-                return -EINVAL;
-
-        if (!buffer.length || !buffer.pointer)
-                return -EINVAL;
-
-        obj = buffer.pointer;
-        if (obj->type != ACPI_TYPE_BUFFER ||
-            obj->buffer.length < sizeof(*lapic)) {
-                kfree(buffer.pointer);
-                return -EINVAL;
-        }
 
-        lapic = (struct acpi_madt_local_apic *)obj->buffer.pointer;
-
-        if (lapic->header.type != ACPI_MADT_TYPE_LOCAL_APIC ||
-            !(lapic->lapic_flags & ACPI_MADT_ENABLED)) {
-                kfree(buffer.pointer);
-                return -EINVAL;
-        }
-
-        physid = lapic->id;
-
-        kfree(buffer.pointer);
-        buffer.length = ACPI_ALLOCATE_BUFFER;
-        buffer.pointer = NULL;
-        lapic = NULL;
-
-        if (!alloc_cpumask_var(&tmp_map, GFP_KERNEL))
-                goto out;
-
-        if (!alloc_cpumask_var(&new_map, GFP_KERNEL))
-                goto free_tmp_map;
-
-        cpumask_copy(tmp_map, cpu_present_mask);
-        acpi_register_lapic(physid, ACPI_MADT_ENABLED);
-
-        /*
-         * If acpi_register_lapic successfully generates a new logical cpu
-         * number, then the following will get us exactly what was mapped
-         */
-        cpumask_andnot(new_map, cpu_present_mask, tmp_map);
-        if (cpumask_empty(new_map)) {
-                printk ("Unable to map lapic to logical cpu number\n");
-                retval = -EINVAL;
-                goto free_new_map;
+        cpu = acpi_register_lapic(physid, ACPI_MADT_ENABLED);
+        if (cpu < 0) {
+                pr_info(PREFIX "Unable to map lapic to logical cpu number\n");
+                return cpu;
         }
 
         acpi_processor_set_pdc(handle);
-
-        cpu = cpumask_first(new_map);
         acpi_map_cpu2node(handle, cpu, physid);
 
         *pcpu = cpu;
-        retval = 0;
-
-free_new_map:
-        free_cpumask_var(new_map);
-free_tmp_map:
-        free_cpumask_var(tmp_map);
-out:
-        return retval;
+        return 0;
 }
 
 /* wrapper to silence section mismatch warning */
-int __ref acpi_map_lsapic(acpi_handle handle, int *pcpu)
+int __ref acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu)
 {
-        return _acpi_map_lsapic(handle, pcpu);
+        return _acpi_map_lsapic(handle, physid, pcpu);
 }
 EXPORT_SYMBOL(acpi_map_lsapic);
 
@@ -745,7 +695,7 @@ static int __init acpi_parse_sbf(struct acpi_table_header *table)
 #ifdef CONFIG_HPET_TIMER
 #include <asm/hpet.h>
 
-static struct __initdata resource *hpet_res;
+static struct resource *hpet_res __initdata;
 
 static int __init acpi_parse_hpet(struct acpi_table_header *table)
 {
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 33120100ff5e..3a2ae4c88948 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -26,6 +26,17 @@ static char temp_stack[4096];
 #endif
 
 /**
+ * x86_acpi_enter_sleep_state - enter sleep state
+ * @state: Sleep state to enter.
+ *
+ * Wrapper around acpi_enter_sleep_state() to be called by assmebly.
+ */
+acpi_status asmlinkage x86_acpi_enter_sleep_state(u8 state)
+{
+        return acpi_enter_sleep_state(state);
+}
+
+/**
  * x86_acpi_suspend_lowlevel - save kernel state
  *
  * Create an identity mapped page table and copy the wakeup routine to
diff --git a/arch/x86/kernel/acpi/sleep.h b/arch/x86/kernel/acpi/sleep.h
index c9c2c982d5e4..65c7b606b606 100644
--- a/arch/x86/kernel/acpi/sleep.h
+++ b/arch/x86/kernel/acpi/sleep.h
@@ -17,3 +17,5 @@ extern void wakeup_long64(void);
 extern void do_suspend_lowlevel(void);
 
 extern int x86_acpi_suspend_lowlevel(void);
+
+acpi_status asmlinkage x86_acpi_enter_sleep_state(u8 state);
diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
index d1daa66ab162..665c6b7d2ea9 100644
--- a/arch/x86/kernel/acpi/wakeup_32.S
+++ b/arch/x86/kernel/acpi/wakeup_32.S
@@ -73,7 +73,7 @@ ENTRY(do_suspend_lowlevel)
         call    save_processor_state
         call    save_registers
         pushl   $3
-        call    acpi_enter_sleep_state
+        call    x86_acpi_enter_sleep_state
         addl    $4, %esp
 
 #       In case of S3 failure, we'll emerge here.  Jump
diff --git a/arch/x86/kernel/acpi/wakeup_64.S b/arch/x86/kernel/acpi/wakeup_64.S
index 8ea5164cbd04..ae693b51ed8e 100644
--- a/arch/x86/kernel/acpi/wakeup_64.S
+++ b/arch/x86/kernel/acpi/wakeup_64.S
@@ -73,7 +73,7 @@ ENTRY(do_suspend_lowlevel)
         addq    $8, %rsp
         movl    $3, %edi
         xorl    %eax, %eax
-        call    acpi_enter_sleep_state
+        call    x86_acpi_enter_sleep_state
         /* in case something went wrong, restore the machine status and go on */
         jmp     resume_point
 
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index a7eb82d9b012..ed165d657380 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -2107,7 +2107,7 @@ void disconnect_bsp_APIC(int virt_wire_setup)
         apic_write(APIC_LVT1, value);
 }
 
-void generic_processor_info(int apicid, int version)
+int generic_processor_info(int apicid, int version)
 {
         int cpu, max = nr_cpu_ids;
         bool boot_cpu_detected = physid_isset(boot_cpu_physical_apicid,
@@ -2127,7 +2127,7 @@ void generic_processor_info(int apicid, int version)
                         "  Processor %d/0x%x ignored.\n", max, thiscpu, apicid);
 
                 disabled_cpus++;
-                return;
+                return -ENODEV;
         }
 
         if (num_processors >= nr_cpu_ids) {
@@ -2138,7 +2138,7 @@ void generic_processor_info(int apicid, int version)
                         "  Processor %d/0x%x ignored.\n", max, thiscpu, apicid);
 
                 disabled_cpus++;
-                return;
+                return -EINVAL;
         }
 
         num_processors++;
@@ -2183,6 +2183,8 @@ void generic_processor_info(int apicid, int version)
 #endif
         set_cpu_possible(cpu, true);
         set_cpu_present(cpu, true);
+
+        return cpu;
 }
 
 int hard_smp_processor_id(void)
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 1191ac1c9d25..a419814cea57 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -113,7 +113,7 @@ static int __init early_get_pnodeid(void)
                 break;
         case UV3_HUB_PART_NUMBER:
         case UV3_HUB_PART_NUMBER_X:
-                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE - 1;
+                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
                 break;
         }
 
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 8355c84b9729..9d8449158cf9 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1506,7 +1506,7 @@ static int __init init_hw_perf_events(void)
                 err = amd_pmu_init();
                 break;
         default:
-                return 0;
+                err = -ENOTSUPP;
         }
         if (err != 0) {
                 pr_cont("no PMU driver, software events only.\n");
@@ -1883,26 +1883,21 @@ static struct pmu pmu = {
 
 void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
 {
-        userpg->cap_usr_time = 0;
-        userpg->cap_usr_time_zero = 0;
-        userpg->cap_usr_rdpmc = x86_pmu.attr_rdpmc;
+        userpg->cap_user_time = 0;
+        userpg->cap_user_time_zero = 0;
+        userpg->cap_user_rdpmc = x86_pmu.attr_rdpmc;
         userpg->pmc_width = x86_pmu.cntval_bits;
 
-        if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC))
-                return;
-
-        if (!boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
+        if (!sched_clock_stable)
                 return;
 
-        userpg->cap_usr_time = 1;
+        userpg->cap_user_time = 1;
         userpg->time_mult = this_cpu_read(cyc2ns);
         userpg->time_shift = CYC2NS_SCALE_FACTOR;
         userpg->time_offset = this_cpu_read(cyc2ns_offset) - now;
 
-        if (sched_clock_stable && !check_tsc_disabled()) {
-                userpg->cap_usr_time_zero = 1;
-                userpg->time_zero = this_cpu_read(cyc2ns_offset);
-        }
+        userpg->cap_user_time_zero = 1;
+        userpg->time_zero = this_cpu_read(cyc2ns_offset);
 }
 
 /*
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 9db76c31b3c3..f31a1655d1ff 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2325,6 +2325,7 @@ __init int intel_pmu_init(void)
                 break;
 
         case 55: /* Atom 22nm "Silvermont" */
+        case 77: /* Avoton "Silvermont" */
                 memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
                         sizeof(hw_cache_event_ids));
                 memcpy(hw_cache_extra_regs, slm_hw_cache_extra_regs,
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 8ed44589b0e4..4118f9f68315 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -2706,14 +2706,14 @@ static void uncore_pmu_init_hrtimer(struct intel_uncore_box *box)
         box->hrtimer.function = uncore_pmu_hrtimer;
 }
 
-struct intel_uncore_box *uncore_alloc_box(struct intel_uncore_type *type, int cpu)
+static struct intel_uncore_box *uncore_alloc_box(struct intel_uncore_type *type, int node)
 {
         struct intel_uncore_box *box;
         int i, size;
 
         size = sizeof(*box) + type->num_shared_regs * sizeof(struct intel_uncore_extra_reg);
 
-        box = kzalloc_node(size, GFP_KERNEL, cpu_to_node(cpu));
+        box = kzalloc_node(size, GFP_KERNEL, node);
         if (!box)
                 return NULL;
 
@@ -3031,7 +3031,7 @@ static int uncore_validate_group(struct intel_uncore_pmu *pmu,
         struct intel_uncore_box *fake_box;
         int ret = -EINVAL, n;
 
-        fake_box = uncore_alloc_box(pmu->type, smp_processor_id());
+        fake_box = uncore_alloc_box(pmu->type, NUMA_NO_NODE);
         if (!fake_box)
                 return -ENOMEM;
 
@@ -3294,7 +3294,7 @@ static int uncore_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id
         }
 
         type = pci_uncores[UNCORE_PCI_DEV_TYPE(id->driver_data)];
-        box = uncore_alloc_box(type, 0);
+        box = uncore_alloc_box(type, NUMA_NO_NODE);
         if (!box)
                 return -ENOMEM;
 
@@ -3499,7 +3499,7 @@ static int uncore_cpu_prepare(int cpu, int phys_id)
                         if (pmu->func_id < 0)
                                 pmu->func_id = j;
 
-                        box = uncore_alloc_box(type, cpu);
+                        box = uncore_alloc_box(type, cpu_to_node(cpu));
                         if (!box)
                                 return -ENOMEM;
 
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 697b93af02dd..a0e2a8a80c94 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -775,11 +775,22 @@ void __init kvm_spinlock_init(void)
         if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
                 return;
 
-        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
+        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
+        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+}
+
+static __init int kvm_spinlock_init_jump(void)
+{
+        if (!kvm_para_available())
+                return 0;
+        if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT))
+                return 0;
 
         static_key_slow_inc(&paravirt_ticketlocks_enabled);
+        printk(KERN_INFO "KVM setup paravirtual spinlock\n");
 
-        pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(kvm_lock_spinning);
-        pv_lock_ops.unlock_kick = kvm_unlock_kick;
+        return 0;
 }
+early_initcall(kvm_spinlock_init_jump);
+
 #endif  /* CONFIG_PARAVIRT_SPINLOCKS */
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 7123b5df479d..af99f71aeb7f 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -216,6 +216,7 @@ int apply_microcode_amd(int cpu)
         /* need to apply patch? */
         if (rev >= mc_amd->hdr.patch_id) {
                 c->microcode = rev;
+                uci->cpu_sig.rev = rev;
                 return 0;
         }
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 563ed91e6faa..7e920bff99a3 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -326,6 +326,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6320"),
                 },
         },
+        {       /* Handle problems with rebooting on the Latitude E5410. */
+                .callback = set_pci_reboot,
+                .ident = "Dell Latitude E5410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E5410"),
+                },
+        },
         {       /* Handle problems with rebooting on the Latitude E5420. */
                 .callback = set_pci_reboot,
                 .ident = "Dell Latitude E5420",
@@ -352,12 +360,28 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
         },
         {       /* Handle problems with rebooting on the Precision M6600. */
                 .callback = set_pci_reboot,
-                .ident = "Dell OptiPlex 990",
+                .ident = "Dell Precision M6600",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
                         DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
                 },
         },
+        {       /* Handle problems with rebooting on the Dell PowerEdge C6100. */
+                .callback = set_pci_reboot,
+                .ident = "Dell PowerEdge C6100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "C6100"),
+                },
+        },
+        {       /* Some C6100 machines were shipped with vendor being 'Dell'. */
+                .callback = set_pci_reboot,
+                .ident = "Dell PowerEdge C6100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "C6100"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
index 22513e96b012..86179d409893 100644
--- a/arch/x86/kernel/sysfb_simplefb.c
+++ b/arch/x86/kernel/sysfb_simplefb.c
@@ -72,14 +72,14 @@ __init int create_simplefb(const struct screen_info *si,
          * the part that is occupied by the framebuffer */
         len = mode->height * mode->stride;
         len = PAGE_ALIGN(len);
-        if (len > si->lfb_size << 16) {
+        if (len > (u64)si->lfb_size << 16) {
                 printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
                 return -EINVAL;
         }
 
         /* setup IORESOURCE_MEM as framebuffer memory */
         memset(&res, 0, sizeof(res));
-        res.flags = IORESOURCE_MEM;
+        res.flags = IORESOURCE_MEM | IORESOURCE_BUSY;
         res.name = simplefb_resname;
         res.start = si->lfb_base;
         res.end = si->lfb_base + len - 1;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a1216de9ffda..2b2fce1b2009 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3255,25 +3255,29 @@ static void vmx_decache_cr4_guest_bits(struct kvm_vcpu *vcpu)
 
 static void ept_load_pdptrs(struct kvm_vcpu *vcpu)
 {
+        struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+
         if (!test_bit(VCPU_EXREG_PDPTR,
                       (unsigned long *)&vcpu->arch.regs_dirty))
                 return;
 
         if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
-                vmcs_write64(GUEST_PDPTR0, vcpu->arch.mmu.pdptrs[0]);
-                vmcs_write64(GUEST_PDPTR1, vcpu->arch.mmu.pdptrs[1]);
-                vmcs_write64(GUEST_PDPTR2, vcpu->arch.mmu.pdptrs[2]);
-                vmcs_write64(GUEST_PDPTR3, vcpu->arch.mmu.pdptrs[3]);
+                vmcs_write64(GUEST_PDPTR0, mmu->pdptrs[0]);
+                vmcs_write64(GUEST_PDPTR1, mmu->pdptrs[1]);
+                vmcs_write64(GUEST_PDPTR2, mmu->pdptrs[2]);
+                vmcs_write64(GUEST_PDPTR3, mmu->pdptrs[3]);
         }
 }
 
 static void ept_save_pdptrs(struct kvm_vcpu *vcpu)
 {
+        struct kvm_mmu *mmu = vcpu->arch.walk_mmu;
+
         if (is_paging(vcpu) && is_pae(vcpu) && !is_long_mode(vcpu)) {
-                vcpu->arch.mmu.pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
-                vcpu->arch.mmu.pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
-                vcpu->arch.mmu.pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
-                vcpu->arch.mmu.pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
+                mmu->pdptrs[0] = vmcs_read64(GUEST_PDPTR0);
+                mmu->pdptrs[1] = vmcs_read64(GUEST_PDPTR1);
+                mmu->pdptrs[2] = vmcs_read64(GUEST_PDPTR2);
+                mmu->pdptrs[3] = vmcs_read64(GUEST_PDPTR3);
         }
 
         __set_bit(VCPU_EXREG_PDPTR,
@@ -5345,7 +5349,9 @@ static int handle_ept_violation(struct kvm_vcpu *vcpu)
          * There are errata that may cause this bit to not be set:
          * AAK134, BY25.
          */
-        if (exit_qualification & INTR_INFO_UNBLOCK_NMI)
+        if (!(to_vmx(vcpu)->idt_vectoring_info & VECTORING_INFO_VALID_MASK) &&
+                        cpu_has_virtual_nmis() &&
+                        (exit_qualification & INTR_INFO_UNBLOCK_NMI))
                 vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, GUEST_INTR_STATE_NMI);
 
         gpa = vmcs_read64(GUEST_PHYSICAL_ADDRESS);
@@ -7775,10 +7781,6 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                 vmcs_write64(GUEST_PDPTR1, vmcs12->guest_pdptr1);
                 vmcs_write64(GUEST_PDPTR2, vmcs12->guest_pdptr2);
                 vmcs_write64(GUEST_PDPTR3, vmcs12->guest_pdptr3);
-                __clear_bit(VCPU_EXREG_PDPTR,
-                                (unsigned long *)&vcpu->arch.regs_avail);
-                __clear_bit(VCPU_EXREG_PDPTR,
-                                (unsigned long *)&vcpu->arch.regs_dirty);
         }
 
         kvm_register_write(vcpu, VCPU_REGS_RSP, vmcs12->guest_rsp);
diff --git a/arch/x86/lib/msr-smp.c b/arch/x86/lib/msr-smp.c
index a6b1b86d2253..518532e6a3fa 100644
--- a/arch/x86/lib/msr-smp.c
+++ b/arch/x86/lib/msr-smp.c
@@ -47,6 +47,21 @@ int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
 }
 EXPORT_SYMBOL(rdmsr_on_cpu);
 
+int rdmsrl_on_cpu(unsigned int cpu, u32 msr_no, u64 *q)
+{
+        int err;
+        struct msr_info rv;
+
+        memset(&rv, 0, sizeof(rv));
+
+        rv.msr_no = msr_no;
+        err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
+        *q = rv.reg.q;
+
+        return err;
+}
+EXPORT_SYMBOL(rdmsrl_on_cpu);
+
 int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 {
         int err;
@@ -63,6 +78,22 @@ int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 }
 EXPORT_SYMBOL(wrmsr_on_cpu);
 
+int wrmsrl_on_cpu(unsigned int cpu, u32 msr_no, u64 q)
+{
+        int err;
+        struct msr_info rv;
+
+        memset(&rv, 0, sizeof(rv));
+
+        rv.msr_no = msr_no;
+        rv.reg.q = q;
+
+        err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
+
+        return err;
+}
+EXPORT_SYMBOL(wrmsrl_on_cpu);
+
 static void __rwmsr_on_cpus(const struct cpumask *mask, u32 msr_no,
                             struct msr *msrs,
                             void (*msr_func) (void *info))
@@ -159,6 +190,37 @@ int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 }
 EXPORT_SYMBOL(wrmsr_safe_on_cpu);
 
+int wrmsrl_safe_on_cpu(unsigned int cpu, u32 msr_no, u64 q)
+{
+        int err;
+        struct msr_info rv;
+
+        memset(&rv, 0, sizeof(rv));
+
+        rv.msr_no = msr_no;
+        rv.reg.q = q;
+
+        err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu, &rv, 1);
+
+        return err ? err : rv.err;
+}
+EXPORT_SYMBOL(wrmsrl_safe_on_cpu);
+
+int rdmsrl_safe_on_cpu(unsigned int cpu, u32 msr_no, u64 *q)
+{
+        int err;
+        struct msr_info rv;
+
+        memset(&rv, 0, sizeof(rv));
+
+        rv.msr_no = msr_no;
+        err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu, &rv, 1);
+        *q = rv.reg.q;
+
+        return err ? err : rv.err;
+}
+EXPORT_SYMBOL(rdmsrl_safe_on_cpu);
+
 /*
  * These variants are significantly slower, but allows control over
  * the entire 32-bit GPR set.
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 79c216aa0e2b..516593e1ce33 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -772,13 +772,21 @@ out:
         return;
 }
 
+static void bpf_jit_free_deferred(struct work_struct *work)
+{
+        struct sk_filter *fp = container_of(work, struct sk_filter, work);
+        unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+        struct bpf_binary_header *header = (void *)addr;
+
+        set_memory_rw(addr, header->pages);
+        module_free(NULL, header);
+        kfree(fp);
+}
+
 void bpf_jit_free(struct sk_filter *fp)
 {
         if (fp->bpf_func != sk_run_filter) {
-                unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
-                struct bpf_binary_header *header = (void *)addr;
-
-                set_memory_rw(addr, header->pages);
-                module_free(NULL, header);
+                INIT_WORK(&fp->work, bpf_jit_free_deferred);
+                schedule_work(&fp->work);
         }
 }
diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
index 5596c7bdd327..082e88129712 100644
--- a/arch/x86/pci/mmconfig-shared.c
+++ b/arch/x86/pci/mmconfig-shared.c
@@ -700,7 +700,7 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
         if (!(pci_probe & PCI_PROBE_MMCONF) || pci_mmcfg_arch_init_failed)
                 return -ENODEV;
 
-        if (start > end || !addr)
+        if (start > end)
                 return -EINVAL;
 
         mutex_lock(&pci_mmcfg_lock);
@@ -716,6 +716,11 @@ int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
                 return -EEXIST;
         }
 
+        if (!addr) {
+                mutex_unlock(&pci_mmcfg_lock);
+                return -EINVAL;
+        }
+
         rc = -EBUSY;
         cfg = pci_mmconfig_alloc(seg, start, end, addr);
         if (cfg == NULL) {
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 90f6ed127096..c7e22ab29a5a 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -912,10 +912,13 @@ void __init efi_enter_virtual_mode(void)
 
         for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                 md = p;
-                if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
-                    md->type != EFI_BOOT_SERVICES_CODE &&
-                    md->type != EFI_BOOT_SERVICES_DATA)
-                        continue;
+                if (!(md->attribute & EFI_MEMORY_RUNTIME)) {
+#ifdef CONFIG_X86_64
+                        if (md->type != EFI_BOOT_SERVICES_CODE &&
+                            md->type != EFI_BOOT_SERVICES_DATA)
+#endif
+                                continue;
+                }
 
                 size = md->num_pages << EFI_PAGE_SHIFT;
                 end = md->phys_addr + size;
diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c
index fef7d0ba7e3a..649a12befba9 100644
--- a/arch/x86/platform/olpc/olpc-xo15-sci.c
+++ b/arch/x86/platform/olpc/olpc-xo15-sci.c
@@ -40,16 +40,9 @@ static bool				lid_wake_on_close;
  */
 static int set_lid_wake_behavior(bool wake_on_close)
 {
-        struct acpi_object_list arg_list;
-        union acpi_object arg;
         acpi_status status;
 
-        arg_list.count          = 1;
-        arg_list.pointer        = &arg;
-        arg.type                = ACPI_TYPE_INTEGER;
-        arg.integer.value       = wake_on_close;
-
-        status = acpi_evaluate_object(NULL, "\\_SB.PCI0.LID.LIDW", &arg_list, NULL);
+        status = acpi_execute_simple_method(NULL, "\\_SB.PCI0.LID.LIDW", wake_on_close);
         if (ACPI_FAILURE(status)) {
                 pr_warning(PFX "failed to set lid behavior\n");
                 return 1;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 8b901e8d782d..a61c7d5811be 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -879,7 +879,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
-        int ret = 0;
 
         pfn = page_to_pfn(page);
         if (!PageHighMem(page)) {
@@ -926,8 +925,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
          * frontend pages while they are being shared with the backend,
          * because mfn_to_pfn (that ends up being called by GUPF) will
          * return the backend pfn rather than the frontend pfn. */
-        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
-        if (ret == 0 && get_phys_to_machine(pfn) == mfn)
+        pfn = mfn_to_pfn_no_overrides(mfn);
+        if (get_phys_to_machine(pfn) == mfn)
                 set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
 
         return 0;
@@ -942,7 +941,6 @@ int m2p_remove_override(struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
-        int ret = 0;
 
         pfn = page_to_pfn(page);
         mfn = get_phys_to_machine(pfn);
@@ -1029,8 +1027,8 @@ int m2p_remove_override(struct page *page,
          * the original pfn causes mfn_to_pfn(mfn) to return the frontend
          * pfn again. */
         mfn &= ~FOREIGN_FRAME_BIT;
-        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
-        if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+        pfn = mfn_to_pfn_no_overrides(mfn);
+        if (get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
                         m2p_find_override(mfn) == NULL)
                 set_phys_to_machine(pfn, mfn);
 
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index d1e4777b4e75..31d04758b76f 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -278,6 +278,15 @@ static void __init xen_smp_prepare_boot_cpu(void)
                    old memory can be recycled */
                 make_lowmem_page_readwrite(xen_initial_gdt);
 
+#ifdef CONFIG_X86_32
+                /*
+                 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
+                 * expects __USER_DS
+                 */
+                loadsegment(ds, __USER_DS);
+                loadsegment(es, __USER_DS);
+#endif
+
                 xen_filter_cpu_maps();
                 xen_setup_vcpu_info_placement();
         }
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 253f63fceea1..be6b86078957 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -259,6 +259,14 @@ void xen_uninit_lock_cpu(int cpu)
 }
 
 
+/*
+ * Our init of PV spinlocks is split in two init functions due to us
+ * using paravirt patching and jump labels patching and having to do
+ * all of this before SMP code is invoked.
+ *
+ * The paravirt patching needs to be done _before_ the alternative asm code
+ * is started, otherwise we would not patch the core kernel code.
+ */
 void __init xen_init_spinlocks(void)
 {
 
@@ -267,12 +275,26 @@ void __init xen_init_spinlocks(void)
                 return;
         }
 
-        static_key_slow_inc(&paravirt_ticketlocks_enabled);
-
         pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(xen_lock_spinning);
         pv_lock_ops.unlock_kick = xen_unlock_kick;
 }
 
+/*
+ * While the jump_label init code needs to happend _after_ the jump labels are
+ * enabled and before SMP is started. Hence we use pre-SMP initcall level
+ * init. We cannot do it in xen_init_spinlocks as that is done before
+ * jump labels are activated.
+ */
+static __init int xen_init_spinlocks_jump(void)
+{
+        if (!xen_pvspin)
+                return 0;
+
+        static_key_slow_inc(&paravirt_ticketlocks_enabled);
+        return 0;
+}
+early_initcall(xen_init_spinlocks_jump);
+
 static __init int xen_parse_nopvspin(char *arg)
 {
         xen_pvspin = false;
diff --git a/block/Kconfig b/block/Kconfig
index 7f38e40fee08..2429515c05c2 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -99,11 +99,16 @@ config BLK_DEV_THROTTLING
 
         See Documentation/cgroups/blkio-controller.txt for more information.
 
-config CMDLINE_PARSER
+config BLK_CMDLINE_PARSER
         bool "Block device command line partition parser"
         default n
         ---help---
-        Parsing command line, get the partitions information.
+        Enabling this option allows you to specify the partition layout from
+        the kernel boot args.  This is typically of use for embedded devices
+        which don't otherwise have any standardized method for listing the
+        partitions on a block device.
+
+        See Documentation/block/cmdline-partition.txt for more information.
 
 menu "Partition Types"
 
diff --git a/block/Makefile b/block/Makefile
index 4fa4be544ece..671a83d063a5 100644
--- a/block/Makefile
+++ b/block/Makefile
@@ -18,4 +18,4 @@ obj-$(CONFIG_IOSCHED_CFQ)	+= cfq-iosched.o
 
 obj-$(CONFIG_BLOCK_COMPAT)      += compat_ioctl.o
 obj-$(CONFIG_BLK_DEV_INTEGRITY) += blk-integrity.o
-obj-$(CONFIG_CMDLINE_PARSER)    += cmdline-parser.o
+obj-$(CONFIG_BLK_CMDLINE_PARSER)        += cmdline-parser.o
diff --git a/block/partitions/Kconfig b/block/partitions/Kconfig
index 87a32086535d..9b29a996c311 100644
--- a/block/partitions/Kconfig
+++ b/block/partitions/Kconfig
@@ -263,7 +263,7 @@ config SYSV68_PARTITION
 
 config CMDLINE_PARTITION
         bool "Command line partition support" if PARTITION_ADVANCED
-        select CMDLINE_PARSER
+        select BLK_CMDLINE_PARSER
         help
-          Say Y here if you would read the partitions table from bootargs.
+          Say Y here if you want to read the partition table from bootargs.
           The format for the command line is just like mtdparts.
diff --git a/block/partitions/cmdline.c b/block/partitions/cmdline.c
index 56cf4ffad51e..5141b563adf1 100644
--- a/block/partitions/cmdline.c
+++ b/block/partitions/cmdline.c
@@ -2,15 +2,15 @@
  * Copyright (C) 2013 HUAWEI
  * Author: Cai Zhiyong <caizhiyong@huawei.com>
  *
- * Read block device partition table from command line.
- * The partition used for fixed block device (eMMC) embedded device.
- * It is no MBR, save storage space. Bootloader can be easily accessed
+ * Read block device partition table from the command line.
+ * Typically used for fixed block (eMMC) embedded devices.
+ * It has no MBR, so saves storage space. Bootloader can be easily accessed
  * by absolute address of data on the block device.
  * Users can easily change the partition.
  *
  * The format for the command line is just like mtdparts.
  *
- * Verbose config please reference "Documentation/block/cmdline-partition.txt"
+ * For further information, see "Documentation/block/cmdline-partition.txt"
  *
  */
 
diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 1eb09ee5311b..a8287b49d062 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -222,11 +222,16 @@ check_hybrid:
          * the disk size.
          *
          * Hybrid MBRs do not necessarily comply with this.
+         *
+         * Consider a bad value here to be a warning to support dd'ing
+         * an image from a smaller disk to a larger disk.
          */
         if (ret == GPT_MBR_PROTECTIVE) {
                 sz = le32_to_cpu(mbr->partition_record[part].size_in_lba);
                 if (sz != (uint32_t) total_sectors - 1 && sz != 0xFFFFFFFF)
-                        ret = 0;
+                        pr_debug("GPT: mbr size in lba (%u) different than whole disk (%u).\n",
+                                 sz, min_t(uint32_t,
+                                           total_sectors - 1, 0xFFFFFFFF));
         }
 done:
         return ret;
diff --git a/drivers/Kconfig b/drivers/Kconfig
index aa43b911ccef..969e9871785c 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -166,4 +166,6 @@ source "drivers/reset/Kconfig"
 
 source "drivers/fmc/Kconfig"
 
+source "drivers/powercap/Kconfig"
+
 endmenu
diff --git a/drivers/Makefile b/drivers/Makefile
index ab93de8297f1..34c1d554f69b 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -152,3 +152,4 @@ obj-$(CONFIG_VME_BUS)		+= vme/
 obj-$(CONFIG_IPACK_BUS)         += ipack/
 obj-$(CONFIG_NTB)               += ntb/
 obj-$(CONFIG_FMC)               += fmc/
+obj-$(CONFIG_POWERCAP)          += powercap/
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 22327e6a7236..589da059ce39 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -24,7 +24,7 @@ menuconfig ACPI
           are configured, ACPI is used.
 
           The project home page for the Linux ACPI subsystem is here:
-          <http://www.lesswatts.org/projects/acpi/>
+          <https://01.org/linux-acpi>
 
           Linux support for ACPI is based on Intel Corporation's ACPI
           Component Architecture (ACPI CA).  For more information on the
@@ -56,23 +56,6 @@ config ACPI_PROCFS
 
           Say N to delete /proc/acpi/ files that have moved to /sys/
 
-config ACPI_PROCFS_POWER
-        bool "Deprecated power /proc/acpi directories"
-        depends on PROC_FS
-        help
-          For backwards compatibility, this option allows
-          deprecated power /proc/acpi/ directories to exist, even when
-          they have been replaced by functions in /sys.
-          The deprecated directories (and their replacements) include:
-          /proc/acpi/battery/* (/sys/class/power_supply/*)
-          /proc/acpi/ac_adapter/* (sys/class/power_supply/*)
-          This option has no effect on /proc/acpi/ directories
-          and functions, which do not yet exist in /sys
-          This option, together with the proc directories, will be
-          deleted in 2.6.39.
-
-          Say N to delete power /proc/acpi/ directories that have moved to /sys/
-
 config ACPI_EC_DEBUGFS
         tristate "EC read/write access through /sys/kernel/debug/ec"
         default n
@@ -123,9 +106,9 @@ config ACPI_BUTTON
         default y
         help
           This driver handles events on the power, sleep, and lid buttons.
-          A daemon reads /proc/acpi/event and perform user-defined actions
-          such as shutting down the system.  This is necessary for
-          software-controlled poweroff.
+          A daemon reads events from input devices or via netlink and
+          performs user-defined actions such as shutting down the system.
+          This is necessary for software-controlled poweroff.
 
           To compile this driver as a module, choose M here:
           the module will be called button.
@@ -175,9 +158,10 @@ config ACPI_PROCESSOR
 
           To compile this driver as a module, choose M here:
           the module will be called processor.
+
 config ACPI_IPMI
         tristate "IPMI"
-        depends on IPMI_SI && IPMI_HANDLER
+        depends on IPMI_SI
         default n
         help
           This driver enables the ACPI to access the BMC controller. And it
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index cdaf68b58b00..a55fc06db4ae 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -47,7 +47,6 @@ acpi-y				+= sysfs.o
 acpi-$(CONFIG_X86)              += acpi_cmos_rtc.o
 acpi-$(CONFIG_DEBUG_FS)         += debugfs.o
 acpi-$(CONFIG_ACPI_NUMA)        += numa.o
-acpi-$(CONFIG_ACPI_PROCFS_POWER) += cm_sbs.o
 ifdef CONFIG_ACPI_VIDEO
 acpi-y                          += video_detect.o
 endif
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index f37beaa32750..b9f0d5f4bba5 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -30,10 +30,7 @@
 #include <linux/types.h>
 #include <linux/dmi.h>
 #include <linux/delay.h>
-#ifdef CONFIG_ACPI_PROCFS_POWER
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#endif
+#include <linux/platform_device.h>
 #include <linux/power_supply.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
@@ -55,75 +52,30 @@ MODULE_AUTHOR("Paul Diefenbaugh");
 MODULE_DESCRIPTION("ACPI AC Adapter Driver");
 MODULE_LICENSE("GPL");
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-extern struct proc_dir_entry *acpi_lock_ac_dir(void);
-extern void *acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir);
-static int acpi_ac_open_fs(struct inode *inode, struct file *file);
-#endif
-
-static int acpi_ac_add(struct acpi_device *device);
-static int acpi_ac_remove(struct acpi_device *device);
-static void acpi_ac_notify(struct acpi_device *device, u32 event);
-
-static const struct acpi_device_id ac_device_ids[] = {
-        {"ACPI0003", 0},
-        {"", 0},
-};
-MODULE_DEVICE_TABLE(acpi, ac_device_ids);
-
-#ifdef CONFIG_PM_SLEEP
-static int acpi_ac_resume(struct device *dev);
-#endif
-static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
-
 static int ac_sleep_before_get_state_ms;
 
-static struct acpi_driver acpi_ac_driver = {
-        .name = "ac",
-        .class = ACPI_AC_CLASS,
-        .ids = ac_device_ids,
-        .flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
-        .ops = {
-                .add = acpi_ac_add,
-                .remove = acpi_ac_remove,
-                .notify = acpi_ac_notify,
-                },
-        .drv.pm = &acpi_ac_pm,
-};
-
 struct acpi_ac {
         struct power_supply charger;
-        struct acpi_device * device;
+        struct acpi_device *adev;
+        struct platform_device *pdev;
         unsigned long long state;
 };
 
 #define to_acpi_ac(x) container_of(x, struct acpi_ac, charger)
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-static const struct file_operations acpi_ac_fops = {
-        .owner = THIS_MODULE,
-        .open = acpi_ac_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-#endif
-
 /* --------------------------------------------------------------------------
                                AC Adapter Management
    -------------------------------------------------------------------------- */
 
 static int acpi_ac_get_state(struct acpi_ac *ac)
 {
-        acpi_status status = AE_OK;
-
-
-        if (!ac)
-                return -EINVAL;
+        acpi_status status;
 
-        status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL, &ac->state);
+        status = acpi_evaluate_integer(ac->adev->handle, "_PSR", NULL,
+                                       &ac->state);
         if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status, "Error reading AC Adapter state"));
+                ACPI_EXCEPTION((AE_INFO, status,
+                                "Error reading AC Adapter state"));
                 ac->state = ACPI_AC_STATUS_UNKNOWN;
                 return -ENODEV;
         }
@@ -160,91 +112,13 @@ static enum power_supply_property ac_props[] = {
         POWER_SUPPLY_PROP_ONLINE,
 };
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-/* --------------------------------------------------------------------------
-                              FS Interface (/proc)
-   -------------------------------------------------------------------------- */
-
-static struct proc_dir_entry *acpi_ac_dir;
-
-static int acpi_ac_seq_show(struct seq_file *seq, void *offset)
-{
-        struct acpi_ac *ac = seq->private;
-
-
-        if (!ac)
-                return 0;
-
-        if (acpi_ac_get_state(ac)) {
-                seq_puts(seq, "ERROR: Unable to read AC Adapter state\n");
-                return 0;
-        }
-
-        seq_puts(seq, "state:                   ");
-        switch (ac->state) {
-        case ACPI_AC_STATUS_OFFLINE:
-                seq_puts(seq, "off-line\n");
-                break;
-        case ACPI_AC_STATUS_ONLINE:
-                seq_puts(seq, "on-line\n");
-                break;
-        default:
-                seq_puts(seq, "unknown\n");
-                break;
-        }
-
-        return 0;
-}
-
-static int acpi_ac_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_ac_seq_show, PDE_DATA(inode));
-}
-
-static int acpi_ac_add_fs(struct acpi_device *device)
-{
-        struct proc_dir_entry *entry = NULL;
-
-        printk(KERN_WARNING PREFIX "Deprecated procfs I/F for AC is loaded,"
-                        " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
-        if (!acpi_device_dir(device)) {
-                acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device),
-                                                     acpi_ac_dir);
-                if (!acpi_device_dir(device))
-                        return -ENODEV;
-        }
-
-        /* 'state' [R] */
-        entry = proc_create_data(ACPI_AC_FILE_STATE,
-                                 S_IRUGO, acpi_device_dir(device),
-                                 &acpi_ac_fops, acpi_driver_data(device));
-        if (!entry)
-                return -ENODEV;
-        return 0;
-}
-
-static int acpi_ac_remove_fs(struct acpi_device *device)
-{
-
-        if (acpi_device_dir(device)) {
-                remove_proc_entry(ACPI_AC_FILE_STATE, acpi_device_dir(device));
-
-                remove_proc_entry(acpi_device_bid(device), acpi_ac_dir);
-                acpi_device_dir(device) = NULL;
-        }
-
-        return 0;
-}
-#endif
-
 /* --------------------------------------------------------------------------
                                    Driver Model
    -------------------------------------------------------------------------- */
 
-static void acpi_ac_notify(struct acpi_device *device, u32 event)
+static void acpi_ac_notify_handler(acpi_handle handle, u32 event, void *data)
 {
-        struct acpi_ac *ac = acpi_driver_data(device);
-
+        struct acpi_ac *ac = data;
 
         if (!ac)
                 return;
@@ -267,10 +141,10 @@ static void acpi_ac_notify(struct acpi_device *device, u32 event)
                         msleep(ac_sleep_before_get_state_ms);
 
                 acpi_ac_get_state(ac);
-                acpi_bus_generate_netlink_event(device->pnp.device_class,
-                                                  dev_name(&device->dev), event,
-                                                  (u32) ac->state);
-                acpi_notifier_call_chain(device, event, (u32) ac->state);
+                acpi_bus_generate_netlink_event(ac->adev->pnp.device_class,
+                                                dev_name(&ac->pdev->dev),
+                                                event, (u32) ac->state);
+                acpi_notifier_call_chain(ac->adev, event, (u32) ac->state);
                 kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
         }
 
@@ -295,53 +169,55 @@ static struct dmi_system_id ac_dmi_table[] = {
         {},
 };
 
-static int acpi_ac_add(struct acpi_device *device)
+static int acpi_ac_probe(struct platform_device *pdev)
 {
         int result = 0;
         struct acpi_ac *ac = NULL;
+        struct acpi_device *adev;
 
-
-        if (!device)
+        if (!pdev)
                 return -EINVAL;
 
+        result = acpi_bus_get_device(ACPI_HANDLE(&pdev->dev), &adev);
+        if (result)
+                return -ENODEV;
+
         ac = kzalloc(sizeof(struct acpi_ac), GFP_KERNEL);
         if (!ac)
                 return -ENOMEM;
 
-        ac->device = device;
-        strcpy(acpi_device_name(device), ACPI_AC_DEVICE_NAME);
-        strcpy(acpi_device_class(device), ACPI_AC_CLASS);
-        device->driver_data = ac;
+        strcpy(acpi_device_name(adev), ACPI_AC_DEVICE_NAME);
+        strcpy(acpi_device_class(adev), ACPI_AC_CLASS);
+        ac->adev = adev;
+        ac->pdev = pdev;
+        platform_set_drvdata(pdev, ac);
 
         result = acpi_ac_get_state(ac);
         if (result)
                 goto end;
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        result = acpi_ac_add_fs(device);
-#endif
-        if (result)
-                goto end;
-        ac->charger.name = acpi_device_bid(device);
+        ac->charger.name = acpi_device_bid(adev);
         ac->charger.type = POWER_SUPPLY_TYPE_MAINS;
         ac->charger.properties = ac_props;
         ac->charger.num_properties = ARRAY_SIZE(ac_props);
         ac->charger.get_property = get_ac_property;
-        result = power_supply_register(&ac->device->dev, &ac->charger);
+        result = power_supply_register(&pdev->dev, &ac->charger);
         if (result)
                 goto end;
 
+        result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
+                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler, ac);
+        if (result) {
+                power_supply_unregister(&ac->charger);
+                goto end;
+        }
         printk(KERN_INFO PREFIX "%s [%s] (%s)\n",
-               acpi_device_name(device), acpi_device_bid(device),
+               acpi_device_name(adev), acpi_device_bid(adev),
                ac->state ? "on-line" : "off-line");
 
-      end:
-        if (result) {
-#ifdef CONFIG_ACPI_PROCFS_POWER
-                acpi_ac_remove_fs(device);
-#endif
+end:
+        if (result)
                 kfree(ac);
-        }
 
         dmi_check_system(ac_dmi_table);
         return result;
@@ -356,7 +232,7 @@ static int acpi_ac_resume(struct device *dev)
         if (!dev)
                 return -EINVAL;
 
-        ac = acpi_driver_data(to_acpi_device(dev));
+        ac = platform_get_drvdata(to_platform_device(dev));
         if (!ac)
                 return -EINVAL;
 
@@ -368,28 +244,44 @@ static int acpi_ac_resume(struct device *dev)
         return 0;
 }
 #endif
+static SIMPLE_DEV_PM_OPS(acpi_ac_pm_ops, NULL, acpi_ac_resume);
 
-static int acpi_ac_remove(struct acpi_device *device)
+static int acpi_ac_remove(struct platform_device *pdev)
 {
-        struct acpi_ac *ac = NULL;
-
+        struct acpi_ac *ac;
 
-        if (!device || !acpi_driver_data(device))
+        if (!pdev)
                 return -EINVAL;
 
-        ac = acpi_driver_data(device);
+        acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
+                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler);
 
+        ac = platform_get_drvdata(pdev);
         if (ac->charger.dev)
                 power_supply_unregister(&ac->charger);
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_ac_remove_fs(device);
-#endif
 
         kfree(ac);
 
         return 0;
 }
 
+static const struct acpi_device_id acpi_ac_match[] = {
+        { "ACPI0003", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(acpi, acpi_ac_match);
+
+static struct platform_driver acpi_ac_driver = {
+        .probe          = acpi_ac_probe,
+        .remove         = acpi_ac_remove,
+        .driver         = {
+                .name   = "acpi-ac",
+                .owner  = THIS_MODULE,
+                .pm     = &acpi_ac_pm_ops,
+                .acpi_match_table = ACPI_PTR(acpi_ac_match),
+        },
+};
+
 static int __init acpi_ac_init(void)
 {
         int result;
@@ -397,34 +289,16 @@ static int __init acpi_ac_init(void)
         if (acpi_disabled)
                 return -ENODEV;
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_ac_dir = acpi_lock_ac_dir();
-        if (!acpi_ac_dir)
+        result = platform_driver_register(&acpi_ac_driver);
+        if (result < 0)
                 return -ENODEV;
-#endif
-
-        result = acpi_bus_register_driver(&acpi_ac_driver);
-        if (result < 0) {
-#ifdef CONFIG_ACPI_PROCFS_POWER
-                acpi_unlock_ac_dir(acpi_ac_dir);
-#endif
-                return -ENODEV;
-        }
 
         return 0;
 }
 
 static void __exit acpi_ac_exit(void)
 {
-
-        acpi_bus_unregister_driver(&acpi_ac_driver);
-
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_unlock_ac_dir(acpi_ac_dir);
-#endif
-
-        return;
+        platform_driver_unregister(&acpi_ac_driver);
 }
-
 module_init(acpi_ac_init);
 module_exit(acpi_ac_exit);
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index f40acef80269..ac0f52f6df2b 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -1,8 +1,9 @@
 /*
  *  acpi_ipmi.c - ACPI IPMI opregion
  *
- *  Copyright (C) 2010 Intel Corporation
- *  Copyright (C) 2010 Zhao Yakui <yakui.zhao@intel.com>
+ *  Copyright (C) 2010, 2013 Intel Corporation
+ *    Author: Zhao Yakui <yakui.zhao@intel.com>
+ *            Lv Zheng <lv.zheng@intel.com>
  *
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *
@@ -23,59 +24,58 @@
  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  */
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/delay.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/interrupt.h>
-#include <linux/list.h>
-#include <linux/spinlock.h>
-#include <linux/io.h>
-#include <acpi/acpi_bus.h>
-#include <acpi/acpi_drivers.h>
+#include <linux/acpi.h>
 #include <linux/ipmi.h>
-#include <linux/device.h>
-#include <linux/pnp.h>
+#include <linux/spinlock.h>
 
 MODULE_AUTHOR("Zhao Yakui");
 MODULE_DESCRIPTION("ACPI IPMI Opregion driver");
 MODULE_LICENSE("GPL");
 
-#define IPMI_FLAGS_HANDLER_INSTALL      0
-
 #define ACPI_IPMI_OK                    0
 #define ACPI_IPMI_TIMEOUT               0x10
 #define ACPI_IPMI_UNKNOWN               0x07
 /* the IPMI timeout is 5s */
-#define IPMI_TIMEOUT                    (5 * HZ)
+#define IPMI_TIMEOUT                    (5000)
+#define ACPI_IPMI_MAX_MSG_LENGTH        64
 
 struct acpi_ipmi_device {
         /* the device list attached to driver_data.ipmi_devices */
         struct list_head head;
+
         /* the IPMI request message list */
         struct list_head tx_msg_list;
-        struct mutex    tx_msg_lock;
+
+        spinlock_t tx_msg_lock;
         acpi_handle handle;
-        struct pnp_dev *pnp_dev;
-        ipmi_user_t     user_interface;
+        struct device *dev;
+        ipmi_user_t user_interface;
         int ipmi_ifnum; /* IPMI interface number */
         long curr_msgid;
-        unsigned long flags;
-        struct ipmi_smi_info smi_data;
+        bool dead;
+        struct kref kref;
 };
 
 struct ipmi_driver_data {
-        struct list_head        ipmi_devices;
-        struct ipmi_smi_watcher bmc_events;
-        struct ipmi_user_hndl   ipmi_hndlrs;
-        struct mutex            ipmi_lock;
+        struct list_head ipmi_devices;
+        struct ipmi_smi_watcher bmc_events;
+        struct ipmi_user_hndl ipmi_hndlrs;
+        struct mutex ipmi_lock;
+
+        /*
+         * NOTE: IPMI System Interface Selection
+         * There is no system interface specified by the IPMI operation
+         * region access.  We try to select one system interface with ACPI
+         * handle set.  IPMI messages passed from the ACPI codes are sent
+         * to this selected global IPMI system interface.
+         */
+        struct acpi_ipmi_device *selected_smi;
 };
 
 struct acpi_ipmi_msg {
         struct list_head head;
+
         /*
          * General speaking the addr type should be SI_ADDR_TYPE. And
          * the addr channel should be BMC.
@@ -85,30 +85,31 @@ struct acpi_ipmi_msg {
          */
         struct ipmi_addr addr;
         long tx_msgid;
+
         /* it is used to track whether the IPMI message is finished */
         struct completion tx_complete;
+
         struct kernel_ipmi_msg tx_message;
-        int     msg_done;
-        /* tx data . And copy it from ACPI object buffer */
-        u8      tx_data[64];
-        int     tx_len;
-        u8      rx_data[64];
-        int     rx_len;
+        int msg_done;
+
+        /* tx/rx data . And copy it from/to ACPI object buffer */
+        u8 data[ACPI_IPMI_MAX_MSG_LENGTH];
+        u8 rx_len;
+
         struct acpi_ipmi_device *device;
+        struct kref kref;
 };
 
 /* IPMI request/response buffer per ACPI 4.0, sec 5.5.2.4.3.2 */
 struct acpi_ipmi_buffer {
         u8 status;
         u8 length;
-        u8 data[64];
+        u8 data[ACPI_IPMI_MAX_MSG_LENGTH];
 };
 
 static void ipmi_register_bmc(int iface, struct device *dev);
 static void ipmi_bmc_gone(int iface);
 static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data);
-static void acpi_add_ipmi_device(struct acpi_ipmi_device *ipmi_device);
-static void acpi_remove_ipmi_device(struct acpi_ipmi_device *ipmi_device);
 
 static struct ipmi_driver_data driver_data = {
         .ipmi_devices = LIST_HEAD_INIT(driver_data.ipmi_devices),
@@ -120,50 +121,174 @@ static struct ipmi_driver_data driver_data = {
         .ipmi_hndlrs = {
                 .ipmi_recv_hndl = ipmi_msg_handler,
         },
+        .ipmi_lock = __MUTEX_INITIALIZER(driver_data.ipmi_lock)
 };
 
-static struct acpi_ipmi_msg *acpi_alloc_ipmi_msg(struct acpi_ipmi_device *ipmi)
+static struct acpi_ipmi_device *
+ipmi_dev_alloc(int iface, struct device *dev, acpi_handle handle)
 {
+        struct acpi_ipmi_device *ipmi_device;
+        int err;
+        ipmi_user_t user;
+
+        ipmi_device = kzalloc(sizeof(*ipmi_device), GFP_KERNEL);
+        if (!ipmi_device)
+                return NULL;
+
+        kref_init(&ipmi_device->kref);
+        INIT_LIST_HEAD(&ipmi_device->head);
+        INIT_LIST_HEAD(&ipmi_device->tx_msg_list);
+        spin_lock_init(&ipmi_device->tx_msg_lock);
+        ipmi_device->handle = handle;
+        ipmi_device->dev = get_device(dev);
+        ipmi_device->ipmi_ifnum = iface;
+
+        err = ipmi_create_user(iface, &driver_data.ipmi_hndlrs,
+                               ipmi_device, &user);
+        if (err) {
+                put_device(dev);
+                kfree(ipmi_device);
+                return NULL;
+        }
+        ipmi_device->user_interface = user;
+
+        return ipmi_device;
+}
+
+static void ipmi_dev_release(struct acpi_ipmi_device *ipmi_device)
+{
+        ipmi_destroy_user(ipmi_device->user_interface);
+        put_device(ipmi_device->dev);
+        kfree(ipmi_device);
+}
+
+static void ipmi_dev_release_kref(struct kref *kref)
+{
+        struct acpi_ipmi_device *ipmi =
+                container_of(kref, struct acpi_ipmi_device, kref);
+
+        ipmi_dev_release(ipmi);
+}
+
+static void __ipmi_dev_kill(struct acpi_ipmi_device *ipmi_device)
+{
+        list_del(&ipmi_device->head);
+        if (driver_data.selected_smi == ipmi_device)
+                driver_data.selected_smi = NULL;
+
+        /*
+         * Always setting dead flag after deleting from the list or
+         * list_for_each_entry() codes must get changed.
+         */
+        ipmi_device->dead = true;
+}
+
+static struct acpi_ipmi_device *acpi_ipmi_dev_get(void)
+{
+        struct acpi_ipmi_device *ipmi_device = NULL;
+
+        mutex_lock(&driver_data.ipmi_lock);
+        if (driver_data.selected_smi) {
+                ipmi_device = driver_data.selected_smi;
+                kref_get(&ipmi_device->kref);
+        }
+        mutex_unlock(&driver_data.ipmi_lock);
+
+        return ipmi_device;
+}
+
+static void acpi_ipmi_dev_put(struct acpi_ipmi_device *ipmi_device)
+{
+        kref_put(&ipmi_device->kref, ipmi_dev_release_kref);
+}
+
+static struct acpi_ipmi_msg *ipmi_msg_alloc(void)
+{
+        struct acpi_ipmi_device *ipmi;
         struct acpi_ipmi_msg *ipmi_msg;
-        struct pnp_dev *pnp_dev = ipmi->pnp_dev;
+
+        ipmi = acpi_ipmi_dev_get();
+        if (!ipmi)
+                return NULL;
 
         ipmi_msg = kzalloc(sizeof(struct acpi_ipmi_msg), GFP_KERNEL);
-        if (!ipmi_msg)  {
-                dev_warn(&pnp_dev->dev, "Can't allocate memory for ipmi_msg\n");
+        if (!ipmi_msg) {
+                acpi_ipmi_dev_put(ipmi);
                 return NULL;
         }
+
+        kref_init(&ipmi_msg->kref);
         init_completion(&ipmi_msg->tx_complete);
         INIT_LIST_HEAD(&ipmi_msg->head);
         ipmi_msg->device = ipmi;
+        ipmi_msg->msg_done = ACPI_IPMI_UNKNOWN;
+
         return ipmi_msg;
 }
 
-#define         IPMI_OP_RGN_NETFN(offset)       ((offset >> 8) & 0xff)
-#define         IPMI_OP_RGN_CMD(offset)         (offset & 0xff)
-static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
-                                acpi_physical_address address,
-                                acpi_integer *value)
+static void ipmi_msg_release(struct acpi_ipmi_msg *tx_msg)
+{
+        acpi_ipmi_dev_put(tx_msg->device);
+        kfree(tx_msg);
+}
+
+static void ipmi_msg_release_kref(struct kref *kref)
+{
+        struct acpi_ipmi_msg *tx_msg =
+                container_of(kref, struct acpi_ipmi_msg, kref);
+
+        ipmi_msg_release(tx_msg);
+}
+
+static struct acpi_ipmi_msg *acpi_ipmi_msg_get(struct acpi_ipmi_msg *tx_msg)
+{
+        kref_get(&tx_msg->kref);
+
+        return tx_msg;
+}
+
+static void acpi_ipmi_msg_put(struct acpi_ipmi_msg *tx_msg)
+{
+        kref_put(&tx_msg->kref, ipmi_msg_release_kref);
+}
+
+#define IPMI_OP_RGN_NETFN(offset)       ((offset >> 8) & 0xff)
+#define IPMI_OP_RGN_CMD(offset)         (offset & 0xff)
+static int acpi_format_ipmi_request(struct acpi_ipmi_msg *tx_msg,
+                                    acpi_physical_address address,
+                                    acpi_integer *value)
 {
         struct kernel_ipmi_msg *msg;
         struct acpi_ipmi_buffer *buffer;
         struct acpi_ipmi_device *device;
+        unsigned long flags;
 
         msg = &tx_msg->tx_message;
+
         /*
          * IPMI network function and command are encoded in the address
          * within the IPMI OpRegion; see ACPI 4.0, sec 5.5.2.4.3.
          */
         msg->netfn = IPMI_OP_RGN_NETFN(address);
         msg->cmd = IPMI_OP_RGN_CMD(address);
-        msg->data = tx_msg->tx_data;
+        msg->data = tx_msg->data;
+
         /*
          * value is the parameter passed by the IPMI opregion space handler.
          * It points to the IPMI request message buffer
          */
         buffer = (struct acpi_ipmi_buffer *)value;
+
         /* copy the tx message data */
+        if (buffer->length > ACPI_IPMI_MAX_MSG_LENGTH) {
+                dev_WARN_ONCE(tx_msg->device->dev, true,
+                              "Unexpected request (msg len %d).\n",
+                              buffer->length);
+                return -EINVAL;
+        }
         msg->data_len = buffer->length;
-        memcpy(tx_msg->tx_data, buffer->data, msg->data_len);
+        memcpy(tx_msg->data, buffer->data, msg->data_len);
+
         /*
          * now the default type is SYSTEM_INTERFACE and channel type is BMC.
          * If the netfn is APP_REQUEST and the cmd is SEND_MESSAGE,
@@ -177,14 +302,17 @@ static void acpi_format_ipmi_msg(struct acpi_ipmi_msg *tx_msg,
 
         /* Get the msgid */
         device = tx_msg->device;
-        mutex_lock(&device->tx_msg_lock);
+
+        spin_lock_irqsave(&device->tx_msg_lock, flags);
         device->curr_msgid++;
         tx_msg->tx_msgid = device->curr_msgid;
-        mutex_unlock(&device->tx_msg_lock);
+        spin_unlock_irqrestore(&device->tx_msg_lock, flags);
+
+        return 0;
 }
 
 static void acpi_format_ipmi_response(struct acpi_ipmi_msg *msg,
-                acpi_integer *value, int rem_time)
+                                      acpi_integer *value)
 {
         struct acpi_ipmi_buffer *buffer;
 
@@ -193,109 +321,158 @@ static void acpi_format_ipmi_response(struct acpi_ipmi_msg *msg,
          * IPMI message returned by IPMI command.
          */
         buffer = (struct acpi_ipmi_buffer *)value;
-        if (!rem_time && !msg->msg_done) {
-                buffer->status = ACPI_IPMI_TIMEOUT;
-                return;
-        }
+
         /*
-         * If the flag of msg_done is not set or the recv length is zero, it
-         * means that the IPMI command is not executed correctly.
-         * The status code will be ACPI_IPMI_UNKNOWN.
+         * If the flag of msg_done is not set, it means that the IPMI command is
+         * not executed correctly.
          */
-        if (!msg->msg_done || !msg->rx_len) {
-                buffer->status = ACPI_IPMI_UNKNOWN;
+        buffer->status = msg->msg_done;
+        if (msg->msg_done != ACPI_IPMI_OK)
                 return;
-        }
+
         /*
          * If the IPMI response message is obtained correctly, the status code
          * will be ACPI_IPMI_OK
          */
-        buffer->status = ACPI_IPMI_OK;
         buffer->length = msg->rx_len;
-        memcpy(buffer->data, msg->rx_data, msg->rx_len);
+        memcpy(buffer->data, msg->data, msg->rx_len);
 }
 
 static void ipmi_flush_tx_msg(struct acpi_ipmi_device *ipmi)
 {
-        struct acpi_ipmi_msg *tx_msg, *temp;
-        int count = HZ / 10;
-        struct pnp_dev *pnp_dev = ipmi->pnp_dev;
+        struct acpi_ipmi_msg *tx_msg;
+        unsigned long flags;
+
+        /*
+         * NOTE: On-going ipmi_recv_msg
+         * ipmi_msg_handler() may still be invoked by ipmi_si after
+         * flushing.  But it is safe to do a fast flushing on module_exit()
+         * without waiting for all ipmi_recv_msg(s) to complete from
+         * ipmi_msg_handler() as it is ensured by ipmi_si that all
+         * ipmi_recv_msg(s) are freed after invoking ipmi_destroy_user().
+         */
+        spin_lock_irqsave(&ipmi->tx_msg_lock, flags);
+        while (!list_empty(&ipmi->tx_msg_list)) {
+                tx_msg = list_first_entry(&ipmi->tx_msg_list,
+                                          struct acpi_ipmi_msg,
+                                          head);
+                list_del(&tx_msg->head);
+                spin_unlock_irqrestore(&ipmi->tx_msg_lock, flags);
 
-        list_for_each_entry_safe(tx_msg, temp, &ipmi->tx_msg_list, head) {
                 /* wake up the sleep thread on the Tx msg */
                 complete(&tx_msg->tx_complete);
+                acpi_ipmi_msg_put(tx_msg);
+                spin_lock_irqsave(&ipmi->tx_msg_lock, flags);
         }
+        spin_unlock_irqrestore(&ipmi->tx_msg_lock, flags);
+}
 
-        /* wait for about 100ms to flush the tx message list */
-        while (count--) {
-                if (list_empty(&ipmi->tx_msg_list))
+static void ipmi_cancel_tx_msg(struct acpi_ipmi_device *ipmi,
+                               struct acpi_ipmi_msg *msg)
+{
+        struct acpi_ipmi_msg *tx_msg, *temp;
+        bool msg_found = false;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ipmi->tx_msg_lock, flags);
+        list_for_each_entry_safe(tx_msg, temp, &ipmi->tx_msg_list, head) {
+                if (msg == tx_msg) {
+                        msg_found = true;
+                        list_del(&tx_msg->head);
                         break;
-                schedule_timeout(1);
+                }
         }
-        if (!list_empty(&ipmi->tx_msg_list))
-                dev_warn(&pnp_dev->dev, "tx msg list is not NULL\n");
+        spin_unlock_irqrestore(&ipmi->tx_msg_lock, flags);
+
+        if (msg_found)
+                acpi_ipmi_msg_put(tx_msg);
 }
 
 static void ipmi_msg_handler(struct ipmi_recv_msg *msg, void *user_msg_data)
 {
         struct acpi_ipmi_device *ipmi_device = user_msg_data;
-        int msg_found = 0;
-        struct acpi_ipmi_msg *tx_msg;
-        struct pnp_dev *pnp_dev = ipmi_device->pnp_dev;
+        bool msg_found = false;
+        struct acpi_ipmi_msg *tx_msg, *temp;
+        struct device *dev = ipmi_device->dev;
+        unsigned long flags;
 
         if (msg->user != ipmi_device->user_interface) {
-                dev_warn(&pnp_dev->dev, "Unexpected response is returned. "
-                        "returned user %p, expected user %p\n",
-                        msg->user, ipmi_device->user_interface);
-                ipmi_free_recv_msg(msg);
-                return;
+                dev_warn(dev,
+                         "Unexpected response is returned. returned user %p, expected user %p\n",
+                         msg->user, ipmi_device->user_interface);
+                goto out_msg;
         }
-        mutex_lock(&ipmi_device->tx_msg_lock);
-        list_for_each_entry(tx_msg, &ipmi_device->tx_msg_list, head) {
+
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
+        list_for_each_entry_safe(tx_msg, temp, &ipmi_device->tx_msg_list, head) {
                 if (msg->msgid == tx_msg->tx_msgid) {
-                        msg_found = 1;
+                        msg_found = true;
+                        list_del(&tx_msg->head);
                         break;
                 }
         }
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
 
-        mutex_unlock(&ipmi_device->tx_msg_lock);
         if (!msg_found) {
-                dev_warn(&pnp_dev->dev, "Unexpected response (msg id %ld) is "
-                        "returned.\n", msg->msgid);
-                ipmi_free_recv_msg(msg);
-                return;
+                dev_warn(dev,
+                         "Unexpected response (msg id %ld) is returned.\n",
+                         msg->msgid);
+                goto out_msg;
+        }
+
+        /* copy the response data to Rx_data buffer */
+        if (msg->msg.data_len > ACPI_IPMI_MAX_MSG_LENGTH) {
+                dev_WARN_ONCE(dev, true,
+                              "Unexpected response (msg len %d).\n",
+                              msg->msg.data_len);
+                goto out_comp;
         }
 
-        if (msg->msg.data_len) {
-                /* copy the response data to Rx_data buffer */
-                memcpy(tx_msg->rx_data, msg->msg_data, msg->msg.data_len);
-                tx_msg->rx_len = msg->msg.data_len;
-                tx_msg->msg_done = 1;
+        /* response msg is an error msg */
+        msg->recv_type = IPMI_RESPONSE_RECV_TYPE;
+        if (msg->recv_type == IPMI_RESPONSE_RECV_TYPE &&
+            msg->msg.data_len == 1) {
+                if (msg->msg.data[0] == IPMI_TIMEOUT_COMPLETION_CODE) {
+                        dev_WARN_ONCE(dev, true,
+                                      "Unexpected response (timeout).\n");
+                        tx_msg->msg_done = ACPI_IPMI_TIMEOUT;
+                }
+                goto out_comp;
         }
+
+        tx_msg->rx_len = msg->msg.data_len;
+        memcpy(tx_msg->data, msg->msg.data, tx_msg->rx_len);
+        tx_msg->msg_done = ACPI_IPMI_OK;
+
+out_comp:
         complete(&tx_msg->tx_complete);
+        acpi_ipmi_msg_put(tx_msg);
+out_msg:
         ipmi_free_recv_msg(msg);
-};
+}
 
 static void ipmi_register_bmc(int iface, struct device *dev)
 {
         struct acpi_ipmi_device *ipmi_device, *temp;
-        struct pnp_dev *pnp_dev;
-        ipmi_user_t             user;
         int err;
         struct ipmi_smi_info smi_data;
         acpi_handle handle;
 
         err = ipmi_get_smi_info(iface, &smi_data);
-
         if (err)
                 return;
 
-        if (smi_data.addr_src != SI_ACPI) {
-                put_device(smi_data.dev);
-                return;
-        }
-
+        if (smi_data.addr_src != SI_ACPI)
+                goto err_ref;
         handle = smi_data.addr_info.acpi_info.acpi_handle;
+        if (!handle)
+                goto err_ref;
+
+        ipmi_device = ipmi_dev_alloc(iface, smi_data.dev, handle);
+        if (!ipmi_device) {
+                dev_warn(smi_data.dev, "Can't create IPMI user interface\n");
+                goto err_ref;
+        }
 
         mutex_lock(&driver_data.ipmi_lock);
         list_for_each_entry(temp, &driver_data.ipmi_devices, head) {
@@ -304,34 +481,20 @@ static void ipmi_register_bmc(int iface, struct device *dev)
                  * to the device list, don't add it again.
                  */
                 if (temp->handle == handle)
-                        goto out;
-        }
-
-        ipmi_device = kzalloc(sizeof(*ipmi_device), GFP_KERNEL);
-
-        if (!ipmi_device)
-                goto out;
-
-        pnp_dev = to_pnp_dev(smi_data.dev);
-        ipmi_device->handle = handle;
-        ipmi_device->pnp_dev = pnp_dev;
-
-        err = ipmi_create_user(iface, &driver_data.ipmi_hndlrs,
-                                        ipmi_device, &user);
-        if (err) {
-                dev_warn(&pnp_dev->dev, "Can't create IPMI user interface\n");
-                kfree(ipmi_device);
-                goto out;
+                        goto err_lock;
         }
-        acpi_add_ipmi_device(ipmi_device);
-        ipmi_device->user_interface = user;
-        ipmi_device->ipmi_ifnum = iface;
+        if (!driver_data.selected_smi)
+                driver_data.selected_smi = ipmi_device;
+        list_add_tail(&ipmi_device->head, &driver_data.ipmi_devices);
         mutex_unlock(&driver_data.ipmi_lock);
-        memcpy(&ipmi_device->smi_data, &smi_data, sizeof(struct ipmi_smi_info));
+
+        put_device(smi_data.dev);
         return;
 
-out:
+err_lock:
         mutex_unlock(&driver_data.ipmi_lock);
+        ipmi_dev_release(ipmi_device);
+err_ref:
         put_device(smi_data.dev);
         return;
 }
@@ -339,23 +502,29 @@ out:
 static void ipmi_bmc_gone(int iface)
 {
         struct acpi_ipmi_device *ipmi_device, *temp;
+        bool dev_found = false;
 
         mutex_lock(&driver_data.ipmi_lock);
         list_for_each_entry_safe(ipmi_device, temp,
-                                &driver_data.ipmi_devices, head) {
-                if (ipmi_device->ipmi_ifnum != iface)
-                        continue;
-
-                acpi_remove_ipmi_device(ipmi_device);
-                put_device(ipmi_device->smi_data.dev);
-                kfree(ipmi_device);
-                break;
+                                 &driver_data.ipmi_devices, head) {
+                if (ipmi_device->ipmi_ifnum != iface) {
+                        dev_found = true;
+                        __ipmi_dev_kill(ipmi_device);
+                        break;
+                }
         }
+        if (!driver_data.selected_smi)
+                driver_data.selected_smi = list_first_entry_or_null(
+                                        &driver_data.ipmi_devices,
+                                        struct acpi_ipmi_device, head);
         mutex_unlock(&driver_data.ipmi_lock);
+
+        if (dev_found) {
+                ipmi_flush_tx_msg(ipmi_device);
+                acpi_ipmi_dev_put(ipmi_device);
+        }
 }
-/* --------------------------------------------------------------------------
- *                      Address Space Management
- * -------------------------------------------------------------------------- */
+
 /*
  * This is the IPMI opregion space handler.
  * @function: indicates the read/write. In fact as the IPMI message is driven
@@ -368,16 +537,17 @@ static void ipmi_bmc_gone(int iface)
  *           the response IPMI message returned by IPMI command.
  * @handler_context: IPMI device context.
  */
-
 static acpi_status
 acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
-                      u32 bits, acpi_integer *value,
-                      void *handler_context, void *region_context)
+                        u32 bits, acpi_integer *value,
+                        void *handler_context, void *region_context)
 {
         struct acpi_ipmi_msg *tx_msg;
-        struct acpi_ipmi_device *ipmi_device = handler_context;
-        int err, rem_time;
+        struct acpi_ipmi_device *ipmi_device;
+        int err;
         acpi_status status;
+        unsigned long flags;
+
         /*
          * IPMI opregion message.
          * IPMI message is firstly written to the BMC and system software
@@ -387,118 +557,75 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
         if ((function & ACPI_IO_MASK) == ACPI_READ)
                 return AE_TYPE;
 
-        if (!ipmi_device->user_interface)
+        tx_msg = ipmi_msg_alloc();
+        if (!tx_msg)
                 return AE_NOT_EXIST;
+        ipmi_device = tx_msg->device;
 
-        tx_msg = acpi_alloc_ipmi_msg(ipmi_device);
-        if (!tx_msg)
-                return AE_NO_MEMORY;
+        if (acpi_format_ipmi_request(tx_msg, address, value) != 0) {
+                ipmi_msg_release(tx_msg);
+                return AE_TYPE;
+        }
 
-        acpi_format_ipmi_msg(tx_msg, address, value);
-        mutex_lock(&ipmi_device->tx_msg_lock);
+        acpi_ipmi_msg_get(tx_msg);
+        mutex_lock(&driver_data.ipmi_lock);
+        /* Do not add a tx_msg that can not be flushed. */
+        if (ipmi_device->dead) {
+                mutex_unlock(&driver_data.ipmi_lock);
+                ipmi_msg_release(tx_msg);
+                return AE_NOT_EXIST;
+        }
+        spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
         list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
-        mutex_unlock(&ipmi_device->tx_msg_lock);
+        spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
+        mutex_unlock(&driver_data.ipmi_lock);
+
         err = ipmi_request_settime(ipmi_device->user_interface,
-                                        &tx_msg->addr,
-                                        tx_msg->tx_msgid,
-                                        &tx_msg->tx_message,
-                                        NULL, 0, 0, 0);
+                                   &tx_msg->addr,
+                                   tx_msg->tx_msgid,
+                                   &tx_msg->tx_message,
+                                   NULL, 0, 0, IPMI_TIMEOUT);
         if (err) {
                 status = AE_ERROR;
-                goto end_label;
+                goto out_msg;
         }
-        rem_time = wait_for_completion_timeout(&tx_msg->tx_complete,
-                                        IPMI_TIMEOUT);
-        acpi_format_ipmi_response(tx_msg, value, rem_time);
+        wait_for_completion(&tx_msg->tx_complete);
+
+        acpi_format_ipmi_response(tx_msg, value);
         status = AE_OK;
 
-end_label:
-        mutex_lock(&ipmi_device->tx_msg_lock);
-        list_del(&tx_msg->head);
-        mutex_unlock(&ipmi_device->tx_msg_lock);
-        kfree(tx_msg);
+out_msg:
+        ipmi_cancel_tx_msg(ipmi_device, tx_msg);
+        acpi_ipmi_msg_put(tx_msg);
         return status;
 }
 
-static void ipmi_remove_space_handler(struct acpi_ipmi_device *ipmi)
-{
-        if (!test_bit(IPMI_FLAGS_HANDLER_INSTALL, &ipmi->flags))
-                return;
-
-        acpi_remove_address_space_handler(ipmi->handle,
-                                ACPI_ADR_SPACE_IPMI, &acpi_ipmi_space_handler);
-
-        clear_bit(IPMI_FLAGS_HANDLER_INSTALL, &ipmi->flags);
-}
-
-static int ipmi_install_space_handler(struct acpi_ipmi_device *ipmi)
+static int __init acpi_ipmi_init(void)
 {
+        int result;
         acpi_status status;
 
-        if (test_bit(IPMI_FLAGS_HANDLER_INSTALL, &ipmi->flags))
+        if (acpi_disabled)
                 return 0;
 
-        status = acpi_install_address_space_handler(ipmi->handle,
+        status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT,
                                                     ACPI_ADR_SPACE_IPMI,
                                                     &acpi_ipmi_space_handler,
-                                                    NULL, ipmi);
+                                                    NULL, NULL);
         if (ACPI_FAILURE(status)) {
-                struct pnp_dev *pnp_dev = ipmi->pnp_dev;
-                dev_warn(&pnp_dev->dev, "Can't register IPMI opregion space "
-                        "handle\n");
+                pr_warn("Can't register IPMI opregion space handle\n");
                 return -EINVAL;
         }
-        set_bit(IPMI_FLAGS_HANDLER_INSTALL, &ipmi->flags);
-        return 0;
-}
-
-static void acpi_add_ipmi_device(struct acpi_ipmi_device *ipmi_device)
-{
-
-        INIT_LIST_HEAD(&ipmi_device->head);
-
-        mutex_init(&ipmi_device->tx_msg_lock);
-        INIT_LIST_HEAD(&ipmi_device->tx_msg_list);
-        ipmi_install_space_handler(ipmi_device);
-
-        list_add_tail(&ipmi_device->head, &driver_data.ipmi_devices);
-}
-
-static void acpi_remove_ipmi_device(struct acpi_ipmi_device *ipmi_device)
-{
-        /*
-         * If the IPMI user interface is created, it should be
-         * destroyed.
-         */
-        if (ipmi_device->user_interface) {
-                ipmi_destroy_user(ipmi_device->user_interface);
-                ipmi_device->user_interface = NULL;
-        }
-        /* flush the Tx_msg list */
-        if (!list_empty(&ipmi_device->tx_msg_list))
-                ipmi_flush_tx_msg(ipmi_device);
-
-        list_del(&ipmi_device->head);
-        ipmi_remove_space_handler(ipmi_device);
-}
-
-static int __init acpi_ipmi_init(void)
-{
-        int result = 0;
-
-        if (acpi_disabled)
-                return result;
-
-        mutex_init(&driver_data.ipmi_lock);
-
         result = ipmi_smi_watcher_register(&driver_data.bmc_events);
+        if (result)
+                pr_err("Can't register IPMI system interface watcher\n");
 
         return result;
 }
 
 static void __exit acpi_ipmi_exit(void)
 {
-        struct acpi_ipmi_device *ipmi_device, *temp;
+        struct acpi_ipmi_device *ipmi_device;
 
         if (acpi_disabled)
                 return;
@@ -512,13 +639,22 @@ static void __exit acpi_ipmi_exit(void)
          * handler and free it.
          */
         mutex_lock(&driver_data.ipmi_lock);
-        list_for_each_entry_safe(ipmi_device, temp,
-                                &driver_data.ipmi_devices, head) {
-                acpi_remove_ipmi_device(ipmi_device);
-                put_device(ipmi_device->smi_data.dev);
-                kfree(ipmi_device);
+        while (!list_empty(&driver_data.ipmi_devices)) {
+                ipmi_device = list_first_entry(&driver_data.ipmi_devices,
+                                               struct acpi_ipmi_device,
+                                               head);
+                __ipmi_dev_kill(ipmi_device);
+                mutex_unlock(&driver_data.ipmi_lock);
+
+                ipmi_flush_tx_msg(ipmi_device);
+                acpi_ipmi_dev_put(ipmi_device);
+
+                mutex_lock(&driver_data.ipmi_lock);
         }
         mutex_unlock(&driver_data.ipmi_lock);
+        acpi_remove_address_space_handler(ACPI_ROOT_OBJECT,
+                                          ACPI_ADR_SPACE_IPMI,
+                                          &acpi_ipmi_space_handler);
 }
 
 module_init(acpi_ipmi_init);
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index fb78bb9ad8f6..d3961014aad7 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -30,6 +30,7 @@ ACPI_MODULE_NAME("acpi_lpss");
 /* Offsets relative to LPSS_PRIVATE_OFFSET */
 #define LPSS_GENERAL                    0x08
 #define LPSS_GENERAL_LTR_MODE_SW        BIT(2)
+#define LPSS_GENERAL_UART_RTS_OVRD      BIT(3)
 #define LPSS_SW_LTR                     0x10
 #define LPSS_AUTO_LTR                   0x14
 #define LPSS_TX_INT                     0x20
@@ -68,11 +69,16 @@ struct lpss_private_data {
 
 static void lpss_uart_setup(struct lpss_private_data *pdata)
 {
-        unsigned int tx_int_offset = pdata->dev_desc->prv_offset + LPSS_TX_INT;
+        unsigned int offset;
         u32 reg;
 
-        reg = readl(pdata->mmio_base + tx_int_offset);
-        writel(reg | LPSS_TX_INT_MASK, pdata->mmio_base + tx_int_offset);
+        offset = pdata->dev_desc->prv_offset + LPSS_TX_INT;
+        reg = readl(pdata->mmio_base + offset);
+        writel(reg | LPSS_TX_INT_MASK, pdata->mmio_base + offset);
+
+        offset = pdata->dev_desc->prv_offset + LPSS_GENERAL;
+        reg = readl(pdata->mmio_base + offset);
+        writel(reg | LPSS_GENERAL_UART_RTS_OVRD, pdata->mmio_base + offset);
 }
 
 static struct lpss_device_desc lpt_dev_desc = {
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index dc0880db909c..551dad712ffe 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -282,7 +282,7 @@ static void acpi_memory_remove_memory(struct acpi_memory_device *mem_device)
                 if (!info->enabled)
                         continue;
 
-                if (nid < 0)
+                if (nid == NUMA_NO_NODE)
                         nid = memory_add_physaddr_to_nid(info->start_addr);
 
                 acpi_unbind_memory_blocks(info, handle);
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index 1bde12708f9e..8a4cfc7e71f0 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -29,6 +29,13 @@ ACPI_MODULE_NAME("platform");
 static const struct acpi_device_id acpi_platform_device_ids[] = {
 
         { "PNP0D40" },
+        { "ACPI0003" },
+        { "VPC2004" },
+        { "BCM4752" },
+
+        /* Intel Smart Sound Technology */
+        { "INT33C8" },
+        { "80860F28" },
 
         { }
 };
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index f29e06efa479..3c1d6b0c09a4 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -140,15 +140,11 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
         return 0;
 }
 
-static int acpi_processor_errata(struct acpi_processor *pr)
+static int acpi_processor_errata(void)
 {
         int result = 0;
         struct pci_dev *dev = NULL;
 
-
-        if (!pr)
-                return -EINVAL;
-
         /*
          * PIIX4
          */
@@ -181,7 +177,7 @@ static int acpi_processor_hotadd_init(struct acpi_processor *pr)
         cpu_maps_update_begin();
         cpu_hotplug_begin();
 
-        ret = acpi_map_lsapic(pr->handle, &pr->id);
+        ret = acpi_map_lsapic(pr->handle, pr->apic_id, &pr->id);
         if (ret)
                 goto out;
 
@@ -219,11 +215,9 @@ static int acpi_processor_get_info(struct acpi_device *device)
         int cpu_index, device_declaration = 0;
         acpi_status status = AE_OK;
         static int cpu0_initialized;
+        unsigned long long value;
 
-        if (num_online_cpus() > 1)
-                errata.smp = TRUE;
-
-        acpi_processor_errata(pr);
+        acpi_processor_errata();
 
         /*
          * Check to see if we have bus mastering arbitration control.  This
@@ -247,18 +241,12 @@ static int acpi_processor_get_info(struct acpi_device *device)
                         return -ENODEV;
                 }
 
-                /*
-                 * TBD: Synch processor ID (via LAPIC/LSAPIC structures) on SMP.
-                 *      >>> 'acpi_get_processor_id(acpi_id, &id)' in
-                 *      arch/xxx/acpi.c
-                 */
                 pr->acpi_id = object.processor.proc_id;
         } else {
                 /*
                  * Declared with "Device" statement; match _UID.
                  * Note that we don't handle string _UIDs yet.
                  */
-                unsigned long long value;
                 status = acpi_evaluate_integer(pr->handle, METHOD_NAME__UID,
                                                 NULL, &value);
                 if (ACPI_FAILURE(status)) {
@@ -270,7 +258,9 @@ static int acpi_processor_get_info(struct acpi_device *device)
                 device_declaration = 1;
                 pr->acpi_id = value;
         }
-        cpu_index = acpi_get_cpuid(pr->handle, device_declaration, pr->acpi_id);
+        pr->apic_id = acpi_get_apicid(pr->handle, device_declaration,
+                                        pr->acpi_id);
+        cpu_index = acpi_map_cpuid(pr->apic_id, pr->acpi_id);
 
         /* Handle UP system running SMP kernel, with no LAPIC in MADT */
         if (!cpu0_initialized && (cpu_index == -1) &&
@@ -332,9 +322,9 @@ static int acpi_processor_get_info(struct acpi_device *device)
          * ensure we get the right value in the "physical id" field
          * of /proc/cpuinfo
          */
-        status = acpi_evaluate_object(pr->handle, "_SUN", NULL, &buffer);
+        status = acpi_evaluate_integer(pr->handle, "_SUN", NULL, &value);
         if (ACPI_SUCCESS(status))
-                arch_fix_phys_package_id(pr->id, object.integer.value);
+                arch_fix_phys_package_id(pr->id, value);
 
         return 0;
 }
diff --git a/drivers/acpi/acpica/acdebug.h b/drivers/acpi/acpica/acdebug.h
index 9feba08c29fe..a9fd0b872062 100644
--- a/drivers/acpi/acpica/acdebug.h
+++ b/drivers/acpi/acpica/acdebug.h
@@ -114,10 +114,12 @@ ACPI_HW_DEPENDENT_RETURN_VOID(void
                               acpi_db_generate_gpe(char *gpe_arg,
                                                    char *block_arg))
 
+ACPI_HW_DEPENDENT_RETURN_VOID(void acpi_db_generate_sci(void))
+
 /*
  * dbconvert - miscellaneous conversion routines
  */
- acpi_status acpi_db_hex_char_to_value(int hex_char, u8 *return_value);
+acpi_status acpi_db_hex_char_to_value(int hex_char, u8 *return_value);
 
 acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object);
 
@@ -154,6 +156,8 @@ void acpi_db_set_scope(char *name);
 
 void acpi_db_dump_namespace(char *start_arg, char *depth_arg);
 
+void acpi_db_dump_namespace_paths(void);
+
 void acpi_db_dump_namespace_by_owner(char *owner_arg, char *depth_arg);
 
 acpi_status acpi_db_find_name_in_namespace(char *name_arg);
@@ -240,6 +244,8 @@ void acpi_db_display_history(void);
 
 char *acpi_db_get_from_history(char *command_num_arg);
 
+char *acpi_db_get_history_by_index(u32 commandd_num);
+
 /*
  * dbinput - user front-end to the AML debugger
  */
diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
index ab0e97710381..41abe552c7a3 100644
--- a/drivers/acpi/acpica/acevents.h
+++ b/drivers/acpi/acpica/acevents.h
@@ -71,7 +71,8 @@ acpi_status acpi_ev_init_global_lock_handler(void);
 
 ACPI_HW_DEPENDENT_RETURN_OK(acpi_status
                             acpi_ev_acquire_global_lock(u16 timeout))
- ACPI_HW_DEPENDENT_RETURN_OK(acpi_status acpi_ev_release_global_lock(void))
+
+ACPI_HW_DEPENDENT_RETURN_OK(acpi_status acpi_ev_release_global_lock(void))
  acpi_status acpi_ev_remove_global_lock_handler(void);
 
 /*
@@ -242,11 +243,11 @@ acpi_ev_initialize_region(union acpi_operand_object *region_obj,
  */
 u32 ACPI_SYSTEM_XFACE acpi_ev_gpe_xrupt_handler(void *context);
 
-u32 acpi_ev_install_sci_handler(void);
+u32 acpi_ev_sci_dispatch(void);
 
-acpi_status acpi_ev_remove_sci_handler(void);
+u32 acpi_ev_install_sci_handler(void);
 
-u32 acpi_ev_initialize_SCI(u32 program_SCI);
+acpi_status acpi_ev_remove_all_sci_handlers(void);
 
 ACPI_HW_DEPENDENT_RETURN_VOID(void acpi_ev_terminate(void))
 #endif                          /* __ACEVENTS_H__  */
diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 90e846f985fa..e9f1fc7f99c7 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -269,6 +269,7 @@ ACPI_EXTERN acpi_table_handler acpi_gbl_table_handler;
 ACPI_EXTERN void *acpi_gbl_table_handler_context;
 ACPI_EXTERN struct acpi_walk_state *acpi_gbl_breakpoint_walk;
 ACPI_EXTERN acpi_interface_handler acpi_gbl_interface_handler;
+ACPI_EXTERN struct acpi_sci_handler_info *acpi_gbl_sci_handler_list;
 
 /* Owner ID support */
 
@@ -405,7 +406,9 @@ extern u32 acpi_gbl_nesting_level;
 
 /* Event counters */
 
+ACPI_EXTERN u32 acpi_method_count;
 ACPI_EXTERN u32 acpi_gpe_count;
+ACPI_EXTERN u32 acpi_sci_count;
 ACPI_EXTERN u32 acpi_fixed_event_count[ACPI_NUM_FIXED_EVENTS];
 
 /* Support for dynamic control method tracing mechanism */
@@ -445,13 +448,6 @@ ACPI_EXTERN u8 acpi_gbl_db_opt_tables;
 ACPI_EXTERN u8 acpi_gbl_db_opt_stats;
 ACPI_EXTERN u8 acpi_gbl_db_opt_ini_methods;
 ACPI_EXTERN u8 acpi_gbl_db_opt_no_region_support;
-
-ACPI_EXTERN char *acpi_gbl_db_args[ACPI_DEBUGGER_MAX_ARGS];
-ACPI_EXTERN acpi_object_type acpi_gbl_db_arg_types[ACPI_DEBUGGER_MAX_ARGS];
-ACPI_EXTERN char acpi_gbl_db_line_buf[ACPI_DB_LINE_BUFFER_SIZE];
-ACPI_EXTERN char acpi_gbl_db_parsed_buf[ACPI_DB_LINE_BUFFER_SIZE];
-ACPI_EXTERN char acpi_gbl_db_scope_buf[80];
-ACPI_EXTERN char acpi_gbl_db_debug_filename[80];
 ACPI_EXTERN u8 acpi_gbl_db_output_to_file;
 ACPI_EXTERN char *acpi_gbl_db_buffer;
 ACPI_EXTERN char *acpi_gbl_db_filename;
@@ -459,6 +455,16 @@ ACPI_EXTERN u32 acpi_gbl_db_debug_level;
 ACPI_EXTERN u32 acpi_gbl_db_console_debug_level;
 ACPI_EXTERN struct acpi_namespace_node *acpi_gbl_db_scope_node;
 
+ACPI_EXTERN char *acpi_gbl_db_args[ACPI_DEBUGGER_MAX_ARGS];
+ACPI_EXTERN acpi_object_type acpi_gbl_db_arg_types[ACPI_DEBUGGER_MAX_ARGS];
+
+/* These buffers should all be the same size */
+
+ACPI_EXTERN char acpi_gbl_db_line_buf[ACPI_DB_LINE_BUFFER_SIZE];
+ACPI_EXTERN char acpi_gbl_db_parsed_buf[ACPI_DB_LINE_BUFFER_SIZE];
+ACPI_EXTERN char acpi_gbl_db_scope_buf[ACPI_DB_LINE_BUFFER_SIZE];
+ACPI_EXTERN char acpi_gbl_db_debug_filename[ACPI_DB_LINE_BUFFER_SIZE];
+
 /*
  * Statistic globals
  */
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 0ed00669cd21..53ed1a8ba4f0 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -398,6 +398,14 @@ struct acpi_simple_repair_info {
  *
  ****************************************************************************/
 
+/* Dispatch info for each host-installed SCI handler */
+
+struct acpi_sci_handler_info {
+        struct acpi_sci_handler_info *next;
+        acpi_sci_handler address;       /* Address of handler */
+        void *context;          /* Context to be passed to handler */
+};
+
 /* Dispatch info for each GPE -- either a method or handler, cannot be both */
 
 struct acpi_gpe_handler_info {
@@ -1064,7 +1072,7 @@ struct acpi_db_method_info {
         char *name;
         u32 flags;
         u32 num_loops;
-        char pathname[128];
+        char pathname[ACPI_DB_LINE_BUFFER_SIZE];
         char **args;
         acpi_object_type *types;
 
@@ -1086,6 +1094,7 @@ struct acpi_integrity_info {
         u32 objects;
 };
 
+#define ACPI_DB_DISABLE_OUTPUT          0x00
 #define ACPI_DB_REDIRECTABLE_OUTPUT     0x01
 #define ACPI_DB_CONSOLE_OUTPUT          0x02
 #define ACPI_DB_DUPLICATE_OUTPUT        0x03
diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
index 530a2f8c1252..2a86c65d873b 100644
--- a/drivers/acpi/acpica/acmacros.h
+++ b/drivers/acpi/acpica/acmacros.h
@@ -410,37 +410,6 @@
 #endif
 
 /*
- * Memory allocation tracking (DEBUG ONLY)
- */
-#define ACPI_MEM_PARAMETERS         _COMPONENT, _acpi_module_name, __LINE__
-
-#ifndef ACPI_DBG_TRACK_ALLOCATIONS
-
-/* Memory allocation */
-
-#ifndef ACPI_ALLOCATE
-#define ACPI_ALLOCATE(a)            acpi_ut_allocate((acpi_size) (a), ACPI_MEM_PARAMETERS)
-#endif
-#ifndef ACPI_ALLOCATE_ZEROED
-#define ACPI_ALLOCATE_ZEROED(a)     acpi_ut_allocate_zeroed((acpi_size) (a), ACPI_MEM_PARAMETERS)
-#endif
-#ifndef ACPI_FREE
-#define ACPI_FREE(a)                acpi_os_free(a)
-#endif
-#define ACPI_MEM_TRACKING(a)
-
-#else
-
-/* Memory allocation */
-
-#define ACPI_ALLOCATE(a)            acpi_ut_allocate_and_track((acpi_size) (a), ACPI_MEM_PARAMETERS)
-#define ACPI_ALLOCATE_ZEROED(a)     acpi_ut_allocate_zeroed_and_track((acpi_size) (a), ACPI_MEM_PARAMETERS)
-#define ACPI_FREE(a)                acpi_ut_free_and_track(a, ACPI_MEM_PARAMETERS)
-#define ACPI_MEM_TRACKING(a)        a
-
-#endif                          /* ACPI_DBG_TRACK_ALLOCATIONS */
-
-/*
  * Macros used for ACPICA utilities only
  */
 
diff --git a/drivers/acpi/acpica/acnamesp.h b/drivers/acpi/acpica/acnamesp.h
index 40b04bd5579e..e6138ac4a160 100644
--- a/drivers/acpi/acpica/acnamesp.h
+++ b/drivers/acpi/acpica/acnamesp.h
@@ -213,6 +213,12 @@ acpi_ns_dump_objects(acpi_object_type type,
                      u8 display_type,
                      u32 max_depth,
                      acpi_owner_id owner_id, acpi_handle start_handle);
+
+void
+acpi_ns_dump_object_paths(acpi_object_type type,
+                          u8 display_type,
+                          u32 max_depth,
+                          acpi_owner_id owner_id, acpi_handle start_handle);
 #endif                          /* ACPI_FUTURE_USAGE */
 
 /*
diff --git a/drivers/acpi/acpica/acutils.h b/drivers/acpi/acpica/acutils.h
index d5a62a6182bb..be8180c17d7e 100644
--- a/drivers/acpi/acpica/acutils.h
+++ b/drivers/acpi/acpica/acutils.h
@@ -628,6 +628,17 @@ u8 acpi_ut_valid_acpi_char(char character, u32 position);
 
 void acpi_ut_repair_name(char *name);
 
+#if defined (ACPI_DEBUGGER) || defined (ACPI_APPLICATION)
+u8 acpi_ut_safe_strcpy(char *dest, acpi_size dest_size, char *source);
+
+u8 acpi_ut_safe_strcat(char *dest, acpi_size dest_size, char *source);
+
+u8
+acpi_ut_safe_strncat(char *dest,
+                     acpi_size dest_size,
+                     char *source, acpi_size max_transfer_length);
+#endif
+
 /*
  * utmutex - mutex support
  */
@@ -652,12 +663,6 @@ acpi_status
 acpi_ut_initialize_buffer(struct acpi_buffer *buffer,
                           acpi_size required_length);
 
-void *acpi_ut_allocate(acpi_size size,
-                       u32 component, const char *module, u32 line);
-
-void *acpi_ut_allocate_zeroed(acpi_size size,
-                              u32 component, const char *module, u32 line);
-
 #ifdef ACPI_DBG_TRACK_ALLOCATIONS
 void *acpi_ut_allocate_and_track(acpi_size size,
                                  u32 component, const char *module, u32 line);
diff --git a/drivers/acpi/acpica/dsargs.c b/drivers/acpi/acpica/dsargs.c
index fb09b08d7080..afdc6df17abf 100644
--- a/drivers/acpi/acpica/dsargs.c
+++ b/drivers/acpi/acpica/dsargs.c
@@ -158,7 +158,7 @@ acpi_ds_execute_arguments(struct acpi_namespace_node *node,
         walk_state->deferred_node = node;
         status = acpi_ps_parse_aml(walk_state);
 
-      cleanup:
+cleanup:
         acpi_ps_delete_parse_tree(op);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
index d4bfe7b7f90a..2d4c07322576 100644
--- a/drivers/acpi/acpica/dsfield.c
+++ b/drivers/acpi/acpica/dsfield.c
@@ -259,7 +259,7 @@ acpi_ds_create_buffer_field(union acpi_parse_object *op,
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
 
         /* Remove local reference to the object */
 
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index a9ffd44c18fe..81a78ba84311 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -292,9 +292,10 @@ acpi_ds_begin_method_execution(struct acpi_namespace_node *method_node,
          * reentered one more time (even if it is the same thread)
          */
         obj_desc->method.thread_count++;
+        acpi_method_count++;
         return_ACPI_STATUS(status);
 
-      cleanup:
+cleanup:
         /* On error, must release the method mutex (if present) */
 
         if (obj_desc->method.mutex) {
@@ -424,7 +425,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
 
         return_ACPI_STATUS(status);
 
-      cleanup:
+cleanup:
 
         /* On error, we must terminate the method properly */
 
diff --git a/drivers/acpi/acpica/dsobject.c b/drivers/acpi/acpica/dsobject.c
index 63f0d220ca3d..b1746a68dad1 100644
--- a/drivers/acpi/acpica/dsobject.c
+++ b/drivers/acpi/acpica/dsobject.c
@@ -240,7 +240,7 @@ acpi_ds_build_internal_object(struct acpi_walk_state *walk_state,
                 return_ACPI_STATUS(status);
         }
 
-      exit:
+exit:
         *obj_desc_ptr = obj_desc;
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
index 1fc1ff114f26..5205edcf2c01 100644
--- a/drivers/acpi/acpica/dsopcode.c
+++ b/drivers/acpi/acpica/dsopcode.c
@@ -257,7 +257,7 @@ acpi_ds_init_buffer_field(u16 aml_opcode,
             (buffer_desc->common.reference_count +
              obj_desc->common.reference_count);
 
-      cleanup:
+cleanup:
 
         /* Always delete the operands */
 
diff --git a/drivers/acpi/acpica/dsutils.c b/drivers/acpi/acpica/dsutils.c
index c666fc014987..ade44e49deb4 100644
--- a/drivers/acpi/acpica/dsutils.c
+++ b/drivers/acpi/acpica/dsutils.c
@@ -299,7 +299,7 @@ acpi_ds_is_result_used(union acpi_parse_object * op,
                 goto result_used;
         }
 
-      result_used:
+result_used:
         ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
                           "Result of [%s] used by Parent [%s] Op=%p\n",
                           acpi_ps_get_opcode_name(op->common.aml_opcode),
@@ -308,7 +308,7 @@ acpi_ds_is_result_used(union acpi_parse_object * op,
 
         return_UINT8(TRUE);
 
-      result_not_used:
+result_not_used:
         ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
                           "Result of [%s] not used by Parent [%s] Op=%p\n",
                           acpi_ps_get_opcode_name(op->common.aml_opcode),
@@ -752,7 +752,7 @@ acpi_ds_create_operands(struct acpi_walk_state *walk_state,
 
         return_ACPI_STATUS(status);
 
-      cleanup:
+cleanup:
         /*
          * We must undo everything done above; meaning that we must
          * pop everything off of the operand stack and delete those
@@ -851,7 +851,7 @@ acpi_status acpi_ds_evaluate_name_path(struct acpi_walk_state *walk_state)
                 goto exit;
         }
 
-      push_result:
+push_result:
 
         walk_state->result_obj = new_obj_desc;
 
@@ -863,7 +863,7 @@ acpi_status acpi_ds_evaluate_name_path(struct acpi_walk_state *walk_state)
                 op->common.flags |= ACPI_PARSEOP_IN_STACK;
         }
 
-      exit:
+exit:
 
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c
index 151d924817e1..1bbb22fd6fa0 100644
--- a/drivers/acpi/acpica/dswexec.c
+++ b/drivers/acpi/acpica/dswexec.c
@@ -170,7 +170,7 @@ acpi_ds_get_predicate_value(struct acpi_walk_state *walk_state,
 
         (void)acpi_ds_do_implicit_return(local_obj_desc, walk_state, TRUE);
 
-      cleanup:
+cleanup:
 
         ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Completed a predicate eval=%X Op=%p\n",
                           walk_state->control_state->common.value,
@@ -335,7 +335,7 @@ acpi_ds_exec_begin_op(struct acpi_walk_state *walk_state,
 
         return_ACPI_STATUS(status);
 
-      error_exit:
+error_exit:
         status = acpi_ds_method_error(status, walk_state);
         return_ACPI_STATUS(status);
 }
@@ -722,7 +722,7 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state)
                 walk_state->result_obj = NULL;
         }
 
-      cleanup:
+cleanup:
 
         if (walk_state->result_obj) {
 
diff --git a/drivers/acpi/acpica/dswload2.c b/drivers/acpi/acpica/dswload2.c
index b1f8f4725c23..7f569d573027 100644
--- a/drivers/acpi/acpica/dswload2.c
+++ b/drivers/acpi/acpica/dswload2.c
@@ -728,7 +728,7 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
                 break;
         }
 
-      cleanup:
+cleanup:
 
         /* Remove the Node pushed at the very beginning */
 
diff --git a/drivers/acpi/acpica/evglock.c b/drivers/acpi/acpica/evglock.c
index fdb0a76e40a3..4c67193a9fa7 100644
--- a/drivers/acpi/acpica/evglock.c
+++ b/drivers/acpi/acpica/evglock.c
@@ -173,7 +173,7 @@ static u32 acpi_ev_global_lock_handler(void *context)
 
         acpi_gbl_global_lock_pending = FALSE;
 
-      cleanup_and_exit:
+cleanup_and_exit:
 
         acpi_os_release_lock(acpi_gbl_global_lock_pending_lock, flags);
         return (ACPI_INTERRUPT_HANDLED);
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index c8a1f7d5931f..a9cb4a1a4bb8 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -458,7 +458,7 @@ u32 acpi_ev_gpe_detect(struct acpi_gpe_xrupt_info * gpe_xrupt_list)
                 gpe_block = gpe_block->next;
         }
 
-      unlock_and_exit:
+unlock_and_exit:
 
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
         return (int_status);
@@ -522,6 +522,7 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_execute_gpe_method(void *context)
 
         status = acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         if (ACPI_FAILURE(status)) {
+                ACPI_FREE(local_gpe_event_info);
                 return_VOID;
         }
 
diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
index c1aa1eda26c3..a9e76bc4ad97 100644
--- a/drivers/acpi/acpica/evgpeblk.c
+++ b/drivers/acpi/acpica/evgpeblk.c
@@ -111,7 +111,7 @@ acpi_ev_install_gpe_block(struct acpi_gpe_block_info *gpe_block,
         gpe_block->xrupt_block = gpe_xrupt_block;
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
 
-      unlock_and_exit:
+unlock_and_exit:
         status = acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
@@ -178,7 +178,7 @@ acpi_status acpi_ev_delete_gpe_block(struct acpi_gpe_block_info *gpe_block)
         ACPI_FREE(gpe_block->event_info);
         ACPI_FREE(gpe_block);
 
-      unlock_and_exit:
+unlock_and_exit:
         status = acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
@@ -302,7 +302,7 @@ acpi_ev_create_gpe_info_blocks(struct acpi_gpe_block_info *gpe_block)
 
         return_ACPI_STATUS(AE_OK);
 
-      error_exit:
+error_exit:
         if (gpe_register_info) {
                 ACPI_FREE(gpe_register_info);
         }
diff --git a/drivers/acpi/acpica/evgpeinit.c b/drivers/acpi/acpica/evgpeinit.c
index 7842700346a4..a3e2f38aadf6 100644
--- a/drivers/acpi/acpica/evgpeinit.c
+++ b/drivers/acpi/acpica/evgpeinit.c
@@ -203,7 +203,7 @@ acpi_status acpi_ev_gpe_initialize(void)
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_ACPI_STATUS(AE_OK);
 }
diff --git a/drivers/acpi/acpica/evgpeutil.c b/drivers/acpi/acpica/evgpeutil.c
index b24dbb80fab8..d3f5e1e2a2b1 100644
--- a/drivers/acpi/acpica/evgpeutil.c
+++ b/drivers/acpi/acpica/evgpeutil.c
@@ -101,7 +101,7 @@ acpi_ev_walk_gpe_list(acpi_gpe_callback gpe_walk_callback, void *context)
                 gpe_xrupt_info = gpe_xrupt_info->next;
         }
 
-      unlock_and_exit:
+unlock_and_exit:
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
         return_ACPI_STATUS(status);
 }
@@ -196,7 +196,7 @@ acpi_ev_get_gpe_device(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
  *
  * FUNCTION:    acpi_ev_get_gpe_xrupt_block
  *
- * PARAMETERS:  interrupt_number     - Interrupt for a GPE block
+ * PARAMETERS:  interrupt_number            - Interrupt for a GPE block
  *
  * RETURN:      A GPE interrupt block
  *
diff --git a/drivers/acpi/acpica/evhandler.c b/drivers/acpi/acpica/evhandler.c
index 068af96134b8..e3157313eb27 100644
--- a/drivers/acpi/acpica/evhandler.c
+++ b/drivers/acpi/acpica/evhandler.c
@@ -129,7 +129,7 @@ acpi_status acpi_ev_install_region_handlers(void)
                 }
         }
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_ACPI_STATUS(status);
 }
@@ -531,6 +531,6 @@ acpi_ev_install_space_handler(struct acpi_namespace_node * node,
                                         acpi_ev_install_handler, NULL,
                                         handler_obj, NULL);
 
-      unlock_and_exit:
+unlock_and_exit:
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/evmisc.c b/drivers/acpi/acpica/evmisc.c
index 1b111ef74903..a5687540e9a6 100644
--- a/drivers/acpi/acpica/evmisc.c
+++ b/drivers/acpi/acpica/evmisc.c
@@ -264,13 +264,6 @@ void acpi_ev_terminate(void)
 
                 status = acpi_ev_walk_gpe_list(acpi_hw_disable_gpe_block, NULL);
 
-                /* Remove SCI handler */
-
-                status = acpi_ev_remove_sci_handler();
-                if (ACPI_FAILURE(status)) {
-                        ACPI_ERROR((AE_INFO, "Could not remove SCI handler"));
-                }
-
                 status = acpi_ev_remove_global_lock_handler();
                 if (ACPI_FAILURE(status)) {
                         ACPI_ERROR((AE_INFO,
@@ -280,6 +273,13 @@ void acpi_ev_terminate(void)
                 acpi_gbl_events_initialized = FALSE;
         }
 
+        /* Remove SCI handlers */
+
+        status = acpi_ev_remove_all_sci_handlers();
+        if (ACPI_FAILURE(status)) {
+                ACPI_ERROR((AE_INFO, "Could not remove SCI handler"));
+        }
+
         /* Deallocate all handler objects installed within GPE info structs */
 
         status = acpi_ev_walk_gpe_list(acpi_ev_delete_gpe_handlers, NULL);
diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
index cea14d6fc76c..144cbb9b73bc 100644
--- a/drivers/acpi/acpica/evregion.c
+++ b/drivers/acpi/acpica/evregion.c
@@ -217,16 +217,11 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
                 if (!(region_obj->region.flags & AOPOBJ_SETUP_COMPLETE)) {
                         region_obj->region.flags |= AOPOBJ_SETUP_COMPLETE;
 
-                        if (region_obj2->extra.region_context) {
-
-                                /* The handler for this region was already installed */
-
-                                ACPI_FREE(region_context);
-                        } else {
-                                /*
-                                 * Save the returned context for use in all accesses to
-                                 * this particular region
-                                 */
+                        /*
+                         * Save the returned context for use in all accesses to
+                         * the handler for this particular region
+                         */
+                        if (!(region_obj2->extra.region_context)) {
                                 region_obj2->extra.region_context =
                                     region_context;
                         }
@@ -402,6 +397,14 @@ acpi_ev_detach_region(union acpi_operand_object *region_obj,
                                                  handler_obj->address_space.
                                                  context, region_context);
 
+                                /*
+                                 * region_context should have been released by the deactivate
+                                 * operation. We don't need access to it anymore here.
+                                 */
+                                if (region_context) {
+                                        *region_context = NULL;
+                                }
+
                                 /* Init routine may fail, Just ignore errors */
 
                                 if (ACPI_FAILURE(status)) {
@@ -570,10 +573,10 @@ acpi_ev_execute_reg_method(union acpi_operand_object *region_obj, u32 function)
         status = acpi_ns_evaluate(info);
         acpi_ut_remove_reference(args[1]);
 
-      cleanup2:
+cleanup2:
         acpi_ut_remove_reference(args[0]);
 
-      cleanup1:
+cleanup1:
         ACPI_FREE(info);
         return_ACPI_STATUS(status);
 }
@@ -758,7 +761,7 @@ acpi_ev_orphan_ec_reg_method(struct acpi_namespace_node *ec_device_node)
 
         status = acpi_evaluate_object(reg_method, NULL, &args, NULL);
 
-      exit:
+exit:
         /* We ignore all errors from above, don't care */
 
         status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
diff --git a/drivers/acpi/acpica/evsci.c b/drivers/acpi/acpica/evsci.c
index b905acf7aacd..9e9e3454d893 100644
--- a/drivers/acpi/acpica/evsci.c
+++ b/drivers/acpi/acpica/evsci.c
@@ -54,6 +54,50 @@ static u32 ACPI_SYSTEM_XFACE acpi_ev_sci_xrupt_handler(void *context);
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_ev_sci_dispatch
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      Status code indicates whether interrupt was handled.
+ *
+ * DESCRIPTION: Dispatch the SCI to all host-installed SCI handlers.
+ *
+ ******************************************************************************/
+
+u32 acpi_ev_sci_dispatch(void)
+{
+        struct acpi_sci_handler_info *sci_handler;
+        acpi_cpu_flags flags;
+        u32 int_status = ACPI_INTERRUPT_NOT_HANDLED;
+
+        ACPI_FUNCTION_NAME(ev_sci_dispatch);
+
+        /* Are there any host-installed SCI handlers? */
+
+        if (!acpi_gbl_sci_handler_list) {
+                return (int_status);
+        }
+
+        flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock);
+
+        /* Invoke all host-installed SCI handlers */
+
+        sci_handler = acpi_gbl_sci_handler_list;
+        while (sci_handler) {
+
+                /* Invoke the installed handler (at interrupt level) */
+
+                int_status |= sci_handler->address(sci_handler->context);
+
+                sci_handler = sci_handler->next;
+        }
+
+        acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
+        return (int_status);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ev_sci_xrupt_handler
  *
  * PARAMETERS:  context   - Calling Context
@@ -89,6 +133,11 @@ static u32 ACPI_SYSTEM_XFACE acpi_ev_sci_xrupt_handler(void *context)
          */
         interrupt_handled |= acpi_ev_gpe_detect(gpe_xrupt_list);
 
+        /* Invoke all host-installed SCI handlers */
+
+        interrupt_handled |= acpi_ev_sci_dispatch();
+
+        acpi_sci_count++;
         return_UINT32(interrupt_handled);
 }
 
@@ -112,14 +161,13 @@ u32 ACPI_SYSTEM_XFACE acpi_ev_gpe_xrupt_handler(void *context)
         ACPI_FUNCTION_TRACE(ev_gpe_xrupt_handler);
 
         /*
-         * We are guaranteed by the ACPI CA initialization/shutdown code that
+         * We are guaranteed by the ACPICA initialization/shutdown code that
          * if this interrupt handler is installed, ACPI is enabled.
          */
 
         /* GPEs: Check for and dispatch any GPEs that have occurred */
 
         interrupt_handled |= acpi_ev_gpe_detect(gpe_xrupt_list);
-
         return_UINT32(interrupt_handled);
 }
 
@@ -150,15 +198,15 @@ u32 acpi_ev_install_sci_handler(void)
 
 /******************************************************************************
  *
- * FUNCTION:    acpi_ev_remove_sci_handler
+ * FUNCTION:    acpi_ev_remove_all_sci_handlers
  *
  * PARAMETERS:  none
  *
- * RETURN:      E_OK if handler uninstalled OK, E_ERROR if handler was not
+ * RETURN:      AE_OK if handler uninstalled, AE_ERROR if handler was not
  *              installed to begin with
  *
  * DESCRIPTION: Remove the SCI interrupt handler. No further SCIs will be
- *              taken.
+ *              taken. Remove all host-installed SCI handlers.
  *
  * Note:  It doesn't seem important to disable all events or set the event
  *        enable registers to their original values. The OS should disable
@@ -167,11 +215,13 @@ u32 acpi_ev_install_sci_handler(void)
  *
  ******************************************************************************/
 
-acpi_status acpi_ev_remove_sci_handler(void)
+acpi_status acpi_ev_remove_all_sci_handlers(void)
 {
+        struct acpi_sci_handler_info *sci_handler;
+        acpi_cpu_flags flags;
         acpi_status status;
 
-        ACPI_FUNCTION_TRACE(ev_remove_sci_handler);
+        ACPI_FUNCTION_TRACE(ev_remove_all_sci_handlers);
 
         /* Just let the OS remove the handler and disable the level */
 
@@ -179,6 +229,21 @@ acpi_status acpi_ev_remove_sci_handler(void)
             acpi_os_remove_interrupt_handler((u32) acpi_gbl_FADT.sci_interrupt,
                                              acpi_ev_sci_xrupt_handler);
 
+        if (!acpi_gbl_sci_handler_list) {
+                return (status);
+        }
+
+        flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock);
+
+        /* Free all host-installed SCI handlers */
+
+        while (acpi_gbl_sci_handler_list) {
+                sci_handler = acpi_gbl_sci_handler_list;
+                acpi_gbl_sci_handler_list = sci_handler->next;
+                ACPI_FREE(sci_handler);
+        }
+
+        acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
         return_ACPI_STATUS(status);
 }
 
diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
index ca5fba99c33b..23a7fadca412 100644
--- a/drivers/acpi/acpica/evxface.c
+++ b/drivers/acpi/acpica/evxface.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -374,7 +375,7 @@ acpi_status acpi_install_exception_handler(acpi_exception_handler handler)
 
         acpi_gbl_exception_handler = handler;
 
-      cleanup:
+cleanup:
         (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
@@ -385,6 +386,144 @@ ACPI_EXPORT_SYMBOL(acpi_install_exception_handler)
 #if (!ACPI_REDUCED_HARDWARE)
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_install_sci_handler
+ *
+ * PARAMETERS:  address             - Address of the handler
+ *              context             - Value passed to the handler on each SCI
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Install a handler for a System Control Interrupt.
+ *
+ ******************************************************************************/
+acpi_status acpi_install_sci_handler(acpi_sci_handler address, void *context)
+{
+        struct acpi_sci_handler_info *new_sci_handler;
+        struct acpi_sci_handler_info *sci_handler;
+        acpi_cpu_flags flags;
+        acpi_status status;
+
+        ACPI_FUNCTION_TRACE(acpi_install_sci_handler);
+
+        if (!address) {
+                return_ACPI_STATUS(AE_BAD_PARAMETER);
+        }
+
+        /* Allocate and init a handler object */
+
+        new_sci_handler = ACPI_ALLOCATE(sizeof(struct acpi_sci_handler_info));
+        if (!new_sci_handler) {
+                return_ACPI_STATUS(AE_NO_MEMORY);
+        }
+
+        new_sci_handler->address = address;
+        new_sci_handler->context = context;
+
+        status = acpi_ut_acquire_mutex(ACPI_MTX_EVENTS);
+        if (ACPI_FAILURE(status)) {
+                goto exit;
+        }
+
+        /* Lock list during installation */
+
+        flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock);
+        sci_handler = acpi_gbl_sci_handler_list;
+
+        /* Ensure handler does not already exist */
+
+        while (sci_handler) {
+                if (address == sci_handler->address) {
+                        status = AE_ALREADY_EXISTS;
+                        goto unlock_and_exit;
+                }
+
+                sci_handler = sci_handler->next;
+        }
+
+        /* Install the new handler into the global list (at head) */
+
+        new_sci_handler->next = acpi_gbl_sci_handler_list;
+        acpi_gbl_sci_handler_list = new_sci_handler;
+
+unlock_and_exit:
+
+        acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
+        (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
+
+exit:
+        if (ACPI_FAILURE(status)) {
+                ACPI_FREE(new_sci_handler);
+        }
+        return_ACPI_STATUS(status);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_remove_sci_handler
+ *
+ * PARAMETERS:  address             - Address of the handler
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Remove a handler for a System Control Interrupt.
+ *
+ ******************************************************************************/
+
+acpi_status acpi_remove_sci_handler(acpi_sci_handler address)
+{
+        struct acpi_sci_handler_info *prev_sci_handler;
+        struct acpi_sci_handler_info *next_sci_handler;
+        acpi_cpu_flags flags;
+        acpi_status status;
+
+        ACPI_FUNCTION_TRACE(acpi_remove_sci_handler);
+
+        if (!address) {
+                return_ACPI_STATUS(AE_BAD_PARAMETER);
+        }
+
+        status = acpi_ut_acquire_mutex(ACPI_MTX_EVENTS);
+        if (ACPI_FAILURE(status)) {
+                return_ACPI_STATUS(status);
+        }
+
+        /* Remove the SCI handler with lock */
+
+        flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock);
+
+        prev_sci_handler = NULL;
+        next_sci_handler = acpi_gbl_sci_handler_list;
+        while (next_sci_handler) {
+                if (next_sci_handler->address == address) {
+
+                        /* Unlink and free the SCI handler info block */
+
+                        if (prev_sci_handler) {
+                                prev_sci_handler->next = next_sci_handler->next;
+                        } else {
+                                acpi_gbl_sci_handler_list =
+                                    next_sci_handler->next;
+                        }
+
+                        acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
+                        ACPI_FREE(next_sci_handler);
+                        goto unlock_and_exit;
+                }
+
+                prev_sci_handler = next_sci_handler;
+                next_sci_handler = next_sci_handler->next;
+        }
+
+        acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
+        status = AE_NOT_EXIST;
+
+unlock_and_exit:
+        (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
+        return_ACPI_STATUS(status);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_install_global_event_handler
  *
  * PARAMETERS:  handler         - Pointer to the global event handler function
@@ -398,6 +537,7 @@ ACPI_EXPORT_SYMBOL(acpi_install_exception_handler)
  *              Can be used to update event counters, etc.
  *
  ******************************************************************************/
+
 acpi_status
 acpi_install_global_event_handler(acpi_gbl_event_handler handler, void *context)
 {
@@ -426,7 +566,7 @@ acpi_install_global_event_handler(acpi_gbl_event_handler handler, void *context)
         acpi_gbl_global_event_handler = handler;
         acpi_gbl_global_event_handler_context = context;
 
-      cleanup:
+cleanup:
         (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
@@ -498,7 +638,7 @@ acpi_install_fixed_event_handler(u32 event,
                                   handler));
         }
 
-      cleanup:
+cleanup:
         (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c
index 7039606a0ba8..39d06af5e347 100644
--- a/drivers/acpi/acpica/evxfevnt.c
+++ b/drivers/acpi/acpica/evxfevnt.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "actables.h"
diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
index 7662f1a42ff6..5713da77c665 100644
--- a/drivers/acpi/acpica/evxfgpe.c
+++ b/drivers/acpi/acpica/evxfgpe.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acevents.h"
@@ -471,7 +472,7 @@ acpi_get_gpe_status(acpi_handle gpe_device,
         if (gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK)
                 *event_status |= ACPI_EVENT_FLAG_HANDLE;
 
-      unlock_and_exit:
+unlock_and_exit:
         acpi_os_release_lock(acpi_gbl_gpe_lock, flags);
         return_ACPI_STATUS(status);
 }
@@ -624,7 +625,7 @@ acpi_install_gpe_block(acpi_handle gpe_device,
 
         obj_desc->device.gpe_block = gpe_block;
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_ACPI_STATUS(status);
 }
@@ -679,7 +680,7 @@ acpi_status acpi_remove_gpe_block(acpi_handle gpe_device)
                 obj_desc->device.gpe_block = NULL;
         }
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c
index 80cecf838591..02ed75ac56cd 100644
--- a/drivers/acpi/acpica/evxfregn.c
+++ b/drivers/acpi/acpica/evxfregn.c
@@ -42,7 +42,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -147,7 +148,7 @@ acpi_install_address_space_handler(acpi_handle device,
 
         status = acpi_ev_execute_reg_methods(node, space_id);
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_ACPI_STATUS(status);
 }
@@ -286,7 +287,7 @@ acpi_remove_address_space_handler(acpi_handle device,
 
         status = AE_NOT_EXIST;
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/excreate.c b/drivers/acpi/acpica/excreate.c
index 269e81d86ef4..3c2e6dcdad3e 100644
--- a/drivers/acpi/acpica/excreate.c
+++ b/drivers/acpi/acpica/excreate.c
@@ -193,7 +193,7 @@ acpi_status acpi_ex_create_event(struct acpi_walk_state *walk_state)
             acpi_ns_attach_object((struct acpi_namespace_node *)walk_state->
                                   operands[0], obj_desc, ACPI_TYPE_EVENT);
 
-      cleanup:
+cleanup:
         /*
          * Remove local reference to the object (on error, will cause deletion
          * of both object and semaphore if present.)
@@ -248,7 +248,7 @@ acpi_status acpi_ex_create_mutex(struct acpi_walk_state *walk_state)
             acpi_ns_attach_object(obj_desc->mutex.node, obj_desc,
                                   ACPI_TYPE_MUTEX);
 
-      cleanup:
+cleanup:
         /*
          * Remove local reference to the object (on error, will cause deletion
          * of both object and semaphore if present.)
@@ -347,7 +347,7 @@ acpi_ex_create_region(u8 * aml_start,
 
         status = acpi_ns_attach_object(node, obj_desc, ACPI_TYPE_REGION);
 
-      cleanup:
+cleanup:
 
         /* Remove local reference to the object */
 
@@ -520,7 +520,7 @@ acpi_ex_create_method(u8 * aml_start,
 
         acpi_ut_remove_reference(obj_desc);
 
-      exit:
+exit:
         /* Remove a reference to the operand */
 
         acpi_ut_remove_reference(operand[1]);
diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c
index c2a65aaf29af..cfd875243421 100644
--- a/drivers/acpi/acpica/exfield.c
+++ b/drivers/acpi/acpica/exfield.c
@@ -197,7 +197,7 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
         status = acpi_ex_extract_from_field(obj_desc, buffer, (u32) length);
         acpi_ex_release_global_lock(obj_desc->common_field.field_flags);
 
-      exit:
+exit:
         if (ACPI_FAILURE(status)) {
                 acpi_ut_remove_reference(buffer_desc);
         } else {
diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
index 7e0afe72487e..49fb742d61b9 100644
--- a/drivers/acpi/acpica/exfldio.c
+++ b/drivers/acpi/acpica/exfldio.c
@@ -123,12 +123,6 @@ acpi_ex_setup_region(union acpi_operand_object *obj_desc,
                 }
         }
 
-        /* Exit if Address/Length have been disallowed by the host OS */
-
-        if (rgn_desc->common.flags & AOPOBJ_INVALID) {
-                return_ACPI_STATUS(AE_AML_ILLEGAL_ADDRESS);
-        }
-
         /*
          * Exit now for SMBus, GSBus or IPMI address space, it has a non-linear
          * address space and the request cannot be directly validated
@@ -1002,7 +996,7 @@ acpi_ex_insert_into_field(union acpi_operand_object *obj_desc,
                                                 mask, merged_datum,
                                                 field_offset);
 
-      exit:
+exit:
         /* Free temporary buffer if we used one */
 
         if (new_buffer) {
diff --git a/drivers/acpi/acpica/exmisc.c b/drivers/acpi/acpica/exmisc.c
index 00bf29877574..65d93607f368 100644
--- a/drivers/acpi/acpica/exmisc.c
+++ b/drivers/acpi/acpica/exmisc.c
@@ -388,7 +388,7 @@ acpi_ex_do_concatenate(union acpi_operand_object *operand0,
 
         *actual_return_desc = return_desc;
 
-      cleanup:
+cleanup:
         if (local_operand1 != operand1) {
                 acpi_ut_remove_reference(local_operand1);
         }
@@ -718,7 +718,7 @@ acpi_ex_do_logical_op(u16 opcode,
                 }
         }
 
-      cleanup:
+cleanup:
 
         /* New object was created if implicit conversion performed - delete */
 
diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
index 2cdd41d8ade6..d74cea416ca0 100644
--- a/drivers/acpi/acpica/exoparg1.c
+++ b/drivers/acpi/acpica/exoparg1.c
@@ -115,7 +115,7 @@ acpi_status acpi_ex_opcode_0A_0T_1R(struct acpi_walk_state *walk_state)
                 break;
         }
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
@@ -234,7 +234,7 @@ acpi_status acpi_ex_opcode_1A_1T_0R(struct acpi_walk_state *walk_state)
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
 
         return_ACPI_STATUS(status);
 }
@@ -551,7 +551,7 @@ acpi_status acpi_ex_opcode_1A_1T_1R(struct acpi_walk_state *walk_state)
                 status = acpi_ex_store(return_desc, operand[1], walk_state);
         }
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
@@ -1054,7 +1054,7 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
diff --git a/drivers/acpi/acpica/exoparg2.c b/drivers/acpi/acpica/exoparg2.c
index d5088f7030c7..d6fa0fce1fc9 100644
--- a/drivers/acpi/acpica/exoparg2.c
+++ b/drivers/acpi/acpica/exoparg2.c
@@ -215,7 +215,7 @@ acpi_status acpi_ex_opcode_2A_2T_1R(struct acpi_walk_state *walk_state)
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
         /*
          * Since the remainder is not returned indirectly, remove a reference to
          * it. Only the quotient is returned indirectly.
@@ -445,7 +445,7 @@ acpi_status acpi_ex_opcode_2A_1T_1R(struct acpi_walk_state *walk_state)
                 break;
         }
 
-      store_result_to_target:
+store_result_to_target:
 
         if (ACPI_SUCCESS(status)) {
                 /*
@@ -462,7 +462,7 @@ acpi_status acpi_ex_opcode_2A_1T_1R(struct acpi_walk_state *walk_state)
                 }
         }
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
@@ -553,7 +553,7 @@ acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
                 goto cleanup;
         }
 
-      store_logical_result:
+store_logical_result:
         /*
          * Set return value to according to logical_result. logical TRUE (all ones)
          * Default is FALSE (zero)
@@ -562,7 +562,7 @@ acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
                 return_desc->integer.value = ACPI_UINT64_MAX;
         }
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
index 37656f12f204..bc042adf8804 100644
--- a/drivers/acpi/acpica/exoparg3.c
+++ b/drivers/acpi/acpica/exoparg3.c
@@ -124,7 +124,7 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
 
         return_ACPI_STATUS(status);
 }
@@ -252,7 +252,7 @@ acpi_status acpi_ex_opcode_3A_1T_1R(struct acpi_walk_state *walk_state)
 
         status = acpi_ex_store(return_desc, operand[3], walk_state);
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
diff --git a/drivers/acpi/acpica/exoparg6.c b/drivers/acpi/acpica/exoparg6.c
index 879b6cd8319c..4459e32c683d 100644
--- a/drivers/acpi/acpica/exoparg6.c
+++ b/drivers/acpi/acpica/exoparg6.c
@@ -314,7 +314,7 @@ acpi_status acpi_ex_opcode_6A_0T_1R(struct acpi_walk_state * walk_state)
                 goto cleanup;
         }
 
-      cleanup:
+cleanup:
 
         /* Delete return object on error */
 
diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
index 303429bb4d5d..9d28867e60dc 100644
--- a/drivers/acpi/acpica/exregion.c
+++ b/drivers/acpi/acpica/exregion.c
@@ -400,6 +400,7 @@ acpi_ex_pci_config_space_handler(u32 function,
         switch (function) {
         case ACPI_READ:
 
+                *value = 0;
                 status = acpi_os_read_pci_configuration(pci_id, pci_register,
                                                         value, bit_width);
                 break;
diff --git a/drivers/acpi/acpica/exresolv.c b/drivers/acpi/acpica/exresolv.c
index ac04278ad28f..1606524312e3 100644
--- a/drivers/acpi/acpica/exresolv.c
+++ b/drivers/acpi/acpica/exresolv.c
@@ -521,7 +521,7 @@ acpi_ex_resolve_multiple(struct acpi_walk_state *walk_state,
          */
         type = obj_desc->common.type;
 
-      exit:
+exit:
         /* Convert internal types to external types */
 
         switch (type) {
diff --git a/drivers/acpi/acpica/exresop.c b/drivers/acpi/acpica/exresop.c
index 00e5af7129c1..be3f66973ee8 100644
--- a/drivers/acpi/acpica/exresop.c
+++ b/drivers/acpi/acpica/exresop.c
@@ -683,7 +683,7 @@ acpi_ex_resolve_operands(u16 opcode,
                         return_ACPI_STATUS(status);
                 }
 
-              next_operand:
+next_operand:
                 /*
                  * If more operands needed, decrement stack_ptr to point
                  * to next operand on stack
diff --git a/drivers/acpi/acpica/hwregs.c b/drivers/acpi/acpica/hwregs.c
index 8d2e866be15f..12e6cff54f78 100644
--- a/drivers/acpi/acpica/hwregs.c
+++ b/drivers/acpi/acpica/hwregs.c
@@ -560,7 +560,7 @@ acpi_status acpi_hw_register_write(u32 register_id, u32 value)
                 break;
         }
 
-      exit:
+exit:
         return_ACPI_STATUS(status);
 }
 
diff --git a/drivers/acpi/acpica/hwtimer.c b/drivers/acpi/acpica/hwtimer.c
index 2d7d22ebc782..3c498dc1636e 100644
--- a/drivers/acpi/acpica/hwtimer.c
+++ b/drivers/acpi/acpica/hwtimer.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 
diff --git a/drivers/acpi/acpica/hwxface.c b/drivers/acpi/acpica/hwxface.c
index 5ee7a814cd92..b4b47db2dee2 100644
--- a/drivers/acpi/acpica/hwxface.c
+++ b/drivers/acpi/acpica/hwxface.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -83,11 +84,17 @@ acpi_status acpi_reset(void)
                  * For I/O space, write directly to the OSL. This bypasses the port
                  * validation mechanism, which may block a valid write to the reset
                  * register.
-                 * Spec section 4.7.3.6 requires register width to be 8.
+                 *
+                 * NOTE:
+                 * The ACPI spec requires the reset register width to be 8, so we
+                 * hardcode it here and ignore the FADT value. This maintains
+                 * compatibility with other ACPI implementations that have allowed
+                 * BIOS code with bad register width values to go unnoticed.
                  */
                 status =
                     acpi_os_write_port((acpi_io_address) reset_reg->address,
-                                       acpi_gbl_FADT.reset_value, 8);
+                                       acpi_gbl_FADT.reset_value,
+                                       ACPI_RESET_REGISTER_WIDTH);
         } else {
                 /* Write the reset value to the reset register */
 
@@ -119,7 +126,8 @@ ACPI_EXPORT_SYMBOL(acpi_reset)
  ******************************************************************************/
 acpi_status acpi_read(u64 *return_value, struct acpi_generic_address *reg)
 {
-        u32 value;
+        u32 value_lo;
+        u32 value_hi;
         u32 width;
         u64 address;
         acpi_status status;
@@ -137,13 +145,8 @@ acpi_status acpi_read(u64 *return_value, struct acpi_generic_address *reg)
                 return (status);
         }
 
-        /* Initialize entire 64-bit return value to zero */
-
-        *return_value = 0;
-        value = 0;
-
         /*
-         * Two address spaces supported: Memory or IO. PCI_Config is
+         * Two address spaces supported: Memory or I/O. PCI_Config is
          * not supported here because the GAS structure is insufficient
          */
         if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
@@ -155,29 +158,35 @@ acpi_status acpi_read(u64 *return_value, struct acpi_generic_address *reg)
                 }
         } else {                /* ACPI_ADR_SPACE_SYSTEM_IO, validated earlier */
 
+                value_lo = 0;
+                value_hi = 0;
+
                 width = reg->bit_width;
                 if (width == 64) {
                         width = 32;     /* Break into two 32-bit transfers */
                 }
 
                 status = acpi_hw_read_port((acpi_io_address)
-                                           address, &value, width);
+                                           address, &value_lo, width);
                 if (ACPI_FAILURE(status)) {
                         return (status);
                 }
-                *return_value = value;
 
                 if (reg->bit_width == 64) {
 
                         /* Read the top 32 bits */
 
                         status = acpi_hw_read_port((acpi_io_address)
-                                                   (address + 4), &value, 32);
+                                                   (address + 4), &value_hi,
+                                                   32);
                         if (ACPI_FAILURE(status)) {
                                 return (status);
                         }
-                        *return_value |= ((u64)value << 32);
                 }
+
+                /* Set the return value only if status is AE_OK */
+
+                *return_value = (value_lo | ((u64)value_hi << 32));
         }
 
         ACPI_DEBUG_PRINT((ACPI_DB_IO,
@@ -186,7 +195,7 @@ acpi_status acpi_read(u64 *return_value, struct acpi_generic_address *reg)
                           ACPI_FORMAT_UINT64(address),
                           acpi_ut_get_region_name(reg->space_id)));
 
-        return (status);
+        return (AE_OK);
 }
 
 ACPI_EXPORT_SYMBOL(acpi_read)
@@ -561,10 +570,10 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b)
                 break;
         }
 
-      cleanup1:
+cleanup1:
         acpi_ut_remove_reference(info->return_object);
 
-      cleanup:
+cleanup:
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status,
                                 "While evaluating Sleep State [%s]",
diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
index f2e669db8b65..15dddc10fc9b 100644
--- a/drivers/acpi/acpica/hwxfsleep.c
+++ b/drivers/acpi/acpica/hwxfsleep.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 
@@ -166,7 +167,7 @@ ACPI_EXPORT_SYMBOL(acpi_set_firmware_waking_vector64)
  *              THIS FUNCTION MUST BE CALLED WITH INTERRUPTS DISABLED
  *
  ******************************************************************************/
-acpi_status asmlinkage acpi_enter_sleep_state_s4bios(void)
+acpi_status acpi_enter_sleep_state_s4bios(void)
 {
         u32 in_value;
         acpi_status status;
@@ -360,7 +361,7 @@ ACPI_EXPORT_SYMBOL(acpi_enter_sleep_state_prep)
  *              THIS FUNCTION MUST BE CALLED WITH INTERRUPTS DISABLED
  *
  ******************************************************************************/
-acpi_status asmlinkage acpi_enter_sleep_state(u8 sleep_state)
+acpi_status acpi_enter_sleep_state(u8 sleep_state)
 {
         acpi_status status;
 
diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c
index c5316e5bd4ab..14f65f6345b9 100644
--- a/drivers/acpi/acpica/nsaccess.c
+++ b/drivers/acpi/acpica/nsaccess.c
@@ -240,7 +240,7 @@ acpi_status acpi_ns_root_initialize(void)
                 }
         }
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 
         /* Save a handle to "_GPE", it is always present */
@@ -424,8 +424,9 @@ acpi_ns_lookup(union acpi_generic_state *scope_info,
                                         /* Current scope has no parent scope */
 
                                         ACPI_ERROR((AE_INFO,
-                                                    "ACPI path has too many parent prefixes (^) "
-                                                    "- reached beyond root node"));
+                                                    "%s: Path has too many parent prefixes (^) "
+                                                    "- reached beyond root node",
+                                                    pathname));
                                         return_ACPI_STATUS(AE_NOT_FOUND);
                                 }
                         }
diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
index 7418c77fde8c..48b9c6f12643 100644
--- a/drivers/acpi/acpica/nsdump.c
+++ b/drivers/acpi/acpica/nsdump.c
@@ -59,6 +59,17 @@ acpi_ns_dump_one_device(acpi_handle obj_handle,
 #endif
 
 #if defined(ACPI_DEBUG_OUTPUT) || defined(ACPI_DEBUGGER)
+
+#ifdef  ACPI_FUTURE_USAGE
+static acpi_status
+acpi_ns_dump_one_object_path(acpi_handle obj_handle,
+                             u32 level, void *context, void **return_value);
+
+static acpi_status
+acpi_ns_get_max_depth(acpi_handle obj_handle,
+                      u32 level, void *context, void **return_value);
+#endif                          /* ACPI_FUTURE_USAGE */
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ns_print_pathname
@@ -609,7 +620,7 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
                 obj_type = ACPI_TYPE_INVALID;   /* Terminate loop after next pass */
         }
 
-      cleanup:
+cleanup:
         acpi_os_printf("\n");
         return (AE_OK);
 }
@@ -671,6 +682,136 @@ acpi_ns_dump_objects(acpi_object_type type,
 }
 #endif                          /* ACPI_FUTURE_USAGE */
 
+#ifdef  ACPI_FUTURE_USAGE
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_dump_one_object_path, acpi_ns_get_max_depth
+ *
+ * PARAMETERS:  obj_handle          - Node to be dumped
+ *              level               - Nesting level of the handle
+ *              context             - Passed into walk_namespace
+ *              return_value        - Not used
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Dump the full pathname to a namespace object. acp_ns_get_max_depth
+ *              computes the maximum nesting depth in the namespace tree, in
+ *              order to simplify formatting in acpi_ns_dump_one_object_path.
+ *              These procedures are user_functions called by acpi_ns_walk_namespace.
+ *
+ ******************************************************************************/
+
+static acpi_status
+acpi_ns_dump_one_object_path(acpi_handle obj_handle,
+                             u32 level, void *context, void **return_value)
+{
+        u32 max_level = *((u32 *)context);
+        char *pathname;
+        struct acpi_namespace_node *node;
+        int path_indent;
+
+        if (!obj_handle) {
+                return (AE_OK);
+        }
+
+        node = acpi_ns_validate_handle(obj_handle);
+        if (!node) {
+
+                /* Ignore bad node during namespace walk */
+
+                return (AE_OK);
+        }
+
+        pathname = acpi_ns_get_external_pathname(node);
+
+        path_indent = 1;
+        if (level <= max_level) {
+                path_indent = max_level - level + 1;
+        }
+
+        acpi_os_printf("%2d%*s%-12s%*s",
+                       level, level, " ", acpi_ut_get_type_name(node->type),
+                       path_indent, " ");
+
+        acpi_os_printf("%s\n", &pathname[1]);
+        ACPI_FREE(pathname);
+        return (AE_OK);
+}
+
+static acpi_status
+acpi_ns_get_max_depth(acpi_handle obj_handle,
+                      u32 level, void *context, void **return_value)
+{
+        u32 *max_level = (u32 *)context;
+
+        if (level > *max_level) {
+                *max_level = level;
+        }
+        return (AE_OK);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_dump_object_paths
+ *
+ * PARAMETERS:  type                - Object type to be dumped
+ *              display_type        - 0 or ACPI_DISPLAY_SUMMARY
+ *              max_depth           - Maximum depth of dump. Use ACPI_UINT32_MAX
+ *                                    for an effectively unlimited depth.
+ *              owner_id            - Dump only objects owned by this ID. Use
+ *                                    ACPI_UINT32_MAX to match all owners.
+ *              start_handle        - Where in namespace to start/end search
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Dump full object pathnames within the loaded namespace. Uses
+ *              acpi_ns_walk_namespace in conjunction with acpi_ns_dump_one_object_path.
+ *
+ ******************************************************************************/
+
+void
+acpi_ns_dump_object_paths(acpi_object_type type,
+                          u8 display_type,
+                          u32 max_depth,
+                          acpi_owner_id owner_id, acpi_handle start_handle)
+{
+        acpi_status status;
+        u32 max_level = 0;
+
+        ACPI_FUNCTION_ENTRY();
+
+        /*
+         * Just lock the entire namespace for the duration of the dump.
+         * We don't want any changes to the namespace during this time,
+         * especially the temporary nodes since we are going to display
+         * them also.
+         */
+        status = acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+        if (ACPI_FAILURE(status)) {
+                acpi_os_printf("Could not acquire namespace mutex\n");
+                return;
+        }
+
+        /* Get the max depth of the namespace tree, for formatting later */
+
+        (void)acpi_ns_walk_namespace(type, start_handle, max_depth,
+                                     ACPI_NS_WALK_NO_UNLOCK |
+                                     ACPI_NS_WALK_TEMP_NODES,
+                                     acpi_ns_get_max_depth, NULL,
+                                     (void *)&max_level, NULL);
+
+        /* Now dump the entire namespace */
+
+        (void)acpi_ns_walk_namespace(type, start_handle, max_depth,
+                                     ACPI_NS_WALK_NO_UNLOCK |
+                                     ACPI_NS_WALK_TEMP_NODES,
+                                     acpi_ns_dump_one_object_path, NULL,
+                                     (void *)&max_level, NULL);
+
+        (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+}
+#endif                          /* ACPI_FUTURE_USAGE */
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ns_dump_entry
diff --git a/drivers/acpi/acpica/nsdumpdv.c b/drivers/acpi/acpica/nsdumpdv.c
index 409ae80824d1..283762511b73 100644
--- a/drivers/acpi/acpica/nsdumpdv.c
+++ b/drivers/acpi/acpica/nsdumpdv.c
@@ -69,6 +69,7 @@ static acpi_status
 acpi_ns_dump_one_device(acpi_handle obj_handle,
                         u32 level, void *context, void **return_value)
 {
+        struct acpi_buffer buffer;
         struct acpi_device_info *info;
         acpi_status status;
         u32 i;
@@ -78,15 +79,17 @@ acpi_ns_dump_one_device(acpi_handle obj_handle,
         status =
             acpi_ns_dump_one_object(obj_handle, level, context, return_value);
 
-        status = acpi_get_object_info(obj_handle, &info);
+        buffer.length = ACPI_ALLOCATE_LOCAL_BUFFER;
+        status = acpi_get_object_info(obj_handle, &buffer);
         if (ACPI_SUCCESS(status)) {
+                info = buffer.pointer;
                 for (i = 0; i < level; i++) {
                         ACPI_DEBUG_PRINT_RAW((ACPI_DB_TABLES, " "));
                 }
 
                 ACPI_DEBUG_PRINT_RAW((ACPI_DB_TABLES,
                                       "    HID: %s, ADR: %8.8X%8.8X, Status: %X\n",
-                                      info->hardware_id.string,
+                                      info->hardware_id.value,
                                       ACPI_FORMAT_UINT64(info->address),
                                       info->current_status));
                 ACPI_FREE(info);
diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
index 18108bc2e51c..963ceef063f8 100644
--- a/drivers/acpi/acpica/nseval.c
+++ b/drivers/acpi/acpica/nseval.c
@@ -314,7 +314,7 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
                           "*** Completed evaluation of object %s ***\n",
                           info->relative_pathname));
 
- cleanup:
+cleanup:
         /*
          * Namespace was unlocked by the handling acpi_ns* function, so we
          * just free the pathname and return
@@ -486,7 +486,7 @@ acpi_ns_exec_module_code(union acpi_operand_object *method_obj,
                 parent_node->type = (u8)type;
         }
 
-      exit:
+exit:
         if (parent_obj) {
                 acpi_ut_remove_reference(parent_obj);
         }
diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index dd2ceae3f717..3a0423af968c 100644
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -213,7 +213,7 @@ acpi_status acpi_ns_initialize_devices(void)
 
         return_ACPI_STATUS(status);
 
-      error_exit:
+error_exit:
         ACPI_EXCEPTION((AE_INFO, status, "During device initialization"));
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/nsload.c b/drivers/acpi/acpica/nsload.c
index 0a7badc3179f..89ec645e7730 100644
--- a/drivers/acpi/acpica/nsload.c
+++ b/drivers/acpi/acpica/nsload.c
@@ -114,7 +114,7 @@ acpi_ns_load_table(u32 table_index, struct acpi_namespace_node *node)
                 (void)acpi_tb_release_owner_id(table_index);
         }
 
-      unlock:
+unlock:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 
         if (ACPI_FAILURE(status)) {
diff --git a/drivers/acpi/acpica/nsparse.c b/drivers/acpi/acpica/nsparse.c
index 35dde8151c0d..177857340271 100644
--- a/drivers/acpi/acpica/nsparse.c
+++ b/drivers/acpi/acpica/nsparse.c
@@ -140,7 +140,7 @@ acpi_ns_one_complete_parse(u32 pass_number,
                           pass_number));
         status = acpi_ps_parse_aml(walk_state);
 
-      cleanup:
+cleanup:
         acpi_ps_delete_parse_tree(parse_root);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/nspredef.c b/drivers/acpi/acpica/nspredef.c
index 098e7666cbc9..d2855d9857c4 100644
--- a/drivers/acpi/acpica/nspredef.c
+++ b/drivers/acpi/acpica/nspredef.c
@@ -271,7 +271,7 @@ acpi_ns_check_object_type(struct acpi_evaluate_info *info,
                 return (AE_OK); /* Successful repair */
         }
 
-      type_error_exit:
+type_error_exit:
 
         /* Create a string with all expected types for this predefined object */
 
diff --git a/drivers/acpi/acpica/nsprepkg.c b/drivers/acpi/acpica/nsprepkg.c
index 6d55cef7916c..3d5391f9bcb5 100644
--- a/drivers/acpi/acpica/nsprepkg.c
+++ b/drivers/acpi/acpica/nsprepkg.c
@@ -330,7 +330,7 @@ acpi_ns_check_package(struct acpi_evaluate_info *info,
 
         return (status);
 
-      package_too_small:
+package_too_small:
 
         /* Error exit for the case with an incorrect package count */
 
@@ -555,7 +555,7 @@ acpi_ns_check_package_list(struct acpi_evaluate_info *info,
 
         return (AE_OK);
 
-      package_too_small:
+package_too_small:
 
         /* The sub-package count was smaller than required */
 
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
index f8e71ea60319..a05afff50eb9 100644
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -263,7 +263,7 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,
 
         return (AE_AML_OPERAND_TYPE);
 
-      object_repaired:
+object_repaired:
 
         /* Object was successfully repaired */
 
diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c
index c84603ee83ae..6a25d320b169 100644
--- a/drivers/acpi/acpica/nsrepair2.c
+++ b/drivers/acpi/acpica/nsrepair2.c
@@ -478,7 +478,7 @@ acpi_ns_repair_CST(struct acpi_evaluate_info *info,
                         removing = TRUE;
                 }
 
-              remove_element:
+remove_element:
                 if (removing) {
                         acpi_ns_remove_element(return_object, i + 1);
                         outer_element_count--;
diff --git a/drivers/acpi/acpica/nssearch.c b/drivers/acpi/acpica/nssearch.c
index 5d43efc53a61..47420faef073 100644
--- a/drivers/acpi/acpica/nssearch.c
+++ b/drivers/acpi/acpica/nssearch.c
@@ -381,7 +381,8 @@ acpi_ns_search_and_enter(u32 target_name,
 
         /* Node is an object defined by an External() statement */
 
-        if (flags & ACPI_NS_EXTERNAL) {
+        if (flags & ACPI_NS_EXTERNAL ||
+            (walk_state && walk_state->opcode == AML_SCOPE_OP)) {
                 new_node->flags |= ANOBJ_IS_EXTERNAL;
         }
 #endif
diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c
index 08c0b5beec88..cc2fea94c5f0 100644
--- a/drivers/acpi/acpica/nsutils.c
+++ b/drivers/acpi/acpica/nsutils.c
@@ -722,7 +722,7 @@ acpi_ns_get_node(struct acpi_namespace_node *prefix_node,
 
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 
-      cleanup:
+cleanup:
         ACPI_FREE(internal_path);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index b38b4b07f86e..e973e311f856 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -42,7 +42,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -138,7 +139,7 @@ acpi_evaluate_object_typed(acpi_handle handle,
 
                 /* Caller used ACPI_ALLOCATE_BUFFER, free the return buffer */
 
-                ACPI_FREE(return_buffer->pointer);
+                ACPI_FREE_BUFFER(*return_buffer);
                 return_buffer->pointer = NULL;
         }
 
@@ -441,7 +442,7 @@ acpi_evaluate_object(acpi_handle handle,
                 acpi_ex_exit_interpreter();
         }
 
-      cleanup:
+cleanup:
 
         /* Free the input parameter list (if we created one) */
 
@@ -605,14 +606,22 @@ acpi_walk_namespace(acpi_object_type type,
                 goto unlock_and_exit;
         }
 
+        /* Now we can validate the starting node */
+
+        if (!acpi_ns_validate_handle(start_object)) {
+                status = AE_BAD_PARAMETER;
+                goto unlock_and_exit2;
+        }
+
         status = acpi_ns_walk_namespace(type, start_object, max_depth,
                                         ACPI_NS_WALK_UNLOCK,
                                         descending_callback, ascending_callback,
                                         context, return_value);
 
+unlock_and_exit2:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_read_lock(&acpi_gbl_namespace_rw_lock);
         return_ACPI_STATUS(status);
 }
@@ -856,7 +865,7 @@ acpi_attach_data(acpi_handle obj_handle,
 
         status = acpi_ns_attach_data(node, handler, data);
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return (status);
 }
@@ -902,7 +911,7 @@ acpi_detach_data(acpi_handle obj_handle, acpi_object_handler handler)
 
         status = acpi_ns_detach_data(node, handler);
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return (status);
 }
@@ -949,7 +958,7 @@ acpi_get_data(acpi_handle obj_handle, acpi_object_handler handler, void **data)
 
         status = acpi_ns_get_attached_data(node, handler, data);
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return (status);
 }
diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index 83c164434580..3a4bd3ff49a3 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -42,7 +42,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -208,7 +209,7 @@ acpi_get_name(acpi_handle handle, u32 name_type, struct acpi_buffer * buffer)
         ((char *)buffer->pointer)[ACPI_NAME_SIZE] = 0;
         status = AE_OK;
 
-      unlock_and_exit:
+unlock_and_exit:
 
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return (status);
@@ -496,7 +497,7 @@ acpi_get_object_info(acpi_handle handle,
         *return_buffer = info;
         status = AE_OK;
 
-      cleanup:
+cleanup:
         if (hid) {
                 ACPI_FREE(hid);
         }
diff --git a/drivers/acpi/acpica/nsxfobj.c b/drivers/acpi/acpica/nsxfobj.c
index c0853ef294e4..0e6d79e462d4 100644
--- a/drivers/acpi/acpica/nsxfobj.c
+++ b/drivers/acpi/acpica/nsxfobj.c
@@ -42,7 +42,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -200,7 +201,7 @@ acpi_status acpi_get_parent(acpi_handle handle, acpi_handle * ret_handle)
                 status = AE_NULL_ENTRY;
         }
 
-      unlock_and_exit:
+unlock_and_exit:
 
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return (status);
@@ -280,7 +281,7 @@ acpi_get_next_object(acpi_object_type type,
                 *ret_handle = ACPI_CAST_PTR(acpi_handle, node);
         }
 
-      unlock_and_exit:
+unlock_and_exit:
 
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
         return (status);
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index 86198a9139b5..79d9a28dedef 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -297,7 +297,7 @@ acpi_ps_complete_this_op(struct acpi_walk_state * walk_state,
                         }
         }
 
-      cleanup:
+cleanup:
 
         /* Now we can actually delete the subtree rooted at Op */
 
diff --git a/drivers/acpi/acpica/psxface.c b/drivers/acpi/acpica/psxface.c
index 11b99ab20bb3..fcb7a840e996 100644
--- a/drivers/acpi/acpica/psxface.c
+++ b/drivers/acpi/acpica/psxface.c
@@ -142,7 +142,7 @@ static void acpi_ps_start_trace(struct acpi_evaluate_info *info)
                 acpi_dbg_layer = acpi_gbl_trace_dbg_layer;
         }
 
-      exit:
+exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 }
 
@@ -185,7 +185,7 @@ static void acpi_ps_stop_trace(struct acpi_evaluate_info *info)
         acpi_dbg_level = acpi_gbl_original_dbg_level;
         acpi_dbg_layer = acpi_gbl_original_dbg_layer;
 
-      exit:
+exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 }
 
@@ -323,7 +323,7 @@ acpi_status acpi_ps_execute_method(struct acpi_evaluate_info *info)
 
         /* walk_state was deleted by parse_aml */
 
-      cleanup:
+cleanup:
         acpi_ps_delete_parse_tree(op);
 
         /* End optional tracing */
diff --git a/drivers/acpi/acpica/rsmisc.c b/drivers/acpi/acpica/rsmisc.c
index 80d12994e0d0..c99cec9cefde 100644
--- a/drivers/acpi/acpica/rsmisc.c
+++ b/drivers/acpi/acpica/rsmisc.c
@@ -440,7 +440,7 @@ acpi_rs_convert_aml_to_resource(struct acpi_resource *resource,
                 info++;
         }
 
-      exit:
+exit:
         if (!flags_mode) {
 
                 /* Round the resource struct length up to the next boundary (32 or 64) */
@@ -783,7 +783,7 @@ acpi_rs_convert_resource_to_aml(struct acpi_resource *resource,
                 info++;
         }
 
-      exit:
+exit:
         return_ACPI_STATUS(AE_OK);
 }
 
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index 480b6b40c5ea..aef303d56d86 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -784,7 +784,7 @@ acpi_rs_set_srs_method_data(struct acpi_namespace_node *node,
 
         acpi_ut_remove_reference(args[0]);
 
-      cleanup:
+cleanup:
         ACPI_FREE(info);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/rsxface.c b/drivers/acpi/acpica/rsxface.c
index 94e3517554f9..01e476988aae 100644
--- a/drivers/acpi/acpica/rsxface.c
+++ b/drivers/acpi/acpica/rsxface.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acresrc.h"
diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
index 42a13c0d7015..634357d51fe9 100644
--- a/drivers/acpi/acpica/tbinstal.c
+++ b/drivers/acpi/acpica/tbinstal.c
@@ -80,16 +80,10 @@ acpi_status acpi_tb_verify_table(struct acpi_table_desc *table_desc)
                 }
         }
 
-        /* FACS is the odd table, has no standard ACPI header and no checksum */
+        /* Always calculate checksum, ignore bad checksum if requested */
 
-        if (!ACPI_COMPARE_NAME(&table_desc->signature, ACPI_SIG_FACS)) {
-
-                /* Always calculate checksum, ignore bad checksum if requested */
-
-                status =
-                    acpi_tb_verify_checksum(table_desc->pointer,
-                                            table_desc->length);
-        }
+        status =
+            acpi_tb_verify_checksum(table_desc->pointer, table_desc->length);
 
         return_ACPI_STATUS(status);
 }
@@ -237,10 +231,10 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index)
                 goto release;
         }
 
-      print_header:
+print_header:
         acpi_tb_print_table_header(table_desc->address, table_desc->pointer);
 
-      release:
+release:
         (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
         return_ACPI_STATUS(status);
 }
@@ -312,7 +306,7 @@ struct acpi_table_header *acpi_tb_table_override(struct acpi_table_header
 
         return (NULL);          /* There was no override */
 
-      finish_override:
+finish_override:
 
         ACPI_INFO((AE_INFO,
                    "%4.4s %p %s table override, new table: %p",
diff --git a/drivers/acpi/acpica/tbprint.c b/drivers/acpi/acpica/tbprint.c
index dc963f823d2c..6866e767ba90 100644
--- a/drivers/acpi/acpica/tbprint.c
+++ b/drivers/acpi/acpica/tbprint.c
@@ -135,10 +135,10 @@ acpi_tb_print_table_header(acpi_physical_address address,
 
                 /* FACS only has signature and length fields */
 
-                ACPI_INFO((AE_INFO, "%4.4s %p %05X",
+                ACPI_INFO((AE_INFO, "%4.4s %p %06X",
                            header->signature, ACPI_CAST_PTR(void, address),
                            header->length));
-        } else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) {
+        } else if (ACPI_VALIDATE_RSDP_SIG(header->signature)) {
 
                 /* RSDP has no common fields */
 
@@ -147,7 +147,7 @@ acpi_tb_print_table_header(acpi_physical_address address,
                                           header)->oem_id, ACPI_OEM_ID_SIZE);
                 acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
 
-                ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)",
+                ACPI_INFO((AE_INFO, "RSDP %p %06X (v%.2d %6.6s)",
                            ACPI_CAST_PTR(void, address),
                            (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
                             revision >
@@ -162,7 +162,7 @@ acpi_tb_print_table_header(acpi_physical_address address,
                 acpi_tb_cleanup_table_header(&local_header, header);
 
                 ACPI_INFO((AE_INFO,
-                           "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)",
+                           "%4.4s %p %06X (v%.2d %6.6s %8.8s %08X %4.4s %08X)",
                            local_header.signature, ACPI_CAST_PTR(void, address),
                            local_header.length, local_header.revision,
                            local_header.oem_id, local_header.oem_table_id,
@@ -190,6 +190,16 @@ acpi_status acpi_tb_verify_checksum(struct acpi_table_header *table, u32 length)
 {
         u8 checksum;
 
+        /*
+         * FACS/S3PT:
+         * They are the odd tables, have no standard ACPI header and no checksum
+         */
+
+        if (ACPI_COMPARE_NAME(table->signature, ACPI_SIG_S3PT) ||
+            ACPI_COMPARE_NAME(table->signature, ACPI_SIG_FACS)) {
+                return (AE_OK);
+        }
+
         /* Compute the checksum on the table */
 
         checksum = acpi_tb_checksum(ACPI_CAST_PTR(u8, table), length);
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index bffdfc7b8322..3d6bb83aa7e7 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -350,7 +350,7 @@ acpi_tb_install_table(acpi_physical_address address,
                 acpi_tb_delete_table(table_desc);
         }
 
-      unmap_and_exit:
+unmap_and_exit:
 
         /* Always unmap the table header that we mapped above */
 
@@ -430,8 +430,7 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size)
  *
  ******************************************************************************/
 
-acpi_status __init
-acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
+acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
 {
         struct acpi_table_rsdp *rsdp;
         u32 table_entry_size;
diff --git a/drivers/acpi/acpica/tbxface.c b/drivers/acpi/acpica/tbxface.c
index ad11162482ff..db826eaadd1c 100644
--- a/drivers/acpi/acpica/tbxface.c
+++ b/drivers/acpi/acpica/tbxface.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "actables.h"
@@ -147,6 +148,8 @@ acpi_initialize_tables(struct acpi_table_desc * initial_table_array,
         return_ACPI_STATUS(status);
 }
 
+ACPI_EXPORT_SYMBOL_INIT(acpi_initialize_tables)
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_reallocate_root_table
@@ -161,7 +164,7 @@ acpi_initialize_tables(struct acpi_table_desc * initial_table_array,
  *              kernel.
  *
  ******************************************************************************/
-acpi_status acpi_reallocate_root_table(void)
+acpi_status __init acpi_reallocate_root_table(void)
 {
         acpi_status status;
 
@@ -181,6 +184,8 @@ acpi_status acpi_reallocate_root_table(void)
         return_ACPI_STATUS(status);
 }
 
+ACPI_EXPORT_SYMBOL_INIT(acpi_reallocate_root_table)
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_get_table_header
@@ -356,6 +361,7 @@ acpi_get_table_with_size(char *signature,
 
         return (AE_NOT_FOUND);
 }
+
 ACPI_EXPORT_SYMBOL(acpi_get_table_with_size)
 
 acpi_status
@@ -367,6 +373,7 @@ acpi_get_table(char *signature,
         return acpi_get_table_with_size(signature,
                        instance, out_table, &tbl_size);
 }
+
 ACPI_EXPORT_SYMBOL(acpi_get_table)
 
 /*******************************************************************************
@@ -424,7 +431,6 @@ acpi_get_table_by_index(u32 table_index, struct acpi_table_header **table)
 
 ACPI_EXPORT_SYMBOL(acpi_get_table_by_index)
 
-
 /*******************************************************************************
  *
  * FUNCTION:    acpi_install_table_handler
@@ -465,7 +471,7 @@ acpi_install_table_handler(acpi_table_handler handler, void *context)
         acpi_gbl_table_handler = handler;
         acpi_gbl_table_handler_context = context;
 
-      cleanup:
+cleanup:
         (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
@@ -506,7 +512,7 @@ acpi_status acpi_remove_table_handler(acpi_table_handler handler)
 
         acpi_gbl_table_handler = NULL;
 
-      cleanup:
+cleanup:
         (void)acpi_ut_release_mutex(ACPI_MTX_EVENTS);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
index 0ba9e328d5d7..60b5a871833c 100644
--- a/drivers/acpi/acpica/tbxfload.c
+++ b/drivers/acpi/acpica/tbxfload.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
@@ -65,7 +66,7 @@ static acpi_status acpi_tb_load_namespace(void);
  *
  ******************************************************************************/
 
-acpi_status acpi_load_tables(void)
+acpi_status __init acpi_load_tables(void)
 {
         acpi_status status;
 
@@ -82,7 +83,7 @@ acpi_status acpi_load_tables(void)
         return_ACPI_STATUS(status);
 }
 
-ACPI_EXPORT_SYMBOL(acpi_load_tables)
+ACPI_EXPORT_SYMBOL_INIT(acpi_load_tables)
 
 /*******************************************************************************
  *
@@ -200,7 +201,7 @@ static acpi_status acpi_tb_load_namespace(void)
 
         ACPI_INFO((AE_INFO, "All ACPI Tables successfully acquired"));
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
         return_ACPI_STATUS(status);
 }
@@ -268,7 +269,7 @@ acpi_status acpi_load_table(struct acpi_table_header *table)
                                              acpi_gbl_table_handler_context);
         }
 
-      unlock_and_exit:
+unlock_and_exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_INTERPRETER);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
index 948c95e80d44..e4e1468877c3 100644
--- a/drivers/acpi/acpica/tbxfroot.c
+++ b/drivers/acpi/acpica/tbxfroot.c
@@ -68,8 +68,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
          * Note: Sometimes there exists more than one RSDP in memory; the valid
          * RSDP has a valid checksum, all others have an invalid checksum.
          */
-        if (ACPI_STRNCMP((char *)rsdp->signature, ACPI_SIG_RSDP,
-                         sizeof(ACPI_SIG_RSDP) - 1) != 0) {
+        if (!ACPI_VALIDATE_RSDP_SIG(rsdp->signature)) {
 
                 /* Nope, BAD Signature */
 
@@ -112,7 +111,7 @@ acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
  *
  ******************************************************************************/
 
-acpi_status acpi_find_root_pointer(acpi_size *table_address)
+acpi_status __init acpi_find_root_pointer(acpi_size *table_address)
 {
         u8 *table_ptr;
         u8 *mem_rover;
diff --git a/drivers/acpi/acpica/utalloc.c b/drivers/acpi/acpica/utalloc.c
index e0ffb580f4b0..814267f52715 100644
--- a/drivers/acpi/acpica/utalloc.c
+++ b/drivers/acpi/acpica/utalloc.c
@@ -48,6 +48,39 @@
 #define _COMPONENT          ACPI_UTILITIES
 ACPI_MODULE_NAME("utalloc")
 
+#if !defined (USE_NATIVE_ALLOCATE_ZEROED)
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_os_allocate_zeroed
+ *
+ * PARAMETERS:  size                - Size of the allocation
+ *
+ * RETURN:      Address of the allocated memory on success, NULL on failure.
+ *
+ * DESCRIPTION: Subsystem equivalent of calloc. Allocate and zero memory.
+ *              This is the default implementation. Can be overridden via the
+ *              USE_NATIVE_ALLOCATE_ZEROED flag.
+ *
+ ******************************************************************************/
+void *acpi_os_allocate_zeroed(acpi_size size)
+{
+        void *allocation;
+
+        ACPI_FUNCTION_ENTRY();
+
+        allocation = acpi_os_allocate(size);
+        if (allocation) {
+
+                /* Clear the memory block */
+
+                ACPI_MEMSET(allocation, 0, size);
+        }
+
+        return (allocation);
+}
+
+#endif                          /* !USE_NATIVE_ALLOCATE_ZEROED */
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ut_create_caches
@@ -59,6 +92,7 @@ ACPI_MODULE_NAME("utalloc")
  * DESCRIPTION: Create all local caches
  *
  ******************************************************************************/
+
 acpi_status acpi_ut_create_caches(void)
 {
         acpi_status status;
@@ -175,10 +209,10 @@ acpi_status acpi_ut_delete_caches(void)
 
         /* Free memory lists */
 
-        ACPI_FREE(acpi_gbl_global_list);
+        acpi_os_free(acpi_gbl_global_list);
         acpi_gbl_global_list = NULL;
 
-        ACPI_FREE(acpi_gbl_ns_node_list);
+        acpi_os_free(acpi_gbl_ns_node_list);
         acpi_gbl_ns_node_list = NULL;
 #endif
 
@@ -302,82 +336,3 @@ acpi_ut_initialize_buffer(struct acpi_buffer * buffer,
         ACPI_MEMSET(buffer->pointer, 0, required_length);
         return (AE_OK);
 }
-
-#ifdef NOT_USED_BY_LINUX
-/*******************************************************************************
- *
- * FUNCTION:    acpi_ut_allocate
- *
- * PARAMETERS:  size                - Size of the allocation
- *              component           - Component type of caller
- *              module              - Source file name of caller
- *              line                - Line number of caller
- *
- * RETURN:      Address of the allocated memory on success, NULL on failure.
- *
- * DESCRIPTION: Subsystem equivalent of malloc.
- *
- ******************************************************************************/
-
-void *acpi_ut_allocate(acpi_size size,
-                       u32 component, const char *module, u32 line)
-{
-        void *allocation;
-
-        ACPI_FUNCTION_TRACE_U32(ut_allocate, size);
-
-        /* Check for an inadvertent size of zero bytes */
-
-        if (!size) {
-                ACPI_WARNING((module, line,
-                              "Attempt to allocate zero bytes, allocating 1 byte"));
-                size = 1;
-        }
-
-        allocation = acpi_os_allocate(size);
-        if (!allocation) {
-
-                /* Report allocation error */
-
-                ACPI_WARNING((module, line,
-                              "Could not allocate size %u", (u32) size));
-
-                return_PTR(NULL);
-        }
-
-        return_PTR(allocation);
-}
-
-/*******************************************************************************
- *
- * FUNCTION:    acpi_ut_allocate_zeroed
- *
- * PARAMETERS:  size                - Size of the allocation
- *              component           - Component type of caller
- *              module              - Source file name of caller
- *              line                - Line number of caller
- *
- * RETURN:      Address of the allocated memory on success, NULL on failure.
- *
- * DESCRIPTION: Subsystem equivalent of calloc. Allocate and zero memory.
- *
- ******************************************************************************/
-
-void *acpi_ut_allocate_zeroed(acpi_size size,
-                              u32 component, const char *module, u32 line)
-{
-        void *allocation;
-
-        ACPI_FUNCTION_ENTRY();
-
-        allocation = acpi_ut_allocate(size, component, module, line);
-        if (allocation) {
-
-                /* Clear the memory block */
-
-                ACPI_MEMSET(allocation, 0, size);
-        }
-
-        return (allocation);
-}
-#endif
diff --git a/drivers/acpi/acpica/utcache.c b/drivers/acpi/acpica/utcache.c
index a877a9647fd9..366bfec4b770 100644
--- a/drivers/acpi/acpica/utcache.c
+++ b/drivers/acpi/acpica/utcache.c
@@ -65,7 +65,7 @@ ACPI_MODULE_NAME("utcache")
 acpi_status
 acpi_os_create_cache(char *cache_name,
                      u16 object_size,
-                     u16 max_depth, struct acpi_memory_list ** return_cache)
+                     u16 max_depth, struct acpi_memory_list **return_cache)
 {
         struct acpi_memory_list *cache;
 
diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
index 1731c27c36a6..edff4e653d9a 100644
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -552,7 +552,7 @@ acpi_ut_copy_esimple_to_isimple(union acpi_object *external_object,
         *ret_internal_object = internal_object;
         return_ACPI_STATUS(AE_OK);
 
-      error_exit:
+error_exit:
         acpi_ut_remove_reference(internal_object);
         return_ACPI_STATUS(AE_NO_MEMORY);
 }
@@ -899,7 +899,7 @@ acpi_ut_copy_ielement_to_ielement(u8 object_type,
 
         return (status);
 
-      error_exit:
+error_exit:
         acpi_ut_remove_reference(target_object);
         return (status);
 }
diff --git a/drivers/acpi/acpica/utdebug.c b/drivers/acpi/acpica/utdebug.c
index 5796e11a0671..1a67b3944b3b 100644
--- a/drivers/acpi/acpica/utdebug.c
+++ b/drivers/acpi/acpica/utdebug.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 
@@ -190,7 +191,7 @@ acpi_debug_print(u32 requested_debug_level,
          * Display the module name, current line number, thread ID (if requested),
          * current procedure nesting level, and the current procedure name
          */
-        acpi_os_printf("%8s-%04ld ", module_name, line_number);
+        acpi_os_printf("%9s-%04ld ", module_name, line_number);
 
         if (ACPI_LV_THREADS & acpi_dbg_level) {
                 acpi_os_printf("[%u] ", (u32)thread_id);
diff --git a/drivers/acpi/acpica/utdecode.c b/drivers/acpi/acpica/utdecode.c
index 11e2e02e1618..b3f31dd89a45 100644
--- a/drivers/acpi/acpica/utdecode.c
+++ b/drivers/acpi/acpica/utdecode.c
@@ -41,7 +41,6 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
index d6b33f29d327..c07d2227ea42 100644
--- a/drivers/acpi/acpica/utdelete.c
+++ b/drivers/acpi/acpica/utdelete.c
@@ -649,7 +649,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
 
         return (AE_OK);
 
-      error_exit:
+error_exit:
 
         ACPI_EXCEPTION((AE_INFO, status,
                         "Could not update object reference count"));
diff --git a/drivers/acpi/acpica/uteval.c b/drivers/acpi/acpica/uteval.c
index 4fd68971019b..16fb90506db7 100644
--- a/drivers/acpi/acpica/uteval.c
+++ b/drivers/acpi/acpica/uteval.c
@@ -181,7 +181,7 @@ acpi_ut_evaluate_object(struct acpi_namespace_node *prefix_node,
 
         *return_desc = info->return_object;
 
-      cleanup:
+cleanup:
         ACPI_FREE(info);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/utexcep.c b/drivers/acpi/acpica/utexcep.c
index ff6d9e8aa842..3cf7b597edb9 100644
--- a/drivers/acpi/acpica/utexcep.c
+++ b/drivers/acpi/acpica/utexcep.c
@@ -41,8 +41,9 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
+#define EXPORT_ACPI_INTERFACES
+
 #define ACPI_DEFINE_EXCEPTION_TABLE
-#include <linux/export.h>
 #include <acpi/acpi.h>
 #include "accommon.h"
 
diff --git a/drivers/acpi/acpica/utglobal.c b/drivers/acpi/acpica/utglobal.c
index d6f26bf8a062..81f9a9584451 100644
--- a/drivers/acpi/acpica/utglobal.c
+++ b/drivers/acpi/acpica/utglobal.c
@@ -41,9 +41,9 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
+#define EXPORT_ACPI_INTERFACES
 #define DEFINE_ACPI_GLOBALS
 
-#include <linux/export.h>
 #include <acpi/acpi.h>
 #include "accommon.h"
 
@@ -289,9 +289,19 @@ acpi_status acpi_ut_init_globals(void)
 
         acpi_gbl_owner_id_mask[ACPI_NUM_OWNERID_MASKS - 1] = 0x80000000;
 
+        /* Event counters */
+
+        acpi_method_count = 0;
+        acpi_sci_count = 0;
+        acpi_gpe_count = 0;
+
+        for (i = 0; i < ACPI_NUM_FIXED_EVENTS; i++) {
+                acpi_fixed_event_count[i] = 0;
+        }
+
 #if (!ACPI_REDUCED_HARDWARE)
 
-        /* GPE support */
+        /* GPE/SCI support */
 
         acpi_gbl_all_gpes_initialized = FALSE;
         acpi_gbl_gpe_xrupt_list_head = NULL;
@@ -300,6 +310,7 @@ acpi_status acpi_ut_init_globals(void)
         acpi_current_gpe_count = 0;
 
         acpi_gbl_global_event_handler = NULL;
+        acpi_gbl_sci_handler_list = NULL;
 
 #endif                          /* !ACPI_REDUCED_HARDWARE */
 
@@ -377,6 +388,11 @@ acpi_status acpi_ut_init_globals(void)
 /* Public globals */
 
 ACPI_EXPORT_SYMBOL(acpi_gbl_FADT)
+
 ACPI_EXPORT_SYMBOL(acpi_dbg_level)
+
 ACPI_EXPORT_SYMBOL(acpi_dbg_layer)
+
+ACPI_EXPORT_SYMBOL(acpi_gpe_count)
+
 ACPI_EXPORT_SYMBOL(acpi_current_gpe_count)
diff --git a/drivers/acpi/acpica/utids.c b/drivers/acpi/acpica/utids.c
index fa69071db418..bfca7b4b6731 100644
--- a/drivers/acpi/acpica/utids.c
+++ b/drivers/acpi/acpica/utids.c
@@ -184,7 +184,7 @@ acpi_ut_execute_SUB(struct acpi_namespace_node *device_node,
         sub->length = length;
         *return_id = sub;
 
-      cleanup:
+cleanup:
 
         /* On exit, we must delete the return object */
 
diff --git a/drivers/acpi/acpica/utobject.c b/drivers/acpi/acpica/utobject.c
index aa61f66ee861..13e045025c33 100644
--- a/drivers/acpi/acpica/utobject.c
+++ b/drivers/acpi/acpica/utobject.c
@@ -180,7 +180,7 @@ union acpi_operand_object *acpi_ut_create_package_object(u32 count)
         package_elements = ACPI_ALLOCATE_ZEROED(((acpi_size) count +
                                                  1) * sizeof(void *));
         if (!package_elements) {
-                acpi_ut_remove_reference(package_desc);
+                ACPI_FREE(package_desc);
                 return_PTR(NULL);
         }
 
@@ -396,7 +396,6 @@ void *acpi_ut_allocate_object_desc_dbg(const char *module_name,
 
         /* Mark the descriptor type */
 
-        memset(object, 0, sizeof(union acpi_operand_object));
         ACPI_SET_DESCRIPTOR_TYPE(object, ACPI_DESC_TYPE_OPERAND);
 
         ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, "%p Size %X\n",
@@ -461,25 +460,28 @@ acpi_ut_get_simple_object_size(union acpi_operand_object *internal_object,
 
         ACPI_FUNCTION_TRACE_PTR(ut_get_simple_object_size, internal_object);
 
+        /* Start with the length of the (external) Acpi object */
+
+        length = sizeof(union acpi_object);
+
+        /* A NULL object is allowed, can be a legal uninitialized package element */
+
+        if (!internal_object) {
         /*
-         * Handle a null object (Could be a uninitialized package
-         * element -- which is legal)
+                 * Object is NULL, just return the length of union acpi_object
+                 * (A NULL union acpi_object is an object of all zeroes.)
          */
-        if (!internal_object) {
-                *obj_length = sizeof(union acpi_object);
+                *obj_length = ACPI_ROUND_UP_TO_NATIVE_WORD(length);
                 return_ACPI_STATUS(AE_OK);
         }
 
-        /* Start with the length of the Acpi object */
-
-        length = sizeof(union acpi_object);
+        /* A Namespace Node should never appear here */
 
         if (ACPI_GET_DESCRIPTOR_TYPE(internal_object) == ACPI_DESC_TYPE_NAMED) {
 
-                /* Object is a named object (reference), just return the length */
+                /* A namespace node should never get here */
 
-                *obj_length = ACPI_ROUND_UP_TO_NATIVE_WORD(length);
-                return_ACPI_STATUS(status);
+                return_ACPI_STATUS(AE_AML_INTERNAL);
         }
 
         /*
diff --git a/drivers/acpi/acpica/utownerid.c b/drivers/acpi/acpica/utownerid.c
index 835340b26d37..eb3aca761369 100644
--- a/drivers/acpi/acpica/utownerid.c
+++ b/drivers/acpi/acpica/utownerid.c
@@ -148,7 +148,7 @@ acpi_status acpi_ut_allocate_owner_id(acpi_owner_id * owner_id)
         ACPI_ERROR((AE_INFO,
                     "Could not allocate new OwnerId (255 max), AE_OWNER_ID_LIMIT"));
 
-      exit:
+exit:
         (void)acpi_ut_release_mutex(ACPI_MTX_CACHES);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index cb7fa491decf..2c2accb9e534 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -643,7 +643,7 @@ acpi_ut_validate_resource(struct acpi_walk_state *walk_state,
 
         return (AE_OK);
 
-      invalid_resource:
+invalid_resource:
 
         if (walk_state) {
                 ACPI_ERROR((AE_INFO,
@@ -652,7 +652,7 @@ acpi_ut_validate_resource(struct acpi_walk_state *walk_state,
         }
         return (AE_AML_INVALID_RESOURCE_TYPE);
 
-      bad_resource_length:
+bad_resource_length:
 
         if (walk_state) {
                 ACPI_ERROR((AE_INFO,
diff --git a/drivers/acpi/acpica/utstate.c b/drivers/acpi/acpica/utstate.c
index a6b729d4c1dc..03c4c2febd84 100644
--- a/drivers/acpi/acpica/utstate.c
+++ b/drivers/acpi/acpica/utstate.c
@@ -161,7 +161,6 @@ union acpi_generic_state *acpi_ut_create_generic_state(void)
         if (state) {
 
                 /* Initialize */
-                memset(state, 0, sizeof(union acpi_generic_state));
                 state->common.descriptor_type = ACPI_DESC_TYPE_STATE;
         }
 
diff --git a/drivers/acpi/acpica/utstring.c b/drivers/acpi/acpica/utstring.c
index cb1e9cc32d5f..45c0eb26b33d 100644
--- a/drivers/acpi/acpica/utstring.c
+++ b/drivers/acpi/acpica/utstring.c
@@ -310,7 +310,7 @@ acpi_status acpi_ut_strtoul64(char *string, u32 base, u64 *ret_integer)
 
         /* All done, normal exit */
 
-      all_done:
+all_done:
 
         ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "Converted value: %8.8X%8.8X\n",
                           ACPI_FORMAT_UINT64(return_value)));
@@ -318,7 +318,7 @@ acpi_status acpi_ut_strtoul64(char *string, u32 base, u64 *ret_integer)
         *ret_integer = return_value;
         return_ACPI_STATUS(AE_OK);
 
-      error_exit:
+error_exit:
         /* Base was set/validated above */
 
         if (base == 10) {
@@ -584,3 +584,65 @@ void ut_convert_backslashes(char *pathname)
         }
 }
 #endif
+
+#if defined (ACPI_DEBUGGER) || defined (ACPI_APPLICATION)
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ut_safe_strcpy, acpi_ut_safe_strcat, acpi_ut_safe_strncat
+ *
+ * PARAMETERS:  Adds a "DestSize" parameter to each of the standard string
+ *              functions. This is the size of the Destination buffer.
+ *
+ * RETURN:      TRUE if the operation would overflow the destination buffer.
+ *
+ * DESCRIPTION: Safe versions of standard Clib string functions. Ensure that
+ *              the result of the operation will not overflow the output string
+ *              buffer.
+ *
+ * NOTE:        These functions are typically only helpful for processing
+ *              user input and command lines. For most ACPICA code, the
+ *              required buffer length is precisely calculated before buffer
+ *              allocation, so the use of these functions is unnecessary.
+ *
+ ******************************************************************************/
+
+u8 acpi_ut_safe_strcpy(char *dest, acpi_size dest_size, char *source)
+{
+
+        if (ACPI_STRLEN(source) >= dest_size) {
+                return (TRUE);
+        }
+
+        ACPI_STRCPY(dest, source);
+        return (FALSE);
+}
+
+u8 acpi_ut_safe_strcat(char *dest, acpi_size dest_size, char *source)
+{
+
+        if ((ACPI_STRLEN(dest) + ACPI_STRLEN(source)) >= dest_size) {
+                return (TRUE);
+        }
+
+        ACPI_STRCAT(dest, source);
+        return (FALSE);
+}
+
+u8
+acpi_ut_safe_strncat(char *dest,
+                     acpi_size dest_size,
+                     char *source, acpi_size max_transfer_length)
+{
+        acpi_size actual_transfer_length;
+
+        actual_transfer_length =
+            ACPI_MIN(max_transfer_length, ACPI_STRLEN(source));
+
+        if ((ACPI_STRLEN(dest) + actual_transfer_length) >= dest_size) {
+                return (TRUE);
+        }
+
+        ACPI_STRNCAT(dest, source, max_transfer_length);
+        return (FALSE);
+}
+#endif
diff --git a/drivers/acpi/acpica/uttrack.c b/drivers/acpi/acpica/uttrack.c
index 160f13f4aab5..c0027773cccb 100644
--- a/drivers/acpi/acpica/uttrack.c
+++ b/drivers/acpi/acpica/uttrack.c
@@ -130,10 +130,23 @@ void *acpi_ut_allocate_and_track(acpi_size size,
         struct acpi_debug_mem_block *allocation;
         acpi_status status;
 
+        /* Check for an inadvertent size of zero bytes */
+
+        if (!size) {
+                ACPI_WARNING((module, line,
+                              "Attempt to allocate zero bytes, allocating 1 byte"));
+                size = 1;
+        }
+
         allocation =
-            acpi_ut_allocate(size + sizeof(struct acpi_debug_mem_header),
-                             component, module, line);
+            acpi_os_allocate(size + sizeof(struct acpi_debug_mem_header));
         if (!allocation) {
+
+                /* Report allocation error */
+
+                ACPI_WARNING((module, line,
+                              "Could not allocate size %u", (u32)size));
+
                 return (NULL);
         }
 
@@ -179,9 +192,17 @@ void *acpi_ut_allocate_zeroed_and_track(acpi_size size,
         struct acpi_debug_mem_block *allocation;
         acpi_status status;
 
+        /* Check for an inadvertent size of zero bytes */
+
+        if (!size) {
+                ACPI_WARNING((module, line,
+                              "Attempt to allocate zero bytes, allocating 1 byte"));
+                size = 1;
+        }
+
         allocation =
-            acpi_ut_allocate_zeroed(size + sizeof(struct acpi_debug_mem_header),
-                                    component, module, line);
+            acpi_os_allocate_zeroed(size +
+                                    sizeof(struct acpi_debug_mem_header));
         if (!allocation) {
 
                 /* Report allocation error */
@@ -409,7 +430,7 @@ acpi_ut_track_allocation(struct acpi_debug_mem_block *allocation,
                 element->next = allocation;
         }
 
-      unlock_and_exit:
+unlock_and_exit:
         status = acpi_ut_release_mutex(ACPI_MTX_MEMORY);
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/utxface.c b/drivers/acpi/acpica/utxface.c
index 03a211e6e26a..be322c83643a 100644
--- a/drivers/acpi/acpica/utxface.c
+++ b/drivers/acpi/acpica/utxface.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acdebug.h"
@@ -60,7 +61,7 @@ ACPI_MODULE_NAME("utxface")
  * DESCRIPTION: Shutdown the ACPICA subsystem and release all resources.
  *
  ******************************************************************************/
-acpi_status acpi_terminate(void)
+acpi_status __init acpi_terminate(void)
 {
         acpi_status status;
 
@@ -104,7 +105,7 @@ acpi_status acpi_terminate(void)
         return_ACPI_STATUS(status);
 }
 
-ACPI_EXPORT_SYMBOL(acpi_terminate)
+ACPI_EXPORT_SYMBOL_INIT(acpi_terminate)
 
 #ifndef ACPI_ASL_COMPILER
 #ifdef ACPI_FUTURE_USAGE
@@ -207,6 +208,44 @@ acpi_status acpi_get_system_info(struct acpi_buffer * out_buffer)
 
 ACPI_EXPORT_SYMBOL(acpi_get_system_info)
 
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_get_statistics
+ *
+ * PARAMETERS:  stats           - Where the statistics are returned
+ *
+ * RETURN:      status          - the status of the call
+ *
+ * DESCRIPTION: Get the contents of the various system counters
+ *
+ ******************************************************************************/
+acpi_status acpi_get_statistics(struct acpi_statistics *stats)
+{
+        ACPI_FUNCTION_TRACE(acpi_get_statistics);
+
+        /* Parameter validation */
+
+        if (!stats) {
+                return_ACPI_STATUS(AE_BAD_PARAMETER);
+        }
+
+        /* Various interrupt-based event counters */
+
+        stats->sci_count = acpi_sci_count;
+        stats->gpe_count = acpi_gpe_count;
+
+        ACPI_MEMCPY(stats->fixed_event_count, acpi_fixed_event_count,
+                    sizeof(acpi_fixed_event_count));
+
+        /* Other counters */
+
+        stats->method_count = acpi_method_count;
+
+        return_ACPI_STATUS(AE_OK);
+}
+
+ACPI_EXPORT_SYMBOL(acpi_get_statistics)
+
 /*****************************************************************************
  *
  * FUNCTION:    acpi_install_initialization_handler
diff --git a/drivers/acpi/acpica/utxferror.c b/drivers/acpi/acpica/utxferror.c
index e966a2e47b76..f7edb88f6054 100644
--- a/drivers/acpi/acpica/utxferror.c
+++ b/drivers/acpi/acpica/utxferror.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 
diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
index 41ebaaf8bb1a..75efea0539c1 100644
--- a/drivers/acpi/acpica/utxfinit.c
+++ b/drivers/acpi/acpica/utxfinit.c
@@ -41,7 +41,8 @@
  * POSSIBILITY OF SUCH DAMAGES.
  */
 
-#include <linux/export.h>
+#define EXPORT_ACPI_INTERFACES
+
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acevents.h"
@@ -64,7 +65,7 @@ ACPI_MODULE_NAME("utxfinit")
  *              called, so any early initialization belongs here.
  *
  ******************************************************************************/
-acpi_status acpi_initialize_subsystem(void)
+acpi_status __init acpi_initialize_subsystem(void)
 {
         acpi_status status;
 
@@ -124,7 +125,8 @@ acpi_status acpi_initialize_subsystem(void)
         ACPI_DEBUGGER_EXEC(status = acpi_db_initialize());
         return_ACPI_STATUS(status);
 }
-ACPI_EXPORT_SYMBOL(acpi_initialize_subsystem)
+
+ACPI_EXPORT_SYMBOL_INIT(acpi_initialize_subsystem)
 
 /*******************************************************************************
  *
@@ -138,7 +140,7 @@ ACPI_EXPORT_SYMBOL(acpi_initialize_subsystem)
  *              Puts system into ACPI mode if it isn't already.
  *
  ******************************************************************************/
-acpi_status acpi_enable_subsystem(u32 flags)
+acpi_status __init acpi_enable_subsystem(u32 flags)
 {
         acpi_status status = AE_OK;
 
@@ -228,7 +230,8 @@ acpi_status acpi_enable_subsystem(u32 flags)
 
         return_ACPI_STATUS(status);
 }
-ACPI_EXPORT_SYMBOL(acpi_enable_subsystem)
+
+ACPI_EXPORT_SYMBOL_INIT(acpi_enable_subsystem)
 
 /*******************************************************************************
  *
@@ -242,7 +245,7 @@ ACPI_EXPORT_SYMBOL(acpi_enable_subsystem)
  *              objects and executing AML code for Regions, buffers, etc.
  *
  ******************************************************************************/
-acpi_status acpi_initialize_objects(u32 flags)
+acpi_status __init acpi_initialize_objects(u32 flags)
 {
         acpi_status status = AE_OK;
 
@@ -314,4 +317,5 @@ acpi_status acpi_initialize_objects(u32 flags)
         acpi_gbl_startup_flags |= ACPI_INITIALIZED_OK;
         return_ACPI_STATUS(status);
 }
-ACPI_EXPORT_SYMBOL(acpi_initialize_objects)
+
+ACPI_EXPORT_SYMBOL_INIT(acpi_initialize_objects)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 2c9958cd7a43..fbf1aceda8b8 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -36,12 +36,6 @@
 #include <linux/suspend.h>
 #include <asm/unaligned.h>
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <asm/uaccess.h>
-#endif
-
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 #include <linux/power_supply.h>
@@ -72,19 +66,6 @@ static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-extern struct proc_dir_entry *acpi_lock_battery_dir(void);
-extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
-
-enum acpi_battery_files {
-        info_tag = 0,
-        state_tag,
-        alarm_tag,
-        ACPI_BATTERY_NUMFILES,
-};
-
-#endif
-
 static const struct acpi_device_id battery_device_ids[] = {
         {"PNP0C0A", 0},
         {"", 0},
@@ -320,14 +301,6 @@ static enum power_supply_property energy_battery_props[] = {
         POWER_SUPPLY_PROP_SERIAL_NUMBER,
 };
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-inline char *acpi_battery_units(struct acpi_battery *battery)
-{
-        return (battery->power_unit == ACPI_BATTERY_POWER_UNIT_MA) ?
-                "mA" : "mW";
-}
-#endif
-
 /* --------------------------------------------------------------------------
                                Battery Management
    -------------------------------------------------------------------------- */
@@ -741,279 +714,6 @@ static void acpi_battery_refresh(struct acpi_battery *battery)
 }
 
 /* --------------------------------------------------------------------------
-                              FS Interface (/proc)
-   -------------------------------------------------------------------------- */
-
-#ifdef CONFIG_ACPI_PROCFS_POWER
-static struct proc_dir_entry *acpi_battery_dir;
-
-static int acpi_battery_print_info(struct seq_file *seq, int result)
-{
-        struct acpi_battery *battery = seq->private;
-
-        if (result)
-                goto end;
-
-        seq_printf(seq, "present:                 %s\n",
-                   acpi_battery_present(battery) ? "yes" : "no");
-        if (!acpi_battery_present(battery))
-                goto end;
-        if (battery->design_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
-                seq_printf(seq, "design capacity:         unknown\n");
-        else
-                seq_printf(seq, "design capacity:         %d %sh\n",
-                           battery->design_capacity,
-                           acpi_battery_units(battery));
-
-        if (battery->full_charge_capacity == ACPI_BATTERY_VALUE_UNKNOWN)
-                seq_printf(seq, "last full capacity:      unknown\n");
-        else
-                seq_printf(seq, "last full capacity:      %d %sh\n",
-                           battery->full_charge_capacity,
-                           acpi_battery_units(battery));
-
-        seq_printf(seq, "battery technology:      %srechargeable\n",
-                   (!battery->technology)?"non-":"");
-
-        if (battery->design_voltage == ACPI_BATTERY_VALUE_UNKNOWN)
-                seq_printf(seq, "design voltage:          unknown\n");
-        else
-                seq_printf(seq, "design voltage:          %d mV\n",
-                           battery->design_voltage);
-        seq_printf(seq, "design capacity warning: %d %sh\n",
-                   battery->design_capacity_warning,
-                   acpi_battery_units(battery));
-        seq_printf(seq, "design capacity low:     %d %sh\n",
-                   battery->design_capacity_low,
-                   acpi_battery_units(battery));
-        seq_printf(seq, "cycle count:             %i\n", battery->cycle_count);
-        seq_printf(seq, "capacity granularity 1:  %d %sh\n",
-                   battery->capacity_granularity_1,
-                   acpi_battery_units(battery));
-        seq_printf(seq, "capacity granularity 2:  %d %sh\n",
-                   battery->capacity_granularity_2,
-                   acpi_battery_units(battery));
-        seq_printf(seq, "model number:            %s\n", battery->model_number);
-        seq_printf(seq, "serial number:           %s\n", battery->serial_number);
-        seq_printf(seq, "battery type:            %s\n", battery->type);
-        seq_printf(seq, "OEM info:                %s\n", battery->oem_info);
-      end:
-        if (result)
-                seq_printf(seq, "ERROR: Unable to read battery info\n");
-        return result;
-}
-
-static int acpi_battery_print_state(struct seq_file *seq, int result)
-{
-        struct acpi_battery *battery = seq->private;
-
-        if (result)
-                goto end;
-
-        seq_printf(seq, "present:                 %s\n",
-                   acpi_battery_present(battery) ? "yes" : "no");
-        if (!acpi_battery_present(battery))
-                goto end;
-
-        seq_printf(seq, "capacity state:          %s\n",
-                        (battery->state & 0x04) ? "critical" : "ok");
-        if ((battery->state & 0x01) && (battery->state & 0x02))
-                seq_printf(seq,
-                           "charging state:          charging/discharging\n");
-        else if (battery->state & 0x01)
-                seq_printf(seq, "charging state:          discharging\n");
-        else if (battery->state & 0x02)
-                seq_printf(seq, "charging state:          charging\n");
-        else
-                seq_printf(seq, "charging state:          charged\n");
-
-        if (battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN)
-                seq_printf(seq, "present rate:            unknown\n");
-        else
-                seq_printf(seq, "present rate:            %d %s\n",
-                           battery->rate_now, acpi_battery_units(battery));
-
-        if (battery->capacity_now == ACPI_BATTERY_VALUE_UNKNOWN)
-                seq_printf(seq, "remaining capacity:      unknown\n");
-        else
-                seq_printf(seq, "remaining capacity:      %d %sh\n",
-                           battery->capacity_now, acpi_battery_units(battery));
-        if (battery->voltage_now == ACPI_BATTERY_VALUE_UNKNOWN)
-                seq_printf(seq, "present voltage:         unknown\n");
-        else
-                seq_printf(seq, "present voltage:         %d mV\n",
-                           battery->voltage_now);
-      end:
-        if (result)
-                seq_printf(seq, "ERROR: Unable to read battery state\n");
-
-        return result;
-}
-
-static int acpi_battery_print_alarm(struct seq_file *seq, int result)
-{
-        struct acpi_battery *battery = seq->private;
-
-        if (result)
-                goto end;
-
-        if (!acpi_battery_present(battery)) {
-                seq_printf(seq, "present:                 no\n");
-                goto end;
-        }
-        seq_printf(seq, "alarm:                   ");
-        if (!battery->alarm)
-                seq_printf(seq, "unsupported\n");
-        else
-                seq_printf(seq, "%u %sh\n", battery->alarm,
-                                acpi_battery_units(battery));
-      end:
-        if (result)
-                seq_printf(seq, "ERROR: Unable to read battery alarm\n");
-        return result;
-}
-
-static ssize_t acpi_battery_write_alarm(struct file *file,
-                                        const char __user * buffer,
-                                        size_t count, loff_t * ppos)
-{
-        int result = 0;
-        char alarm_string[12] = { '\0' };
-        struct seq_file *m = file->private_data;
-        struct acpi_battery *battery = m->private;
-
-        if (!battery || (count > sizeof(alarm_string) - 1))
-                return -EINVAL;
-        if (!acpi_battery_present(battery)) {
-                result = -ENODEV;
-                goto end;
-        }
-        if (copy_from_user(alarm_string, buffer, count)) {
-                result = -EFAULT;
-                goto end;
-        }
-        alarm_string[count] = '\0';
-        battery->alarm = simple_strtol(alarm_string, NULL, 0);
-        result = acpi_battery_set_alarm(battery);
-      end:
-        if (!result)
-                return count;
-        return result;
-}
-
-typedef int(*print_func)(struct seq_file *seq, int result);
-
-static print_func acpi_print_funcs[ACPI_BATTERY_NUMFILES] = {
-        acpi_battery_print_info,
-        acpi_battery_print_state,
-        acpi_battery_print_alarm,
-};
-
-static int acpi_battery_read(int fid, struct seq_file *seq)
-{
-        struct acpi_battery *battery = seq->private;
-        int result = acpi_battery_update(battery);
-        return acpi_print_funcs[fid](seq, result);
-}
-
-#define DECLARE_FILE_FUNCTIONS(_name) \
-static int acpi_battery_read_##_name(struct seq_file *seq, void *offset) \
-{ \
-        return acpi_battery_read(_name##_tag, seq); \
-} \
-static int acpi_battery_##_name##_open_fs(struct inode *inode, struct file *file) \
-{ \
-        return single_open(file, acpi_battery_read_##_name, PDE_DATA(inode)); \
-}
-
-DECLARE_FILE_FUNCTIONS(info);
-DECLARE_FILE_FUNCTIONS(state);
-DECLARE_FILE_FUNCTIONS(alarm);
-
-#undef DECLARE_FILE_FUNCTIONS
-
-#define FILE_DESCRIPTION_RO(_name) \
-        { \
-        .name = __stringify(_name), \
-        .mode = S_IRUGO, \
-        .ops = { \
-                .open = acpi_battery_##_name##_open_fs, \
-                .read = seq_read, \
-                .llseek = seq_lseek, \
-                .release = single_release, \
-                .owner = THIS_MODULE, \
-                }, \
-        }
-
-#define FILE_DESCRIPTION_RW(_name) \
-        { \
-        .name = __stringify(_name), \
-        .mode = S_IFREG | S_IRUGO | S_IWUSR, \
-        .ops = { \
-                .open = acpi_battery_##_name##_open_fs, \
-                .read = seq_read, \
-                .llseek = seq_lseek, \
-                .write = acpi_battery_write_##_name, \
-                .release = single_release, \
-                .owner = THIS_MODULE, \
-                }, \
-        }
-
-static const struct battery_file {
-        struct file_operations ops;
-        umode_t mode;
-        const char *name;
-} acpi_battery_file[] = {
-        FILE_DESCRIPTION_RO(info),
-        FILE_DESCRIPTION_RO(state),
-        FILE_DESCRIPTION_RW(alarm),
-};
-
-#undef FILE_DESCRIPTION_RO
-#undef FILE_DESCRIPTION_RW
-
-static int acpi_battery_add_fs(struct acpi_device *device)
-{
-        struct proc_dir_entry *entry = NULL;
-        int i;
-
-        printk(KERN_WARNING PREFIX "Deprecated procfs I/F for battery is loaded,"
-                        " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
-        if (!acpi_device_dir(device)) {
-                acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device),
-                                                     acpi_battery_dir);
-                if (!acpi_device_dir(device))
-                        return -ENODEV;
-        }
-
-        for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i) {
-                entry = proc_create_data(acpi_battery_file[i].name,
-                                         acpi_battery_file[i].mode,
-                                         acpi_device_dir(device),
-                                         &acpi_battery_file[i].ops,
-                                         acpi_driver_data(device));
-                if (!entry)
-                        return -ENODEV;
-        }
-        return 0;
-}
-
-static void acpi_battery_remove_fs(struct acpi_device *device)
-{
-        int i;
-        if (!acpi_device_dir(device))
-                return;
-        for (i = 0; i < ACPI_BATTERY_NUMFILES; ++i)
-                remove_proc_entry(acpi_battery_file[i].name,
-                                  acpi_device_dir(device));
-
-        remove_proc_entry(acpi_device_bid(device), acpi_battery_dir);
-        acpi_device_dir(device) = NULL;
-}
-
-#endif
-
-/* --------------------------------------------------------------------------
                                  Driver Interface
    -------------------------------------------------------------------------- */
 
@@ -1075,15 +775,6 @@ static int acpi_battery_add(struct acpi_device *device)
         result = acpi_battery_update(battery);
         if (result)
                 goto fail;
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        result = acpi_battery_add_fs(device);
-#endif
-        if (result) {
-#ifdef CONFIG_ACPI_PROCFS_POWER
-                acpi_battery_remove_fs(device);
-#endif
-                goto fail;
-        }
 
         printk(KERN_INFO PREFIX "%s Slot [%s] (battery %s)\n",
                 ACPI_BATTERY_DEVICE_NAME, acpi_device_bid(device),
@@ -1110,9 +801,6 @@ static int acpi_battery_remove(struct acpi_device *device)
                 return -EINVAL;
         battery = acpi_driver_data(device);
         unregister_pm_notifier(&battery->pm_nb);
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_battery_remove_fs(device);
-#endif
         sysfs_remove_battery(battery);
         mutex_destroy(&battery->lock);
         mutex_destroy(&battery->sysfs_lock);
@@ -1158,18 +846,7 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
 {
         if (acpi_disabled)
                 return;
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_battery_dir = acpi_lock_battery_dir();
-        if (!acpi_battery_dir)
-                return;
-#endif
-        if (acpi_bus_register_driver(&acpi_battery_driver) < 0) {
-#ifdef CONFIG_ACPI_PROCFS_POWER
-                acpi_unlock_battery_dir(acpi_battery_dir);
-#endif
-                return;
-        }
-        return;
+        acpi_bus_register_driver(&acpi_battery_driver);
 }
 
 static int __init acpi_battery_init(void)
@@ -1181,9 +858,6 @@ static int __init acpi_battery_init(void)
 static void __exit acpi_battery_exit(void)
 {
         acpi_bus_unregister_driver(&acpi_battery_driver);
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_unlock_battery_dir(acpi_battery_dir);
-#endif
 }
 
 module_init(acpi_battery_init);
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 9515f18898b2..fb848378d582 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -274,6 +274,19 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba NB100",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "NB100"),
+                },
+        },
+
+        /*
+         * The following machines have broken backlight support when reporting
+         * the Windows 2012 OSI, so disable it until their support is fixed.
+         */
+        {
         .callback = dmi_disable_osi_win8,
         .ident = "ASUS Zenbook Prime UX31A",
         .matches = {
@@ -291,12 +304,60 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
         },
         {
         .callback = dmi_disable_osi_win8,
-        .ident = "Lenovo ThinkPad Edge E530",
+        .ident = "ThinkPad Edge E530",
         .matches = {
                      DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
                      DMI_MATCH(DMI_PRODUCT_VERSION, "3259A2G"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "ThinkPad Edge E530",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "3259CTO"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "ThinkPad Edge E530",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "3259HJG"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Acer Aspire V5-573G",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Acer Aspire"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "V5-573G/Dazzle_HW"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Acer Aspire V5-572G",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Acer Aspire"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "V5-572G/Dazzle_CX"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "ThinkPad T431s",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "20AACTO1WW"),
+                },
+        },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "ThinkPad T430",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "2349D15"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index a55773801c5f..c971929d75c2 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -383,18 +383,15 @@ static int acpi_button_add(struct acpi_device *device)
 
         switch (button->type) {
         case ACPI_BUTTON_TYPE_POWER:
-                input->evbit[0] = BIT_MASK(EV_KEY);
-                set_bit(KEY_POWER, input->keybit);
+                input_set_capability(input, EV_KEY, KEY_POWER);
                 break;
 
         case ACPI_BUTTON_TYPE_SLEEP:
-                input->evbit[0] = BIT_MASK(EV_KEY);
-                set_bit(KEY_SLEEP, input->keybit);
+                input_set_capability(input, EV_KEY, KEY_SLEEP);
                 break;
 
         case ACPI_BUTTON_TYPE_LID:
-                input->evbit[0] = BIT_MASK(EV_SW);
-                set_bit(SW_LID, input->swbit);
+                input_set_capability(input, EV_SW, SW_LID);
                 break;
         }
 
diff --git a/drivers/acpi/cm_sbs.c b/drivers/acpi/cm_sbs.c
deleted file mode 100644
index 6c9ee68e46fb..000000000000
--- a/drivers/acpi/cm_sbs.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or (at
- *  your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful, but
- *  WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
- *
- * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/acpi.h>
-#include <linux/types.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <acpi/acpi_bus.h>
-#include <acpi/acpi_drivers.h>
-
-#define PREFIX "ACPI: "
-
-ACPI_MODULE_NAME("cm_sbs");
-#define ACPI_AC_CLASS           "ac_adapter"
-#define ACPI_BATTERY_CLASS      "battery"
-#define _COMPONENT              ACPI_SBS_COMPONENT
-static struct proc_dir_entry *acpi_ac_dir;
-static struct proc_dir_entry *acpi_battery_dir;
-
-static DEFINE_MUTEX(cm_sbs_mutex);
-
-static int lock_ac_dir_cnt;
-static int lock_battery_dir_cnt;
-
-struct proc_dir_entry *acpi_lock_ac_dir(void)
-{
-        mutex_lock(&cm_sbs_mutex);
-        if (!acpi_ac_dir)
-                acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir);
-        if (acpi_ac_dir) {
-                lock_ac_dir_cnt++;
-        } else {
-                printk(KERN_ERR PREFIX
-                                  "Cannot create %s\n", ACPI_AC_CLASS);
-        }
-        mutex_unlock(&cm_sbs_mutex);
-        return acpi_ac_dir;
-}
-EXPORT_SYMBOL(acpi_lock_ac_dir);
-
-void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param)
-{
-        mutex_lock(&cm_sbs_mutex);
-        if (acpi_ac_dir_param)
-                lock_ac_dir_cnt--;
-        if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) {
-                remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir);
-                acpi_ac_dir = NULL;
-        }
-        mutex_unlock(&cm_sbs_mutex);
-}
-EXPORT_SYMBOL(acpi_unlock_ac_dir);
-
-struct proc_dir_entry *acpi_lock_battery_dir(void)
-{
-        mutex_lock(&cm_sbs_mutex);
-        if (!acpi_battery_dir) {
-                acpi_battery_dir =
-                    proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir);
-        }
-        if (acpi_battery_dir) {
-                lock_battery_dir_cnt++;
-        } else {
-                printk(KERN_ERR PREFIX
-                                  "Cannot create %s\n", ACPI_BATTERY_CLASS);
-        }
-        mutex_unlock(&cm_sbs_mutex);
-        return acpi_battery_dir;
-}
-EXPORT_SYMBOL(acpi_lock_battery_dir);
-
-void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param)
-{
-        mutex_lock(&cm_sbs_mutex);
-        if (acpi_battery_dir_param)
-                lock_battery_dir_cnt--;
-        if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param
-            && acpi_battery_dir) {
-                remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir);
-                acpi_battery_dir = NULL;
-        }
-        mutex_unlock(&cm_sbs_mutex);
-        return;
-}
-EXPORT_SYMBOL(acpi_unlock_battery_dir);
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 59d3202f6b36..d42b2fb5a7e9 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -118,9 +118,10 @@ int acpi_device_get_power(struct acpi_device *device, int *state)
         /*
          * If we were unsure about the device parent's power state up to this
          * point, the fact that the device is in D0 implies that the parent has
-         * to be in D0 too.
+         * to be in D0 too, except if ignore_parent is set.
          */
-        if (device->parent && device->parent->power.state == ACPI_STATE_UNKNOWN
+        if (!device->power.flags.ignore_parent && device->parent
+            && device->parent->power.state == ACPI_STATE_UNKNOWN
             && result == ACPI_STATE_D0)
                 device->parent->power.state = ACPI_STATE_D0;
 
@@ -177,7 +178,8 @@ int acpi_device_set_power(struct acpi_device *device, int state)
                          acpi_power_state_string(state));
                 return -ENODEV;
         }
-        if (device->parent && (state < device->parent->power.state)) {
+        if (!device->power.flags.ignore_parent &&
+            device->parent && (state < device->parent->power.state)) {
                 dev_warn(&device->dev,
                          "Cannot transition to power state %s for parent in %s\n",
                          acpi_power_state_string(state),
@@ -1025,60 +1027,4 @@ void acpi_dev_pm_detach(struct device *dev, bool power_off)
         }
 }
 EXPORT_SYMBOL_GPL(acpi_dev_pm_detach);
-
-/**
- * acpi_dev_pm_add_dependent - Add physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-
-        mutex_lock(&adev->physical_node_lock);
-
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev)
-                        goto out;
-
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (dep) {
-                dep->dev = depdev;
-                list_add_tail(&dep->node, &adev->power_dependent);
-        }
-
- out:
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_add_dependent);
-
-/**
- * acpi_dev_pm_remove_dependent - Remove physical device depending for PM.
- * @handle: Handle of ACPI device node.
- * @depdev: Device depending on that node for PM.
- */
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev)
-{
-        struct acpi_device_physical_node *dep;
-        struct acpi_device *adev;
-
-        if (!depdev || acpi_bus_get_device(handle, &adev))
-                return;
-
-        mutex_lock(&adev->physical_node_lock);
-
-        list_for_each_entry(dep, &adev->power_dependent, node)
-                if (dep->dev == depdev) {
-                        list_del(&dep->node);
-                        kfree(dep);
-                        break;
-                }
-
-        mutex_unlock(&adev->physical_node_lock);
-}
-EXPORT_SYMBOL_GPL(acpi_dev_pm_remove_dependent);
 #endif /* CONFIG_PM */
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index eab7d1145bfa..dcd73ccb514c 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -441,7 +441,7 @@ static void handle_dock(struct dock_station *ds, int dock)
         acpi_status status;
         struct acpi_object_list arg_list;
         union acpi_object arg;
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        unsigned long long value;
 
         acpi_handle_info(ds->handle, "%s\n", dock ? "docking" : "undocking");
 
@@ -450,12 +450,10 @@ static void handle_dock(struct dock_station *ds, int dock)
         arg_list.pointer = &arg;
         arg.type = ACPI_TYPE_INTEGER;
         arg.integer.value = dock;
-        status = acpi_evaluate_object(ds->handle, "_DCK", &arg_list, &buffer);
+        status = acpi_evaluate_integer(ds->handle, "_DCK", &arg_list, &value);
         if (ACPI_FAILURE(status) && status != AE_NOT_FOUND)
                 acpi_handle_err(ds->handle, "Failed to execute _DCK (0x%x)\n",
                                 status);
-
-        kfree(buffer.pointer);
 }
 
 static inline void dock(struct dock_station *ds)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index a06d98374705..d5309fd49458 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -28,6 +28,7 @@
 
 /* Uncomment next line to get verbose printout */
 /* #define DEBUG */
+#define pr_fmt(fmt) "ACPI : EC: " fmt
 
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -49,9 +50,6 @@
 #define ACPI_EC_DEVICE_NAME             "Embedded Controller"
 #define ACPI_EC_FILE_INFO               "info"
 
-#undef PREFIX
-#define PREFIX                          "ACPI: EC: "
-
 /* EC status register */
 #define ACPI_EC_FLAG_OBF        0x01    /* Output buffer full */
 #define ACPI_EC_FLAG_IBF        0x02    /* Input buffer full */
@@ -131,26 +129,26 @@ static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
 static inline u8 acpi_ec_read_status(struct acpi_ec *ec)
 {
         u8 x = inb(ec->command_addr);
-        pr_debug(PREFIX "---> status = 0x%2.2x\n", x);
+        pr_debug("---> status = 0x%2.2x\n", x);
         return x;
 }
 
 static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
 {
         u8 x = inb(ec->data_addr);
-        pr_debug(PREFIX "---> data = 0x%2.2x\n", x);
+        pr_debug("---> data = 0x%2.2x\n", x);
         return x;
 }
 
 static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
 {
-        pr_debug(PREFIX "<--- command = 0x%2.2x\n", command);
+        pr_debug("<--- command = 0x%2.2x\n", command);
         outb(command, ec->command_addr);
 }
 
 static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
 {
-        pr_debug(PREFIX "<--- data = 0x%2.2x\n", data);
+        pr_debug("<--- data = 0x%2.2x\n", data);
         outb(data, ec->data_addr);
 }
 
@@ -241,7 +239,7 @@ static int ec_poll(struct acpi_ec *ec)
                         }
                         advance_transaction(ec, acpi_ec_read_status(ec));
                 } while (time_before(jiffies, delay));
-                pr_debug(PREFIX "controller reset, restart transaction\n");
+                pr_debug("controller reset, restart transaction\n");
                 spin_lock_irqsave(&ec->lock, flags);
                 start_transaction(ec);
                 spin_unlock_irqrestore(&ec->lock, flags);
@@ -309,12 +307,12 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
                 }
         }
         if (ec_wait_ibf0(ec)) {
-                pr_err(PREFIX "input buffer is not empty, "
+                pr_err("input buffer is not empty, "
                                 "aborting transaction\n");
                 status = -ETIME;
                 goto end;
         }
-        pr_debug(PREFIX "transaction start (cmd=0x%02x, addr=0x%02x)\n",
+        pr_debug("transaction start (cmd=0x%02x, addr=0x%02x)\n",
                         t->command, t->wdata ? t->wdata[0] : 0);
         /* disable GPE during transaction if storm is detected */
         if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
@@ -331,12 +329,12 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
                 /* It is safe to enable the GPE outside of the transaction. */
                 acpi_enable_gpe(NULL, ec->gpe);
         } else if (t->irq_count > ec_storm_threshold) {
-                pr_info(PREFIX "GPE storm detected(%d GPEs), "
+                pr_info("GPE storm detected(%d GPEs), "
                         "transactions will use polling mode\n",
                         t->irq_count);
                 set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
         }
-        pr_debug(PREFIX "transaction end\n");
+        pr_debug("transaction end\n");
 end:
         if (ec->global_lock)
                 acpi_release_global_lock(glk);
@@ -570,12 +568,12 @@ static void acpi_ec_run(void *cxt)
         struct acpi_ec_query_handler *handler = cxt;
         if (!handler)
                 return;
-        pr_debug(PREFIX "start query execution\n");
+        pr_debug("start query execution\n");
         if (handler->func)
                 handler->func(handler->data);
         else if (handler->handle)
                 acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
-        pr_debug(PREFIX "stop query execution\n");
+        pr_debug("stop query execution\n");
         kfree(handler);
 }
 
@@ -593,7 +591,8 @@ static int acpi_ec_sync_query(struct acpi_ec *ec)
                         if (!copy)
                                 return -ENOMEM;
                         memcpy(copy, handler, sizeof(*copy));
-                        pr_debug(PREFIX "push query execution (0x%2x) on queue\n", value);
+                        pr_debug("push query execution (0x%2x) on queue\n",
+                                value);
                         return acpi_os_execute((copy->func) ?
                                 OSL_NOTIFY_HANDLER : OSL_GPE_HANDLER,
                                 acpi_ec_run, copy);
@@ -616,7 +615,7 @@ static int ec_check_sci(struct acpi_ec *ec, u8 state)
 {
         if (state & ACPI_EC_FLAG_SCI) {
                 if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags)) {
-                        pr_debug(PREFIX "push gpe query to the queue\n");
+                        pr_debug("push gpe query to the queue\n");
                         return acpi_os_execute(OSL_NOTIFY_HANDLER,
                                 acpi_ec_gpe_query, ec);
                 }
@@ -630,7 +629,7 @@ static u32 acpi_ec_gpe_handler(acpi_handle gpe_device,
         struct acpi_ec *ec = data;
         u8 status = acpi_ec_read_status(ec);
 
-        pr_debug(PREFIX "~~~> interrupt, status:0x%02x\n", status);
+        pr_debug("~~~> interrupt, status:0x%02x\n", status);
 
         advance_transaction(ec, status);
         if (ec_transaction_done(ec) &&
@@ -776,7 +775,7 @@ static int ec_install_handlers(struct acpi_ec *ec)
                          * The AE_NOT_FOUND error will be ignored and OS
                          * continue to initialize EC.
                          */
-                        printk(KERN_ERR "Fail in evaluating the _REG object"
+                        pr_err("Fail in evaluating the _REG object"
                                 " of EC device. Broken bios is suspected.\n");
                 } else {
                         acpi_remove_gpe_handler(NULL, ec->gpe,
@@ -795,10 +794,10 @@ static void ec_remove_handlers(struct acpi_ec *ec)
         acpi_disable_gpe(NULL, ec->gpe);
         if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
                                 ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
-                pr_err(PREFIX "failed to remove space handler\n");
+                pr_err("failed to remove space handler\n");
         if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe,
                                 &acpi_ec_gpe_handler)))
-                pr_err(PREFIX "failed to remove gpe handler\n");
+                pr_err("failed to remove gpe handler\n");
         clear_bit(EC_FLAGS_HANDLERS_INSTALLED, &ec->flags);
 }
 
@@ -840,7 +839,7 @@ static int acpi_ec_add(struct acpi_device *device)
         ret = !!request_region(ec->command_addr, 1, "EC cmd");
         WARN(!ret, "Could not request EC cmd io port 0x%lx", ec->command_addr);
 
-        pr_info(PREFIX "GPE = 0x%lx, I/O: command/status = 0x%lx, data = 0x%lx\n",
+        pr_info("GPE = 0x%lx, I/O: command/status = 0x%lx, data = 0x%lx\n",
                           ec->gpe, ec->command_addr, ec->data_addr);
 
         ret = ec_install_handlers(ec);
@@ -931,7 +930,7 @@ static int ec_validate_ecdt(const struct dmi_system_id *id)
 /* MSI EC needs special treatment, enable it */
 static int ec_flag_msi(const struct dmi_system_id *id)
 {
-        printk(KERN_DEBUG PREFIX "Detected MSI hardware, enabling workarounds.\n");
+        pr_debug("Detected MSI hardware, enabling workarounds.\n");
         EC_FLAGS_MSI = 1;
         EC_FLAGS_VALIDATE_ECDT = 1;
         return 0;
@@ -1010,7 +1009,7 @@ int __init acpi_ec_ecdt_probe(void)
         status = acpi_get_table(ACPI_SIG_ECDT, 1,
                                 (struct acpi_table_header **)&ecdt_ptr);
         if (ACPI_SUCCESS(status)) {
-                pr_info(PREFIX "EC description table is found, configuring boot EC\n");
+                pr_info("EC description table is found, configuring boot EC\n");
                 boot_ec->command_addr = ecdt_ptr->control.address;
                 boot_ec->data_addr = ecdt_ptr->data.address;
                 boot_ec->gpe = ecdt_ptr->gpe;
@@ -1030,7 +1029,7 @@ int __init acpi_ec_ecdt_probe(void)
 
         /* This workaround is needed only on some broken machines,
          * which require early EC, but fail to provide ECDT */
-        printk(KERN_DEBUG PREFIX "Look up EC in DSDT\n");
+        pr_debug("Look up EC in DSDT\n");
         status = acpi_get_devices(ec_device_ids[0].id, ec_parse_device,
                                         boot_ec, NULL);
         /* Check that acpi_get_devices actually find something */
@@ -1042,7 +1041,7 @@ int __init acpi_ec_ecdt_probe(void)
                     saved_ec->data_addr != boot_ec->data_addr ||
                     saved_ec->gpe != boot_ec->gpe ||
                     saved_ec->handle != boot_ec->handle)
-                        pr_info(PREFIX "ASUSTek keeps feeding us with broken "
+                        pr_info("ASUSTek keeps feeding us with broken "
                         "ECDT tables, which are very hard to workaround. "
                         "Trying to use DSDT EC info instead. Please send "
                         "output of acpidump to linux-acpi@vger.kernel.org\n");
diff --git a/drivers/acpi/event.c b/drivers/acpi/event.c
index 8247fcdde079..fdef416c0ff6 100644
--- a/drivers/acpi/event.c
+++ b/drivers/acpi/event.c
@@ -127,11 +127,6 @@ int acpi_bus_generate_netlink_event(const char *device_class,
         }
 
         event = nla_data(attr);
-        if (!event) {
-                nlmsg_free(skb);
-                return -EINVAL;
-        }
-
         memset(event, 0, sizeof(struct acpi_genl_event));
 
         strcpy(event->device_class, device_class);
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 41ade6570bc0..ba3da88cee45 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -168,7 +168,7 @@ static int acpi_fan_add(struct acpi_device *device)
                acpi_device_name(device), acpi_device_bid(device),
                !device->power.state ? "on" : "off");
 
-      end:
+end:
         return result;
 }
 
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index c6db680c826c..a29739c0ba79 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -165,9 +165,7 @@ int acpi_create_platform_device(struct acpi_device *adev,
                                         Video
   -------------------------------------------------------------------------- */
 #if defined(CONFIG_ACPI_VIDEO) || defined(CONFIG_ACPI_VIDEO_MODULE)
-bool acpi_video_backlight_quirks(void);
-#else
-static inline bool acpi_video_backlight_quirks(void) { return false; }
+bool acpi_osi_is_win8(void);
 #endif
 
 #endif /* _ACPI_INTERNAL_H_ */
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 2e82e5d76930..a2343a1d9e0b 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -73,7 +73,7 @@ int acpi_map_pxm_to_node(int pxm)
 {
         int node = pxm_to_node_map[pxm];
 
-        if (node < 0) {
+        if (node == NUMA_NO_NODE) {
                 if (nodes_weight(nodes_found_map) >= MAX_NUMNODES)
                         return NUMA_NO_NODE;
                 node = first_unset_node(nodes_found_map);
@@ -334,7 +334,7 @@ int acpi_get_pxm(acpi_handle h)
 
 int acpi_get_node(acpi_handle *handle)
 {
-        int pxm, node = -1;
+        int pxm, node = NUMA_NO_NODE;
 
         pxm = acpi_get_pxm(handle);
         if (pxm >= 0 && pxm < MAX_PXM_DOMAINS)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index cfc3e260a688..54a20ff4b864 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -568,8 +568,10 @@ static const char * const table_sigs[] = {
 
 #define ACPI_HEADER_SIZE sizeof(struct acpi_table_header)
 
-/* Must not increase 10 or needs code modification below */
-#define ACPI_OVERRIDE_TABLES 10
+#define ACPI_OVERRIDE_TABLES 64
+static struct cpio_data __initdata acpi_initrd_files[ACPI_OVERRIDE_TABLES];
+
+#define MAP_CHUNK_SIZE   (NR_FIX_BTMAPS << PAGE_SHIFT)
 
 void __init acpi_initrd_override(void *data, size_t size)
 {
@@ -578,8 +580,6 @@ void __init acpi_initrd_override(void *data, size_t size)
         struct acpi_table_header *table;
         char cpio_path[32] = "kernel/firmware/acpi/";
         struct cpio_data file;
-        struct cpio_data early_initrd_files[ACPI_OVERRIDE_TABLES];
-        char *p;
 
         if (data == NULL || size == 0)
                 return;
@@ -624,8 +624,8 @@ void __init acpi_initrd_override(void *data, size_t size)
                         table->signature, cpio_path, file.name, table->length);
 
                 all_tables_size += table->length;
-                early_initrd_files[table_nr].data = file.data;
-                early_initrd_files[table_nr].size = file.size;
+                acpi_initrd_files[table_nr].data = file.data;
+                acpi_initrd_files[table_nr].size = file.size;
                 table_nr++;
         }
         if (table_nr == 0)
@@ -651,14 +651,34 @@ void __init acpi_initrd_override(void *data, size_t size)
         memblock_reserve(acpi_tables_addr, all_tables_size);
         arch_reserve_mem_area(acpi_tables_addr, all_tables_size);
 
-        p = early_ioremap(acpi_tables_addr, all_tables_size);
-
+        /*
+         * early_ioremap only can remap 256k one time. If we map all
+         * tables one time, we will hit the limit. Need to map chunks
+         * one by one during copying the same as that in relocate_initrd().
+         */
         for (no = 0; no < table_nr; no++) {
-                memcpy(p + total_offset, early_initrd_files[no].data,
-                       early_initrd_files[no].size);
-                total_offset += early_initrd_files[no].size;
+                unsigned char *src_p = acpi_initrd_files[no].data;
+                phys_addr_t size = acpi_initrd_files[no].size;
+                phys_addr_t dest_addr = acpi_tables_addr + total_offset;
+                phys_addr_t slop, clen;
+                char *dest_p;
+
+                total_offset += size;
+
+                while (size) {
+                        slop = dest_addr & ~PAGE_MASK;
+                        clen = size;
+                        if (clen > MAP_CHUNK_SIZE - slop)
+                                clen = MAP_CHUNK_SIZE - slop;
+                        dest_p = early_ioremap(dest_addr & PAGE_MASK,
+                                                 clen + slop);
+                        memcpy(dest_p + slop, src_p, clen);
+                        early_iounmap(dest_p, clen + slop);
+                        src_p += clen;
+                        dest_addr += clen;
+                        size -= clen;
+                }
         }
-        early_iounmap(p, all_tables_size);
 }
 #endif /* CONFIG_ACPI_INITRD_TABLE_OVERRIDE */
 
@@ -819,7 +839,7 @@ acpi_status acpi_os_remove_interrupt_handler(u32 irq, acpi_osd_handler handler)
 
 void acpi_os_sleep(u64 ms)
 {
-        schedule_timeout_interruptible(msecs_to_jiffies(ms));
+        msleep(ms);
 }
 
 void acpi_os_stall(u32 us)
@@ -1353,7 +1373,7 @@ static int __init acpi_os_name_setup(char *str)
         if (!str || !*str)
                 return 0;
 
-        for (; count-- && str && *str; str++) {
+        for (; count-- && *str; str++) {
                 if (isalnum(*str) || *str == ' ' || *str == ':')
                         *p++ = *str;
                 else if (*str == '\'' || *str == '"')
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 0dbe5cdf3396..c2ad391d8041 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -59,16 +59,9 @@ ACPI_MODULE_NAME("power");
 #define ACPI_POWER_RESOURCE_STATE_ON    0x01
 #define ACPI_POWER_RESOURCE_STATE_UNKNOWN 0xFF
 
-struct acpi_power_dependent_device {
-        struct list_head node;
-        struct acpi_device *adev;
-        struct work_struct work;
-};
-
 struct acpi_power_resource {
         struct acpi_device device;
         struct list_head list_node;
-        struct list_head dependent;
         char *name;
         u32 system_level;
         u32 order;
@@ -233,32 +226,6 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
         return 0;
 }
 
-static void acpi_power_resume_dependent(struct work_struct *work)
-{
-        struct acpi_power_dependent_device *dep;
-        struct acpi_device_physical_node *pn;
-        struct acpi_device *adev;
-        int state;
-
-        dep = container_of(work, struct acpi_power_dependent_device, work);
-        adev = dep->adev;
-        if (acpi_power_get_inferred_state(adev, &state))
-                return;
-
-        if (state > ACPI_STATE_D0)
-                return;
-
-        mutex_lock(&adev->physical_node_lock);
-
-        list_for_each_entry(pn, &adev->physical_node_list, node)
-                pm_request_resume(pn->dev);
-
-        list_for_each_entry(pn, &adev->power_dependent, node)
-                pm_request_resume(pn->dev);
-
-        mutex_unlock(&adev->physical_node_lock);
-}
-
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
         acpi_status status = AE_OK;
@@ -283,14 +250,8 @@ static int acpi_power_on_unlocked(struct acpi_power_resource *resource)
                                   resource->name));
         } else {
                 result = __acpi_power_on(resource);
-                if (result) {
+                if (result)
                         resource->ref_count--;
-                } else {
-                        struct acpi_power_dependent_device *dep;
-
-                        list_for_each_entry(dep, &resource->dependent, node)
-                                schedule_work(&dep->work);
-                }
         }
         return result;
 }
@@ -390,52 +351,6 @@ static int acpi_power_on_list(struct list_head *list)
         return result;
 }
 
-static void acpi_power_add_dependent(struct acpi_power_resource *resource,
-                                     struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-
-        mutex_lock(&resource->resource_lock);
-
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev)
-                        goto out;
-
-        dep = kzalloc(sizeof(*dep), GFP_KERNEL);
-        if (!dep)
-                goto out;
-
-        dep->adev = adev;
-        INIT_WORK(&dep->work, acpi_power_resume_dependent);
-        list_add_tail(&dep->node, &resource->dependent);
-
- out:
-        mutex_unlock(&resource->resource_lock);
-}
-
-static void acpi_power_remove_dependent(struct acpi_power_resource *resource,
-                                        struct acpi_device *adev)
-{
-        struct acpi_power_dependent_device *dep;
-        struct work_struct *work = NULL;
-
-        mutex_lock(&resource->resource_lock);
-
-        list_for_each_entry(dep, &resource->dependent, node)
-                if (dep->adev == adev) {
-                        list_del(&dep->node);
-                        work = &dep->work;
-                        break;
-                }
-
-        mutex_unlock(&resource->resource_lock);
-
-        if (work) {
-                cancel_work_sync(work);
-                kfree(dep);
-        }
-}
-
 static struct attribute *attrs[] = {
         NULL,
 };
@@ -524,8 +439,6 @@ static void acpi_power_expose_hide(struct acpi_device *adev,
 
 void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
 {
-        struct acpi_device_power_state *ps;
-        struct acpi_power_resource_entry *entry;
         int state;
 
         if (adev->wakeup.flags.valid)
@@ -535,16 +448,6 @@ void acpi_power_add_remove_device(struct acpi_device *adev, bool add)
         if (!adev->power.flags.power_resources)
                 return;
 
-        ps = &adev->power.states[ACPI_STATE_D0];
-        list_for_each_entry(entry, &ps->resources, node) {
-                struct acpi_power_resource *resource = entry->resource;
-
-                if (add)
-                        acpi_power_add_dependent(resource, adev);
-                else
-                        acpi_power_remove_dependent(resource, adev);
-        }
-
         for (state = ACPI_STATE_D0; state <= ACPI_STATE_D3_HOT; state++)
                 acpi_power_expose_hide(adev,
                                        &adev->power.states[state].resources,
@@ -882,7 +785,6 @@ int acpi_add_power_resource(acpi_handle handle)
         acpi_init_device_object(device, handle, ACPI_BUS_TYPE_POWER,
                                 ACPI_STA_DEFAULT);
         mutex_init(&resource->resource_lock);
-        INIT_LIST_HEAD(&resource->dependent);
         INIT_LIST_HEAD(&resource->list_node);
         resource->name = device->pnp.bus_id;
         strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
@@ -936,8 +838,10 @@ void acpi_resume_power_resources(void)
                 mutex_lock(&resource->resource_lock);
 
                 result = acpi_power_get_state(resource->device.handle, &state);
-                if (result)
+                if (result) {
+                        mutex_unlock(&resource->resource_lock);
                         continue;
+                }
 
                 if (state == ACPI_POWER_RESOURCE_STATE_OFF
                     && resource->ref_count) {
diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
index 04a13784dd20..6a5b152ad4d0 100644
--- a/drivers/acpi/proc.c
+++ b/drivers/acpi/proc.c
@@ -8,289 +8,17 @@
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
-#ifdef CONFIG_X86
-#include <linux/mc146818rtc.h>
-#endif
-
 #include "sleep.h"
 
 #define _COMPONENT              ACPI_SYSTEM_COMPONENT
 
 /*
  * this file provides support for:
- * /proc/acpi/alarm
  * /proc/acpi/wakeup
  */
 
 ACPI_MODULE_NAME("sleep")
 
-#if defined(CONFIG_RTC_DRV_CMOS) || defined(CONFIG_RTC_DRV_CMOS_MODULE) || !defined(CONFIG_X86)
-/* use /sys/class/rtc/rtcX/wakealarm instead; it's not ACPI-specific */
-#else
-#define HAVE_ACPI_LEGACY_ALARM
-#endif
-
-#ifdef  HAVE_ACPI_LEGACY_ALARM
-
-static u32 cmos_bcd_read(int offset, int rtc_control);
-
-static int acpi_system_alarm_seq_show(struct seq_file *seq, void *offset)
-{
-        u32 sec, min, hr;
-        u32 day, mo, yr, cent = 0;
-        u32 today = 0;
-        unsigned char rtc_control = 0;
-        unsigned long flags;
-
-        spin_lock_irqsave(&rtc_lock, flags);
-
-        rtc_control = CMOS_READ(RTC_CONTROL);
-        sec = cmos_bcd_read(RTC_SECONDS_ALARM, rtc_control);
-        min = cmos_bcd_read(RTC_MINUTES_ALARM, rtc_control);
-        hr = cmos_bcd_read(RTC_HOURS_ALARM, rtc_control);
-
-        /* If we ever get an FACP with proper values... */
-        if (acpi_gbl_FADT.day_alarm) {
-                /* ACPI spec: only low 6 its should be cared */
-                day = CMOS_READ(acpi_gbl_FADT.day_alarm) & 0x3F;
-                if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
-                        day = bcd2bin(day);
-        } else
-                day = cmos_bcd_read(RTC_DAY_OF_MONTH, rtc_control);
-        if (acpi_gbl_FADT.month_alarm)
-                mo = cmos_bcd_read(acpi_gbl_FADT.month_alarm, rtc_control);
-        else {
-                mo = cmos_bcd_read(RTC_MONTH, rtc_control);
-                today = cmos_bcd_read(RTC_DAY_OF_MONTH, rtc_control);
-        }
-        if (acpi_gbl_FADT.century)
-                cent = cmos_bcd_read(acpi_gbl_FADT.century, rtc_control);
-
-        yr = cmos_bcd_read(RTC_YEAR, rtc_control);
-
-        spin_unlock_irqrestore(&rtc_lock, flags);
-
-        /* we're trusting the FADT (see above) */
-        if (!acpi_gbl_FADT.century)
-                /* If we're not trusting the FADT, we should at least make it
-                 * right for _this_ century... ehm, what is _this_ century?
-                 *
-                 * TBD:
-                 *  ASAP: find piece of code in the kernel, e.g. star tracker driver,
-                 *        which we can trust to determine the century correctly. Atom
-                 *        watch driver would be nice, too...
-                 *
-                 *  if that has not happened, change for first release in 2050:
-                 *        if (yr<50)
-                 *                yr += 2100;
-                 *        else
-                 *                yr += 2000;   // current line of code
-                 *
-                 *  if that has not happened either, please do on 2099/12/31:23:59:59
-                 *        s/2000/2100
-                 *
-                 */
-                yr += 2000;
-        else
-                yr += cent * 100;
-
-        /*
-         * Show correct dates for alarms up to a month into the future.
-         * This solves issues for nearly all situations with the common
-         * 30-day alarm clocks in PC hardware.
-         */
-        if (day < today) {
-                if (mo < 12) {
-                        mo += 1;
-                } else {
-                        mo = 1;
-                        yr += 1;
-                }
-        }
-
-        seq_printf(seq, "%4.4u-", yr);
-        (mo > 12) ? seq_puts(seq, "**-") : seq_printf(seq, "%2.2u-", mo);
-        (day > 31) ? seq_puts(seq, "** ") : seq_printf(seq, "%2.2u ", day);
-        (hr > 23) ? seq_puts(seq, "**:") : seq_printf(seq, "%2.2u:", hr);
-        (min > 59) ? seq_puts(seq, "**:") : seq_printf(seq, "%2.2u:", min);
-        (sec > 59) ? seq_puts(seq, "**\n") : seq_printf(seq, "%2.2u\n", sec);
-
-        return 0;
-}
-
-static int acpi_system_alarm_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_system_alarm_seq_show, PDE_DATA(inode));
-}
-
-static int get_date_field(char **p, u32 * value)
-{
-        char *next = NULL;
-        char *string_end = NULL;
-        int result = -EINVAL;
-
-        /*
-         * Try to find delimeter, only to insert null.  The end of the
-         * string won't have one, but is still valid.
-         */
-        if (*p == NULL)
-                return result;
-
-        next = strpbrk(*p, "- :");
-        if (next)
-                *next++ = '\0';
-
-        *value = simple_strtoul(*p, &string_end, 10);
-
-        /* Signal success if we got a good digit */
-        if (string_end != *p)
-                result = 0;
-
-        if (next)
-                *p = next;
-        else
-                *p = NULL;
-
-        return result;
-}
-
-/* Read a possibly BCD register, always return binary */
-static u32 cmos_bcd_read(int offset, int rtc_control)
-{
-        u32 val = CMOS_READ(offset);
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
-                val = bcd2bin(val);
-        return val;
-}
-
-/* Write binary value into possibly BCD register */
-static void cmos_bcd_write(u32 val, int offset, int rtc_control)
-{
-        if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD)
-                val = bin2bcd(val);
-        CMOS_WRITE(val, offset);
-}
-
-static ssize_t
-acpi_system_write_alarm(struct file *file,
-                        const char __user * buffer, size_t count, loff_t * ppos)
-{
-        int result = 0;
-        char alarm_string[30] = { '\0' };
-        char *p = alarm_string;
-        u32 sec, min, hr, day, mo, yr;
-        int adjust = 0;
-        unsigned char rtc_control = 0;
-
-        if (count > sizeof(alarm_string) - 1)
-                return -EINVAL;
-
-        if (copy_from_user(alarm_string, buffer, count))
-                return -EFAULT;
-
-        alarm_string[count] = '\0';
-
-        /* check for time adjustment */
-        if (alarm_string[0] == '+') {
-                p++;
-                adjust = 1;
-        }
-
-        if ((result = get_date_field(&p, &yr)))
-                goto end;
-        if ((result = get_date_field(&p, &mo)))
-                goto end;
-        if ((result = get_date_field(&p, &day)))
-                goto end;
-        if ((result = get_date_field(&p, &hr)))
-                goto end;
-        if ((result = get_date_field(&p, &min)))
-                goto end;
-        if ((result = get_date_field(&p, &sec)))
-                goto end;
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc_control = CMOS_READ(RTC_CONTROL);
-
-        if (adjust) {
-                yr += cmos_bcd_read(RTC_YEAR, rtc_control);
-                mo += cmos_bcd_read(RTC_MONTH, rtc_control);
-                day += cmos_bcd_read(RTC_DAY_OF_MONTH, rtc_control);
-                hr += cmos_bcd_read(RTC_HOURS, rtc_control);
-                min += cmos_bcd_read(RTC_MINUTES, rtc_control);
-                sec += cmos_bcd_read(RTC_SECONDS, rtc_control);
-        }
-
-        spin_unlock_irq(&rtc_lock);
-
-        if (sec > 59) {
-                min += sec/60;
-                sec = sec%60;
-        }
-        if (min > 59) {
-                hr += min/60;
-                min = min%60;
-        }
-        if (hr > 23) {
-                day += hr/24;
-                hr = hr%24;
-        }
-        if (day > 31) {
-                mo += day/32;
-                day = day%32;
-        }
-        if (mo > 12) {
-                yr += mo/13;
-                mo = mo%13;
-        }
-
-        spin_lock_irq(&rtc_lock);
-        /*
-         * Disable alarm interrupt before setting alarm timer or else
-         * when ACPI_EVENT_RTC is enabled, a spurious ACPI interrupt occurs
-         */
-        rtc_control &= ~RTC_AIE;
-        CMOS_WRITE(rtc_control, RTC_CONTROL);
-        CMOS_READ(RTC_INTR_FLAGS);
-
-        /* write the fields the rtc knows about */
-        cmos_bcd_write(hr, RTC_HOURS_ALARM, rtc_control);
-        cmos_bcd_write(min, RTC_MINUTES_ALARM, rtc_control);
-        cmos_bcd_write(sec, RTC_SECONDS_ALARM, rtc_control);
-
-        /*
-         * If the system supports an enhanced alarm it will have non-zero
-         * offsets into the CMOS RAM here -- which for some reason are pointing
-         * to the RTC area of memory.
-         */
-        if (acpi_gbl_FADT.day_alarm)
-                cmos_bcd_write(day, acpi_gbl_FADT.day_alarm, rtc_control);
-        if (acpi_gbl_FADT.month_alarm)
-                cmos_bcd_write(mo, acpi_gbl_FADT.month_alarm, rtc_control);
-        if (acpi_gbl_FADT.century) {
-                if (adjust)
-                        yr += cmos_bcd_read(acpi_gbl_FADT.century, rtc_control) * 100;
-                cmos_bcd_write(yr / 100, acpi_gbl_FADT.century, rtc_control);
-        }
-        /* enable the rtc alarm interrupt */
-        rtc_control |= RTC_AIE;
-        CMOS_WRITE(rtc_control, RTC_CONTROL);
-        CMOS_READ(RTC_INTR_FLAGS);
-
-        spin_unlock_irq(&rtc_lock);
-
-        acpi_clear_event(ACPI_EVENT_RTC);
-        acpi_enable_event(ACPI_EVENT_RTC, 0);
-
-        *ppos += count;
-
-        result = 0;
-      end:
-        return result ? result : count;
-}
-#endif                          /* HAVE_ACPI_LEGACY_ALARM */
-
 static int
 acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
 {
@@ -417,41 +145,8 @@ static const struct file_operations acpi_system_wakeup_device_fops = {
         .release = single_release,
 };
 
-#ifdef  HAVE_ACPI_LEGACY_ALARM
-static const struct file_operations acpi_system_alarm_fops = {
-        .owner = THIS_MODULE,
-        .open = acpi_system_alarm_open_fs,
-        .read = seq_read,
-        .write = acpi_system_write_alarm,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static u32 rtc_handler(void *context)
-{
-        acpi_clear_event(ACPI_EVENT_RTC);
-        acpi_disable_event(ACPI_EVENT_RTC, 0);
-
-        return ACPI_INTERRUPT_HANDLED;
-}
-#endif                          /* HAVE_ACPI_LEGACY_ALARM */
-
 int __init acpi_sleep_proc_init(void)
 {
-#ifdef  HAVE_ACPI_LEGACY_ALARM
-        /* 'alarm' [R/W] */
-        proc_create("alarm", S_IFREG | S_IRUGO | S_IWUSR,
-                    acpi_root_dir, &acpi_system_alarm_fops);
-
-        acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, NULL);
-        /*
-         * Disable the RTC event after installing RTC handler.
-         * Only when RTC alarm is set will it be enabled.
-         */
-        acpi_clear_event(ACPI_EVENT_RTC);
-        acpi_disable_event(ACPI_EVENT_RTC, 0);
-#endif                          /* HAVE_ACPI_LEGACY_ALARM */
-
         /* 'wakeup device' [R/W] */
         proc_create("wakeup", S_IFREG | S_IRUGO | S_IWUSR,
                     acpi_root_dir, &acpi_system_wakeup_device_fops);
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index cf34d903f4fb..b3171f30b319 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -162,16 +162,23 @@ exit:
         return apic_id;
 }
 
-int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
+int acpi_get_apicid(acpi_handle handle, int type, u32 acpi_id)
 {
-#ifdef CONFIG_SMP
-        int i;
-#endif
-        int apic_id = -1;
+        int apic_id;
 
         apic_id = map_mat_entry(handle, type, acpi_id);
         if (apic_id == -1)
                 apic_id = map_madt_entry(type, acpi_id);
+
+        return apic_id;
+}
+
+int acpi_map_cpuid(int apic_id, u32 acpi_id)
+{
+#ifdef CONFIG_SMP
+        int i;
+#endif
+
         if (apic_id == -1) {
                 /*
                  * On UP processor, there is no _MAT or MADT table.
@@ -211,6 +218,15 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
 #endif
         return -1;
 }
+
+int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
+{
+        int apic_id;
+
+        apic_id = acpi_get_apicid(handle, type, acpi_id);
+
+        return acpi_map_cpuid(apic_id, acpi_id);
+}
 EXPORT_SYMBOL_GPL(acpi_get_cpuid);
 
 static bool __init processor_physically_present(acpi_handle handle)
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index e534ba66d5b8..146ab7e2b81d 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -153,8 +153,7 @@ static int acpi_cpu_soft_notify(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __refdata acpi_cpu_notifier =
-{
+static struct notifier_block __refdata acpi_cpu_notifier = {
             .notifier_call = acpi_cpu_soft_notify,
 };
 
@@ -172,7 +171,6 @@ static int __acpi_processor_start(struct acpi_device *device)
 
 #ifdef CONFIG_CPU_FREQ
         acpi_processor_ppc_has_changed(pr, 0);
-        acpi_processor_load_module(pr);
 #endif
         acpi_processor_get_throttling_info(pr);
 
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index f98dd00b51a9..35c8f2bbcc40 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -272,9 +272,6 @@ static void tsc_check_state(int state) { return; }
 static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
 {
 
-        if (!pr)
-                return -EINVAL;
-
         if (!pr->pblk)
                 return -ENODEV;
 
@@ -1076,12 +1073,8 @@ int acpi_processor_hotplug(struct acpi_processor *pr)
         if (disabled_by_idle_boot_param())
                 return 0;
 
-        if (!pr)
-                return -EINVAL;
-
-        if (nocst) {
+        if (nocst)
                 return -ENODEV;
-        }
 
         if (!pr->flags.power_setup_done)
                 return -ENODEV;
@@ -1108,9 +1101,6 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
         if (disabled_by_idle_boot_param())
                 return 0;
 
-        if (!pr)
-                return -EINVAL;
-
         if (nocst)
                 return -ENODEV;
 
@@ -1183,9 +1173,6 @@ int acpi_processor_power_init(struct acpi_processor *pr)
                 first_run++;
         }
 
-        if (!pr)
-                return -EINVAL;
-
         if (acpi_gbl_FADT.cst_control && !nocst) {
                 status =
                     acpi_os_write_port(acpi_gbl_FADT.smi_command, acpi_gbl_FADT.cst_control, 8);
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 51d7948611da..60a7c28fc167 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -235,28 +235,6 @@ void acpi_processor_ppc_exit(void)
         acpi_processor_ppc_status &= ~PPC_REGISTERED;
 }
 
-/*
- * Do a quick check if the systems looks like it should use ACPI
- * cpufreq. We look at a _PCT method being available, but don't
- * do a whole lot of sanity checks.
- */
-void acpi_processor_load_module(struct acpi_processor *pr)
-{
-        static int requested;
-        acpi_status status = 0;
-        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-
-        if (!arch_has_acpi_pdc() || requested)
-                return;
-        status = acpi_evaluate_object(pr->handle, "_PCT", NULL, &buffer);
-        if (!ACPI_FAILURE(status)) {
-                printk(KERN_INFO PREFIX "Requesting acpi_cpufreq\n");
-                request_module_nowait("acpi_cpufreq");
-                requested = 1;
-        }
-        kfree(buffer.pointer);
-}
-
 static int acpi_processor_get_performance_control(struct acpi_processor *pr)
 {
         int result = 0;
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index aef7e1cd1e5d..d465ae6cdd00 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -30,12 +30,6 @@
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
 
-#ifdef CONFIG_ACPI_PROCFS_POWER
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <asm/uaccess.h>
-#endif
-
 #include <linux/acpi.h>
 #include <linux/timer.h>
 #include <linux/jiffies.h>
@@ -67,11 +61,6 @@ static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
 
-extern struct proc_dir_entry *acpi_lock_ac_dir(void);
-extern struct proc_dir_entry *acpi_lock_battery_dir(void);
-extern void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir);
-extern void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
-
 #define MAX_SBS_BAT                     4
 #define ACPI_SBS_BLOCK_MAX              32
 
@@ -84,9 +73,6 @@ MODULE_DEVICE_TABLE(acpi, sbs_device_ids);
 struct acpi_battery {
         struct power_supply bat;
         struct acpi_sbs *sbs;
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        struct proc_dir_entry *proc_entry;
-#endif
         unsigned long update_time;
         char name[8];
         char manufacturer_name[ACPI_SBS_BLOCK_MAX];
@@ -119,9 +105,6 @@ struct acpi_sbs {
         struct acpi_device *device;
         struct acpi_smb_hc *hc;
         struct mutex lock;
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        struct proc_dir_entry *charger_entry;
-#endif
         struct acpi_battery battery[MAX_SBS_BAT];
         u8 batteries_supported:4;
         u8 manager_present:1;
@@ -482,261 +465,6 @@ static struct device_attribute alarm_attr = {
 };
 
 /* --------------------------------------------------------------------------
-                              FS Interface (/proc/acpi)
-   -------------------------------------------------------------------------- */
-
-#ifdef CONFIG_ACPI_PROCFS_POWER
-/* Generic Routines */
-static int
-acpi_sbs_add_fs(struct proc_dir_entry **dir,
-                struct proc_dir_entry *parent_dir,
-                char *dir_name,
-                const struct file_operations *info_fops,
-                const struct file_operations *state_fops,
-                const struct file_operations *alarm_fops, void *data)
-{
-        printk(KERN_WARNING PREFIX "Deprecated procfs I/F for SBS is loaded,"
-                        " please retry with CONFIG_ACPI_PROCFS_POWER cleared\n");
-        if (!*dir) {
-                *dir = proc_mkdir(dir_name, parent_dir);
-                if (!*dir) {
-                        return -ENODEV;
-                }
-        }
-
-        /* 'info' [R] */
-        if (info_fops)
-                proc_create_data(ACPI_SBS_FILE_INFO, S_IRUGO, *dir,
-                                 info_fops, data);
-
-        /* 'state' [R] */
-        if (state_fops)
-                proc_create_data(ACPI_SBS_FILE_STATE, S_IRUGO, *dir,
-                                 state_fops, data);
-
-        /* 'alarm' [R/W] */
-        if (alarm_fops)
-                proc_create_data(ACPI_SBS_FILE_ALARM, S_IRUGO, *dir,
-                                 alarm_fops, data);
-        return 0;
-}
-
-/* Smart Battery Interface */
-static struct proc_dir_entry *acpi_battery_dir = NULL;
-
-static inline char *acpi_battery_units(struct acpi_battery *battery)
-{
-        return acpi_battery_mode(battery) ? " mW" : " mA";
-}
-
-
-static int acpi_battery_read_info(struct seq_file *seq, void *offset)
-{
-        struct acpi_battery *battery = seq->private;
-        struct acpi_sbs *sbs = battery->sbs;
-        int result = 0;
-
-        mutex_lock(&sbs->lock);
-
-        seq_printf(seq, "present:                 %s\n",
-                   (battery->present) ? "yes" : "no");
-        if (!battery->present)
-                goto end;
-
-        seq_printf(seq, "design capacity:         %i%sh\n",
-                   battery->design_capacity * acpi_battery_scale(battery),
-                   acpi_battery_units(battery));
-        seq_printf(seq, "last full capacity:      %i%sh\n",
-                   battery->full_charge_capacity * acpi_battery_scale(battery),
-                   acpi_battery_units(battery));
-        seq_printf(seq, "battery technology:      rechargeable\n");
-        seq_printf(seq, "design voltage:          %i mV\n",
-                   battery->design_voltage * acpi_battery_vscale(battery));
-        seq_printf(seq, "design capacity warning: unknown\n");
-        seq_printf(seq, "design capacity low:     unknown\n");
-        seq_printf(seq, "cycle count:             %i\n", battery->cycle_count);
-        seq_printf(seq, "capacity granularity 1:  unknown\n");
-        seq_printf(seq, "capacity granularity 2:  unknown\n");
-        seq_printf(seq, "model number:            %s\n", battery->device_name);
-        seq_printf(seq, "serial number:           %i\n",
-                   battery->serial_number);
-        seq_printf(seq, "battery type:            %s\n",
-                   battery->device_chemistry);
-        seq_printf(seq, "OEM info:                %s\n",
-                   battery->manufacturer_name);
-      end:
-        mutex_unlock(&sbs->lock);
-        return result;
-}
-
-static int acpi_battery_info_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_battery_read_info, PDE_DATA(inode));
-}
-
-static int acpi_battery_read_state(struct seq_file *seq, void *offset)
-{
-        struct acpi_battery *battery = seq->private;
-        struct acpi_sbs *sbs = battery->sbs;
-        int rate;
-
-        mutex_lock(&sbs->lock);
-        seq_printf(seq, "present:                 %s\n",
-                   (battery->present) ? "yes" : "no");
-        if (!battery->present)
-                goto end;
-
-        acpi_battery_get_state(battery);
-        seq_printf(seq, "capacity state:          %s\n",
-                   (battery->state & 0x0010) ? "critical" : "ok");
-        seq_printf(seq, "charging state:          %s\n",
-                   (battery->rate_now < 0) ? "discharging" :
-                   ((battery->rate_now > 0) ? "charging" : "charged"));
-        rate = abs(battery->rate_now) * acpi_battery_ipscale(battery);
-        rate *= (acpi_battery_mode(battery))?(battery->voltage_now *
-                        acpi_battery_vscale(battery)/1000):1;
-        seq_printf(seq, "present rate:            %d%s\n", rate,
-                   acpi_battery_units(battery));
-        seq_printf(seq, "remaining capacity:      %i%sh\n",
-                   battery->capacity_now * acpi_battery_scale(battery),
-                   acpi_battery_units(battery));
-        seq_printf(seq, "present voltage:         %i mV\n",
-                   battery->voltage_now * acpi_battery_vscale(battery));
-
-      end:
-        mutex_unlock(&sbs->lock);
-        return 0;
-}
-
-static int acpi_battery_state_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_battery_read_state, PDE_DATA(inode));
-}
-
-static int acpi_battery_read_alarm(struct seq_file *seq, void *offset)
-{
-        struct acpi_battery *battery = seq->private;
-        struct acpi_sbs *sbs = battery->sbs;
-        int result = 0;
-
-        mutex_lock(&sbs->lock);
-
-        if (!battery->present) {
-                seq_printf(seq, "present:                 no\n");
-                goto end;
-        }
-
-        acpi_battery_get_alarm(battery);
-        seq_printf(seq, "alarm:                   ");
-        if (battery->alarm_capacity)
-                seq_printf(seq, "%i%sh\n",
-                           battery->alarm_capacity *
-                           acpi_battery_scale(battery),
-                           acpi_battery_units(battery));
-        else
-                seq_printf(seq, "disabled\n");
-      end:
-        mutex_unlock(&sbs->lock);
-        return result;
-}
-
-static ssize_t
-acpi_battery_write_alarm(struct file *file, const char __user * buffer,
-                         size_t count, loff_t * ppos)
-{
-        struct seq_file *seq = file->private_data;
-        struct acpi_battery *battery = seq->private;
-        struct acpi_sbs *sbs = battery->sbs;
-        char alarm_string[12] = { '\0' };
-        int result = 0;
-        mutex_lock(&sbs->lock);
-        if (!battery->present) {
-                result = -ENODEV;
-                goto end;
-        }
-        if (count > sizeof(alarm_string) - 1) {
-                result = -EINVAL;
-                goto end;
-        }
-        if (copy_from_user(alarm_string, buffer, count)) {
-                result = -EFAULT;
-                goto end;
-        }
-        alarm_string[count] = 0;
-        battery->alarm_capacity = simple_strtoul(alarm_string, NULL, 0) /
-                                        acpi_battery_scale(battery);
-        acpi_battery_set_alarm(battery);
-      end:
-        mutex_unlock(&sbs->lock);
-        if (result)
-                return result;
-        return count;
-}
-
-static int acpi_battery_alarm_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_battery_read_alarm, PDE_DATA(inode));
-}
-
-static const struct file_operations acpi_battery_info_fops = {
-        .open = acpi_battery_info_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static const struct file_operations acpi_battery_state_fops = {
-        .open = acpi_battery_state_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-static const struct file_operations acpi_battery_alarm_fops = {
-        .open = acpi_battery_alarm_open_fs,
-        .read = seq_read,
-        .write = acpi_battery_write_alarm,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-/* Legacy AC Adapter Interface */
-
-static struct proc_dir_entry *acpi_ac_dir = NULL;
-
-static int acpi_ac_read_state(struct seq_file *seq, void *offset)
-{
-
-        struct acpi_sbs *sbs = seq->private;
-
-        mutex_lock(&sbs->lock);
-
-        seq_printf(seq, "state:                   %s\n",
-                   sbs->charger_present ? "on-line" : "off-line");
-
-        mutex_unlock(&sbs->lock);
-        return 0;
-}
-
-static int acpi_ac_state_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_ac_read_state, PDE_DATA(inode));
-}
-
-static const struct file_operations acpi_ac_state_fops = {
-        .open = acpi_ac_state_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-        .owner = THIS_MODULE,
-};
-
-#endif
-
-/* --------------------------------------------------------------------------
                                  Driver Interface
    -------------------------------------------------------------------------- */
 static int acpi_battery_read(struct acpi_battery *battery)
@@ -781,12 +509,6 @@ static int acpi_battery_add(struct acpi_sbs *sbs, int id)
                 return result;
 
         sprintf(battery->name, ACPI_BATTERY_DIR_NAME, id);
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_sbs_add_fs(&battery->proc_entry, acpi_battery_dir,
-                        battery->name, &acpi_battery_info_fops,
-                        &acpi_battery_state_fops, &acpi_battery_alarm_fops,
-                        battery);
-#endif
         battery->bat.name = battery->name;
         battery->bat.type = POWER_SUPPLY_TYPE_BATTERY;
         if (!acpi_battery_mode(battery)) {
@@ -822,10 +544,6 @@ static void acpi_battery_remove(struct acpi_sbs *sbs, int id)
                         device_remove_file(battery->bat.dev, &alarm_attr);
                 power_supply_unregister(&battery->bat);
         }
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        proc_remove(battery->proc_entry);
-        battery->proc_entry = NULL;
-#endif
 }
 
 static int acpi_charger_add(struct acpi_sbs *sbs)
@@ -835,13 +553,7 @@ static int acpi_charger_add(struct acpi_sbs *sbs)
         result = acpi_ac_get_present(sbs);
         if (result)
                 goto end;
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        result = acpi_sbs_add_fs(&sbs->charger_entry, acpi_ac_dir,
-                                 ACPI_AC_DIR_NAME, NULL,
-                                 &acpi_ac_state_fops, NULL, sbs);
-        if (result)
-                goto end;
-#endif
+
         sbs->charger.name = "sbs-charger";
         sbs->charger.type = POWER_SUPPLY_TYPE_MAINS;
         sbs->charger.properties = sbs_ac_props;
@@ -859,10 +571,6 @@ static void acpi_charger_remove(struct acpi_sbs *sbs)
 {
         if (sbs->charger.dev)
                 power_supply_unregister(&sbs->charger);
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        proc_remove(sbs->charger_entry);
-        sbs->charger_entry = NULL;
-#endif
 }
 
 static void acpi_sbs_callback(void *context)
@@ -950,20 +658,6 @@ static int acpi_sbs_remove(struct acpi_device *device)
         return 0;
 }
 
-static void acpi_sbs_rmdirs(void)
-{
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        if (acpi_ac_dir) {
-                acpi_unlock_ac_dir(acpi_ac_dir);
-                acpi_ac_dir = NULL;
-        }
-        if (acpi_battery_dir) {
-                acpi_unlock_battery_dir(acpi_battery_dir);
-                acpi_battery_dir = NULL;
-        }
-#endif
-}
-
 #ifdef CONFIG_PM_SLEEP
 static int acpi_sbs_resume(struct device *dev)
 {
@@ -995,28 +689,17 @@ static int __init acpi_sbs_init(void)
 
         if (acpi_disabled)
                 return -ENODEV;
-#ifdef CONFIG_ACPI_PROCFS_POWER
-        acpi_ac_dir = acpi_lock_ac_dir();
-        if (!acpi_ac_dir)
-                return -ENODEV;
-        acpi_battery_dir = acpi_lock_battery_dir();
-        if (!acpi_battery_dir) {
-                acpi_sbs_rmdirs();
-                return -ENODEV;
-        }
-#endif
+
         result = acpi_bus_register_driver(&acpi_sbs_driver);
-        if (result < 0) {
-                acpi_sbs_rmdirs();
+        if (result < 0)
                 return -ENODEV;
-        }
+
         return 0;
 }
 
 static void __exit acpi_sbs_exit(void)
 {
         acpi_bus_unregister_driver(&acpi_sbs_driver);
-        acpi_sbs_rmdirs();
         return;
 }
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 276cde70a514..55f9dedbbf9f 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -935,7 +935,7 @@ int acpi_bus_get_device(acpi_handle handle, struct acpi_device **device)
         }
         return 0;
 }
-EXPORT_SYMBOL_GPL(acpi_bus_get_device);
+EXPORT_SYMBOL(acpi_bus_get_device);
 
 int acpi_device_add(struct acpi_device *device,
                     void (*release)(struct device *))
@@ -966,7 +966,6 @@ int acpi_device_add(struct acpi_device *device,
         INIT_LIST_HEAD(&device->wakeup_list);
         INIT_LIST_HEAD(&device->physical_node_list);
         mutex_init(&device->physical_node_lock);
-        INIT_LIST_HEAD(&device->power_dependent);
 
         new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL);
         if (!new_bus_id) {
@@ -1088,7 +1087,7 @@ int acpi_bus_register_driver(struct acpi_driver *driver)
 EXPORT_SYMBOL(acpi_bus_register_driver);
 
 /**
- * acpi_bus_unregister_driver - unregisters a driver with the APIC bus
+ * acpi_bus_unregister_driver - unregisters a driver with the ACPI bus
  * @driver: driver to unregister
  *
  * Unregisters a driver with the ACPI bus.  Searches the namespace for all
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index bb6045c5385b..db5293650f62 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -564,6 +564,7 @@ static ssize_t counter_set(struct kobject *kobj,
         acpi_event_status status;
         acpi_handle handle;
         int result = 0;
+        unsigned long tmp;
 
         if (index == num_gpes + ACPI_NUM_FIXED_EVENTS + COUNT_SCI) {
                 int i;
@@ -596,8 +597,10 @@ static ssize_t counter_set(struct kobject *kobj,
                 else if (!strcmp(buf, "clear\n") &&
                          (status & ACPI_EVENT_FLAG_SET))
                         result = acpi_clear_gpe(handle, index);
+                else if (!kstrtoul(buf, 0, &tmp))
+                        all_counters[index].count = tmp;
                 else
-                        all_counters[index].count = strtoul(buf, NULL, 0);
+                        result = -EINVAL;
         } else if (index < num_gpes + ACPI_NUM_FIXED_EVENTS) {
                 int event = index - num_gpes;
                 if (!strcmp(buf, "disable\n") &&
@@ -609,8 +612,10 @@ static ssize_t counter_set(struct kobject *kobj,
                 else if (!strcmp(buf, "clear\n") &&
                          (status & ACPI_EVENT_FLAG_SET))
                         result = acpi_clear_event(event);
+                else if (!kstrtoul(buf, 0, &tmp))
+                        all_counters[index].count = tmp;
                 else
-                        all_counters[index].count = strtoul(buf, NULL, 0);
+                        result = -EINVAL;
         } else
                 all_counters[index].count = strtoul(buf, NULL, 0);
 
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 6a0329340b42..e600b5dbfcb6 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -299,8 +299,8 @@ static int acpi_thermal_trips_update(struct acpi_thermal *tz, int flag)
                         ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                           "No critical threshold\n"));
                 } else if (tmp <= 2732) {
-                        printk(KERN_WARNING FW_BUG "Invalid critical threshold "
-                               "(%llu)\n", tmp);
+                        pr_warn(FW_BUG "Invalid critical threshold (%llu)\n",
+                                tmp);
                         tz->trips.critical.flags.valid = 0;
                 } else {
                         tz->trips.critical.flags.valid = 1;
@@ -317,8 +317,8 @@ static int acpi_thermal_trips_update(struct acpi_thermal *tz, int flag)
                                  * Allow override critical threshold
                                  */
                                 if (crt_k > tz->trips.critical.temperature)
-                                        printk(KERN_WARNING PREFIX
-                                                "Critical threshold %d C\n", crt);
+                                        pr_warn(PREFIX "Critical threshold %d C\n",
+                                                crt);
                                 tz->trips.critical.temperature = crt_k;
                         }
                 }
@@ -390,8 +390,7 @@ static int acpi_thermal_trips_update(struct acpi_thermal *tz, int flag)
                 status = acpi_evaluate_reference(tz->device->handle, "_PSL",
                                                         NULL, &devices);
                 if (ACPI_FAILURE(status)) {
-                        printk(KERN_WARNING PREFIX
-                                "Invalid passive threshold\n");
+                        pr_warn(PREFIX "Invalid passive threshold\n");
                         tz->trips.passive.flags.valid = 0;
                 }
                 else
@@ -453,8 +452,8 @@ static int acpi_thermal_trips_update(struct acpi_thermal *tz, int flag)
                         status = acpi_evaluate_reference(tz->device->handle,
                                                 name, NULL, &devices);
                         if (ACPI_FAILURE(status)) {
-                                printk(KERN_WARNING PREFIX
-                                        "Invalid active%d threshold\n", i);
+                                pr_warn(PREFIX "Invalid active%d threshold\n",
+                                        i);
                                 tz->trips.active[i].flags.valid = 0;
                         }
                         else
@@ -505,7 +504,7 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
                 valid |= tz->trips.active[i].flags.valid;
 
         if (!valid) {
-                printk(KERN_WARNING FW_BUG "No valid trip found\n");
+                pr_warn(FW_BUG "No valid trip found\n");
                 return -ENODEV;
         }
         return 0;
@@ -923,8 +922,7 @@ static int acpi_thermal_register_thermal_zone(struct acpi_thermal *tz)
                                   acpi_bus_private_data_handler,
                                   tz->thermal_zone);
         if (ACPI_FAILURE(status)) {
-                printk(KERN_ERR PREFIX
-                                "Error attaching device data\n");
+                pr_err(PREFIX "Error attaching device data\n");
                 return -ENODEV;
         }
 
@@ -1094,9 +1092,8 @@ static int acpi_thermal_add(struct acpi_device *device)
         if (result)
                 goto free_memory;
 
-        printk(KERN_INFO PREFIX "%s [%s] (%ld C)\n",
-               acpi_device_name(device), acpi_device_bid(device),
-               KELVIN_TO_CELSIUS(tz->temperature));
+        pr_info(PREFIX "%s [%s] (%ld C)\n", acpi_device_name(device),
+                acpi_device_bid(device), KELVIN_TO_CELSIUS(tz->temperature));
         goto end;
 
 free_memory:
@@ -1159,24 +1156,24 @@ static int acpi_thermal_resume(struct device *dev)
 static int thermal_act(const struct dmi_system_id *d) {
 
         if (act == 0) {
-                printk(KERN_NOTICE "ACPI: %s detected: "
-                        "disabling all active thermal trip points\n", d->ident);
+                pr_notice(PREFIX "%s detected: "
+                          "disabling all active thermal trip points\n", d->ident);
                 act = -1;
         }
         return 0;
 }
 static int thermal_nocrt(const struct dmi_system_id *d) {
 
-        printk(KERN_NOTICE "ACPI: %s detected: "
-                "disabling all critical thermal trip point actions.\n", d->ident);
+        pr_notice(PREFIX "%s detected: "
+                  "disabling all critical thermal trip point actions.\n", d->ident);
         nocrt = 1;
         return 0;
 }
 static int thermal_tzp(const struct dmi_system_id *d) {
 
         if (tzp == 0) {
-                printk(KERN_NOTICE "ACPI: %s detected: "
-                        "enabling thermal zone polling\n", d->ident);
+                pr_notice(PREFIX "%s detected: "
+                          "enabling thermal zone polling\n", d->ident);
                 tzp = 300;      /* 300 dS = 30 Seconds */
         }
         return 0;
@@ -1184,8 +1181,8 @@ static int thermal_tzp(const struct dmi_system_id *d) {
 static int thermal_psv(const struct dmi_system_id *d) {
 
         if (psv == 0) {
-                printk(KERN_NOTICE "ACPI: %s detected: "
-                        "disabling all passive thermal trip points\n", d->ident);
+                pr_notice(PREFIX "%s detected: "
+                          "disabling all passive thermal trip points\n", d->ident);
                 psv = -1;
         }
         return 0;
@@ -1238,7 +1235,7 @@ static int __init acpi_thermal_init(void)
         dmi_check_system(thermal_dmi_table);
 
         if (off) {
-                printk(KERN_NOTICE "ACPI: thermal control disabled\n");
+                pr_notice(PREFIX "thermal control disabled\n");
                 return -ENODEV;
         }
 
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index 552248b0005b..6d408bfbbb1d 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -121,7 +121,7 @@ acpi_extract_package(union acpi_object *package,
                                 break;
                         default:
                                 printk(KERN_WARNING PREFIX "Invalid package element"
-                                              " [%d]: got number, expecing"
+                                              " [%d]: got number, expecting"
                                               " [%c]\n",
                                               i, format_string[i]);
                                 return AE_BAD_DATA;
@@ -148,7 +148,7 @@ acpi_extract_package(union acpi_object *package,
                         default:
                                 printk(KERN_WARNING PREFIX "Invalid package element"
                                               " [%d] got string/buffer,"
-                                              " expecing [%c]\n",
+                                              " expecting [%c]\n",
                                               i, format_string[i]);
                                 return AE_BAD_DATA;
                                 break;
@@ -169,11 +169,20 @@ acpi_extract_package(union acpi_object *package,
         /*
          * Validate output buffer.
          */
-        if (buffer->length < size_required) {
+        if (buffer->length == ACPI_ALLOCATE_BUFFER) {
+                buffer->pointer = ACPI_ALLOCATE(size_required);
+                if (!buffer->pointer)
+                        return AE_NO_MEMORY;
                 buffer->length = size_required;
-                return AE_BUFFER_OVERFLOW;
-        } else if (buffer->length != size_required || !buffer->pointer) {
-                return AE_BAD_PARAMETER;
+                memset(buffer->pointer, 0, size_required);
+        } else {
+                if (buffer->length < size_required) {
+                        buffer->length = size_required;
+                        return AE_BUFFER_OVERFLOW;
+                } else if (buffer->length != size_required ||
+                           !buffer->pointer) {
+                        return AE_BAD_PARAMETER;
+                }
         }
 
         head = buffer->pointer;
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index aebcf6355df4..18dbdff4656e 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -88,7 +88,16 @@ module_param(allow_duplicates, bool, 0644);
 static bool use_bios_initial_backlight = 1;
 module_param(use_bios_initial_backlight, bool, 0644);
 
+/*
+ * For Windows 8 systems: if set ture and the GPU driver has
+ * registered a backlight interface, skip registering ACPI video's.
+ */
+static bool use_native_backlight = false;
+module_param(use_native_backlight, bool, 0644);
+
 static int register_count;
+static struct mutex video_list_lock;
+static struct list_head video_bus_head;
 static int acpi_video_bus_add(struct acpi_device *device);
 static int acpi_video_bus_remove(struct acpi_device *device);
 static void acpi_video_bus_notify(struct acpi_device *device, u32 event);
@@ -157,6 +166,7 @@ struct acpi_video_bus {
         struct acpi_video_bus_flags flags;
         struct list_head video_device_list;
         struct mutex device_list_lock;  /* protects video_device_list */
+        struct list_head entry;
         struct input_dev *input;
         char phys[32];  /* for input device */
         struct notifier_block pm_nb;
@@ -229,6 +239,14 @@ static int acpi_video_get_next_level(struct acpi_video_device *device,
 static int acpi_video_switch_brightness(struct acpi_video_device *device,
                                          int event);
 
+static bool acpi_video_verify_backlight_support(void)
+{
+        if (acpi_osi_is_win8() && use_native_backlight &&
+            backlight_device_registered(BACKLIGHT_RAW))
+                return false;
+        return acpi_video_backlight_support();
+}
+
 /* backlight device sysfs support */
 static int acpi_video_get_brightness(struct backlight_device *bd)
 {
@@ -830,9 +848,9 @@ acpi_video_init_brightness(struct acpi_video_device *device)
                  * or an index). Set the backlight to max_level in this case.
                  */
                 for (i = 2; i < br->count; i++)
-                        if (level_old == br->levels[i])
+                        if (level == br->levels[i])
                                 break;
-                if (i == br->count)
+                if (i == br->count || !level)
                         level = max_level;
         }
 
@@ -884,79 +902,6 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
 
         if (acpi_has_method(device->dev->handle, "_DDC"))
                 device->cap._DDC = 1;
-
-        if (acpi_video_backlight_support()) {
-                struct backlight_properties props;
-                struct pci_dev *pdev;
-                acpi_handle acpi_parent;
-                struct device *parent = NULL;
-                int result;
-                static int count;
-                char *name;
-
-                result = acpi_video_init_brightness(device);
-                if (result)
-                        return;
-                name = kasprintf(GFP_KERNEL, "acpi_video%d", count);
-                if (!name)
-                        return;
-                count++;
-
-                acpi_get_parent(device->dev->handle, &acpi_parent);
-
-                pdev = acpi_get_pci_dev(acpi_parent);
-                if (pdev) {
-                        parent = &pdev->dev;
-                        pci_dev_put(pdev);
-                }
-
-                memset(&props, 0, sizeof(struct backlight_properties));
-                props.type = BACKLIGHT_FIRMWARE;
-                props.max_brightness = device->brightness->count - 3;
-                device->backlight = backlight_device_register(name,
-                                                              parent,
-                                                              device,
-                                                              &acpi_backlight_ops,
-                                                              &props);
-                kfree(name);
-                if (IS_ERR(device->backlight))
-                        return;
-
-                /*
-                 * Save current brightness level in case we have to restore it
-                 * before acpi_video_device_lcd_set_level() is called next time.
-                 */
-                device->backlight->props.brightness =
-                                acpi_video_get_brightness(device->backlight);
-
-                device->cooling_dev = thermal_cooling_device_register("LCD",
-                                        device->dev, &video_cooling_ops);
-                if (IS_ERR(device->cooling_dev)) {
-                        /*
-                         * Set cooling_dev to NULL so we don't crash trying to
-                         * free it.
-                         * Also, why the hell we are returning early and
-                         * not attempt to register video output if cooling
-                         * device registration failed?
-                         * -- dtor
-                         */
-                        device->cooling_dev = NULL;
-                        return;
-                }
-
-                dev_info(&device->dev->dev, "registered as cooling_device%d\n",
-                         device->cooling_dev->id);
-                result = sysfs_create_link(&device->dev->dev.kobj,
-                                &device->cooling_dev->device.kobj,
-                                "thermal_cooling");
-                if (result)
-                        printk(KERN_ERR PREFIX "Create sysfs link\n");
-                result = sysfs_create_link(&device->cooling_dev->device.kobj,
-                                &device->dev->dev.kobj, "device");
-                if (result)
-                        printk(KERN_ERR PREFIX "Create sysfs link\n");
-
-        }
 }
 
 /*
@@ -1143,13 +1088,6 @@ acpi_video_bus_get_one_device(struct acpi_device *device,
         acpi_video_device_bind(video, data);
         acpi_video_device_find_cap(data);
 
-        status = acpi_install_notify_handler(device->handle, ACPI_DEVICE_NOTIFY,
-                                             acpi_video_device_notify, data);
-        if (ACPI_FAILURE(status))
-                dev_err(&device->dev, "Error installing notify handler\n");
-        else
-                data->flags.notify = 1;
-
         mutex_lock(&video->device_list_lock);
         list_add_tail(&data->entry, &video->video_device_list);
         mutex_unlock(&video->device_list_lock);
@@ -1333,8 +1271,8 @@ acpi_video_switch_brightness(struct acpi_video_device *device, int event)
         unsigned long long level_current, level_next;
         int result = -EINVAL;
 
-        /* no warning message if acpi_backlight=vendor is used */
-        if (!acpi_video_backlight_support())
+        /* no warning message if acpi_backlight=vendor or a quirk is used */
+        if (!acpi_video_verify_backlight_support())
                 return 0;
 
         if (!device->brightness)
@@ -1454,64 +1392,6 @@ acpi_video_bus_get_devices(struct acpi_video_bus *video,
         return status;
 }
 
-static int acpi_video_bus_put_one_device(struct acpi_video_device *device)
-{
-        acpi_status status;
-
-        if (!device || !device->video)
-                return -ENOENT;
-
-        if (device->flags.notify) {
-                status = acpi_remove_notify_handler(device->dev->handle,
-                                ACPI_DEVICE_NOTIFY, acpi_video_device_notify);
-                if (ACPI_FAILURE(status))
-                        dev_err(&device->dev->dev,
-                                        "Can't remove video notify handler\n");
-        }
-
-        if (device->backlight) {
-                backlight_device_unregister(device->backlight);
-                device->backlight = NULL;
-        }
-        if (device->cooling_dev) {
-                sysfs_remove_link(&device->dev->dev.kobj,
-                                  "thermal_cooling");
-                sysfs_remove_link(&device->cooling_dev->device.kobj,
-                                  "device");
-                thermal_cooling_device_unregister(device->cooling_dev);
-                device->cooling_dev = NULL;
-        }
-
-        return 0;
-}
-
-static int acpi_video_bus_put_devices(struct acpi_video_bus *video)
-{
-        int status;
-        struct acpi_video_device *dev, *next;
-
-        mutex_lock(&video->device_list_lock);
-
-        list_for_each_entry_safe(dev, next, &video->video_device_list, entry) {
-
-                status = acpi_video_bus_put_one_device(dev);
-                if (ACPI_FAILURE(status))
-                        printk(KERN_WARNING PREFIX
-                               "hhuuhhuu bug in acpi video driver.\n");
-
-                if (dev->brightness) {
-                        kfree(dev->brightness->levels);
-                        kfree(dev->brightness);
-                }
-                list_del(&dev->entry);
-                kfree(dev);
-        }
-
-        mutex_unlock(&video->device_list_lock);
-
-        return 0;
-}
-
 /* acpi_video interface */
 
 /*
@@ -1521,13 +1401,13 @@ static int acpi_video_bus_put_devices(struct acpi_video_bus *video)
 static int acpi_video_bus_start_devices(struct acpi_video_bus *video)
 {
         return acpi_video_bus_DOS(video, 0,
-                                  acpi_video_backlight_quirks() ? 1 : 0);
+                                  acpi_osi_is_win8() ? 1 : 0);
 }
 
 static int acpi_video_bus_stop_devices(struct acpi_video_bus *video)
 {
         return acpi_video_bus_DOS(video, 0,
-                                  acpi_video_backlight_quirks() ? 0 : 1);
+                                  acpi_osi_is_win8() ? 0 : 1);
 }
 
 static void acpi_video_bus_notify(struct acpi_device *device, u32 event)
@@ -1536,7 +1416,7 @@ static void acpi_video_bus_notify(struct acpi_device *device, u32 event)
         struct input_dev *input;
         int keycode = 0;
 
-        if (!video)
+        if (!video || !video->input)
                 return;
 
         input = video->input;
@@ -1691,12 +1571,236 @@ acpi_video_bus_match(acpi_handle handle, u32 level, void *context,
         return AE_OK;
 }
 
+static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
+{
+        if (acpi_video_verify_backlight_support()) {
+                struct backlight_properties props;
+                struct pci_dev *pdev;
+                acpi_handle acpi_parent;
+                struct device *parent = NULL;
+                int result;
+                static int count;
+                char *name;
+
+                result = acpi_video_init_brightness(device);
+                if (result)
+                        return;
+                name = kasprintf(GFP_KERNEL, "acpi_video%d", count);
+                if (!name)
+                        return;
+                count++;
+
+                acpi_get_parent(device->dev->handle, &acpi_parent);
+
+                pdev = acpi_get_pci_dev(acpi_parent);
+                if (pdev) {
+                        parent = &pdev->dev;
+                        pci_dev_put(pdev);
+                }
+
+                memset(&props, 0, sizeof(struct backlight_properties));
+                props.type = BACKLIGHT_FIRMWARE;
+                props.max_brightness = device->brightness->count - 3;
+                device->backlight = backlight_device_register(name,
+                                                              parent,
+                                                              device,
+                                                              &acpi_backlight_ops,
+                                                              &props);
+                kfree(name);
+                if (IS_ERR(device->backlight))
+                        return;
+
+                /*
+                 * Save current brightness level in case we have to restore it
+                 * before acpi_video_device_lcd_set_level() is called next time.
+                 */
+                device->backlight->props.brightness =
+                                acpi_video_get_brightness(device->backlight);
+
+                device->cooling_dev = thermal_cooling_device_register("LCD",
+                                        device->dev, &video_cooling_ops);
+                if (IS_ERR(device->cooling_dev)) {
+                        /*
+                         * Set cooling_dev to NULL so we don't crash trying to
+                         * free it.
+                         * Also, why the hell we are returning early and
+                         * not attempt to register video output if cooling
+                         * device registration failed?
+                         * -- dtor
+                         */
+                        device->cooling_dev = NULL;
+                        return;
+                }
+
+                dev_info(&device->dev->dev, "registered as cooling_device%d\n",
+                         device->cooling_dev->id);
+                result = sysfs_create_link(&device->dev->dev.kobj,
+                                &device->cooling_dev->device.kobj,
+                                "thermal_cooling");
+                if (result)
+                        printk(KERN_ERR PREFIX "Create sysfs link\n");
+                result = sysfs_create_link(&device->cooling_dev->device.kobj,
+                                &device->dev->dev.kobj, "device");
+                if (result)
+                        printk(KERN_ERR PREFIX "Create sysfs link\n");
+        }
+}
+
+static int acpi_video_bus_register_backlight(struct acpi_video_bus *video)
+{
+        struct acpi_video_device *dev;
+
+        mutex_lock(&video->device_list_lock);
+        list_for_each_entry(dev, &video->video_device_list, entry)
+                acpi_video_dev_register_backlight(dev);
+        mutex_unlock(&video->device_list_lock);
+
+        video->pm_nb.notifier_call = acpi_video_resume;
+        video->pm_nb.priority = 0;
+        return register_pm_notifier(&video->pm_nb);
+}
+
+static void acpi_video_dev_unregister_backlight(struct acpi_video_device *device)
+{
+        if (device->backlight) {
+                backlight_device_unregister(device->backlight);
+                device->backlight = NULL;
+        }
+        if (device->brightness) {
+                kfree(device->brightness->levels);
+                kfree(device->brightness);
+                device->brightness = NULL;
+        }
+        if (device->cooling_dev) {
+                sysfs_remove_link(&device->dev->dev.kobj, "thermal_cooling");
+                sysfs_remove_link(&device->cooling_dev->device.kobj, "device");
+                thermal_cooling_device_unregister(device->cooling_dev);
+                device->cooling_dev = NULL;
+        }
+}
+
+static int acpi_video_bus_unregister_backlight(struct acpi_video_bus *video)
+{
+        struct acpi_video_device *dev;
+        int error = unregister_pm_notifier(&video->pm_nb);
+
+        mutex_lock(&video->device_list_lock);
+        list_for_each_entry(dev, &video->video_device_list, entry)
+                acpi_video_dev_unregister_backlight(dev);
+        mutex_unlock(&video->device_list_lock);
+
+        return error;
+}
+
+static void acpi_video_dev_add_notify_handler(struct acpi_video_device *device)
+{
+        acpi_status status;
+        struct acpi_device *adev = device->dev;
+
+        status = acpi_install_notify_handler(adev->handle, ACPI_DEVICE_NOTIFY,
+                                             acpi_video_device_notify, device);
+        if (ACPI_FAILURE(status))
+                dev_err(&adev->dev, "Error installing notify handler\n");
+        else
+                device->flags.notify = 1;
+}
+
+static int acpi_video_bus_add_notify_handler(struct acpi_video_bus *video)
+{
+        struct input_dev *input;
+        struct acpi_video_device *dev;
+        int error;
+
+        video->input = input = input_allocate_device();
+        if (!input) {
+                error = -ENOMEM;
+                goto out;
+        }
+
+        error = acpi_video_bus_start_devices(video);
+        if (error)
+                goto err_free_input;
+
+        snprintf(video->phys, sizeof(video->phys),
+                        "%s/video/input0", acpi_device_hid(video->device));
+
+        input->name = acpi_device_name(video->device);
+        input->phys = video->phys;
+        input->id.bustype = BUS_HOST;
+        input->id.product = 0x06;
+        input->dev.parent = &video->device->dev;
+        input->evbit[0] = BIT(EV_KEY);
+        set_bit(KEY_SWITCHVIDEOMODE, input->keybit);
+        set_bit(KEY_VIDEO_NEXT, input->keybit);
+        set_bit(KEY_VIDEO_PREV, input->keybit);
+        set_bit(KEY_BRIGHTNESS_CYCLE, input->keybit);
+        set_bit(KEY_BRIGHTNESSUP, input->keybit);
+        set_bit(KEY_BRIGHTNESSDOWN, input->keybit);
+        set_bit(KEY_BRIGHTNESS_ZERO, input->keybit);
+        set_bit(KEY_DISPLAY_OFF, input->keybit);
+
+        error = input_register_device(input);
+        if (error)
+                goto err_stop_dev;
+
+        mutex_lock(&video->device_list_lock);
+        list_for_each_entry(dev, &video->video_device_list, entry)
+                acpi_video_dev_add_notify_handler(dev);
+        mutex_unlock(&video->device_list_lock);
+
+        return 0;
+
+err_stop_dev:
+        acpi_video_bus_stop_devices(video);
+err_free_input:
+        input_free_device(input);
+        video->input = NULL;
+out:
+        return error;
+}
+
+static void acpi_video_dev_remove_notify_handler(struct acpi_video_device *dev)
+{
+        if (dev->flags.notify) {
+                acpi_remove_notify_handler(dev->dev->handle, ACPI_DEVICE_NOTIFY,
+                                           acpi_video_device_notify);
+                dev->flags.notify = 0;
+        }
+}
+
+static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video)
+{
+        struct acpi_video_device *dev;
+
+        mutex_lock(&video->device_list_lock);
+        list_for_each_entry(dev, &video->video_device_list, entry)
+                acpi_video_dev_remove_notify_handler(dev);
+        mutex_unlock(&video->device_list_lock);
+
+        acpi_video_bus_stop_devices(video);
+        input_unregister_device(video->input);
+        video->input = NULL;
+}
+
+static int acpi_video_bus_put_devices(struct acpi_video_bus *video)
+{
+        struct acpi_video_device *dev, *next;
+
+        mutex_lock(&video->device_list_lock);
+        list_for_each_entry_safe(dev, next, &video->video_device_list, entry) {
+                list_del(&dev->entry);
+                kfree(dev);
+        }
+        mutex_unlock(&video->device_list_lock);
+
+        return 0;
+}
+
 static int instance;
 
 static int acpi_video_bus_add(struct acpi_device *device)
 {
         struct acpi_video_bus *video;
-        struct input_dev *input;
         int error;
         acpi_status status;
 
@@ -1748,62 +1852,24 @@ static int acpi_video_bus_add(struct acpi_device *device)
         if (error)
                 goto err_put_video;
 
-        video->input = input = input_allocate_device();
-        if (!input) {
-                error = -ENOMEM;
-                goto err_put_video;
-        }
-
-        error = acpi_video_bus_start_devices(video);
-        if (error)
-                goto err_free_input_dev;
-
-        snprintf(video->phys, sizeof(video->phys),
-                "%s/video/input0", acpi_device_hid(video->device));
-
-        input->name = acpi_device_name(video->device);
-        input->phys = video->phys;
-        input->id.bustype = BUS_HOST;
-        input->id.product = 0x06;
-        input->dev.parent = &device->dev;
-        input->evbit[0] = BIT(EV_KEY);
-        set_bit(KEY_SWITCHVIDEOMODE, input->keybit);
-        set_bit(KEY_VIDEO_NEXT, input->keybit);
-        set_bit(KEY_VIDEO_PREV, input->keybit);
-        set_bit(KEY_BRIGHTNESS_CYCLE, input->keybit);
-        set_bit(KEY_BRIGHTNESSUP, input->keybit);
-        set_bit(KEY_BRIGHTNESSDOWN, input->keybit);
-        set_bit(KEY_BRIGHTNESS_ZERO, input->keybit);
-        set_bit(KEY_DISPLAY_OFF, input->keybit);
-
         printk(KERN_INFO PREFIX "%s [%s] (multi-head: %s  rom: %s  post: %s)\n",
                ACPI_VIDEO_DEVICE_NAME, acpi_device_bid(device),
                video->flags.multihead ? "yes" : "no",
                video->flags.rom ? "yes" : "no",
                video->flags.post ? "yes" : "no");
+        mutex_lock(&video_list_lock);
+        list_add_tail(&video->entry, &video_bus_head);
+        mutex_unlock(&video_list_lock);
 
-        video->pm_nb.notifier_call = acpi_video_resume;
-        video->pm_nb.priority = 0;
-        error = register_pm_notifier(&video->pm_nb);
-        if (error)
-                goto err_stop_video;
-
-        error = input_register_device(input);
-        if (error)
-                goto err_unregister_pm_notifier;
+        acpi_video_bus_register_backlight(video);
+        acpi_video_bus_add_notify_handler(video);
 
         return 0;
 
- err_unregister_pm_notifier:
-        unregister_pm_notifier(&video->pm_nb);
- err_stop_video:
-        acpi_video_bus_stop_devices(video);
- err_free_input_dev:
-        input_free_device(input);
- err_put_video:
+err_put_video:
         acpi_video_bus_put_devices(video);
         kfree(video->attached_array);
- err_free_video:
+err_free_video:
         kfree(video);
         device->driver_data = NULL;
 
@@ -1820,12 +1886,14 @@ static int acpi_video_bus_remove(struct acpi_device *device)
 
         video = acpi_driver_data(device);
 
-        unregister_pm_notifier(&video->pm_nb);
-
-        acpi_video_bus_stop_devices(video);
+        acpi_video_bus_remove_notify_handler(video);
+        acpi_video_bus_unregister_backlight(video);
         acpi_video_bus_put_devices(video);
 
-        input_unregister_device(video->input);
+        mutex_lock(&video_list_lock);
+        list_del(&video->entry);
+        mutex_unlock(&video_list_lock);
+
         kfree(video->attached_array);
         kfree(video);
 
@@ -1874,6 +1942,9 @@ int acpi_video_register(void)
                 return 0;
         }
 
+        mutex_init(&video_list_lock);
+        INIT_LIST_HEAD(&video_bus_head);
+
         result = acpi_bus_register_driver(&acpi_video_bus);
         if (result < 0)
                 return -ENODEV;
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 940edbf2fe8f..84875fd4c74f 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -168,6 +168,14 @@ static struct dmi_system_id video_detect_dmi_table[] = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"),
                 },
         },
+        {
+        .callback = video_detect_force_vendor,
+        .ident = "Lenovo Yoga 13",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo IdeaPad Yoga 13"),
+                },
+        },
         { },
 };
 
@@ -233,11 +241,11 @@ static void acpi_video_caps_check(void)
                 acpi_video_get_capabilities(NULL);
 }
 
-bool acpi_video_backlight_quirks(void)
+bool acpi_osi_is_win8(void)
 {
         return acpi_gbl_osi_data >= ACPI_OSI_WIN_8;
 }
-EXPORT_SYMBOL(acpi_video_backlight_quirks);
+EXPORT_SYMBOL(acpi_osi_is_win8);
 
 /* Promote the vendor interface instead of the generic video module.
  * This function allow DMI blacklists to be implemented by externals
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 9d715ae5ff6b..8e28f923cf7f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1343,7 +1343,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                 host->flags |= ATA_HOST_PARALLEL_SCAN;
         else
-                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
+                dev_info(&pdev->dev, "SSS flag set, parallel bus scan disabled\n");
 
         if (pi.flags & ATA_FLAG_EM)
                 ahci_reset_em(host);
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 2daaee05cab1..7d3b85385bfc 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -184,7 +184,7 @@ static int ahci_probe(struct platform_device *pdev)
         if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                 host->flags |= ATA_HOST_PARALLEL_SCAN;
         else
-                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
+                dev_info(dev, "SSS flag set, parallel bus scan disabled\n");
 
         if (pi.flags & ATA_FLAG_EM)
                 ahci_reset_em(host);
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index acfd0f711069..aaac4fb0d564 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -778,8 +778,16 @@ static void ahci_start_port(struct ata_port *ap)
                                 rc = ap->ops->transmit_led_message(ap,
                                                                emp->led_state,
                                                                4);
+                                /*
+                                 * If busy, give a breather but do not
+                                 * release EH ownership by using msleep()
+                                 * instead of ata_msleep().  EM Transmit
+                                 * bit is busy for the whole host and
+                                 * releasing ownership will cause other
+                                 * ports to fail the same way.
+                                 */
                                 if (rc == -EBUSY)
-                                        ata_msleep(ap, 1);
+                                        msleep(1);
                                 else
                                         break;
                         }
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 4ba8b0405572..ab714d2ad978 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1035,17 +1035,3 @@ void ata_acpi_on_disable(struct ata_device *dev)
 {
         ata_acpi_clear_gtf(dev);
 }
-
-void ata_scsi_acpi_bind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_add_dependent(handle, &dev->sdev->sdev_gendev);
-}
-
-void ata_scsi_acpi_unbind(struct ata_device *dev)
-{
-        acpi_handle handle = ata_dev_acpi_handle(dev);
-        if (handle)
-                acpi_dev_pm_remove_dependent(handle, &dev->sdev->sdev_gendev);
-}
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c69fcce505c0..370462fa8e01 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1322,14 +1322,14 @@ void ata_eh_qc_complete(struct ata_queued_cmd *qc)
  *      should be retried.  To be used from EH.
  *
  *      SCSI midlayer limits the number of retries to scmd->allowed.
- *      scmd->retries is decremented for commands which get retried
+ *      scmd->allowed is incremented for commands which get retried
  *      due to unrelated failures (qc->err_mask is zero).
  */
 void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 {
         struct scsi_cmnd *scmd = qc->scsicmd;
-        if (!qc->err_mask && scmd->retries)
-                scmd->retries--;
+        if (!qc->err_mask)
+                scmd->allowed++;
         __ata_eh_qc_complete(qc);
 }
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 97a0cef12959..db6dfcfa3e2e 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3679,7 +3679,6 @@ void ata_scsi_scan_host(struct ata_port *ap, int sync)
                         if (!IS_ERR(sdev)) {
                                 dev->sdev = sdev;
                                 scsi_device_put(sdev);
-                                ata_scsi_acpi_bind(dev);
                         } else {
                                 dev->sdev = NULL;
                         }
@@ -3767,8 +3766,6 @@ static void ata_scsi_remove_dev(struct ata_device *dev)
         struct scsi_device *sdev;
         unsigned long flags;
 
-        ata_scsi_acpi_unbind(dev);
-
         /* Alas, we need to grab scan_mutex to ensure SCSI device
          * state doesn't change underneath us and thus
          * scsi_device_get() always succeeds.  The mutex locking can
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index eeeb77845d48..45b5ab3a95d5 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -121,8 +121,6 @@ extern void ata_acpi_set_state(struct ata_port *ap, pm_message_t state);
 extern void ata_acpi_bind_port(struct ata_port *ap);
 extern void ata_acpi_bind_dev(struct ata_device *dev);
 extern acpi_handle ata_dev_acpi_handle(struct ata_device *dev);
-extern void ata_scsi_acpi_bind(struct ata_device *dev);
-extern void ata_scsi_acpi_unbind(struct ata_device *dev);
 #else
 static inline void ata_acpi_dissociate(struct ata_host *host) { }
 static inline int ata_acpi_on_suspend(struct ata_port *ap) { return 0; }
@@ -133,8 +131,6 @@ static inline void ata_acpi_set_state(struct ata_port *ap,
                                       pm_message_t state) { }
 static inline void ata_acpi_bind_port(struct ata_port *ap) {}
 static inline void ata_acpi_bind_dev(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_bind(struct ata_device *dev) {}
-static inline void ata_scsi_acpi_unbind(struct ata_device *dev) {}
 #endif
 
 /* libata-scsi.c */
diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
index 4bceb8803a10..b33d1f99b3a4 100644
--- a/drivers/ata/pata_isapnp.c
+++ b/drivers/ata/pata_isapnp.c
@@ -78,7 +78,7 @@ static int isapnp_init_one(struct pnp_dev *idev, const struct pnp_device_id *dev
 
         ap->ioaddr.cmd_addr = cmd_addr;
 
-        if (pnp_port_valid(idev, 1) == 0) {
+        if (pnp_port_valid(idev, 1)) {
                 ctl_addr = devm_ioport_map(&idev->dev,
                                            pnp_port_start(idev, 1), 1);
                 ap->ioaddr.altstatus_addr = ctl_addr;
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 958ba2a420c3..97f4acb54ad6 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -2,7 +2,7 @@
  *  sata_promise.c - Promise SATA
  *
  *  Maintained by:  Tejun Heo <tj@kernel.org>
- *                  Mikael Pettersson <mikpe@it.uu.se>
+ *                  Mikael Pettersson
  *                  Please ALWAYS copy linux-ide@vger.kernel.org
  *                  on emails.
  *
diff --git a/drivers/base/core.c b/drivers/base/core.c
index c7cfadcf6752..34abf4d8a45f 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(device_move);
  */
 void device_shutdown(void)
 {
-        struct device *dev;
+        struct device *dev, *parent;
 
         spin_lock(&devices_kset->list_lock);
         /*
@@ -2034,7 +2034,7 @@ void device_shutdown(void)
                  * prevent it from being freed because parent's
                  * lock is to be held
                  */
-                get_device(dev->parent);
+                parent = get_device(dev->parent);
                 get_device(dev);
                 /*
                  * Make sure the device is off the kset list, in the
@@ -2044,8 +2044,8 @@ void device_shutdown(void)
                 spin_unlock(&devices_kset->list_lock);
 
                 /* hold lock to avoid race with probe/release */
-                if (dev->parent)
-                        device_lock(dev->parent);
+                if (parent)
+                        device_lock(parent);
                 device_lock(dev);
 
                 /* Don't allow any more runtime suspends */
@@ -2063,11 +2063,11 @@ void device_shutdown(void)
                 }
 
                 device_unlock(dev);
-                if (dev->parent)
-                        device_unlock(dev->parent);
+                if (parent)
+                        device_unlock(parent);
 
                 put_device(dev);
-                put_device(dev->parent);
+                put_device(parent);
 
                 spin_lock(&devices_kset->list_lock);
         }
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 35fa36898916..06051767393f 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -499,7 +499,7 @@ static void __device_release_driver(struct device *dev)
                                                      BUS_NOTIFY_UNBIND_DRIVER,
                                                      dev);
 
-                pm_runtime_put(dev);
+                pm_runtime_put_sync(dev);
 
                 if (dev->bus && dev->bus->remove)
                         dev->bus->remove(dev);
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 9e59f6535c44..bece691cb5d9 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -333,8 +333,10 @@ store_mem_state(struct device *dev,
                 online_type = ONLINE_KEEP;
         else if (!strncmp(buf, "offline", min_t(int, count, 7)))
                 online_type = -1;
-        else
-                return -EINVAL;
+        else {
+                ret = -EINVAL;
+                goto err;
+        }
 
         switch (online_type) {
         case ONLINE_KERNEL:
@@ -357,6 +359,7 @@ store_mem_state(struct device *dev,
                 ret = -EINVAL; /* should never happen */
         }
 
+err:
         unlock_device_hotplug();
 
         if (ret)
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 9f098a82cf04..ee039afe9078 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -30,6 +30,8 @@
 #include <linux/suspend.h>
 #include <trace/events/power.h>
 #include <linux/cpuidle.h>
+#include <linux/timer.h>
+
 #include "../base.h"
 #include "power.h"
 
@@ -390,6 +392,71 @@ static int dpm_run_callback(pm_callback_t cb, struct device *dev,
         return error;
 }
 
+#ifdef CONFIG_DPM_WATCHDOG
+struct dpm_watchdog {
+        struct device           *dev;
+        struct task_struct      *tsk;
+        struct timer_list       timer;
+};
+
+#define DECLARE_DPM_WATCHDOG_ON_STACK(wd) \
+        struct dpm_watchdog wd
+
+/**
+ * dpm_watchdog_handler - Driver suspend / resume watchdog handler.
+ * @data: Watchdog object address.
+ *
+ * Called when a driver has timed out suspending or resuming.
+ * There's not much we can do here to recover so panic() to
+ * capture a crash-dump in pstore.
+ */
+static void dpm_watchdog_handler(unsigned long data)
+{
+        struct dpm_watchdog *wd = (void *)data;
+
+        dev_emerg(wd->dev, "**** DPM device timeout ****\n");
+        show_stack(wd->tsk, NULL);
+        panic("%s %s: unrecoverable failure\n",
+                dev_driver_string(wd->dev), dev_name(wd->dev));
+}
+
+/**
+ * dpm_watchdog_set - Enable pm watchdog for given device.
+ * @wd: Watchdog. Must be allocated on the stack.
+ * @dev: Device to handle.
+ */
+static void dpm_watchdog_set(struct dpm_watchdog *wd, struct device *dev)
+{
+        struct timer_list *timer = &wd->timer;
+
+        wd->dev = dev;
+        wd->tsk = current;
+
+        init_timer_on_stack(timer);
+        /* use same timeout value for both suspend and resume */
+        timer->expires = jiffies + HZ * CONFIG_DPM_WATCHDOG_TIMEOUT;
+        timer->function = dpm_watchdog_handler;
+        timer->data = (unsigned long)wd;
+        add_timer(timer);
+}
+
+/**
+ * dpm_watchdog_clear - Disable suspend/resume watchdog.
+ * @wd: Watchdog to disable.
+ */
+static void dpm_watchdog_clear(struct dpm_watchdog *wd)
+{
+        struct timer_list *timer = &wd->timer;
+
+        del_timer_sync(timer);
+        destroy_timer_on_stack(timer);
+}
+#else
+#define DECLARE_DPM_WATCHDOG_ON_STACK(wd)
+#define dpm_watchdog_set(x, y)
+#define dpm_watchdog_clear(x)
+#endif
+
 /*------------------------- Resume routines -------------------------*/
 
 /**
@@ -576,6 +643,7 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
         pm_callback_t callback = NULL;
         char *info = NULL;
         int error = 0;
+        DECLARE_DPM_WATCHDOG_ON_STACK(wd);
 
         TRACE_DEVICE(dev);
         TRACE_RESUME(0);
@@ -584,6 +652,7 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
                 goto Complete;
 
         dpm_wait(dev->parent, async);
+        dpm_watchdog_set(&wd, dev);
         device_lock(dev);
 
         /*
@@ -642,6 +711,7 @@ static int device_resume(struct device *dev, pm_message_t state, bool async)
 
  Unlock:
         device_unlock(dev);
+        dpm_watchdog_clear(&wd);
 
  Complete:
         complete_all(&dev->power.completion);
@@ -1060,6 +1130,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
         pm_callback_t callback = NULL;
         char *info = NULL;
         int error = 0;
+        DECLARE_DPM_WATCHDOG_ON_STACK(wd);
 
         dpm_wait_for_children(dev, async);
 
@@ -1083,6 +1154,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
         if (dev->power.syscore)
                 goto Complete;
 
+        dpm_watchdog_set(&wd, dev);
         device_lock(dev);
 
         if (dev->pm_domain) {
@@ -1139,6 +1211,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
         }
 
         device_unlock(dev);
+        dpm_watchdog_clear(&wd);
 
  Complete:
         complete_all(&dev->power.completion);
diff --git a/drivers/base/power/opp.c b/drivers/base/power/opp.c
index ef89897c6043..fa4187418440 100644
--- a/drivers/base/power/opp.c
+++ b/drivers/base/power/opp.c
@@ -21,7 +21,7 @@
 #include <linux/list.h>
 #include <linux/rculist.h>
 #include <linux/rcupdate.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/of.h>
 #include <linux/export.h>
 
@@ -42,7 +42,7 @@
  */
 
 /**
- * struct opp - Generic OPP description structure
+ * struct dev_pm_opp - Generic OPP description structure
  * @node:       opp list node. The nodes are maintained throughout the lifetime
  *              of boot. It is expected only an optimal set of OPPs are
  *              added to the library by the SoC framework.
@@ -59,7 +59,7 @@
  *
  * This structure stores the OPP information for a given device.
  */
-struct opp {
+struct dev_pm_opp {
         struct list_head node;
 
         bool available;
@@ -136,7 +136,7 @@ static struct device_opp *find_device_opp(struct device *dev)
 }
 
 /**
- * opp_get_voltage() - Gets the voltage corresponding to an available opp
+ * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an available opp
  * @opp:        opp for which voltage has to be returned for
  *
  * Return voltage in micro volt corresponding to the opp, else
@@ -150,9 +150,9 @@ static struct device_opp *find_device_opp(struct device *dev)
  * prior to unlocking with rcu_read_unlock() to maintain the integrity of the
  * pointer.
  */
-unsigned long opp_get_voltage(struct opp *opp)
+unsigned long dev_pm_opp_get_voltage(struct dev_pm_opp *opp)
 {
-        struct opp *tmp_opp;
+        struct dev_pm_opp *tmp_opp;
         unsigned long v = 0;
 
         tmp_opp = rcu_dereference(opp);
@@ -163,10 +163,10 @@ unsigned long opp_get_voltage(struct opp *opp)
 
         return v;
 }
-EXPORT_SYMBOL_GPL(opp_get_voltage);
+EXPORT_SYMBOL_GPL(dev_pm_opp_get_voltage);
 
 /**
- * opp_get_freq() - Gets the frequency corresponding to an available opp
+ * dev_pm_opp_get_freq() - Gets the frequency corresponding to an available opp
  * @opp:        opp for which frequency has to be returned for
  *
  * Return frequency in hertz corresponding to the opp, else
@@ -180,9 +180,9 @@ EXPORT_SYMBOL_GPL(opp_get_voltage);
  * prior to unlocking with rcu_read_unlock() to maintain the integrity of the
  * pointer.
  */
-unsigned long opp_get_freq(struct opp *opp)
+unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
 {
-        struct opp *tmp_opp;
+        struct dev_pm_opp *tmp_opp;
         unsigned long f = 0;
 
         tmp_opp = rcu_dereference(opp);
@@ -193,10 +193,10 @@ unsigned long opp_get_freq(struct opp *opp)
 
         return f;
 }
-EXPORT_SYMBOL_GPL(opp_get_freq);
+EXPORT_SYMBOL_GPL(dev_pm_opp_get_freq);
 
 /**
- * opp_get_opp_count() - Get number of opps available in the opp list
+ * dev_pm_opp_get_opp_count() - Get number of opps available in the opp list
  * @dev:        device for which we do this operation
  *
  * This function returns the number of available opps if there are any,
@@ -206,10 +206,10 @@ EXPORT_SYMBOL_GPL(opp_get_freq);
  * internally references two RCU protected structures: device_opp and opp which
  * are safe as long as we are under a common RCU locked section.
  */
-int opp_get_opp_count(struct device *dev)
+int dev_pm_opp_get_opp_count(struct device *dev)
 {
         struct device_opp *dev_opp;
-        struct opp *temp_opp;
+        struct dev_pm_opp *temp_opp;
         int count = 0;
 
         dev_opp = find_device_opp(dev);
@@ -226,10 +226,10 @@ int opp_get_opp_count(struct device *dev)
 
         return count;
 }
-EXPORT_SYMBOL_GPL(opp_get_opp_count);
+EXPORT_SYMBOL_GPL(dev_pm_opp_get_opp_count);
 
 /**
- * opp_find_freq_exact() - search for an exact frequency
+ * dev_pm_opp_find_freq_exact() - search for an exact frequency
  * @dev:                device for which we do this operation
  * @freq:               frequency to search for
  * @available:          true/false - match for available opp
@@ -254,11 +254,12 @@ EXPORT_SYMBOL_GPL(opp_get_opp_count);
  * under the locked area. The pointer returned must be used prior to unlocking
  * with rcu_read_unlock() to maintain the integrity of the pointer.
  */
-struct opp *opp_find_freq_exact(struct device *dev, unsigned long freq,
-                                bool available)
+struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+                                              unsigned long freq,
+                                              bool available)
 {
         struct device_opp *dev_opp;
-        struct opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
 
         dev_opp = find_device_opp(dev);
         if (IS_ERR(dev_opp)) {
@@ -277,10 +278,10 @@ struct opp *opp_find_freq_exact(struct device *dev, unsigned long freq,
 
         return opp;
 }
-EXPORT_SYMBOL_GPL(opp_find_freq_exact);
+EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact);
 
 /**
- * opp_find_freq_ceil() - Search for an rounded ceil freq
+ * dev_pm_opp_find_freq_ceil() - Search for an rounded ceil freq
  * @dev:        device for which we do this operation
  * @freq:       Start frequency
  *
@@ -300,10 +301,11 @@ EXPORT_SYMBOL_GPL(opp_find_freq_exact);
  * under the locked area. The pointer returned must be used prior to unlocking
  * with rcu_read_unlock() to maintain the integrity of the pointer.
  */
-struct opp *opp_find_freq_ceil(struct device *dev, unsigned long *freq)
+struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+                                             unsigned long *freq)
 {
         struct device_opp *dev_opp;
-        struct opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
 
         if (!dev || !freq) {
                 dev_err(dev, "%s: Invalid argument freq=%p\n", __func__, freq);
@@ -324,10 +326,10 @@ struct opp *opp_find_freq_ceil(struct device *dev, unsigned long *freq)
 
         return opp;
 }
-EXPORT_SYMBOL_GPL(opp_find_freq_ceil);
+EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil);
 
 /**
- * opp_find_freq_floor() - Search for a rounded floor freq
+ * dev_pm_opp_find_freq_floor() - Search for a rounded floor freq
  * @dev:        device for which we do this operation
  * @freq:       Start frequency
  *
@@ -347,10 +349,11 @@ EXPORT_SYMBOL_GPL(opp_find_freq_ceil);
  * under the locked area. The pointer returned must be used prior to unlocking
  * with rcu_read_unlock() to maintain the integrity of the pointer.
  */
-struct opp *opp_find_freq_floor(struct device *dev, unsigned long *freq)
+struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+                                              unsigned long *freq)
 {
         struct device_opp *dev_opp;
-        struct opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+        struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
 
         if (!dev || !freq) {
                 dev_err(dev, "%s: Invalid argument freq=%p\n", __func__, freq);
@@ -375,17 +378,17 @@ struct opp *opp_find_freq_floor(struct device *dev, unsigned long *freq)
 
         return opp;
 }
-EXPORT_SYMBOL_GPL(opp_find_freq_floor);
+EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor);
 
 /**
- * opp_add()  - Add an OPP table from a table definitions
+ * dev_pm_opp_add()  - Add an OPP table from a table definitions
  * @dev:        device for which we do this operation
  * @freq:       Frequency in Hz for this OPP
  * @u_volt:     Voltage in uVolts for this OPP
  *
  * This function adds an opp definition to the opp list and returns status.
  * The opp is made available by default and it can be controlled using
- * opp_enable/disable functions.
+ * dev_pm_opp_enable/disable functions.
  *
  * Locking: The internal device_opp and opp structures are RCU protected.
  * Hence this function internally uses RCU updater strategy with mutex locks
@@ -393,14 +396,14 @@ EXPORT_SYMBOL_GPL(opp_find_freq_floor);
  * that this function is *NOT* called under RCU protection or in contexts where
  * mutex cannot be locked.
  */
-int opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
+int dev_pm_opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
 {
         struct device_opp *dev_opp = NULL;
-        struct opp *opp, *new_opp;
+        struct dev_pm_opp *opp, *new_opp;
         struct list_head *head;
 
         /* allocate new OPP node */
-        new_opp = kzalloc(sizeof(struct opp), GFP_KERNEL);
+        new_opp = kzalloc(sizeof(*new_opp), GFP_KERNEL);
         if (!new_opp) {
                 dev_warn(dev, "%s: Unable to create new OPP node\n", __func__);
                 return -ENOMEM;
@@ -460,7 +463,7 @@ int opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
         srcu_notifier_call_chain(&dev_opp->head, OPP_EVENT_ADD, new_opp);
         return 0;
 }
-EXPORT_SYMBOL_GPL(opp_add);
+EXPORT_SYMBOL_GPL(dev_pm_opp_add);
 
 /**
  * opp_set_availability() - helper to set the availability of an opp
@@ -485,11 +488,11 @@ static int opp_set_availability(struct device *dev, unsigned long freq,
                 bool availability_req)
 {
         struct device_opp *tmp_dev_opp, *dev_opp = ERR_PTR(-ENODEV);
-        struct opp *new_opp, *tmp_opp, *opp = ERR_PTR(-ENODEV);
+        struct dev_pm_opp *new_opp, *tmp_opp, *opp = ERR_PTR(-ENODEV);
         int r = 0;
 
         /* keep the node allocated */
-        new_opp = kmalloc(sizeof(struct opp), GFP_KERNEL);
+        new_opp = kmalloc(sizeof(*new_opp), GFP_KERNEL);
         if (!new_opp) {
                 dev_warn(dev, "%s: Unable to create OPP\n", __func__);
                 return -ENOMEM;
@@ -552,13 +555,13 @@ unlock:
 }
 
 /**
- * opp_enable() - Enable a specific OPP
+ * dev_pm_opp_enable() - Enable a specific OPP
  * @dev:        device for which we do this operation
  * @freq:       OPP frequency to enable
  *
  * Enables a provided opp. If the operation is valid, this returns 0, else the
  * corresponding error value. It is meant to be used for users an OPP available
- * after being temporarily made unavailable with opp_disable.
+ * after being temporarily made unavailable with dev_pm_opp_disable.
  *
  * Locking: The internal device_opp and opp structures are RCU protected.
  * Hence this function indirectly uses RCU and mutex locks to keep the
@@ -566,21 +569,21 @@ unlock:
  * this function is *NOT* called under RCU protection or in contexts where
  * mutex locking or synchronize_rcu() blocking calls cannot be used.
  */
-int opp_enable(struct device *dev, unsigned long freq)
+int dev_pm_opp_enable(struct device *dev, unsigned long freq)
 {
         return opp_set_availability(dev, freq, true);
 }
-EXPORT_SYMBOL_GPL(opp_enable);
+EXPORT_SYMBOL_GPL(dev_pm_opp_enable);
 
 /**
- * opp_disable() - Disable a specific OPP
+ * dev_pm_opp_disable() - Disable a specific OPP
  * @dev:        device for which we do this operation
  * @freq:       OPP frequency to disable
  *
  * Disables a provided opp. If the operation is valid, this returns
  * 0, else the corresponding error value. It is meant to be a temporary
  * control by users to make this OPP not available until the circumstances are
- * right to make it available again (with a call to opp_enable).
+ * right to make it available again (with a call to dev_pm_opp_enable).
  *
  * Locking: The internal device_opp and opp structures are RCU protected.
  * Hence this function indirectly uses RCU and mutex locks to keep the
@@ -588,15 +591,15 @@ EXPORT_SYMBOL_GPL(opp_enable);
  * this function is *NOT* called under RCU protection or in contexts where
  * mutex locking or synchronize_rcu() blocking calls cannot be used.
  */
-int opp_disable(struct device *dev, unsigned long freq)
+int dev_pm_opp_disable(struct device *dev, unsigned long freq)
 {
         return opp_set_availability(dev, freq, false);
 }
-EXPORT_SYMBOL_GPL(opp_disable);
+EXPORT_SYMBOL_GPL(dev_pm_opp_disable);
 
 #ifdef CONFIG_CPU_FREQ
 /**
- * opp_init_cpufreq_table() - create a cpufreq table for a device
+ * dev_pm_opp_init_cpufreq_table() - create a cpufreq table for a device
  * @dev:        device for which we do this operation
  * @table:      Cpufreq table returned back to caller
  *
@@ -619,11 +622,11 @@ EXPORT_SYMBOL_GPL(opp_disable);
  * Callers should ensure that this function is *NOT* called under RCU protection
  * or in contexts where mutex locking cannot be used.
  */
-int opp_init_cpufreq_table(struct device *dev,
+int dev_pm_opp_init_cpufreq_table(struct device *dev,
                             struct cpufreq_frequency_table **table)
 {
         struct device_opp *dev_opp;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         struct cpufreq_frequency_table *freq_table;
         int i = 0;
 
@@ -639,7 +642,7 @@ int opp_init_cpufreq_table(struct device *dev,
         }
 
         freq_table = kzalloc(sizeof(struct cpufreq_frequency_table) *
-                             (opp_get_opp_count(dev) + 1), GFP_KERNEL);
+                             (dev_pm_opp_get_opp_count(dev) + 1), GFP_KERNEL);
         if (!freq_table) {
                 mutex_unlock(&dev_opp_list_lock);
                 dev_warn(dev, "%s: Unable to allocate frequency table\n",
@@ -663,16 +666,16 @@ int opp_init_cpufreq_table(struct device *dev,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(opp_init_cpufreq_table);
+EXPORT_SYMBOL_GPL(dev_pm_opp_init_cpufreq_table);
 
 /**
- * opp_free_cpufreq_table() - free the cpufreq table
+ * dev_pm_opp_free_cpufreq_table() - free the cpufreq table
  * @dev:        device for which we do this operation
  * @table:      table to free
  *
- * Free up the table allocated by opp_init_cpufreq_table
+ * Free up the table allocated by dev_pm_opp_init_cpufreq_table
  */
-void opp_free_cpufreq_table(struct device *dev,
+void dev_pm_opp_free_cpufreq_table(struct device *dev,
                                 struct cpufreq_frequency_table **table)
 {
         if (!table)
@@ -681,14 +684,14 @@ void opp_free_cpufreq_table(struct device *dev,
         kfree(*table);
         *table = NULL;
 }
-EXPORT_SYMBOL_GPL(opp_free_cpufreq_table);
+EXPORT_SYMBOL_GPL(dev_pm_opp_free_cpufreq_table);
 #endif          /* CONFIG_CPU_FREQ */
 
 /**
- * opp_get_notifier() - find notifier_head of the device with opp
+ * dev_pm_opp_get_notifier() - find notifier_head of the device with opp
  * @dev:        device pointer used to lookup device OPPs.
  */
-struct srcu_notifier_head *opp_get_notifier(struct device *dev)
+struct srcu_notifier_head *dev_pm_opp_get_notifier(struct device *dev)
 {
         struct device_opp *dev_opp = find_device_opp(dev);
 
@@ -732,7 +735,7 @@ int of_init_opp_table(struct device *dev)
                 unsigned long freq = be32_to_cpup(val++) * 1000;
                 unsigned long volt = be32_to_cpup(val++);
 
-                if (opp_add(dev, freq, volt)) {
+                if (dev_pm_opp_add(dev, freq, volt)) {
                         dev_warn(dev, "%s: Failed to add OPP %ld\n",
                                  __func__, freq);
                         continue;
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 268a35097578..72e00e66ecc5 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -258,7 +258,8 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
  * Check if the device's runtime PM status allows it to be suspended.  If
  * another idle notification has been started earlier, return immediately.  If
  * the RPM_ASYNC flag is set then queue an idle-notification request; otherwise
- * run the ->runtime_idle() callback directly.
+ * run the ->runtime_idle() callback directly. If the ->runtime_idle callback
+ * doesn't exist or if it returns 0, call rpm_suspend with the RPM_AUTO flag.
  *
  * This function must be called under dev->power.lock with interrupts disabled.
  */
@@ -331,7 +332,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
 
  out:
         trace_rpm_return_int(dev, _THIS_IP_, retval);
-        return retval ? retval : rpm_suspend(dev, rpmflags);
+        return retval ? retval : rpm_suspend(dev, rpmflags | RPM_AUTO);
 }
 
 /**
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index c9fd6943ce45..50329d1057ed 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -210,25 +210,6 @@ static void bcma_core_pci_config_fixup(struct bcma_drv_pci *pc)
         }
 }
 
-static void bcma_core_pci_power_save(struct bcma_drv_pci *pc, bool up)
-{
-        u16 data;
-
-        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
-                data = up ? 0x74 : 0x7C;
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
-        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
-                data = up ? 0x75 : 0x7D;
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
-                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
-                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
-        }
-}
-
 /**************************************************
  * Init.
  **************************************************/
@@ -255,6 +236,32 @@ void bcma_core_pci_init(struct bcma_drv_pci *pc)
                 bcma_core_pci_clientmode_init(pc);
 }
 
+void bcma_core_pci_power_save(struct bcma_bus *bus, bool up)
+{
+        struct bcma_drv_pci *pc;
+        u16 data;
+
+        if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+                return;
+
+        pc = &bus->drv_pci[0];
+
+        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
+                data = up ? 0x74 : 0x7C;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
+                data = up ? 0x75 : 0x7D;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        }
+}
+EXPORT_SYMBOL_GPL(bcma_core_pci_power_save);
+
 int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
                           bool enable)
 {
@@ -310,8 +317,6 @@ void bcma_core_pci_up(struct bcma_bus *bus)
 
         pc = &bus->drv_pci[0];
 
-        bcma_core_pci_power_save(pc, true);
-
         bcma_core_pci_extend_L1timer(pc, true);
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_up);
@@ -326,7 +331,5 @@ void bcma_core_pci_down(struct bcma_bus *bus)
         pc = &bus->drv_pci[0];
 
         bcma_core_pci_extend_L1timer(pc, false);
-
-        bcma_core_pci_power_save(pc, false);
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_down);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index d2d95ff5353b..edfa2515bc86 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1189,6 +1189,7 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
         int err;
         u32 cp;
 
+        memset(&arg64, 0, sizeof(arg64));
         err = 0;
         err |=
             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 639d26b90b91..2b9440384536 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -1193,6 +1193,7 @@ out_passthru:
                 ida_pci_info_struct pciinfo;
 
                 if (!arg) return -EINVAL;
+                memset(&pciinfo, 0, sizeof(pciinfo));
                 pciinfo.bus = host->pci_dev->bus->number;
                 pciinfo.dev_fn = host->pci_dev->devfn;
                 pciinfo.board_id = host->board_id;
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a12b923bbaca..0a327f4154a2 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -85,6 +85,7 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x04CA, 0x3008) },
         { USB_DEVICE(0x13d3, 0x3362) },
         { USB_DEVICE(0x0CF3, 0xE004) },
+        { USB_DEVICE(0x0CF3, 0xE005) },
         { USB_DEVICE(0x0930, 0x0219) },
         { USB_DEVICE(0x0489, 0xe057) },
         { USB_DEVICE(0x13d3, 0x3393) },
@@ -126,6 +127,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8e16f0af6358..f3dfc0a88fdc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0b05, 0x17b5) },
+        { USB_DEVICE(0x0b05, 0x17cb) },
         { USB_DEVICE(0x04ca, 0x2003) },
         { USB_DEVICE(0x0489, 0xe042) },
         { USB_DEVICE(0x413c, 0x8197) },
@@ -112,6 +113,9 @@ static struct usb_device_id btusb_table[] = {
         /*Broadcom devices with vendor specific id */
         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
 
+        /* Belkin F8065bf - Broadcom based */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
+
         { }     /* Terminating entry */
 };
 
@@ -148,6 +152,7 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index 19ab6ff53d59..2394e9753ef5 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -700,6 +700,7 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus,
                                          phys_addr_t sdramwins_phys_base,
                                          size_t sdramwins_size)
 {
+        struct device_node *np;
         int win;
 
         mbus->mbuswins_base = ioremap(mbuswins_phys_base, mbuswins_size);
@@ -712,8 +713,11 @@ static int __init mvebu_mbus_common_init(struct mvebu_mbus_state *mbus,
                 return -ENOMEM;
         }
 
-        if (of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric"))
+        np = of_find_compatible_node(NULL, NULL, "marvell,coherency-fabric");
+        if (np) {
                 mbus->hw_io_coherency = 1;
+                of_node_put(np);
+        }
 
         for (win = 0; win < mbus->soc->num_wins; win++)
                 mvebu_mbus_disable_window(mbus, win);
@@ -861,11 +865,13 @@ static void __init mvebu_mbus_get_pcie_resources(struct device_node *np,
         int ret;
 
         /*
-         * These are optional, so we clear them and they'll
-         * be zero if they are missing from the DT.
+         * These are optional, so we make sure that resource_size(x) will
+         * return 0.
          */
         memset(mem, 0, sizeof(struct resource));
+        mem->end = -1;
         memset(io, 0, sizeof(struct resource));
+        io->end = -1;
 
         ret = of_property_read_u32_array(np, "pcie-mem-aperture", reg, ARRAY_SIZE(reg));
         if (!ret) {
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 7737b5bd26af..7a744d391756 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -640,7 +640,7 @@ struct timer_rand_state {
  */
 void add_device_randomness(const void *buf, unsigned int size)
 {
-        unsigned long time = get_cycles() ^ jiffies;
+        unsigned long time = random_get_entropy() ^ jiffies;
 
         mix_pool_bytes(&input_pool, buf, size, NULL);
         mix_pool_bytes(&input_pool, &time, sizeof(time), NULL);
@@ -677,7 +677,7 @@ static void add_timer_randomness(struct timer_rand_state *state, unsigned num)
                 goto out;
 
         sample.jiffies = jiffies;
-        sample.cycles = get_cycles();
+        sample.cycles = random_get_entropy();
         sample.num = num;
         mix_pool_bytes(&input_pool, &sample, sizeof(sample), NULL);
 
@@ -744,7 +744,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
         struct fast_pool        *fast_pool = &__get_cpu_var(irq_randomness);
         struct pt_regs          *regs = get_irq_regs();
         unsigned long           now = jiffies;
-        __u32                   input[4], cycles = get_cycles();
+        __u32                   input[4], cycles = random_get_entropy();
 
         input[0] = cycles ^ jiffies;
         input[1] = irq;
@@ -1459,12 +1459,11 @@ struct ctl_table random_table[] = {
 
 static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
 
-static int __init random_int_secret_init(void)
+int random_int_secret_init(void)
 {
         get_random_bytes(random_int_secret, sizeof(random_int_secret));
         return 0;
 }
-late_initcall(random_int_secret_init);
 
 /*
  * Get a random word for internal kernel use only. Similar to urandom but
@@ -1483,7 +1482,7 @@ unsigned int get_random_int(void)
 
         hash = get_cpu_var(get_random_int_hash);
 
-        hash[0] += current->pid + jiffies + get_cycles();
+        hash[0] += current->pid + jiffies + random_get_entropy();
         md5_transform(hash, random_int_secret);
         ret = hash[0];
         put_cpu_var(get_random_int_hash);
diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
index 7a7929ba2658..94c280d36e8b 100644
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
+#include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/interface/io/tpmif.h>
 #include <xen/grant_table.h>
@@ -142,32 +143,6 @@ static int vtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
         return length;
 }
 
-ssize_t tpm_show_locality(struct device *dev, struct device_attribute *attr,
-                          char *buf)
-{
-        struct tpm_chip *chip = dev_get_drvdata(dev);
-        struct tpm_private *priv = TPM_VPRIV(chip);
-        u8 locality = priv->shr->locality;
-
-        return sprintf(buf, "%d\n", locality);
-}
-
-ssize_t tpm_store_locality(struct device *dev, struct device_attribute *attr,
-                        const char *buf, size_t len)
-{
-        struct tpm_chip *chip = dev_get_drvdata(dev);
-        struct tpm_private *priv = TPM_VPRIV(chip);
-        u8 val;
-
-        int rv = kstrtou8(buf, 0, &val);
-        if (rv)
-                return rv;
-
-        priv->shr->locality = val;
-
-        return len;
-}
-
 static const struct file_operations vtpm_ops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
@@ -188,8 +163,6 @@ static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
-static DEVICE_ATTR(locality, S_IRUGO | S_IWUSR, tpm_show_locality,
-                tpm_store_locality);
 
 static struct attribute *vtpm_attrs[] = {
         &dev_attr_pubek.attr,
@@ -202,7 +175,6 @@ static struct attribute *vtpm_attrs[] = {
         &dev_attr_cancel.attr,
         &dev_attr_durations.attr,
         &dev_attr_timeouts.attr,
-        &dev_attr_locality.attr,
         NULL,
 };
 
@@ -210,8 +182,6 @@ static struct attribute_group vtpm_attr_grp = {
         .attrs = vtpm_attrs,
 };
 
-#define TPM_LONG_TIMEOUT   (10 * 60 * HZ)
-
 static const struct tpm_vendor_specific tpm_vtpm = {
         .status = vtpm_status,
         .recv = vtpm_recv,
@@ -224,11 +194,6 @@ static const struct tpm_vendor_specific tpm_vtpm = {
         .miscdev = {
                 .fops = &vtpm_ops,
         },
-        .duration = {
-                TPM_LONG_TIMEOUT,
-                TPM_LONG_TIMEOUT,
-                TPM_LONG_TIMEOUT,
-        },
 };
 
 static irqreturn_t tpmif_interrupt(int dummy, void *dev_id)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 41c69469ce20..971d796e071d 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -26,6 +26,7 @@ config DW_APB_TIMER_OF
 
 config ARMADA_370_XP_TIMER
         bool
+        select CLKSRC_OF
 
 config ORION_TIMER
         select CLKSRC_OF
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index 37f5325bec95..b9ddd9e3a2f5 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -30,6 +30,9 @@ void __init clocksource_of_init(void)
         clocksource_of_init_fn init_func;
 
         for_each_matching_node_and_match(np, __clksrc_of_table, &match) {
+                if (!of_device_is_available(np))
+                        continue;
+
                 init_func = match->data;
                 init_func(np);
         }
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index b9c81b7c3a3b..3a5909c12d42 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -301,7 +301,7 @@ static void em_sti_register_clockevent(struct em_sti_priv *p)
         ced->name = dev_name(&p->pdev->dev);
         ced->features = CLOCK_EVT_FEAT_ONESHOT;
         ced->rating = 200;
-        ced->cpumask = cpumask_of(0);
+        ced->cpumask = cpu_possible_mask;
         ced->set_next_event = em_sti_clock_event_next;
         ced->set_mode = em_sti_clock_event_mode;
 
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index 5b34768f4d7c..62b0de6a1837 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -428,7 +428,6 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
                                 evt->irq);
                         return -EIO;
                 }
-                irq_set_affinity(evt->irq, cpumask_of(cpu));
         } else {
                 enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
         }
@@ -449,6 +448,7 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                                            unsigned long action, void *hcpu)
 {
         struct mct_clock_event_device *mevt;
+        unsigned int cpu;
 
         /*
          * Grab cpu pointer in each case to avoid spurious
@@ -459,6 +459,12 @@ static int exynos4_mct_cpu_notify(struct notifier_block *self,
                 mevt = this_cpu_ptr(&percpu_mct_tick);
                 exynos4_local_timer_setup(&mevt->evt);
                 break;
+        case CPU_ONLINE:
+                cpu = (unsigned long)hcpu;
+                if (mct_int_type == MCT_INT_SPI)
+                        irq_set_affinity(mct_irqs[MCT_L0_IRQ + cpu],
+                                                cpumask_of(cpu));
+                break;
         case CPU_DYING:
                 mevt = this_cpu_ptr(&percpu_mct_tick);
                 exynos4_local_timer_stop(&mevt->evt);
@@ -500,6 +506,8 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
                                          &percpu_mct_tick);
                 WARN(err, "MCT: can't request IRQ %d (%d)\n",
                      mct_irqs[MCT_L0_IRQ], err);
+        } else {
+                irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
         }
 
         err = register_cpu_notifier(&exynos4_mct_cpu_nb);
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 08ae128cce9b..c73fc2b74de2 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -65,6 +65,7 @@ void proc_fork_connector(struct task_struct *task)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -80,6 +81,7 @@ void proc_fork_connector(struct task_struct *task)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         /*  If cn_netlink_send() failed, the data is not sent */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
@@ -96,6 +98,7 @@ void proc_exec_connector(struct task_struct *task)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -106,6 +109,7 @@ void proc_exec_connector(struct task_struct *task)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -122,6 +126,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         ev->what = which_id;
         ev->event_data.id.process_pid = task->pid;
         ev->event_data.id.process_tgid = task->tgid;
@@ -145,6 +150,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -160,6 +166,7 @@ void proc_sid_connector(struct task_struct *task)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -170,6 +177,7 @@ void proc_sid_connector(struct task_struct *task)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -185,6 +193,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -203,6 +212,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -218,6 +228,7 @@ void proc_comm_connector(struct task_struct *task)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -229,6 +240,7 @@ void proc_comm_connector(struct task_struct *task)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -244,6 +256,7 @@ void proc_coredump_connector(struct task_struct *task)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -254,6 +267,7 @@ void proc_coredump_connector(struct task_struct *task)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -269,6 +283,7 @@ void proc_exit_connector(struct task_struct *task)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         get_seq(&msg->seq, &ev->cpu);
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -281,6 +296,7 @@ void proc_exit_connector(struct task_struct *task)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
@@ -304,6 +320,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
 
         msg = (struct cn_msg *)buffer;
         ev = (struct proc_event *)msg->data;
+        memset(&ev->event_data, 0, sizeof(ev->event_data));
         msg->seq = rcvd_seq;
         ktime_get_ts(&ts); /* get high res monotonic timestamp */
         put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
@@ -313,6 +330,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = rcvd_ack + 1;
         msg->len = sizeof(*ev);
+        msg->flags = 0; /* not used */
         cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
 }
 
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 6ecfa758942c..a36749f1e44a 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -109,7 +109,7 @@ int cn_netlink_send(struct cn_msg *msg, u32 __group, gfp_t gfp_mask)
 
         data = nlmsg_data(nlh);
 
-        memcpy(data, msg, sizeof(*data) + msg->len);
+        memcpy(data, msg, size);
 
         NETLINK_CB(skb).dst_group = group;
 
@@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb)
 static void cn_rx_skb(struct sk_buff *__skb)
 {
         struct nlmsghdr *nlh;
-        int err;
         struct sk_buff *skb;
+        int len, err;
 
         skb = skb_get(__skb);
 
         if (skb->len >= NLMSG_HDRLEN) {
                 nlh = nlmsg_hdr(skb);
+                len = nlmsg_len(nlh);
 
-                if (nlh->nlmsg_len < sizeof(struct cn_msg) ||
+                if (len < (int)sizeof(struct cn_msg) ||
                     skb->len < nlh->nlmsg_len ||
-                    nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) {
+                    len > CONNECTOR_MAX_MSG_SIZE) {
                         kfree_skb(skb);
                         return;
                 }
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 534fcb825153..38093e272377 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -17,15 +17,11 @@ config CPU_FREQ
 
 if CPU_FREQ
 
-config CPU_FREQ_TABLE
-        tristate
-
 config CPU_FREQ_GOV_COMMON
         bool
 
 config CPU_FREQ_STAT
         tristate "CPU frequency translation statistics"
-        select CPU_FREQ_TABLE
         default y
         help
           This driver exports CPU frequency statistics information through sysfs
@@ -143,7 +139,6 @@ config CPU_FREQ_GOV_USERSPACE
 
 config CPU_FREQ_GOV_ONDEMAND
         tristate "'ondemand' cpufreq policy governor"
-        select CPU_FREQ_TABLE
         select CPU_FREQ_GOV_COMMON
         help
           'ondemand' - This driver adds a dynamic cpufreq policy governor.
@@ -187,7 +182,6 @@ config CPU_FREQ_GOV_CONSERVATIVE
 config GENERIC_CPUFREQ_CPU0
         tristate "Generic CPU0 cpufreq driver"
         depends on HAVE_CLK && REGULATOR && PM_OPP && OF
-        select CPU_FREQ_TABLE
         help
           This adds a generic cpufreq driver for CPU0 frequency management.
           It supports both uniprocessor (UP) and symmetric multiprocessor (SMP)
@@ -223,7 +217,6 @@ depends on IA64
 
 config IA64_ACPI_CPUFREQ
         tristate "ACPI Processor P-States driver"
-        select CPU_FREQ_TABLE
         depends on ACPI_PROCESSOR
         help
         This driver adds a CPUFreq driver which utilizes the ACPI
@@ -240,7 +233,6 @@ depends on MIPS
 
 config LOONGSON2_CPUFREQ
         tristate "Loongson2 CPUFreq Driver"
-        select CPU_FREQ_TABLE
         help
           This option adds a CPUFreq driver for loongson processors which
           support software configurable cpu frequency.
@@ -262,7 +254,6 @@ menu "SPARC CPU frequency scaling drivers"
 depends on SPARC64
 config SPARC_US3_CPUFREQ
         tristate "UltraSPARC-III CPU Frequency driver"
-        select CPU_FREQ_TABLE
         help
           This adds the CPUFreq driver for UltraSPARC-III processors.
 
@@ -272,7 +263,6 @@ config SPARC_US3_CPUFREQ
 
 config SPARC_US2E_CPUFREQ
         tristate "UltraSPARC-IIe CPU Frequency driver"
-        select CPU_FREQ_TABLE
         help
           This adds the CPUFreq driver for UltraSPARC-IIe processors.
 
@@ -285,7 +275,6 @@ menu "SH CPU Frequency scaling"
 depends on SUPERH
 config SH_CPU_FREQ
         tristate "SuperH CPU Frequency driver"
-        select CPU_FREQ_TABLE
         help
           This adds the cpufreq driver for SuperH. Any CPU that supports
           clock rate rounding through the clock framework can use this
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 0fa204b244bd..ce52ed949249 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -5,7 +5,6 @@
 config ARM_BIG_LITTLE_CPUFREQ
         tristate "Generic ARM big LITTLE CPUfreq driver"
         depends on ARM_CPU_TOPOLOGY && PM_OPP && HAVE_CLK
-        select CPU_FREQ_TABLE
         help
           This enables the Generic CPUfreq driver for ARM big.LITTLE platforms.
 
@@ -18,7 +17,6 @@ config ARM_DT_BL_CPUFREQ
 
 config ARM_EXYNOS_CPUFREQ
         bool
-        select CPU_FREQ_TABLE
 
 config ARM_EXYNOS4210_CPUFREQ
         bool "SAMSUNG EXYNOS4210"
@@ -58,7 +56,6 @@ config ARM_EXYNOS5440_CPUFREQ
         depends on SOC_EXYNOS5440
         depends on HAVE_CLK && PM_OPP && OF
         default y
-        select CPU_FREQ_TABLE
         help
           This adds the CPUFreq driver for Samsung EXYNOS5440
           SoC. The nature of exynos5440 clock controller is
@@ -85,7 +82,6 @@ config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6Q cpufreq support"
         depends on SOC_IMX6Q
         depends on REGULATOR_ANATOP
-        select CPU_FREQ_TABLE
         help
           This adds cpufreq driver support for Freescale i.MX6Q SOC.
 
@@ -101,7 +97,6 @@ config ARM_INTEGRATOR
 
 config ARM_KIRKWOOD_CPUFREQ
         def_bool ARCH_KIRKWOOD && OF
-        select CPU_FREQ_TABLE
         help
           This adds the CPUFreq driver for Marvell Kirkwood
           SoCs.
@@ -110,7 +105,6 @@ config ARM_OMAP2PLUS_CPUFREQ
         bool "TI OMAP2+"
         depends on ARCH_OMAP2PLUS
         default ARCH_OMAP2PLUS
-        select CPU_FREQ_TABLE
 
 config ARM_S3C_CPUFREQ
         bool
@@ -165,7 +159,6 @@ config ARM_S3C2412_CPUFREQ
 config ARM_S3C2416_CPUFREQ
         bool "S3C2416 CPU Frequency scaling support"
         depends on CPU_S3C2416
-        select CPU_FREQ_TABLE
         help
           This adds the CPUFreq driver for the Samsung S3C2416 and
           S3C2450 SoC. The S3C2416 supports changing the rate of the
@@ -196,7 +189,6 @@ config ARM_S3C2440_CPUFREQ
 config ARM_S3C64XX_CPUFREQ
         bool "Samsung S3C64XX"
         depends on CPU_S3C6410
-        select CPU_FREQ_TABLE
         default y
         help
           This adds the CPUFreq driver for Samsung S3C6410 SoC.
@@ -206,7 +198,6 @@ config ARM_S3C64XX_CPUFREQ
 config ARM_S5PV210_CPUFREQ
         bool "Samsung S5PV210 and S5PC110"
         depends on CPU_S5PV210
-        select CPU_FREQ_TABLE
         default y
         help
           This adds the CPUFreq driver for Samsung S5PV210 and
@@ -223,7 +214,6 @@ config ARM_SA1110_CPUFREQ
 config ARM_SPEAR_CPUFREQ
         bool "SPEAr CPUFreq support"
         depends on PLAT_SPEAR
-        select CPU_FREQ_TABLE
         default y
         help
           This adds the CPUFreq driver support for SPEAr SOCs.
@@ -231,7 +221,14 @@ config ARM_SPEAR_CPUFREQ
 config ARM_TEGRA_CPUFREQ
         bool "TEGRA CPUFreq support"
         depends on ARCH_TEGRA
-        select CPU_FREQ_TABLE
         default y
         help
           This adds the CPUFreq driver support for TEGRA SOCs.
+
+config ARM_VEXPRESS_SPC_CPUFREQ
+        tristate "Versatile Express SPC based CPUfreq driver"
+        select ARM_BIG_LITTLE_CPUFREQ
+        depends on ARCH_VEXPRESS_SPC
+        help
+          This add the CPUfreq driver support for Versatile Express
+          big.LITTLE platforms using SPC for power management.
diff --git a/drivers/cpufreq/Kconfig.powerpc b/drivers/cpufreq/Kconfig.powerpc
index 25ca9db62e09..ca0021a96e19 100644
--- a/drivers/cpufreq/Kconfig.powerpc
+++ b/drivers/cpufreq/Kconfig.powerpc
@@ -1,7 +1,6 @@
 config CPU_FREQ_CBE
         tristate "CBE frequency scaling"
         depends on CBE_RAS && PPC_CELL
-        select CPU_FREQ_TABLE
         default m
         help
           This adds the cpufreq driver for Cell BE processors.
@@ -20,7 +19,6 @@ config CPU_FREQ_CBE_PMI
 config CPU_FREQ_MAPLE
         bool "Support for Maple 970FX Evaluation Board"
         depends on PPC_MAPLE
-        select CPU_FREQ_TABLE
         help
           This adds support for frequency switching on Maple 970FX
           Evaluation Board and compatible boards (IBM JS2x blades).
@@ -28,7 +26,6 @@ config CPU_FREQ_MAPLE
 config PPC_CORENET_CPUFREQ
         tristate "CPU frequency scaling driver for Freescale E500MC SoCs"
         depends on PPC_E500MC && OF && COMMON_CLK
-        select CPU_FREQ_TABLE
         select CLK_PPC_CORENET
         help
           This adds the CPUFreq driver support for Freescale e500mc,
@@ -38,7 +35,6 @@ config PPC_CORENET_CPUFREQ
 config CPU_FREQ_PMAC
         bool "Support for Apple PowerBooks"
         depends on ADB_PMU && PPC32
-        select CPU_FREQ_TABLE
         help
           This adds support for frequency switching on Apple PowerBooks,
           this currently includes some models of iBook & Titanium
@@ -47,7 +43,6 @@ config CPU_FREQ_PMAC
 config CPU_FREQ_PMAC64
         bool "Support for some Apple G5s"
         depends on PPC_PMAC && PPC64
-        select CPU_FREQ_TABLE
         help
           This adds support for frequency switching on Apple iMac G5,
           and some of the more recent desktop G5 machines as well.
@@ -55,7 +50,6 @@ config CPU_FREQ_PMAC64
 config PPC_PASEMI_CPUFREQ
         bool "Support for PA Semi PWRficient"
         depends on PPC_PASEMI
-        select CPU_FREQ_TABLE
         default y
         help
           This adds the support for frequency switching on PA Semi
diff --git a/drivers/cpufreq/Kconfig.x86 b/drivers/cpufreq/Kconfig.x86
index e2b6eabef221..6897ad85b046 100644
--- a/drivers/cpufreq/Kconfig.x86
+++ b/drivers/cpufreq/Kconfig.x86
@@ -31,7 +31,6 @@ config X86_PCC_CPUFREQ
 
 config X86_ACPI_CPUFREQ
         tristate "ACPI Processor P-States driver"
-        select CPU_FREQ_TABLE
         depends on ACPI_PROCESSOR
         help
           This driver adds a CPUFreq driver which utilizes the ACPI
@@ -60,7 +59,6 @@ config X86_ACPI_CPUFREQ_CPB
 
 config ELAN_CPUFREQ
         tristate "AMD Elan SC400 and SC410"
-        select CPU_FREQ_TABLE
         depends on MELAN
         ---help---
           This adds the CPUFreq driver for AMD Elan SC400 and SC410
@@ -76,7 +74,6 @@ config ELAN_CPUFREQ
 
 config SC520_CPUFREQ
         tristate "AMD Elan SC520"
-        select CPU_FREQ_TABLE
         depends on MELAN
         ---help---
           This adds the CPUFreq driver for AMD Elan SC520 processor.
@@ -88,7 +85,6 @@ config SC520_CPUFREQ
 
 config X86_POWERNOW_K6
         tristate "AMD Mobile K6-2/K6-3 PowerNow!"
-        select CPU_FREQ_TABLE
         depends on X86_32
         help
           This adds the CPUFreq driver for mobile AMD K6-2+ and mobile
@@ -100,7 +96,6 @@ config X86_POWERNOW_K6
 
 config X86_POWERNOW_K7
         tristate "AMD Mobile Athlon/Duron PowerNow!"
-        select CPU_FREQ_TABLE
         depends on X86_32
         help
           This adds the CPUFreq driver for mobile AMD K7 mobile processors.
@@ -118,7 +113,6 @@ config X86_POWERNOW_K7_ACPI
 
 config X86_POWERNOW_K8
         tristate "AMD Opteron/Athlon64 PowerNow!"
-        select CPU_FREQ_TABLE
         depends on ACPI && ACPI_PROCESSOR && X86_ACPI_CPUFREQ
         help
           This adds the CPUFreq driver for K8/early Opteron/Athlon64 processors.
@@ -132,7 +126,6 @@ config X86_POWERNOW_K8
 config X86_AMD_FREQ_SENSITIVITY
         tristate "AMD frequency sensitivity feedback powersave bias"
         depends on CPU_FREQ_GOV_ONDEMAND && X86_ACPI_CPUFREQ && CPU_SUP_AMD
-        select CPU_FREQ_TABLE
         help
           This adds AMD-specific powersave bias function to the ondemand
           governor, which allows it to make more power-conscious frequency
@@ -160,7 +153,6 @@ config X86_GX_SUSPMOD
 
 config X86_SPEEDSTEP_CENTRINO
         tristate "Intel Enhanced SpeedStep (deprecated)"
-        select CPU_FREQ_TABLE
         select X86_SPEEDSTEP_CENTRINO_TABLE if X86_32
         depends on X86_32 || (X86_64 && ACPI_PROCESSOR)
         help
@@ -190,7 +182,6 @@ config X86_SPEEDSTEP_CENTRINO_TABLE
 
 config X86_SPEEDSTEP_ICH
         tristate "Intel Speedstep on ICH-M chipsets (ioport interface)"
-        select CPU_FREQ_TABLE
         depends on X86_32
         help
           This adds the CPUFreq driver for certain mobile Intel Pentium III
@@ -204,7 +195,6 @@ config X86_SPEEDSTEP_ICH
 
 config X86_SPEEDSTEP_SMI
         tristate "Intel SpeedStep on 440BX/ZX/MX chipsets (SMI interface)"
-        select CPU_FREQ_TABLE
         depends on X86_32
         help
           This adds the CPUFreq driver for certain mobile Intel Pentium III
@@ -217,7 +207,6 @@ config X86_SPEEDSTEP_SMI
 
 config X86_P4_CLOCKMOD
         tristate "Intel Pentium 4 clock modulation"
-        select CPU_FREQ_TABLE
         help
           This adds the CPUFreq driver for Intel Pentium 4 / XEON
           processors.  When enabled it will lower CPU temperature by skipping
@@ -259,7 +248,6 @@ config X86_LONGRUN
 
 config X86_LONGHAUL
         tristate "VIA Cyrix III Longhaul"
-        select CPU_FREQ_TABLE
         depends on X86_32 && ACPI_PROCESSOR
         help
           This adds the CPUFreq driver for VIA Samuel/CyrixIII,
@@ -272,7 +260,6 @@ config X86_LONGHAUL
 
 config X86_E_POWERSAVER
         tristate "VIA C7 Enhanced PowerSaver (DANGEROUS)"
-        select CPU_FREQ_TABLE
         depends on X86_32 && ACPI_PROCESSOR
         help
           This adds the CPUFreq driver for VIA C7 processors.  However, this driver
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index ad5866c2ada0..74945652dd7a 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -1,5 +1,5 @@
 # CPUfreq core
-obj-$(CONFIG_CPU_FREQ)                  += cpufreq.o
+obj-$(CONFIG_CPU_FREQ)                  += cpufreq.o freq_table.o
 # CPUfreq stats
 obj-$(CONFIG_CPU_FREQ_STAT)             += cpufreq_stats.o
 
@@ -11,9 +11,6 @@ obj-$(CONFIG_CPU_FREQ_GOV_ONDEMAND)	+= cpufreq_ondemand.o
 obj-$(CONFIG_CPU_FREQ_GOV_CONSERVATIVE) += cpufreq_conservative.o
 obj-$(CONFIG_CPU_FREQ_GOV_COMMON)               += cpufreq_governor.o
 
-# CPUfreq cross-arch helpers
-obj-$(CONFIG_CPU_FREQ_TABLE)            += freq_table.o
-
 obj-$(CONFIG_GENERIC_CPUFREQ_CPU0)      += cpufreq-cpu0.o
 
 ##################################################################################
@@ -77,6 +74,7 @@ obj-$(CONFIG_ARM_SA1100_CPUFREQ)	+= sa1100-cpufreq.o
 obj-$(CONFIG_ARM_SA1110_CPUFREQ)        += sa1110-cpufreq.o
 obj-$(CONFIG_ARM_SPEAR_CPUFREQ)         += spear-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA_CPUFREQ)         += tegra-cpufreq.o
+obj-$(CONFIG_ARM_VEXPRESS_SPC_CPUFREQ)  += vexpress-spc-cpufreq.o
 
 ##################################################################################
 # PowerPC platform drivers
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index a1260b4549db..caf41ebea184 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -424,34 +424,21 @@ static unsigned int check_freqs(const struct cpumask *mask, unsigned int freq,
 }
 
 static int acpi_cpufreq_target(struct cpufreq_policy *policy,
-                               unsigned int target_freq, unsigned int relation)
+                               unsigned int index)
 {
         struct acpi_cpufreq_data *data = per_cpu(acfreq_data, policy->cpu);
         struct acpi_processor_performance *perf;
-        struct cpufreq_freqs freqs;
         struct drv_cmd cmd;
-        unsigned int next_state = 0; /* Index into freq_table */
         unsigned int next_perf_state = 0; /* Index into perf table */
         int result = 0;
 
-        pr_debug("acpi_cpufreq_target %d (%d)\n", target_freq, policy->cpu);
-
         if (unlikely(data == NULL ||
              data->acpi_data == NULL || data->freq_table == NULL)) {
                 return -ENODEV;
         }
 
         perf = data->acpi_data;
-        result = cpufreq_frequency_table_target(policy,
-                                                data->freq_table,
-                                                target_freq,
-                                                relation, &next_state);
-        if (unlikely(result)) {
-                result = -ENODEV;
-                goto out;
-        }
-
-        next_perf_state = data->freq_table[next_state].driver_data;
+        next_perf_state = data->freq_table[index].driver_data;
         if (perf->state == next_perf_state) {
                 if (unlikely(data->resume)) {
                         pr_debug("Called after resume, resetting to P%d\n",
@@ -492,23 +479,17 @@ static int acpi_cpufreq_target(struct cpufreq_policy *policy,
         else
                 cmd.mask = cpumask_of(policy->cpu);
 
-        freqs.old = perf->states[perf->state].core_frequency * 1000;
-        freqs.new = data->freq_table[next_state].frequency;
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         drv_write(&cmd);
 
         if (acpi_pstate_strict) {
-                if (!check_freqs(cmd.mask, freqs.new, data)) {
+                if (!check_freqs(cmd.mask, data->freq_table[index].frequency,
+                                        data)) {
                         pr_debug("acpi_cpufreq_target failed (%d)\n",
                                 policy->cpu);
                         result = -EAGAIN;
-                        freqs.new = freqs.old;
                 }
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         if (!result)
                 perf->state = next_perf_state;
 
@@ -516,15 +497,6 @@ out:
         return result;
 }
 
-static int acpi_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        struct acpi_cpufreq_data *data = per_cpu(acfreq_data, policy->cpu);
-
-        pr_debug("acpi_cpufreq_verify\n");
-
-        return cpufreq_frequency_table_verify(policy, data->freq_table);
-}
-
 static unsigned long
 acpi_cpufreq_guess_freq(struct acpi_cpufreq_data *data, unsigned int cpu)
 {
@@ -837,7 +809,7 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
         data->freq_table[valid_states].frequency = CPUFREQ_TABLE_END;
         perf->state = 0;
 
-        result = cpufreq_frequency_table_cpuinfo(policy, data->freq_table);
+        result = cpufreq_table_validate_and_show(policy, data->freq_table);
         if (result)
                 goto err_freqfree;
 
@@ -846,12 +818,16 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
 
         switch (perf->control_register.space_id) {
         case ACPI_ADR_SPACE_SYSTEM_IO:
-                /* Current speed is unknown and not detectable by IO port */
+                /*
+                 * The core will not set policy->cur, because
+                 * cpufreq_driver->get is NULL, so we need to set it here.
+                 * However, we have to guess it, because the current speed is
+                 * unknown and not detectable via IO ports.
+                 */
                 policy->cur = acpi_cpufreq_guess_freq(data, policy->cpu);
                 break;
         case ACPI_ADR_SPACE_FIXED_HARDWARE:
                 acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
-                policy->cur = get_cur_freq_on_cpu(cpu);
                 break;
         default:
                 break;
@@ -868,8 +844,6 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
                         (u32) perf->states[i].power,
                         (u32) perf->states[i].transition_latency);
 
-        cpufreq_frequency_table_get_attr(data->freq_table, policy->cpu);
-
         /*
          * the first call to ->target() should result in us actually
          * writing something to the appropriate registers.
@@ -929,8 +903,8 @@ static struct freq_attr *acpi_cpufreq_attr[] = {
 };
 
 static struct cpufreq_driver acpi_cpufreq_driver = {
-        .verify         = acpi_cpufreq_verify,
-        .target         = acpi_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = acpi_cpufreq_target,
         .bios_limit     = acpi_processor_get_bios_limit,
         .init           = acpi_cpufreq_cpu_init,
         .exit           = acpi_cpufreq_cpu_exit,
@@ -987,7 +961,11 @@ static int __init acpi_cpufreq_init(void)
         int ret;
 
         if (acpi_disabled)
-                return 0;
+                return -ENODEV;
+
+        /* don't keep reloading if cpufreq_driver exists */
+        if (cpufreq_get_current_driver())
+                return -EEXIST;
 
         pr_debug("acpi_cpufreq_init\n");
 
diff --git a/drivers/cpufreq/arm_big_little.c b/drivers/cpufreq/arm_big_little.c
index 3549f0784af1..5519933813ea 100644
--- a/drivers/cpufreq/arm_big_little.c
+++ b/drivers/cpufreq/arm_big_little.c
@@ -24,110 +24,323 @@
 #include <linux/cpufreq.h>
 #include <linux/cpumask.h>
 #include <linux/export.h>
+#include <linux/mutex.h>
 #include <linux/of_platform.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/slab.h>
 #include <linux/topology.h>
 #include <linux/types.h>
+#include <asm/bL_switcher.h>
 
 #include "arm_big_little.h"
 
 /* Currently we support only two clusters */
+#define A15_CLUSTER     0
+#define A7_CLUSTER      1
 #define MAX_CLUSTERS    2
 
+#ifdef CONFIG_BL_SWITCHER
+static bool bL_switching_enabled;
+#define is_bL_switching_enabled()       bL_switching_enabled
+#define set_switching_enabled(x)        (bL_switching_enabled = (x))
+#else
+#define is_bL_switching_enabled()       false
+#define set_switching_enabled(x)        do { } while (0)
+#endif
+
+#define ACTUAL_FREQ(cluster, freq)  ((cluster == A7_CLUSTER) ? freq << 1 : freq)
+#define VIRT_FREQ(cluster, freq)    ((cluster == A7_CLUSTER) ? freq >> 1 : freq)
+
 static struct cpufreq_arm_bL_ops *arm_bL_ops;
 static struct clk *clk[MAX_CLUSTERS];
-static struct cpufreq_frequency_table *freq_table[MAX_CLUSTERS];
-static atomic_t cluster_usage[MAX_CLUSTERS] = {ATOMIC_INIT(0), ATOMIC_INIT(0)};
+static struct cpufreq_frequency_table *freq_table[MAX_CLUSTERS + 1];
+static atomic_t cluster_usage[MAX_CLUSTERS + 1];
+
+static unsigned int clk_big_min;        /* (Big) clock frequencies */
+static unsigned int clk_little_max;     /* Maximum clock frequency (Little) */
+
+static DEFINE_PER_CPU(unsigned int, physical_cluster);
+static DEFINE_PER_CPU(unsigned int, cpu_last_req_freq);
 
-static unsigned int bL_cpufreq_get(unsigned int cpu)
+static struct mutex cluster_lock[MAX_CLUSTERS];
+
+static inline int raw_cpu_to_cluster(int cpu)
 {
-        u32 cur_cluster = cpu_to_cluster(cpu);
+        return topology_physical_package_id(cpu);
+}
 
-        return clk_get_rate(clk[cur_cluster]) / 1000;
+static inline int cpu_to_cluster(int cpu)
+{
+        return is_bL_switching_enabled() ?
+                MAX_CLUSTERS : raw_cpu_to_cluster(cpu);
 }
 
-/* Validate policy frequency range */
-static int bL_cpufreq_verify_policy(struct cpufreq_policy *policy)
+static unsigned int find_cluster_maxfreq(int cluster)
 {
-        u32 cur_cluster = cpu_to_cluster(policy->cpu);
+        int j;
+        u32 max_freq = 0, cpu_freq;
+
+        for_each_online_cpu(j) {
+                cpu_freq = per_cpu(cpu_last_req_freq, j);
+
+                if ((cluster == per_cpu(physical_cluster, j)) &&
+                                (max_freq < cpu_freq))
+                        max_freq = cpu_freq;
+        }
+
+        pr_debug("%s: cluster: %d, max freq: %d\n", __func__, cluster,
+                        max_freq);
+
+        return max_freq;
+}
+
+static unsigned int clk_get_cpu_rate(unsigned int cpu)
+{
+        u32 cur_cluster = per_cpu(physical_cluster, cpu);
+        u32 rate = clk_get_rate(clk[cur_cluster]) / 1000;
+
+        /* For switcher we use virtual A7 clock rates */
+        if (is_bL_switching_enabled())
+                rate = VIRT_FREQ(cur_cluster, rate);
+
+        pr_debug("%s: cpu: %d, cluster: %d, freq: %u\n", __func__, cpu,
+                        cur_cluster, rate);
+
+        return rate;
+}
+
+static unsigned int bL_cpufreq_get_rate(unsigned int cpu)
+{
+        if (is_bL_switching_enabled()) {
+                pr_debug("%s: freq: %d\n", __func__, per_cpu(cpu_last_req_freq,
+                                        cpu));
+
+                return per_cpu(cpu_last_req_freq, cpu);
+        } else {
+                return clk_get_cpu_rate(cpu);
+        }
+}
+
+static unsigned int
+bL_cpufreq_set_rate(u32 cpu, u32 old_cluster, u32 new_cluster, u32 rate)
+{
+        u32 new_rate, prev_rate;
+        int ret;
+        bool bLs = is_bL_switching_enabled();
+
+        mutex_lock(&cluster_lock[new_cluster]);
 
-        return cpufreq_frequency_table_verify(policy, freq_table[cur_cluster]);
+        if (bLs) {
+                prev_rate = per_cpu(cpu_last_req_freq, cpu);
+                per_cpu(cpu_last_req_freq, cpu) = rate;
+                per_cpu(physical_cluster, cpu) = new_cluster;
+
+                new_rate = find_cluster_maxfreq(new_cluster);
+                new_rate = ACTUAL_FREQ(new_cluster, new_rate);
+        } else {
+                new_rate = rate;
+        }
+
+        pr_debug("%s: cpu: %d, old cluster: %d, new cluster: %d, freq: %d\n",
+                        __func__, cpu, old_cluster, new_cluster, new_rate);
+
+        ret = clk_set_rate(clk[new_cluster], new_rate * 1000);
+        if (WARN_ON(ret)) {
+                pr_err("clk_set_rate failed: %d, new cluster: %d\n", ret,
+                                new_cluster);
+                if (bLs) {
+                        per_cpu(cpu_last_req_freq, cpu) = prev_rate;
+                        per_cpu(physical_cluster, cpu) = old_cluster;
+                }
+
+                mutex_unlock(&cluster_lock[new_cluster]);
+
+                return ret;
+        }
+
+        mutex_unlock(&cluster_lock[new_cluster]);
+
+        /* Recalc freq for old cluster when switching clusters */
+        if (old_cluster != new_cluster) {
+                pr_debug("%s: cpu: %d, old cluster: %d, new cluster: %d\n",
+                                __func__, cpu, old_cluster, new_cluster);
+
+                /* Switch cluster */
+                bL_switch_request(cpu, new_cluster);
+
+                mutex_lock(&cluster_lock[old_cluster]);
+
+                /* Set freq of old cluster if there are cpus left on it */
+                new_rate = find_cluster_maxfreq(old_cluster);
+                new_rate = ACTUAL_FREQ(old_cluster, new_rate);
+
+                if (new_rate) {
+                        pr_debug("%s: Updating rate of old cluster: %d, to freq: %d\n",
+                                        __func__, old_cluster, new_rate);
+
+                        if (clk_set_rate(clk[old_cluster], new_rate * 1000))
+                                pr_err("%s: clk_set_rate failed: %d, old cluster: %d\n",
+                                                __func__, ret, old_cluster);
+                }
+                mutex_unlock(&cluster_lock[old_cluster]);
+        }
+
+        return 0;
 }
 
 /* Set clock frequency */
 static int bL_cpufreq_set_target(struct cpufreq_policy *policy,
-                unsigned int target_freq, unsigned int relation)
+                unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        u32 cpu = policy->cpu, freq_tab_idx, cur_cluster;
-        int ret = 0;
+        u32 cpu = policy->cpu, cur_cluster, new_cluster, actual_cluster;
+        unsigned int freqs_new;
+
+        cur_cluster = cpu_to_cluster(cpu);
+        new_cluster = actual_cluster = per_cpu(physical_cluster, cpu);
+
+        freqs_new = freq_table[cur_cluster][index].frequency;
+
+        if (is_bL_switching_enabled()) {
+                if ((actual_cluster == A15_CLUSTER) &&
+                                (freqs_new < clk_big_min)) {
+                        new_cluster = A7_CLUSTER;
+                } else if ((actual_cluster == A7_CLUSTER) &&
+                                (freqs_new > clk_little_max)) {
+                        new_cluster = A15_CLUSTER;
+                }
+        }
 
-        cur_cluster = cpu_to_cluster(policy->cpu);
+        return bL_cpufreq_set_rate(cpu, actual_cluster, new_cluster, freqs_new);
+}
 
-        freqs.old = bL_cpufreq_get(policy->cpu);
+static inline u32 get_table_count(struct cpufreq_frequency_table *table)
+{
+        int count;
 
-        /* Determine valid target frequency using freq_table */
-        cpufreq_frequency_table_target(policy, freq_table[cur_cluster],
-                        target_freq, relation, &freq_tab_idx);
-        freqs.new = freq_table[cur_cluster][freq_tab_idx].frequency;
+        for (count = 0; table[count].frequency != CPUFREQ_TABLE_END; count++)
+                ;
 
-        pr_debug("%s: cpu: %d, cluster: %d, oldfreq: %d, target freq: %d, new freq: %d\n",
-                        __func__, cpu, cur_cluster, freqs.old, target_freq,
-                        freqs.new);
+        return count;
+}
 
-        if (freqs.old == freqs.new)
-                return 0;
+/* get the minimum frequency in the cpufreq_frequency_table */
+static inline u32 get_table_min(struct cpufreq_frequency_table *table)
+{
+        int i;
+        uint32_t min_freq = ~0;
+        for (i = 0; (table[i].frequency != CPUFREQ_TABLE_END); i++)
+                if (table[i].frequency < min_freq)
+                        min_freq = table[i].frequency;
+        return min_freq;
+}
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+/* get the maximum frequency in the cpufreq_frequency_table */
+static inline u32 get_table_max(struct cpufreq_frequency_table *table)
+{
+        int i;
+        uint32_t max_freq = 0;
+        for (i = 0; (table[i].frequency != CPUFREQ_TABLE_END); i++)
+                if (table[i].frequency > max_freq)
+                        max_freq = table[i].frequency;
+        return max_freq;
+}
 
-        ret = clk_set_rate(clk[cur_cluster], freqs.new * 1000);
-        if (ret) {
-                pr_err("clk_set_rate failed: %d\n", ret);
-                freqs.new = freqs.old;
+static int merge_cluster_tables(void)
+{
+        int i, j, k = 0, count = 1;
+        struct cpufreq_frequency_table *table;
+
+        for (i = 0; i < MAX_CLUSTERS; i++)
+                count += get_table_count(freq_table[i]);
+
+        table = kzalloc(sizeof(*table) * count, GFP_KERNEL);
+        if (!table)
+                return -ENOMEM;
+
+        freq_table[MAX_CLUSTERS] = table;
+
+        /* Add in reverse order to get freqs in increasing order */
+        for (i = MAX_CLUSTERS - 1; i >= 0; i--) {
+                for (j = 0; freq_table[i][j].frequency != CPUFREQ_TABLE_END;
+                                j++) {
+                        table[k].frequency = VIRT_FREQ(i,
+                                        freq_table[i][j].frequency);
+                        pr_debug("%s: index: %d, freq: %d\n", __func__, k,
+                                        table[k].frequency);
+                        k++;
+                }
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+        table[k].driver_data = k;
+        table[k].frequency = CPUFREQ_TABLE_END;
 
-        return ret;
+        pr_debug("%s: End, table: %p, count: %d\n", __func__, table, k);
+
+        return 0;
+}
+
+static void _put_cluster_clk_and_freq_table(struct device *cpu_dev)
+{
+        u32 cluster = raw_cpu_to_cluster(cpu_dev->id);
+
+        if (!freq_table[cluster])
+                return;
+
+        clk_put(clk[cluster]);
+        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table[cluster]);
+        dev_dbg(cpu_dev, "%s: cluster: %d\n", __func__, cluster);
 }
 
 static void put_cluster_clk_and_freq_table(struct device *cpu_dev)
 {
         u32 cluster = cpu_to_cluster(cpu_dev->id);
+        int i;
+
+        if (atomic_dec_return(&cluster_usage[cluster]))
+                return;
+
+        if (cluster < MAX_CLUSTERS)
+                return _put_cluster_clk_and_freq_table(cpu_dev);
 
-        if (!atomic_dec_return(&cluster_usage[cluster])) {
-                clk_put(clk[cluster]);
-                opp_free_cpufreq_table(cpu_dev, &freq_table[cluster]);
-                dev_dbg(cpu_dev, "%s: cluster: %d\n", __func__, cluster);
+        for_each_present_cpu(i) {
+                struct device *cdev = get_cpu_device(i);
+                if (!cdev) {
+                        pr_err("%s: failed to get cpu%d device\n", __func__, i);
+                        return;
+                }
+
+                _put_cluster_clk_and_freq_table(cdev);
         }
+
+        /* free virtual table */
+        kfree(freq_table[cluster]);
 }
 
-static int get_cluster_clk_and_freq_table(struct device *cpu_dev)
+static int _get_cluster_clk_and_freq_table(struct device *cpu_dev)
 {
-        u32 cluster = cpu_to_cluster(cpu_dev->id);
+        u32 cluster = raw_cpu_to_cluster(cpu_dev->id);
         char name[14] = "cpu-cluster.";
         int ret;
 
-        if (atomic_inc_return(&cluster_usage[cluster]) != 1)
+        if (freq_table[cluster])
                 return 0;
 
         ret = arm_bL_ops->init_opp_table(cpu_dev);
         if (ret) {
                 dev_err(cpu_dev, "%s: init_opp_table failed, cpu: %d, err: %d\n",
                                 __func__, cpu_dev->id, ret);
-                goto atomic_dec;
+                goto out;
         }
 
-        ret = opp_init_cpufreq_table(cpu_dev, &freq_table[cluster]);
+        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table[cluster]);
         if (ret) {
                 dev_err(cpu_dev, "%s: failed to init cpufreq table, cpu: %d, err: %d\n",
                                 __func__, cpu_dev->id, ret);
-                goto atomic_dec;
+                goto out;
         }
 
         name[12] = cluster + '0';
-        clk[cluster] = clk_get_sys(name, NULL);
+        clk[cluster] = clk_get(cpu_dev, name);
         if (!IS_ERR(clk[cluster])) {
                 dev_dbg(cpu_dev, "%s: clk: %p & freq table: %p, cluster: %d\n",
                                 __func__, clk[cluster], freq_table[cluster],
@@ -138,15 +351,74 @@ static int get_cluster_clk_and_freq_table(struct device *cpu_dev)
         dev_err(cpu_dev, "%s: Failed to get clk for cpu: %d, cluster: %d\n",
                         __func__, cpu_dev->id, cluster);
         ret = PTR_ERR(clk[cluster]);
-        opp_free_cpufreq_table(cpu_dev, &freq_table[cluster]);
+        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table[cluster]);
 
-atomic_dec:
-        atomic_dec(&cluster_usage[cluster]);
+out:
         dev_err(cpu_dev, "%s: Failed to get data for cluster: %d\n", __func__,
                         cluster);
         return ret;
 }
 
+static int get_cluster_clk_and_freq_table(struct device *cpu_dev)
+{
+        u32 cluster = cpu_to_cluster(cpu_dev->id);
+        int i, ret;
+
+        if (atomic_inc_return(&cluster_usage[cluster]) != 1)
+                return 0;
+
+        if (cluster < MAX_CLUSTERS) {
+                ret = _get_cluster_clk_and_freq_table(cpu_dev);
+                if (ret)
+                        atomic_dec(&cluster_usage[cluster]);
+                return ret;
+        }
+
+        /*
+         * Get data for all clusters and fill virtual cluster with a merge of
+         * both
+         */
+        for_each_present_cpu(i) {
+                struct device *cdev = get_cpu_device(i);
+                if (!cdev) {
+                        pr_err("%s: failed to get cpu%d device\n", __func__, i);
+                        return -ENODEV;
+                }
+
+                ret = _get_cluster_clk_and_freq_table(cdev);
+                if (ret)
+                        goto put_clusters;
+        }
+
+        ret = merge_cluster_tables();
+        if (ret)
+                goto put_clusters;
+
+        /* Assuming 2 cluster, set clk_big_min and clk_little_max */
+        clk_big_min = get_table_min(freq_table[0]);
+        clk_little_max = VIRT_FREQ(1, get_table_max(freq_table[1]));
+
+        pr_debug("%s: cluster: %d, clk_big_min: %d, clk_little_max: %d\n",
+                        __func__, cluster, clk_big_min, clk_little_max);
+
+        return 0;
+
+put_clusters:
+        for_each_present_cpu(i) {
+                struct device *cdev = get_cpu_device(i);
+                if (!cdev) {
+                        pr_err("%s: failed to get cpu%d device\n", __func__, i);
+                        return -ENODEV;
+                }
+
+                _put_cluster_clk_and_freq_table(cdev);
+        }
+
+        atomic_dec(&cluster_usage[cluster]);
+
+        return ret;
+}
+
 /* Per-CPU initialization */
 static int bL_cpufreq_init(struct cpufreq_policy *policy)
 {
@@ -165,7 +437,7 @@ static int bL_cpufreq_init(struct cpufreq_policy *policy)
         if (ret)
                 return ret;
 
-        ret = cpufreq_frequency_table_cpuinfo(policy, freq_table[cur_cluster]);
+        ret = cpufreq_table_validate_and_show(policy, freq_table[cur_cluster]);
         if (ret) {
                 dev_err(cpu_dev, "CPU %d, cluster: %d invalid freq table\n",
                                 policy->cpu, cur_cluster);
@@ -173,7 +445,14 @@ static int bL_cpufreq_init(struct cpufreq_policy *policy)
                 return ret;
         }
 
-        cpufreq_frequency_table_get_attr(freq_table[cur_cluster], policy->cpu);
+        if (cur_cluster < MAX_CLUSTERS) {
+                cpumask_copy(policy->cpus, topology_core_cpumask(policy->cpu));
+
+                per_cpu(physical_cluster, policy->cpu) = cur_cluster;
+        } else {
+                /* Assumption: during init, we are always running on A15 */
+                per_cpu(physical_cluster, policy->cpu) = A15_CLUSTER;
+        }
 
         if (arm_bL_ops->get_transition_latency)
                 policy->cpuinfo.transition_latency =
@@ -181,9 +460,8 @@ static int bL_cpufreq_init(struct cpufreq_policy *policy)
         else
                 policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
 
-        policy->cur = bL_cpufreq_get(policy->cpu);
-
-        cpumask_copy(policy->cpus, topology_core_cpumask(policy->cpu));
+        if (is_bL_switching_enabled())
+                per_cpu(cpu_last_req_freq, policy->cpu) = clk_get_cpu_rate(policy->cpu);
 
         dev_info(cpu_dev, "%s: CPU %d initialized\n", __func__, policy->cpu);
         return 0;
@@ -200,33 +478,60 @@ static int bL_cpufreq_exit(struct cpufreq_policy *policy)
                 return -ENODEV;
         }
 
+        cpufreq_frequency_table_put_attr(policy->cpu);
         put_cluster_clk_and_freq_table(cpu_dev);
         dev_dbg(cpu_dev, "%s: Exited, cpu: %d\n", __func__, policy->cpu);
 
         return 0;
 }
 
-/* Export freq_table to sysfs */
-static struct freq_attr *bL_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver bL_cpufreq_driver = {
         .name                   = "arm-big-little",
-        .flags                  = CPUFREQ_STICKY,
-        .verify                 = bL_cpufreq_verify_policy,
-        .target                 = bL_cpufreq_set_target,
-        .get                    = bL_cpufreq_get,
+        .flags                  = CPUFREQ_STICKY |
+                                        CPUFREQ_HAVE_GOVERNOR_PER_POLICY,
+        .verify                 = cpufreq_generic_frequency_table_verify,
+        .target_index           = bL_cpufreq_set_target,
+        .get                    = bL_cpufreq_get_rate,
         .init                   = bL_cpufreq_init,
         .exit                   = bL_cpufreq_exit,
-        .have_governor_per_policy = true,
-        .attr                   = bL_cpufreq_attr,
+        .attr                   = cpufreq_generic_attr,
+};
+
+static int bL_cpufreq_switcher_notifier(struct notifier_block *nfb,
+                                        unsigned long action, void *_arg)
+{
+        pr_debug("%s: action: %ld\n", __func__, action);
+
+        switch (action) {
+        case BL_NOTIFY_PRE_ENABLE:
+        case BL_NOTIFY_PRE_DISABLE:
+                cpufreq_unregister_driver(&bL_cpufreq_driver);
+                break;
+
+        case BL_NOTIFY_POST_ENABLE:
+                set_switching_enabled(true);
+                cpufreq_register_driver(&bL_cpufreq_driver);
+                break;
+
+        case BL_NOTIFY_POST_DISABLE:
+                set_switching_enabled(false);
+                cpufreq_register_driver(&bL_cpufreq_driver);
+                break;
+
+        default:
+                return NOTIFY_DONE;
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block bL_switcher_notifier = {
+        .notifier_call = bL_cpufreq_switcher_notifier,
 };
 
 int bL_cpufreq_register(struct cpufreq_arm_bL_ops *ops)
 {
-        int ret;
+        int ret, i;
 
         if (arm_bL_ops) {
                 pr_debug("%s: Already registered: %s, exiting\n", __func__,
@@ -241,16 +546,29 @@ int bL_cpufreq_register(struct cpufreq_arm_bL_ops *ops)
 
         arm_bL_ops = ops;
 
+        ret = bL_switcher_get_enabled();
+        set_switching_enabled(ret);
+
+        for (i = 0; i < MAX_CLUSTERS; i++)
+                mutex_init(&cluster_lock[i]);
+
         ret = cpufreq_register_driver(&bL_cpufreq_driver);
         if (ret) {
                 pr_info("%s: Failed registering platform driver: %s, err: %d\n",
                                 __func__, ops->name, ret);
                 arm_bL_ops = NULL;
         } else {
-                pr_info("%s: Registered platform driver: %s\n", __func__,
-                                ops->name);
+                ret = bL_switcher_register_notifier(&bL_switcher_notifier);
+                if (ret) {
+                        cpufreq_unregister_driver(&bL_cpufreq_driver);
+                        arm_bL_ops = NULL;
+                } else {
+                        pr_info("%s: Registered platform driver: %s\n",
+                                        __func__, ops->name);
+                }
         }
 
+        bL_switcher_put_enabled();
         return ret;
 }
 EXPORT_SYMBOL_GPL(bL_cpufreq_register);
@@ -263,7 +581,10 @@ void bL_cpufreq_unregister(struct cpufreq_arm_bL_ops *ops)
                 return;
         }
 
+        bL_switcher_get_enabled();
+        bL_switcher_unregister_notifier(&bL_switcher_notifier);
         cpufreq_unregister_driver(&bL_cpufreq_driver);
+        bL_switcher_put_enabled();
         pr_info("%s: Un-registered platform driver: %s\n", __func__,
                         arm_bL_ops->name);
         arm_bL_ops = NULL;
diff --git a/drivers/cpufreq/arm_big_little.h b/drivers/cpufreq/arm_big_little.h
index 79b2ce17884d..70f18fc12d4a 100644
--- a/drivers/cpufreq/arm_big_little.h
+++ b/drivers/cpufreq/arm_big_little.h
@@ -34,11 +34,6 @@ struct cpufreq_arm_bL_ops {
         int (*init_opp_table)(struct device *cpu_dev);
 };
 
-static inline int cpu_to_cluster(int cpu)
-{
-        return topology_physical_package_id(cpu);
-}
-
 int bL_cpufreq_register(struct cpufreq_arm_bL_ops *ops);
 void bL_cpufreq_unregister(struct cpufreq_arm_bL_ops *ops);
 
diff --git a/drivers/cpufreq/arm_big_little_dt.c b/drivers/cpufreq/arm_big_little_dt.c
index 480c0bd0468d..8d9d59108906 100644
--- a/drivers/cpufreq/arm_big_little_dt.c
+++ b/drivers/cpufreq/arm_big_little_dt.c
@@ -24,7 +24,7 @@
 #include <linux/export.h>
 #include <linux/module.h>
 #include <linux/of_device.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/types.h>
diff --git a/drivers/cpufreq/at32ap-cpufreq.c b/drivers/cpufreq/at32ap-cpufreq.c
index e0c38d938997..856ad80418ae 100644
--- a/drivers/cpufreq/at32ap-cpufreq.c
+++ b/drivers/cpufreq/at32ap-cpufreq.c
@@ -19,18 +19,10 @@
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/export.h>
+#include <linux/slab.h>
 
 static struct clk *cpuclk;
-
-static int at32_verify_speed(struct cpufreq_policy *policy)
-{
-        if (policy->cpu != 0)
-                return -EINVAL;
-
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                        policy->cpuinfo.max_freq);
-        return 0;
-}
+static struct cpufreq_frequency_table *freq_table;
 
 static unsigned int at32_get_speed(unsigned int cpu)
 {
@@ -43,74 +35,94 @@ static unsigned int at32_get_speed(unsigned int cpu)
 static unsigned int     ref_freq;
 static unsigned long    loops_per_jiffy_ref;
 
-static int at32_set_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
+static int at32_set_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        long freq;
-
-        /* Convert target_freq from kHz to Hz */
-        freq = clk_round_rate(cpuclk, target_freq * 1000);
-
-        /* Check if policy->min <= new_freq <= policy->max */
-        if(freq < (policy->min * 1000) || freq > (policy->max * 1000))
-                return -EINVAL;
-
-        pr_debug("cpufreq: requested frequency %u Hz\n", target_freq * 1000);
+        unsigned int old_freq, new_freq;
 
-        freqs.old = at32_get_speed(0);
-        freqs.new = (freq + 500) / 1000;
-        freqs.flags = 0;
+        old_freq = at32_get_speed(0);
+        new_freq = freq_table[index].frequency;
 
         if (!ref_freq) {
-                ref_freq = freqs.old;
+                ref_freq = old_freq;
                 loops_per_jiffy_ref = boot_cpu_data.loops_per_jiffy;
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-        if (freqs.old < freqs.new)
+        if (old_freq < new_freq)
                 boot_cpu_data.loops_per_jiffy = cpufreq_scale(
-                                loops_per_jiffy_ref, ref_freq, freqs.new);
-        clk_set_rate(cpuclk, freq);
-        if (freqs.new < freqs.old)
+                                loops_per_jiffy_ref, ref_freq, new_freq);
+        clk_set_rate(cpuclk, new_freq * 1000);
+        if (new_freq < old_freq)
                 boot_cpu_data.loops_per_jiffy = cpufreq_scale(
-                                loops_per_jiffy_ref, ref_freq, freqs.new);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        pr_debug("cpufreq: set frequency %lu Hz\n", freq);
+                                loops_per_jiffy_ref, ref_freq, new_freq);
 
         return 0;
 }
 
 static int __init at32_cpufreq_driver_init(struct cpufreq_policy *policy)
 {
+        unsigned int frequency, rate, min_freq;
+        int retval, steps, i;
+
         if (policy->cpu != 0)
                 return -EINVAL;
 
         cpuclk = clk_get(NULL, "cpu");
         if (IS_ERR(cpuclk)) {
                 pr_debug("cpufreq: could not get CPU clk\n");
-                return PTR_ERR(cpuclk);
+                retval = PTR_ERR(cpuclk);
+                goto out_err;
         }
 
-        policy->cpuinfo.min_freq = (clk_round_rate(cpuclk, 1) + 500) / 1000;
-        policy->cpuinfo.max_freq = (clk_round_rate(cpuclk, ~0UL) + 500) / 1000;
+        min_freq = (clk_round_rate(cpuclk, 1) + 500) / 1000;
+        frequency = (clk_round_rate(cpuclk, ~0UL) + 500) / 1000;
         policy->cpuinfo.transition_latency = 0;
-        policy->cur = at32_get_speed(0);
-        policy->min = policy->cpuinfo.min_freq;
-        policy->max = policy->cpuinfo.max_freq;
 
-        printk("cpufreq: AT32AP CPU frequency driver\n");
+        /*
+         * AVR32 CPU frequency rate scales in power of two between maximum and
+         * minimum, also add space for the table end marker.
+         *
+         * Further validate that the frequency is usable, and append it to the
+         * frequency table.
+         */
+        steps = fls(frequency / min_freq) + 1;
+        freq_table = kzalloc(steps * sizeof(struct cpufreq_frequency_table),
+                        GFP_KERNEL);
+        if (!freq_table) {
+                retval = -ENOMEM;
+                goto out_err_put_clk;
+        }
 
-        return 0;
+        for (i = 0; i < (steps - 1); i++) {
+                rate = clk_round_rate(cpuclk, frequency * 1000) / 1000;
+
+                if (rate != frequency)
+                        freq_table[i].frequency = CPUFREQ_ENTRY_INVALID;
+                else
+                        freq_table[i].frequency = frequency;
+
+                frequency /= 2;
+        }
+
+        freq_table[steps - 1].frequency = CPUFREQ_TABLE_END;
+
+        retval = cpufreq_table_validate_and_show(policy, freq_table);
+        if (!retval) {
+                printk("cpufreq: AT32AP CPU frequency driver\n");
+                return 0;
+        }
+
+        kfree(freq_table);
+out_err_put_clk:
+        clk_put(cpuclk);
+out_err:
+        return retval;
 }
 
 static struct cpufreq_driver at32_driver = {
         .name           = "at32ap",
         .init           = at32_cpufreq_driver_init,
-        .verify         = at32_verify_speed,
-        .target         = at32_set_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = at32_set_target,
         .get            = at32_get_speed,
         .flags          = CPUFREQ_STICKY,
 };
diff --git a/drivers/cpufreq/blackfin-cpufreq.c b/drivers/cpufreq/blackfin-cpufreq.c
index ef05978a7237..e9e63fc9c2c9 100644
--- a/drivers/cpufreq/blackfin-cpufreq.c
+++ b/drivers/cpufreq/blackfin-cpufreq.c
@@ -127,41 +127,28 @@ unsigned long cpu_set_cclk(int cpu, unsigned long new)
 }
 #endif
 
-static int bfin_target(struct cpufreq_policy *policy,
-                        unsigned int target_freq, unsigned int relation)
+static int bfin_target(struct cpufreq_policy *policy, unsigned int index)
 {
 #ifndef CONFIG_BF60x
         unsigned int plldiv;
 #endif
-        unsigned int index;
-        unsigned long cclk_hz;
-        struct cpufreq_freqs freqs;
         static unsigned long lpj_ref;
         static unsigned int  lpj_ref_freq;
+        unsigned int old_freq, new_freq;
         int ret = 0;
 
 #if defined(CONFIG_CYCLES_CLOCKSOURCE)
         cycles_t cycles;
 #endif
 
-        if (cpufreq_frequency_table_target(policy, bfin_freq_table, target_freq,
-                                relation, &index))
-                return -EINVAL;
+        old_freq = bfin_getfreq_khz(0);
+        new_freq = bfin_freq_table[index].frequency;
 
-        cclk_hz = bfin_freq_table[index].frequency;
-
-        freqs.old = bfin_getfreq_khz(0);
-        freqs.new = cclk_hz;
-
-        pr_debug("cpufreq: changing cclk to %lu; target = %u, oldfreq = %u\n",
-                        cclk_hz, target_freq, freqs.old);
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
 #ifndef CONFIG_BF60x
         plldiv = (bfin_read_PLL_DIV() & SSEL) | dpm_state_table[index].csel;
         bfin_write_PLL_DIV(plldiv);
 #else
-        ret = cpu_set_cclk(policy->cpu, freqs.new * 1000);
+        ret = cpu_set_cclk(policy->cpu, new_freq * 1000);
         if (ret != 0) {
                 WARN_ONCE(ret, "cpufreq set freq failed %d\n", ret);
                 return ret;
@@ -177,25 +164,16 @@ static int bfin_target(struct cpufreq_policy *policy,
 #endif
         if (!lpj_ref_freq) {
                 lpj_ref = loops_per_jiffy;
-                lpj_ref_freq = freqs.old;
+                lpj_ref_freq = old_freq;
         }
-        if (freqs.new != freqs.old) {
+        if (new_freq != old_freq) {
                 loops_per_jiffy = cpufreq_scale(lpj_ref,
-                                lpj_ref_freq, freqs.new);
+                                lpj_ref_freq, new_freq);
         }
 
-        /* TODO: just test case for cycles clock source, remove later */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        pr_debug("cpufreq: done\n");
         return ret;
 }
 
-static int bfin_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, bfin_freq_table);
-}
-
 static int __bfin_cpu_init(struct cpufreq_policy *policy)
 {
 
@@ -209,23 +187,17 @@ static int __bfin_cpu_init(struct cpufreq_policy *policy)
 
         policy->cpuinfo.transition_latency = 50000; /* 50us assumed */
 
-        policy->cur = cclk;
-        cpufreq_frequency_table_get_attr(bfin_freq_table, policy->cpu);
-        return cpufreq_frequency_table_cpuinfo(policy, bfin_freq_table);
+        return cpufreq_table_validate_and_show(policy, bfin_freq_table);
 }
 
-static struct freq_attr *bfin_freq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver bfin_driver = {
-        .verify = bfin_verify_speed,
-        .target = bfin_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = bfin_target,
         .get = bfin_getfreq_khz,
         .init = __bfin_cpu_init,
+        .exit = cpufreq_generic_exit,
         .name = "bfin cpufreq",
-        .attr = bfin_freq_attr,
+        .attr = cpufreq_generic_attr,
 };
 
 static int __init bfin_cpu_init(void)
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 78c49d8e0f4a..d4585ce2346c 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -17,7 +17,7 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/of.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/consumer.h>
 #include <linux/slab.h>
@@ -30,73 +30,51 @@ static struct clk *cpu_clk;
 static struct regulator *cpu_reg;
 static struct cpufreq_frequency_table *freq_table;
 
-static int cpu0_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, freq_table);
-}
-
 static unsigned int cpu0_get_speed(unsigned int cpu)
 {
         return clk_get_rate(cpu_clk) / 1000;
 }
 
-static int cpu0_set_target(struct cpufreq_policy *policy,
-                           unsigned int target_freq, unsigned int relation)
+static int cpu0_set_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long volt = 0, volt_old = 0, tol = 0;
+        unsigned int old_freq, new_freq;
         long freq_Hz, freq_exact;
-        unsigned int index;
         int ret;
 
-        ret = cpufreq_frequency_table_target(policy, freq_table, target_freq,
-                                             relation, &index);
-        if (ret) {
-                pr_err("failed to match target freqency %d: %d\n",
-                       target_freq, ret);
-                return ret;
-        }
-
         freq_Hz = clk_round_rate(cpu_clk, freq_table[index].frequency * 1000);
         if (freq_Hz < 0)
                 freq_Hz = freq_table[index].frequency * 1000;
-        freq_exact = freq_Hz;
-        freqs.new = freq_Hz / 1000;
-        freqs.old = clk_get_rate(cpu_clk) / 1000;
 
-        if (freqs.old == freqs.new)
-                return 0;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+        freq_exact = freq_Hz;
+        new_freq = freq_Hz / 1000;
+        old_freq = clk_get_rate(cpu_clk) / 1000;
 
         if (!IS_ERR(cpu_reg)) {
                 rcu_read_lock();
-                opp = opp_find_freq_ceil(cpu_dev, &freq_Hz);
+                opp = dev_pm_opp_find_freq_ceil(cpu_dev, &freq_Hz);
                 if (IS_ERR(opp)) {
                         rcu_read_unlock();
                         pr_err("failed to find OPP for %ld\n", freq_Hz);
-                        freqs.new = freqs.old;
-                        ret = PTR_ERR(opp);
-                        goto post_notify;
+                        return PTR_ERR(opp);
                 }
-                volt = opp_get_voltage(opp);
+                volt = dev_pm_opp_get_voltage(opp);
                 rcu_read_unlock();
                 tol = volt * voltage_tolerance / 100;
                 volt_old = regulator_get_voltage(cpu_reg);
         }
 
         pr_debug("%u MHz, %ld mV --> %u MHz, %ld mV\n",
-                 freqs.old / 1000, volt_old ? volt_old / 1000 : -1,
-                 freqs.new / 1000, volt ? volt / 1000 : -1);
+                 old_freq / 1000, volt_old ? volt_old / 1000 : -1,
+                 new_freq / 1000, volt ? volt / 1000 : -1);
 
         /* scaling up?  scale voltage before frequency */
-        if (!IS_ERR(cpu_reg) && freqs.new > freqs.old) {
+        if (!IS_ERR(cpu_reg) && new_freq > old_freq) {
                 ret = regulator_set_voltage_tol(cpu_reg, volt, tol);
                 if (ret) {
                         pr_err("failed to scale voltage up: %d\n", ret);
-                        freqs.new = freqs.old;
-                        goto post_notify;
+                        return ret;
                 }
         }
 
@@ -105,72 +83,35 @@ static int cpu0_set_target(struct cpufreq_policy *policy,
                 pr_err("failed to set clock rate: %d\n", ret);
                 if (!IS_ERR(cpu_reg))
                         regulator_set_voltage_tol(cpu_reg, volt_old, tol);
-                freqs.new = freqs.old;
-                goto post_notify;
+                return ret;
         }
 
         /* scaling down?  scale voltage after frequency */
-        if (!IS_ERR(cpu_reg) && freqs.new < freqs.old) {
+        if (!IS_ERR(cpu_reg) && new_freq < old_freq) {
                 ret = regulator_set_voltage_tol(cpu_reg, volt, tol);
                 if (ret) {
                         pr_err("failed to scale voltage down: %d\n", ret);
-                        clk_set_rate(cpu_clk, freqs.old * 1000);
-                        freqs.new = freqs.old;
+                        clk_set_rate(cpu_clk, old_freq * 1000);
                 }
         }
 
-post_notify:
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         return ret;
 }
 
 static int cpu0_cpufreq_init(struct cpufreq_policy *policy)
 {
-        int ret;
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, freq_table);
-        if (ret) {
-                pr_err("invalid frequency table: %d\n", ret);
-                return ret;
-        }
-
-        policy->cpuinfo.transition_latency = transition_latency;
-        policy->cur = clk_get_rate(cpu_clk) / 1000;
-
-        /*
-         * The driver only supports the SMP configuartion where all processors
-         * share the clock and voltage and clock.  Use cpufreq affected_cpus
-         * interface to have all CPUs scaled together.
-         */
-        cpumask_setall(policy->cpus);
-
-        cpufreq_frequency_table_get_attr(freq_table, policy->cpu);
-
-        return 0;
-}
-
-static int cpu0_cpufreq_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-
-        return 0;
+        return cpufreq_generic_init(policy, freq_table, transition_latency);
 }
 
-static struct freq_attr *cpu0_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver cpu0_cpufreq_driver = {
         .flags = CPUFREQ_STICKY,
-        .verify = cpu0_verify_speed,
-        .target = cpu0_set_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = cpu0_set_target,
         .get = cpu0_get_speed,
         .init = cpu0_cpufreq_init,
-        .exit = cpu0_cpufreq_exit,
+        .exit = cpufreq_generic_exit,
         .name = "generic_cpu0",
-        .attr = cpu0_cpufreq_attr,
+        .attr = cpufreq_generic_attr,
 };
 
 static int cpu0_cpufreq_probe(struct platform_device *pdev)
@@ -218,7 +159,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                 goto out_put_node;
         }
 
-        ret = opp_init_cpufreq_table(cpu_dev, &freq_table);
+        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
         if (ret) {
                 pr_err("failed to init cpufreq table: %d\n", ret);
                 goto out_put_node;
@@ -229,8 +170,8 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
         if (of_property_read_u32(np, "clock-latency", &transition_latency))
                 transition_latency = CPUFREQ_ETERNAL;
 
-        if (cpu_reg) {
-                struct opp *opp;
+        if (!IS_ERR(cpu_reg)) {
+                struct dev_pm_opp *opp;
                 unsigned long min_uV, max_uV;
                 int i;
 
@@ -242,12 +183,12 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                 for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++)
                         ;
                 rcu_read_lock();
-                opp = opp_find_freq_exact(cpu_dev,
+                opp = dev_pm_opp_find_freq_exact(cpu_dev,
                                 freq_table[0].frequency * 1000, true);
-                min_uV = opp_get_voltage(opp);
-                opp = opp_find_freq_exact(cpu_dev,
+                min_uV = dev_pm_opp_get_voltage(opp);
+                opp = dev_pm_opp_find_freq_exact(cpu_dev,
                                 freq_table[i-1].frequency * 1000, true);
-                max_uV = opp_get_voltage(opp);
+                max_uV = dev_pm_opp_get_voltage(opp);
                 rcu_read_unlock();
                 ret = regulator_set_voltage_time(cpu_reg, min_uV, max_uV);
                 if (ret > 0)
@@ -264,7 +205,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
         return 0;
 
 out_free_table:
-        opp_free_cpufreq_table(cpu_dev, &freq_table);
+        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
 out_put_node:
         of_node_put(np);
         return ret;
@@ -273,7 +214,7 @@ out_put_node:
 static int cpu0_cpufreq_remove(struct platform_device *pdev)
 {
         cpufreq_unregister_driver(&cpu0_cpufreq_driver);
-        opp_free_cpufreq_table(cpu_dev, &freq_table);
+        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
 
         return 0;
 }
diff --git a/drivers/cpufreq/cpufreq-nforce2.c b/drivers/cpufreq/cpufreq-nforce2.c
index b83d45f68574..a05b876f375e 100644
--- a/drivers/cpufreq/cpufreq-nforce2.c
+++ b/drivers/cpufreq/cpufreq-nforce2.c
@@ -303,9 +303,7 @@ static int nforce2_verify(struct cpufreq_policy *policy)
         if (policy->min < (fsb_pol_max * fid * 100))
                 policy->max = (fsb_pol_max + 1) * fid * 100;
 
-        cpufreq_verify_within_limits(policy,
-                                     policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
         return 0;
 }
 
@@ -362,7 +360,6 @@ static int nforce2_cpu_init(struct cpufreq_policy *policy)
         policy->min = policy->cpuinfo.min_freq = min_fsb * fid * 100;
         policy->max = policy->cpuinfo.max_freq = max_fsb * fid * 100;
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        policy->cur = nforce2_get(policy->cpu);
 
         return 0;
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 89b3c52cd5c3..02d534da22dd 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -47,49 +47,11 @@ static LIST_HEAD(cpufreq_policy_list);
 static DEFINE_PER_CPU(char[CPUFREQ_NAME_LEN], cpufreq_cpu_governor);
 #endif
 
-/*
- * cpu_policy_rwsem is a per CPU reader-writer semaphore designed to cure
- * all cpufreq/hotplug/workqueue/etc related lock issues.
- *
- * The rules for this semaphore:
- * - Any routine that wants to read from the policy structure will
- *   do a down_read on this semaphore.
- * - Any routine that will write to the policy structure and/or may take away
- *   the policy altogether (eg. CPU hotplug), will hold this lock in write
- *   mode before doing so.
- *
- * Additional rules:
- * - Governor routines that can be called in cpufreq hotplug path should not
- *   take this sem as top level hotplug notifier handler takes this.
- * - Lock should not be held across
- *     __cpufreq_governor(data, CPUFREQ_GOV_STOP);
- */
-static DEFINE_PER_CPU(struct rw_semaphore, cpu_policy_rwsem);
-
-#define lock_policy_rwsem(mode, cpu)                                    \
-static int lock_policy_rwsem_##mode(int cpu)                            \
-{                                                                       \
-        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu); \
-        BUG_ON(!policy);                                                \
-        down_##mode(&per_cpu(cpu_policy_rwsem, policy->cpu));           \
-                                                                        \
-        return 0;                                                       \
-}
-
-lock_policy_rwsem(read, cpu);
-lock_policy_rwsem(write, cpu);
-
-#define unlock_policy_rwsem(mode, cpu)                                  \
-static void unlock_policy_rwsem_##mode(int cpu)                         \
-{                                                                       \
-        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu); \
-        BUG_ON(!policy);                                                \
-        up_##mode(&per_cpu(cpu_policy_rwsem, policy->cpu));             \
+static inline bool has_target(void)
+{
+        return cpufreq_driver->target_index || cpufreq_driver->target;
 }
 
-unlock_policy_rwsem(read, cpu);
-unlock_policy_rwsem(write, cpu);
-
 /*
  * rwsem to guarantee that cpufreq driver module doesn't unload during critical
  * sections
@@ -135,7 +97,7 @@ static DEFINE_MUTEX(cpufreq_governor_mutex);
 
 bool have_governor_per_policy(void)
 {
-        return cpufreq_driver->have_governor_per_policy;
+        return !!(cpufreq_driver->flags & CPUFREQ_HAVE_GOVERNOR_PER_POLICY);
 }
 EXPORT_SYMBOL_GPL(have_governor_per_policy);
 
@@ -183,6 +145,37 @@ u64 get_cpu_idle_time(unsigned int cpu, u64 *wall, int io_busy)
 }
 EXPORT_SYMBOL_GPL(get_cpu_idle_time);
 
+/*
+ * This is a generic cpufreq init() routine which can be used by cpufreq
+ * drivers of SMP systems. It will do following:
+ * - validate & show freq table passed
+ * - set policies transition latency
+ * - policy->cpus with all possible CPUs
+ */
+int cpufreq_generic_init(struct cpufreq_policy *policy,
+                struct cpufreq_frequency_table *table,
+                unsigned int transition_latency)
+{
+        int ret;
+
+        ret = cpufreq_table_validate_and_show(policy, table);
+        if (ret) {
+                pr_err("%s: invalid frequency table: %d\n", __func__, ret);
+                return ret;
+        }
+
+        policy->cpuinfo.transition_latency = transition_latency;
+
+        /*
+         * The driver only supports the SMP configuartion where all processors
+         * share the clock and voltage and clock.
+         */
+        cpumask_setall(policy->cpus);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cpufreq_generic_init);
+
 struct cpufreq_policy *cpufreq_cpu_get(unsigned int cpu)
 {
         struct cpufreq_policy *policy = NULL;
@@ -363,7 +356,7 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy,
                         *policy = CPUFREQ_POLICY_POWERSAVE;
                         err = 0;
                 }
-        } else if (cpufreq_driver->target) {
+        } else if (has_target()) {
                 struct cpufreq_governor *t;
 
                 mutex_lock(&cpufreq_governor_mutex);
@@ -414,7 +407,7 @@ show_one(scaling_min_freq, min);
 show_one(scaling_max_freq, max);
 show_one(scaling_cur_freq, cur);
 
-static int __cpufreq_set_policy(struct cpufreq_policy *policy,
+static int cpufreq_set_policy(struct cpufreq_policy *policy,
                                 struct cpufreq_policy *new_policy);
 
 /**
@@ -435,7 +428,7 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
-        ret = __cpufreq_set_policy(policy, &new_policy);                \
+        ret = cpufreq_set_policy(policy, &new_policy);          \
         policy->user_policy.object = policy->object;                    \
                                                                         \
         return ret ? ret : count;                                       \
@@ -493,11 +486,7 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy,
                                                 &new_policy.governor))
                 return -EINVAL;
 
-        /*
-         * Do not use cpufreq_set_policy here or the user_policy.max
-         * will be wrongly overridden
-         */
-        ret = __cpufreq_set_policy(policy, &new_policy);
+        ret = cpufreq_set_policy(policy, &new_policy);
 
         policy->user_policy.policy = policy->policy;
         policy->user_policy.governor = policy->governor;
@@ -525,7 +514,7 @@ static ssize_t show_scaling_available_governors(struct cpufreq_policy *policy,
         ssize_t i = 0;
         struct cpufreq_governor *t;
 
-        if (!cpufreq_driver->target) {
+        if (!has_target()) {
                 i += sprintf(buf, "performance powersave");
                 goto out;
         }
@@ -653,24 +642,21 @@ static ssize_t show(struct kobject *kobj, struct attribute *attr, char *buf)
 {
         struct cpufreq_policy *policy = to_policy(kobj);
         struct freq_attr *fattr = to_attr(attr);
-        ssize_t ret = -EINVAL;
+        ssize_t ret;
 
         if (!down_read_trylock(&cpufreq_rwsem))
-                goto exit;
+                return -EINVAL;
 
-        if (lock_policy_rwsem_read(policy->cpu) < 0)
-                goto up_read;
+        down_read(&policy->rwsem);
 
         if (fattr->show)
                 ret = fattr->show(policy, buf);
         else
                 ret = -EIO;
 
-        unlock_policy_rwsem_read(policy->cpu);
-
-up_read:
+        up_read(&policy->rwsem);
         up_read(&cpufreq_rwsem);
-exit:
+
         return ret;
 }
 
@@ -689,17 +675,15 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
         if (!down_read_trylock(&cpufreq_rwsem))
                 goto unlock;
 
-        if (lock_policy_rwsem_write(policy->cpu) < 0)
-                goto up_read;
+        down_write(&policy->rwsem);
 
         if (fattr->store)
                 ret = fattr->store(policy, buf, count);
         else
                 ret = -EIO;
 
-        unlock_policy_rwsem_write(policy->cpu);
+        up_write(&policy->rwsem);
 
-up_read:
         up_read(&cpufreq_rwsem);
 unlock:
         put_online_cpus();
@@ -815,7 +799,7 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy,
                 if (ret)
                         goto err_out_kobj_put;
         }
-        if (cpufreq_driver->target) {
+        if (has_target()) {
                 ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
                 if (ret)
                         goto err_out_kobj_put;
@@ -844,11 +828,11 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
         int ret = 0;
 
         memcpy(&new_policy, policy, sizeof(*policy));
-        /* assure that the starting sequence is run in __cpufreq_set_policy */
+        /* assure that the starting sequence is run in cpufreq_set_policy */
         policy->governor = NULL;
 
         /* set default policy */
-        ret = __cpufreq_set_policy(policy, &new_policy);
+        ret = cpufreq_set_policy(policy, &new_policy);
         policy->user_policy.policy = policy->policy;
         policy->user_policy.governor = policy->governor;
 
@@ -864,10 +848,10 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
                                   unsigned int cpu, struct device *dev,
                                   bool frozen)
 {
-        int ret = 0, has_target = !!cpufreq_driver->target;
+        int ret = 0;
         unsigned long flags;
 
-        if (has_target) {
+        if (has_target()) {
                 ret = __cpufreq_governor(policy, CPUFREQ_GOV_STOP);
                 if (ret) {
                         pr_err("%s: Failed to stop governor\n", __func__);
@@ -875,7 +859,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
                 }
         }
 
-        lock_policy_rwsem_write(policy->cpu);
+        down_write(&policy->rwsem);
 
         write_lock_irqsave(&cpufreq_driver_lock, flags);
 
@@ -883,9 +867,9 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
         per_cpu(cpufreq_cpu_data, cpu) = policy;
         write_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
-        unlock_policy_rwsem_write(policy->cpu);
+        up_write(&policy->rwsem);
 
-        if (has_target) {
+        if (has_target()) {
                 if ((ret = __cpufreq_governor(policy, CPUFREQ_GOV_START)) ||
                         (ret = __cpufreq_governor(policy, CPUFREQ_GOV_LIMITS))) {
                         pr_err("%s: Failed to start governor\n", __func__);
@@ -930,6 +914,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(void)
                 goto err_free_cpumask;
 
         INIT_LIST_HEAD(&policy->policy_list);
+        init_rwsem(&policy->rwsem);
+
         return policy;
 
 err_free_cpumask:
@@ -949,26 +935,17 @@ static void cpufreq_policy_free(struct cpufreq_policy *policy)
 
 static void update_policy_cpu(struct cpufreq_policy *policy, unsigned int cpu)
 {
-        if (cpu == policy->cpu)
+        if (WARN_ON(cpu == policy->cpu))
                 return;
 
-        /*
-         * Take direct locks as lock_policy_rwsem_write wouldn't work here.
-         * Also lock for last cpu is enough here as contention will happen only
-         * after policy->cpu is changed and after it is changed, other threads
-         * will try to acquire lock for new cpu. And policy is already updated
-         * by then.
-         */
-        down_write(&per_cpu(cpu_policy_rwsem, policy->cpu));
+        down_write(&policy->rwsem);
 
         policy->last_cpu = policy->cpu;
         policy->cpu = cpu;
 
-        up_write(&per_cpu(cpu_policy_rwsem, policy->last_cpu));
+        up_write(&policy->rwsem);
 
-#ifdef CONFIG_CPU_FREQ_TABLE
         cpufreq_frequency_table_update_policy_cpu(policy);
-#endif
         blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                         CPUFREQ_UPDATE_POLICY_CPU, policy);
 }
@@ -1053,6 +1030,14 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
                 goto err_set_policy_cpu;
         }
 
+        if (cpufreq_driver->get) {
+                policy->cur = cpufreq_driver->get(policy->cpu);
+                if (!policy->cur) {
+                        pr_err("%s: ->get() failed\n", __func__);
+                        goto err_get_freq;
+                }
+        }
+
         /* related cpus should atleast have policy->cpus */
         cpumask_or(policy->related_cpus, policy->related_cpus, policy->cpus);
 
@@ -1107,6 +1092,9 @@ err_out_unregister:
                 per_cpu(cpufreq_cpu_data, j) = NULL;
         write_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
+err_get_freq:
+        if (cpufreq_driver->exit)
+                cpufreq_driver->exit(policy);
 err_set_policy_cpu:
         cpufreq_policy_free(policy);
 nomem_out:
@@ -1147,9 +1135,9 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
         if (ret) {
                 pr_err("%s: Failed to move kobj: %d", __func__, ret);
 
-                WARN_ON(lock_policy_rwsem_write(old_cpu));
+                down_write(&policy->rwsem);
                 cpumask_set_cpu(old_cpu, policy->cpus);
-                unlock_policy_rwsem_write(old_cpu);
+                up_write(&policy->rwsem);
 
                 ret = sysfs_create_link(&cpu_dev->kobj, &policy->kobj,
                                         "cpufreq");
@@ -1186,7 +1174,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                 return -EINVAL;
         }
 
-        if (cpufreq_driver->target) {
+        if (has_target()) {
                 ret = __cpufreq_governor(policy, CPUFREQ_GOV_STOP);
                 if (ret) {
                         pr_err("%s: Failed to stop governor\n", __func__);
@@ -1200,22 +1188,21 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                         policy->governor->name, CPUFREQ_NAME_LEN);
 #endif
 
-        lock_policy_rwsem_read(cpu);
+        down_read(&policy->rwsem);
         cpus = cpumask_weight(policy->cpus);
-        unlock_policy_rwsem_read(cpu);
+        up_read(&policy->rwsem);
 
         if (cpu != policy->cpu) {
                 if (!frozen)
                         sysfs_remove_link(&dev->kobj, "cpufreq");
         } else if (cpus > 1) {
-
                 new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen);
                 if (new_cpu >= 0) {
                         update_policy_cpu(policy, new_cpu);
 
                         if (!frozen) {
-                                pr_debug("%s: policy Kobject moved to cpu: %d "
-                                         "from: %d\n",__func__, new_cpu, cpu);
+                                pr_debug("%s: policy Kobject moved to cpu: %d from: %d\n",
+                                                __func__, new_cpu, cpu);
                         }
                 }
         }
@@ -1243,16 +1230,16 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                 return -EINVAL;
         }
 
-        WARN_ON(lock_policy_rwsem_write(cpu));
+        down_write(&policy->rwsem);
         cpus = cpumask_weight(policy->cpus);
 
         if (cpus > 1)
                 cpumask_clear_cpu(cpu, policy->cpus);
-        unlock_policy_rwsem_write(cpu);
+        up_write(&policy->rwsem);
 
         /* If cpu is last user of policy, free policy */
         if (cpus == 1) {
-                if (cpufreq_driver->target) {
+                if (has_target()) {
                         ret = __cpufreq_governor(policy,
                                         CPUFREQ_GOV_POLICY_EXIT);
                         if (ret) {
@@ -1263,10 +1250,10 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                 }
 
                 if (!frozen) {
-                        lock_policy_rwsem_read(cpu);
+                        down_read(&policy->rwsem);
                         kobj = &policy->kobj;
                         cmp = &policy->kobj_unregister;
-                        unlock_policy_rwsem_read(cpu);
+                        up_read(&policy->rwsem);
                         kobject_put(kobj);
 
                         /*
@@ -1295,7 +1282,7 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                 if (!frozen)
                         cpufreq_policy_free(policy);
         } else {
-                if (cpufreq_driver->target) {
+                if (has_target()) {
                         if ((ret = __cpufreq_governor(policy, CPUFREQ_GOV_START)) ||
                                         (ret = __cpufreq_governor(policy, CPUFREQ_GOV_LIMITS))) {
                                 pr_err("%s: Failed to start governor\n",
@@ -1310,36 +1297,24 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
 }
 
 /**
- * __cpufreq_remove_dev - remove a CPU device
+ * cpufreq_remove_dev - remove a CPU device
  *
  * Removes the cpufreq interface for a CPU device.
- * Caller should already have policy_rwsem in write mode for this CPU.
- * This routine frees the rwsem before returning.
  */
-static inline int __cpufreq_remove_dev(struct device *dev,
-                                       struct subsys_interface *sif,
-                                       bool frozen)
-{
-        int ret;
-
-        ret = __cpufreq_remove_dev_prepare(dev, sif, frozen);
-
-        if (!ret)
-                ret = __cpufreq_remove_dev_finish(dev, sif, frozen);
-
-        return ret;
-}
-
 static int cpufreq_remove_dev(struct device *dev, struct subsys_interface *sif)
 {
         unsigned int cpu = dev->id;
-        int retval;
+        int ret;
 
         if (cpu_is_offline(cpu))
                 return 0;
 
-        retval = __cpufreq_remove_dev(dev, sif, false);
-        return retval;
+        ret = __cpufreq_remove_dev_prepare(dev, sif, false);
+
+        if (!ret)
+                ret = __cpufreq_remove_dev_finish(dev, sif, false);
+
+        return ret;
 }
 
 static void handle_update(struct work_struct *work)
@@ -1458,19 +1433,22 @@ static unsigned int __cpufreq_get(unsigned int cpu)
  */
 unsigned int cpufreq_get(unsigned int cpu)
 {
+        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
         unsigned int ret_freq = 0;
 
+        if (cpufreq_disabled() || !cpufreq_driver)
+                return -ENOENT;
+
+        BUG_ON(!policy);
+
         if (!down_read_trylock(&cpufreq_rwsem))
                 return 0;
 
-        if (unlikely(lock_policy_rwsem_read(cpu)))
-                goto out_policy;
+        down_read(&policy->rwsem);
 
         ret_freq = __cpufreq_get(cpu);
 
-        unlock_policy_rwsem_read(cpu);
-
-out_policy:
+        up_read(&policy->rwsem);
         up_read(&cpufreq_rwsem);
 
         return ret_freq;
@@ -1678,12 +1656,75 @@ int __cpufreq_driver_target(struct cpufreq_policy *policy,
         pr_debug("target for CPU %u: %u kHz, relation %u, requested %u kHz\n",
                         policy->cpu, target_freq, relation, old_target_freq);
 
+        /*
+         * This might look like a redundant call as we are checking it again
+         * after finding index. But it is left intentionally for cases where
+         * exactly same freq is called again and so we can save on few function
+         * calls.
+         */
         if (target_freq == policy->cur)
                 return 0;
 
         if (cpufreq_driver->target)
                 retval = cpufreq_driver->target(policy, target_freq, relation);
+        else if (cpufreq_driver->target_index) {
+                struct cpufreq_frequency_table *freq_table;
+                struct cpufreq_freqs freqs;
+                bool notify;
+                int index;
+
+                freq_table = cpufreq_frequency_get_table(policy->cpu);
+                if (unlikely(!freq_table)) {
+                        pr_err("%s: Unable to find freq_table\n", __func__);
+                        goto out;
+                }
+
+                retval = cpufreq_frequency_table_target(policy, freq_table,
+                                target_freq, relation, &index);
+                if (unlikely(retval)) {
+                        pr_err("%s: Unable to find matching freq\n", __func__);
+                        goto out;
+                }
+
+                if (freq_table[index].frequency == policy->cur) {
+                        retval = 0;
+                        goto out;
+                }
+
+                notify = !(cpufreq_driver->flags & CPUFREQ_ASYNC_NOTIFICATION);
+
+                if (notify) {
+                        freqs.old = policy->cur;
+                        freqs.new = freq_table[index].frequency;
+                        freqs.flags = 0;
+
+                        pr_debug("%s: cpu: %d, oldfreq: %u, new freq: %u\n",
+                                        __func__, policy->cpu, freqs.old,
+                                        freqs.new);
+
+                        cpufreq_notify_transition(policy, &freqs,
+                                        CPUFREQ_PRECHANGE);
+                }
+
+                retval = cpufreq_driver->target_index(policy, index);
+                if (retval)
+                        pr_err("%s: Failed to change cpu frequency: %d\n",
+                                        __func__, retval);
+
+                if (notify) {
+                        /*
+                         * Notify with old freq in case we failed to change
+                         * frequency
+                         */
+                        if (retval)
+                                freqs.new = freqs.old;
+
+                        cpufreq_notify_transition(policy, &freqs,
+                                        CPUFREQ_POSTCHANGE);
+                }
+        }
 
+out:
         return retval;
 }
 EXPORT_SYMBOL_GPL(__cpufreq_driver_target);
@@ -1694,14 +1735,12 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
 {
         int ret = -EINVAL;
 
-        if (unlikely(lock_policy_rwsem_write(policy->cpu)))
-                goto fail;
+        down_write(&policy->rwsem);
 
         ret = __cpufreq_driver_target(policy, target_freq, relation);
 
-        unlock_policy_rwsem_write(policy->cpu);
+        up_write(&policy->rwsem);
 
-fail:
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
@@ -1868,10 +1907,10 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_get_policy);
 
 /*
- * data   : current policy.
- * policy : policy to be set.
+ * policy : current policy.
+ * new_policy: policy to be set.
  */
-static int __cpufreq_set_policy(struct cpufreq_policy *policy,
+static int cpufreq_set_policy(struct cpufreq_policy *policy,
                                 struct cpufreq_policy *new_policy)
 {
         int ret = 0, failed = 1;
@@ -1931,10 +1970,10 @@ static int __cpufreq_set_policy(struct cpufreq_policy *policy,
                         /* end old governor */
                         if (policy->governor) {
                                 __cpufreq_governor(policy, CPUFREQ_GOV_STOP);
-                                unlock_policy_rwsem_write(new_policy->cpu);
+                                up_write(&policy->rwsem);
                                 __cpufreq_governor(policy,
                                                 CPUFREQ_GOV_POLICY_EXIT);
-                                lock_policy_rwsem_write(new_policy->cpu);
+                                down_write(&policy->rwsem);
                         }
 
                         /* start new governor */
@@ -1943,10 +1982,10 @@ static int __cpufreq_set_policy(struct cpufreq_policy *policy,
                                 if (!__cpufreq_governor(policy, CPUFREQ_GOV_START)) {
                                         failed = 0;
                                 } else {
-                                        unlock_policy_rwsem_write(new_policy->cpu);
+                                        up_write(&policy->rwsem);
                                         __cpufreq_governor(policy,
                                                         CPUFREQ_GOV_POLICY_EXIT);
-                                        lock_policy_rwsem_write(new_policy->cpu);
+                                        down_write(&policy->rwsem);
                                 }
                         }
 
@@ -1992,10 +2031,7 @@ int cpufreq_update_policy(unsigned int cpu)
                 goto no_policy;
         }
 
-        if (unlikely(lock_policy_rwsem_write(cpu))) {
-                ret = -EINVAL;
-                goto fail;
-        }
+        down_write(&policy->rwsem);
 
         pr_debug("updating policy for CPU %u\n", cpu);
         memcpy(&new_policy, policy, sizeof(*policy));
@@ -2014,17 +2050,16 @@ int cpufreq_update_policy(unsigned int cpu)
                         pr_debug("Driver did not initialize current freq");
                         policy->cur = new_policy.cur;
                 } else {
-                        if (policy->cur != new_policy.cur && cpufreq_driver->target)
+                        if (policy->cur != new_policy.cur && has_target())
                                 cpufreq_out_of_sync(cpu, policy->cur,
                                                                 new_policy.cur);
                 }
         }
 
-        ret = __cpufreq_set_policy(policy, &new_policy);
+        ret = cpufreq_set_policy(policy, &new_policy);
 
-        unlock_policy_rwsem_write(cpu);
+        up_write(&policy->rwsem);
 
-fail:
         cpufreq_cpu_put(policy);
 no_policy:
         return ret;
@@ -2093,7 +2128,8 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
                 return -ENODEV;
 
         if (!driver_data || !driver_data->verify || !driver_data->init ||
-            ((!driver_data->setpolicy) && (!driver_data->target)))
+            !(driver_data->setpolicy || driver_data->target_index ||
+                    driver_data->target))
                 return -EINVAL;
 
         pr_debug("trying to register driver %s\n", driver_data->name);
@@ -2180,14 +2216,9 @@ EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
 
 static int __init cpufreq_core_init(void)
 {
-        int cpu;
-
         if (cpufreq_disabled())
                 return -ENODEV;
 
-        for_each_possible_cpu(cpu)
-                init_rwsem(&per_cpu(cpu_policy_rwsem, cpu));
-
         cpufreq_global_kobject = kobject_create();
         BUG_ON(!cpufreq_global_kobject);
         register_syscore_ops(&cpufreq_syscore_ops);
diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
index 88cd39f7b0e9..b5f2b8618949 100644
--- a/drivers/cpufreq/cpufreq_governor.h
+++ b/drivers/cpufreq/cpufreq_governor.h
@@ -191,7 +191,10 @@ struct common_dbs_data {
         struct attribute_group *attr_group_gov_sys; /* one governor - system */
         struct attribute_group *attr_group_gov_pol; /* one governor - policy */
 
-        /* Common data for platforms that don't set have_governor_per_policy */
+        /*
+         * Common data for platforms that don't set
+         * CPUFREQ_HAVE_GOVERNOR_PER_POLICY
+         */
         struct dbs_data *gdbs_data;
 
         struct cpu_dbs_common_info *(*get_cpu_cdbs)(int cpu);
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 32f26f6e17c5..18d409189092 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -168,7 +168,6 @@ static void od_check_cpu(int cpu, unsigned int load)
                         dbs_info->rate_mult =
                                 od_tuners->sampling_down_factor;
                 dbs_freq_increase(policy, policy->max);
-                return;
         } else {
                 /* Calculate the next frequency proportional to load */
                 unsigned int freq_next;
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 03078090b5f7..4dbf1db16aca 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -38,18 +38,7 @@ static int cpufreq_set(struct cpufreq_policy *policy, unsigned int freq)
         if (!per_cpu(cpu_is_managed, policy->cpu))
                 goto err;
 
-        /*
-         * We're safe from concurrent calls to ->target() here
-         * as we hold the userspace_mutex lock. If we were calling
-         * cpufreq_driver_target, a deadlock situation might occur:
-         * A: cpufreq_set (lock userspace_mutex) ->
-         *      cpufreq_driver_target(lock policy->lock)
-         * B: cpufreq_set_policy(lock policy->lock) ->
-         *      __cpufreq_governor ->
-         *         cpufreq_governor_userspace (lock userspace_mutex)
-         */
         ret = __cpufreq_driver_target(policy, freq, CPUFREQ_RELATION_L);
-
  err:
         mutex_unlock(&userspace_mutex);
         return ret;
diff --git a/drivers/cpufreq/cris-artpec3-cpufreq.c b/drivers/cpufreq/cris-artpec3-cpufreq.c
index cb8276dd19ca..86559040c54c 100644
--- a/drivers/cpufreq/cris-artpec3-cpufreq.c
+++ b/drivers/cpufreq/cris-artpec3-cpufreq.c
@@ -27,18 +27,11 @@ static unsigned int cris_freq_get_cpu_frequency(unsigned int cpu)
         return clk_ctrl.pll ? 200000 : 6000;
 }
 
-static void cris_freq_set_cpu_state(struct cpufreq_policy *policy,
-                unsigned int state)
+static int cris_freq_target(struct cpufreq_policy *policy, unsigned int state)
 {
-        struct cpufreq_freqs freqs;
         reg_clkgen_rw_clk_ctrl clk_ctrl;
         clk_ctrl = REG_RD(clkgen, regi_clkgen, rw_clk_ctrl);
 
-        freqs.old = cris_freq_get_cpu_frequency(policy->cpu);
-        freqs.new = cris_freq_table[state].frequency;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         local_irq_disable();
 
         /* Even though we may be SMP they will share the same clock
@@ -51,67 +44,22 @@ static void cris_freq_set_cpu_state(struct cpufreq_policy *policy,
 
         local_irq_enable();
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-};
-
-static int cris_freq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &cris_freq_table[0]);
-}
-
-static int cris_freq_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq,
-                            unsigned int relation)
-{
-        unsigned int newstate = 0;
-
-        if (cpufreq_frequency_table_target(policy, cris_freq_table,
-                        target_freq, relation, &newstate))
-                return -EINVAL;
-
-        cris_freq_set_cpu_state(policy, newstate);
-
         return 0;
 }
 
 static int cris_freq_cpu_init(struct cpufreq_policy *policy)
 {
-        int result;
-
-        /* cpuinfo and default policy values */
-        policy->cpuinfo.transition_latency = 1000000; /* 1ms */
-        policy->cur = cris_freq_get_cpu_frequency(0);
-
-        result = cpufreq_frequency_table_cpuinfo(policy, cris_freq_table);
-        if (result)
-                return (result);
-
-        cpufreq_frequency_table_get_attr(cris_freq_table, policy->cpu);
-
-        return 0;
-}
-
-
-static int cris_freq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_generic_init(policy, cris_freq_table, 1000000);
 }
 
-
-static struct freq_attr *cris_freq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver cris_freq_driver = {
         .get    = cris_freq_get_cpu_frequency,
-        .verify = cris_freq_verify,
-        .target = cris_freq_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = cris_freq_target,
         .init   = cris_freq_cpu_init,
-        .exit   = cris_freq_cpu_exit,
+        .exit   = cpufreq_generic_exit,
         .name   = "cris_freq",
-        .attr   = cris_freq_attr,
+        .attr   = cpufreq_generic_attr,
 };
 
 static int __init cris_freq_init(void)
diff --git a/drivers/cpufreq/cris-etraxfs-cpufreq.c b/drivers/cpufreq/cris-etraxfs-cpufreq.c
index 72328f77dc53..26d940d40b1d 100644
--- a/drivers/cpufreq/cris-etraxfs-cpufreq.c
+++ b/drivers/cpufreq/cris-etraxfs-cpufreq.c
@@ -27,18 +27,11 @@ static unsigned int cris_freq_get_cpu_frequency(unsigned int cpu)
         return clk_ctrl.pll ? 200000 : 6000;
 }
 
-static void cris_freq_set_cpu_state(struct cpufreq_policy *policy,
-                unsigned int state)
+static int cris_freq_target(struct cpufreq_policy *policy, unsigned int state)
 {
-        struct cpufreq_freqs freqs;
         reg_config_rw_clk_ctrl clk_ctrl;
         clk_ctrl = REG_RD(config, regi_config, rw_clk_ctrl);
 
-        freqs.old = cris_freq_get_cpu_frequency(policy->cpu);
-        freqs.new = cris_freq_table[state].frequency;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         local_irq_disable();
 
         /* Even though we may be SMP they will share the same clock
@@ -51,64 +44,22 @@ static void cris_freq_set_cpu_state(struct cpufreq_policy *policy,
 
         local_irq_enable();
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-};
-
-static int cris_freq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &cris_freq_table[0]);
-}
-
-static int cris_freq_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq, unsigned int relation)
-{
-        unsigned int newstate = 0;
-
-        if (cpufreq_frequency_table_target
-            (policy, cris_freq_table, target_freq, relation, &newstate))
-                return -EINVAL;
-
-        cris_freq_set_cpu_state(policy, newstate);
-
         return 0;
 }
 
 static int cris_freq_cpu_init(struct cpufreq_policy *policy)
 {
-        int result;
-
-        /* cpuinfo and default policy values */
-        policy->cpuinfo.transition_latency = 1000000;   /* 1ms */
-        policy->cur = cris_freq_get_cpu_frequency(0);
-
-        result = cpufreq_frequency_table_cpuinfo(policy, cris_freq_table);
-        if (result)
-                return (result);
-
-        cpufreq_frequency_table_get_attr(cris_freq_table, policy->cpu);
-
-        return 0;
+        return cpufreq_generic_init(policy, cris_freq_table, 1000000);
 }
 
-static int cris_freq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
-}
-
-static struct freq_attr *cris_freq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver cris_freq_driver = {
         .get = cris_freq_get_cpu_frequency,
-        .verify = cris_freq_verify,
-        .target = cris_freq_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = cris_freq_target,
         .init = cris_freq_cpu_init,
-        .exit = cris_freq_cpu_exit,
+        .exit = cpufreq_generic_exit,
         .name = "cris_freq",
-        .attr = cris_freq_attr,
+        .attr = cpufreq_generic_attr,
 };
 
 static int __init cris_freq_init(void)
diff --git a/drivers/cpufreq/davinci-cpufreq.c b/drivers/cpufreq/davinci-cpufreq.c
index 551dd655c6f2..5e8a854381b7 100644
--- a/drivers/cpufreq/davinci-cpufreq.c
+++ b/drivers/cpufreq/davinci-cpufreq.c
@@ -50,9 +50,7 @@ static int davinci_verify_speed(struct cpufreq_policy *policy)
         if (policy->cpu)
                 return -EINVAL;
 
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
-
+        cpufreq_verify_within_cpu_limits(policy);
         policy->min = clk_round_rate(armclk, policy->min * 1000) / 1000;
         policy->max = clk_round_rate(armclk, policy->max * 1000) / 1000;
         cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
@@ -68,58 +66,38 @@ static unsigned int davinci_getspeed(unsigned int cpu)
         return clk_get_rate(cpufreq.armclk) / 1000;
 }
 
-static int davinci_target(struct cpufreq_policy *policy,
-                                unsigned int target_freq, unsigned int relation)
+static int davinci_target(struct cpufreq_policy *policy, unsigned int idx)
 {
-        int ret = 0;
-        unsigned int idx;
-        struct cpufreq_freqs freqs;
         struct davinci_cpufreq_config *pdata = cpufreq.dev->platform_data;
         struct clk *armclk = cpufreq.armclk;
+        unsigned int old_freq, new_freq;
+        int ret = 0;
 
-        freqs.old = davinci_getspeed(0);
-        freqs.new = clk_round_rate(armclk, target_freq * 1000) / 1000;
-
-        if (freqs.old == freqs.new)
-                return ret;
-
-        dev_dbg(cpufreq.dev, "transition: %u --> %u\n", freqs.old, freqs.new);
-
-        ret = cpufreq_frequency_table_target(policy, pdata->freq_table,
-                                                freqs.new, relation, &idx);
-        if (ret)
-                return -EINVAL;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+        old_freq = davinci_getspeed(0);
+        new_freq = pdata->freq_table[idx].frequency;
 
         /* if moving to higher frequency, up the voltage beforehand */
-        if (pdata->set_voltage && freqs.new > freqs.old) {
+        if (pdata->set_voltage && new_freq > old_freq) {
                 ret = pdata->set_voltage(idx);
                 if (ret)
-                        goto out;
+                        return ret;
         }
 
         ret = clk_set_rate(armclk, idx);
         if (ret)
-                goto out;
+                return ret;
 
         if (cpufreq.asyncclk) {
                 ret = clk_set_rate(cpufreq.asyncclk, cpufreq.asyncrate);
                 if (ret)
-                        goto out;
+                        return ret;
         }
 
         /* if moving to lower freq, lower the voltage after lowering freq */
-        if (pdata->set_voltage && freqs.new < freqs.old)
+        if (pdata->set_voltage && new_freq < old_freq)
                 pdata->set_voltage(idx);
 
-out:
-        if (ret)
-                freqs.new = freqs.old;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        return ret;
+        return 0;
 }
 
 static int davinci_cpu_init(struct cpufreq_policy *policy)
@@ -138,47 +116,24 @@ static int davinci_cpu_init(struct cpufreq_policy *policy)
                         return result;
         }
 
-        policy->cur = davinci_getspeed(0);
-
-        result = cpufreq_frequency_table_cpuinfo(policy, freq_table);
-        if (result) {
-                pr_err("%s: cpufreq_frequency_table_cpuinfo() failed",
-                                __func__);
-                return result;
-        }
-
-        cpufreq_frequency_table_get_attr(freq_table, policy->cpu);
-
         /*
          * Time measurement across the target() function yields ~1500-1800us
          * time taken with no drivers on notification list.
          * Setting the latency to 2000 us to accommodate addition of drivers
          * to pre/post change notification list.
          */
-        policy->cpuinfo.transition_latency = 2000 * 1000;
-        return 0;
+        return cpufreq_generic_init(policy, freq_table, 2000 * 1000);
 }
 
-static int davinci_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
-}
-
-static struct freq_attr *davinci_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver davinci_driver = {
         .flags          = CPUFREQ_STICKY,
         .verify         = davinci_verify_speed,
-        .target         = davinci_target,
+        .target_index   = davinci_target,
         .get            = davinci_getspeed,
         .init           = davinci_cpu_init,
-        .exit           = davinci_cpu_exit,
+        .exit           = cpufreq_generic_exit,
         .name           = "davinci",
-        .attr           = davinci_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int __init davinci_cpufreq_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/dbx500-cpufreq.c b/drivers/cpufreq/dbx500-cpufreq.c
index 26321cdc1946..0e67ab96321a 100644
--- a/drivers/cpufreq/dbx500-cpufreq.c
+++ b/drivers/cpufreq/dbx500-cpufreq.c
@@ -19,51 +19,11 @@
 static struct cpufreq_frequency_table *freq_table;
 static struct clk *armss_clk;
 
-static struct freq_attr *dbx500_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
-static int dbx500_cpufreq_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, freq_table);
-}
-
 static int dbx500_cpufreq_target(struct cpufreq_policy *policy,
-                                unsigned int target_freq,
-                                unsigned int relation)
+                                unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        unsigned int idx;
-        int ret;
-
-        /* Lookup the next frequency */
-        if (cpufreq_frequency_table_target(policy, freq_table, target_freq,
-                                        relation, &idx))
-                return -EINVAL;
-
-        freqs.old = policy->cur;
-        freqs.new = freq_table[idx].frequency;
-
-        if (freqs.old == freqs.new)
-                return 0;
-
-        /* pre-change notification */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         /* update armss clk frequency */
-        ret = clk_set_rate(armss_clk, freqs.new * 1000);
-
-        if (ret) {
-                pr_err("dbx500-cpufreq: Failed to set armss_clk to %d Hz: error %d\n",
-                       freqs.new * 1000, ret);
-                freqs.new = freqs.old;
-        }
-
-        /* post change notification */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        return ret;
+        return clk_set_rate(armss_clk, freq_table[index].frequency * 1000);
 }
 
 static unsigned int dbx500_cpufreq_getspeed(unsigned int cpu)
@@ -84,43 +44,17 @@ static unsigned int dbx500_cpufreq_getspeed(unsigned int cpu)
 
 static int dbx500_cpufreq_init(struct cpufreq_policy *policy)
 {
-        int res;
-
-        /* get policy fields based on the table */
-        res = cpufreq_frequency_table_cpuinfo(policy, freq_table);
-        if (!res)
-                cpufreq_frequency_table_get_attr(freq_table, policy->cpu);
-        else {
-                pr_err("dbx500-cpufreq: Failed to read policy table\n");
-                return res;
-        }
-
-        policy->min = policy->cpuinfo.min_freq;
-        policy->max = policy->cpuinfo.max_freq;
-        policy->cur = dbx500_cpufreq_getspeed(policy->cpu);
-        policy->governor = CPUFREQ_DEFAULT_GOVERNOR;
-
-        /*
-         * FIXME : Need to take time measurement across the target()
-         *         function with no/some/all drivers in the notification
-         *         list.
-         */
-        policy->cpuinfo.transition_latency = 20 * 1000; /* in ns */
-
-        /* policy sharing between dual CPUs */
-        cpumask_setall(policy->cpus);
-
-        return 0;
+        return cpufreq_generic_init(policy, freq_table, 20 * 1000);
 }
 
 static struct cpufreq_driver dbx500_cpufreq_driver = {
         .flags  = CPUFREQ_STICKY | CPUFREQ_CONST_LOOPS,
-        .verify = dbx500_cpufreq_verify_speed,
-        .target = dbx500_cpufreq_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = dbx500_cpufreq_target,
         .get    = dbx500_cpufreq_getspeed,
         .init   = dbx500_cpufreq_init,
         .name   = "DBX500",
-        .attr   = dbx500_cpufreq_attr,
+        .attr   = cpufreq_generic_attr,
 };
 
 static int dbx500_cpufreq_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/e_powersaver.c b/drivers/cpufreq/e_powersaver.c
index 09f64cc83019..9012b8bb6b64 100644
--- a/drivers/cpufreq/e_powersaver.c
+++ b/drivers/cpufreq/e_powersaver.c
@@ -107,15 +107,9 @@ static int eps_set_state(struct eps_cpu_data *centaur,
                          struct cpufreq_policy *policy,
                          u32 dest_state)
 {
-        struct cpufreq_freqs freqs;
         u32 lo, hi;
-        int err = 0;
         int i;
 
-        freqs.old = eps_get(policy->cpu);
-        freqs.new = centaur->fsb * ((dest_state >> 8) & 0xff);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         /* Wait while CPU is busy */
         rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
         i = 0;
@@ -124,8 +118,7 @@ static int eps_set_state(struct eps_cpu_data *centaur,
                 rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
                 i++;
                 if (unlikely(i > 64)) {
-                        err = -ENODEV;
-                        goto postchange;
+                        return -ENODEV;
                 }
         }
         /* Set new multiplier and voltage */
@@ -137,16 +130,10 @@ static int eps_set_state(struct eps_cpu_data *centaur,
                 rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
                 i++;
                 if (unlikely(i > 64)) {
-                        err = -ENODEV;
-                        goto postchange;
+                        return -ENODEV;
                 }
         } while (lo & ((1 << 16) | (1 << 17)));
 
-        /* Return current frequency */
-postchange:
-        rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
-        freqs.new = centaur->fsb * ((lo >> 8) & 0xff);
-
 #ifdef DEBUG
         {
         u8 current_multiplier, current_voltage;
@@ -161,19 +148,12 @@ postchange:
                 current_multiplier);
         }
 #endif
-        if (err)
-                freqs.new = freqs.old;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-        return err;
+        return 0;
 }
 
-static int eps_target(struct cpufreq_policy *policy,
-                               unsigned int target_freq,
-                               unsigned int relation)
+static int eps_target(struct cpufreq_policy *policy, unsigned int index)
 {
         struct eps_cpu_data *centaur;
-        unsigned int newstate = 0;
         unsigned int cpu = policy->cpu;
         unsigned int dest_state;
         int ret;
@@ -182,28 +162,14 @@ static int eps_target(struct cpufreq_policy *policy,
                 return -ENODEV;
         centaur = eps_cpu[cpu];
 
-        if (unlikely(cpufreq_frequency_table_target(policy,
-                        &eps_cpu[cpu]->freq_table[0],
-                        target_freq,
-                        relation,
-                        &newstate))) {
-                return -EINVAL;
-        }
-
         /* Make frequency transition */
-        dest_state = centaur->freq_table[newstate].driver_data & 0xffff;
+        dest_state = centaur->freq_table[index].driver_data & 0xffff;
         ret = eps_set_state(centaur, policy, dest_state);
         if (ret)
                 printk(KERN_ERR "eps: Timeout!\n");
         return ret;
 }
 
-static int eps_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                        &eps_cpu[policy->cpu]->freq_table[0]);
-}
-
 static int eps_cpu_init(struct cpufreq_policy *policy)
 {
         unsigned int i;
@@ -401,15 +367,13 @@ static int eps_cpu_init(struct cpufreq_policy *policy)
         }
 
         policy->cpuinfo.transition_latency = 140000; /* 844mV -> 700mV in ns */
-        policy->cur = fsb * current_multiplier;
 
-        ret = cpufreq_frequency_table_cpuinfo(policy, &centaur->freq_table[0]);
+        ret = cpufreq_table_validate_and_show(policy, &centaur->freq_table[0]);
         if (ret) {
                 kfree(centaur);
                 return ret;
         }
 
-        cpufreq_frequency_table_get_attr(&centaur->freq_table[0], policy->cpu);
         return 0;
 }
 
@@ -424,19 +388,14 @@ static int eps_cpu_exit(struct cpufreq_policy *policy)
         return 0;
 }
 
-static struct freq_attr *eps_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver eps_driver = {
-        .verify         = eps_verify,
-        .target         = eps_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = eps_target,
         .init           = eps_cpu_init,
         .exit           = eps_cpu_exit,
         .get            = eps_get,
         .name           = "e_powersaver",
-        .attr           = eps_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 
diff --git a/drivers/cpufreq/elanfreq.c b/drivers/cpufreq/elanfreq.c
index 823a400d98fd..de08acff5101 100644
--- a/drivers/cpufreq/elanfreq.c
+++ b/drivers/cpufreq/elanfreq.c
@@ -105,32 +105,9 @@ static unsigned int elanfreq_get_cpu_frequency(unsigned int cpu)
 }
 
 
-/**
- *      elanfreq_set_cpu_frequency: Change the CPU core frequency
- *      @cpu: cpu number
- *      @freq: frequency in kHz
- *
- *      This function takes a frequency value and changes the CPU frequency
- *      according to this. Note that the frequency has to be checked by
- *      elanfreq_validatespeed() for correctness!
- *
- *      There is no return value.
- */
-
-static void elanfreq_set_cpu_state(struct cpufreq_policy *policy,
-                unsigned int state)
+static int elanfreq_target(struct cpufreq_policy *policy,
+                            unsigned int state)
 {
-        struct cpufreq_freqs    freqs;
-
-        freqs.old = elanfreq_get_cpu_frequency(0);
-        freqs.new = elan_multiplier[state].clock;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
-        printk(KERN_INFO "elanfreq: attempting to set frequency to %i kHz\n",
-                        elan_multiplier[state].clock);
-
-
         /*
          * Access to the Elan's internal registers is indexed via
          * 0x22: Chip Setup & Control Register Index Register (CSCI)
@@ -161,39 +138,8 @@ static void elanfreq_set_cpu_state(struct cpufreq_policy *policy,
         udelay(10000);
         local_irq_enable();
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-};
-
-
-/**
- *      elanfreq_validatespeed: test if frequency range is valid
- *      @policy: the policy to validate
- *
- *      This function checks if a given frequency range in kHz is valid
- *      for the hardware supported by the driver.
- */
-
-static int elanfreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &elanfreq_table[0]);
-}
-
-static int elanfreq_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq,
-                            unsigned int relation)
-{
-        unsigned int newstate = 0;
-
-        if (cpufreq_frequency_table_target(policy, &elanfreq_table[0],
-                                target_freq, relation, &newstate))
-                return -EINVAL;
-
-        elanfreq_set_cpu_state(policy, newstate);
-
         return 0;
 }
-
-
 /*
  *      Module init and exit code
  */
@@ -202,7 +148,6 @@ static int elanfreq_cpu_init(struct cpufreq_policy *policy)
 {
         struct cpuinfo_x86 *c = &cpu_data(0);
         unsigned int i;
-        int result;
 
         /* capability check */
         if ((c->x86_vendor != X86_VENDOR_AMD) ||
@@ -221,21 +166,8 @@ static int elanfreq_cpu_init(struct cpufreq_policy *policy)
 
         /* cpuinfo and default policy values */
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        policy->cur = elanfreq_get_cpu_frequency(0);
-
-        result = cpufreq_frequency_table_cpuinfo(policy, elanfreq_table);
-        if (result)
-                return result;
 
-        cpufreq_frequency_table_get_attr(elanfreq_table, policy->cpu);
-        return 0;
-}
-
-
-static int elanfreq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_table_validate_and_show(policy, elanfreq_table);
 }
 
 
@@ -261,20 +193,14 @@ __setup("elanfreq=", elanfreq_setup);
 #endif
 
 
-static struct freq_attr *elanfreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
-
 static struct cpufreq_driver elanfreq_driver = {
         .get            = elanfreq_get_cpu_frequency,
-        .verify         = elanfreq_verify,
-        .target         = elanfreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = elanfreq_target,
         .init           = elanfreq_cpu_init,
-        .exit           = elanfreq_cpu_exit,
+        .exit           = cpufreq_generic_exit,
         .name           = "elanfreq",
-        .attr           = elanfreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id elan_id[] = {
diff --git a/drivers/cpufreq/exynos-cpufreq.c b/drivers/cpufreq/exynos-cpufreq.c
index 0fac34439e31..7b6dc06b1bd4 100644
--- a/drivers/cpufreq/exynos-cpufreq.c
+++ b/drivers/cpufreq/exynos-cpufreq.c
@@ -25,18 +25,11 @@
 static struct exynos_dvfs_info *exynos_info;
 
 static struct regulator *arm_regulator;
-static struct cpufreq_freqs freqs;
 
 static unsigned int locking_frequency;
 static bool frequency_locked;
 static DEFINE_MUTEX(cpufreq_lock);
 
-static int exynos_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                                              exynos_info->freq_table);
-}
-
 static unsigned int exynos_getspeed(unsigned int cpu)
 {
         return clk_get_rate(exynos_info->cpu_clk) / 1000;
@@ -65,21 +58,18 @@ static int exynos_cpufreq_scale(unsigned int target_freq)
         struct cpufreq_policy *policy = cpufreq_cpu_get(0);
         unsigned int arm_volt, safe_arm_volt = 0;
         unsigned int mpll_freq_khz = exynos_info->mpll_freq_khz;
+        unsigned int old_freq;
         int index, old_index;
         int ret = 0;
 
-        freqs.old = policy->cur;
-        freqs.new = target_freq;
-
-        if (freqs.new == freqs.old)
-                goto out;
+        old_freq = policy->cur;
 
         /*
          * The policy max have been changed so that we cannot get proper
          * old_index with cpufreq_frequency_table_target(). Thus, ignore
          * policy and get the index from the raw freqeuncy table.
          */
-        old_index = exynos_cpufreq_get_index(freqs.old);
+        old_index = exynos_cpufreq_get_index(old_freq);
         if (old_index < 0) {
                 ret = old_index;
                 goto out;
@@ -104,17 +94,14 @@ static int exynos_cpufreq_scale(unsigned int target_freq)
         }
         arm_volt = volt_table[index];
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         /* When the new frequency is higher than current frequency */
-        if ((freqs.new > freqs.old) && !safe_arm_volt) {
+        if ((target_freq > old_freq) && !safe_arm_volt) {
                 /* Firstly, voltage up to increase frequency */
                 ret = regulator_set_voltage(arm_regulator, arm_volt, arm_volt);
                 if (ret) {
                         pr_err("%s: failed to set cpu voltage to %d\n",
                                 __func__, arm_volt);
-                        freqs.new = freqs.old;
-                        goto post_notify;
+                        return ret;
                 }
         }
 
@@ -124,24 +111,17 @@ static int exynos_cpufreq_scale(unsigned int target_freq)
                 if (ret) {
                         pr_err("%s: failed to set cpu voltage to %d\n",
                                 __func__, safe_arm_volt);
-                        freqs.new = freqs.old;
-                        goto post_notify;
+                        return ret;
                 }
         }
 
         exynos_info->set_freq(old_index, index);
 
-post_notify:
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        if (ret)
-                goto out;
-
         /* When the new frequency is lower than current frequency */
-        if ((freqs.new < freqs.old) ||
-           ((freqs.new > freqs.old) && safe_arm_volt)) {
+        if ((target_freq < old_freq) ||
+           ((target_freq > old_freq) && safe_arm_volt)) {
                 /* down the voltage after frequency change */
-                regulator_set_voltage(arm_regulator, arm_volt,
+                ret = regulator_set_voltage(arm_regulator, arm_volt,
                                 arm_volt);
                 if (ret) {
                         pr_err("%s: failed to set cpu voltage to %d\n",
@@ -151,19 +131,14 @@ post_notify:
         }
 
 out:
-
         cpufreq_cpu_put(policy);
 
         return ret;
 }
 
-static int exynos_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
+static int exynos_target(struct cpufreq_policy *policy, unsigned int index)
 {
         struct cpufreq_frequency_table *freq_table = exynos_info->freq_table;
-        unsigned int index;
-        unsigned int new_freq;
         int ret = 0;
 
         mutex_lock(&cpufreq_lock);
@@ -171,15 +146,7 @@ static int exynos_target(struct cpufreq_policy *policy,
         if (frequency_locked)
                 goto out;
 
-        if (cpufreq_frequency_table_target(policy, freq_table,
-                                           target_freq, relation, &index)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        new_freq = freq_table[index].frequency;
-
-        ret = exynos_cpufreq_scale(new_freq);
+        ret = exynos_cpufreq_scale(freq_table[index].frequency);
 
 out:
         mutex_unlock(&cpufreq_lock);
@@ -247,38 +214,18 @@ static struct notifier_block exynos_cpufreq_nb = {
 
 static int exynos_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-        policy->cur = policy->min = policy->max = exynos_getspeed(policy->cpu);
-
-        cpufreq_frequency_table_get_attr(exynos_info->freq_table, policy->cpu);
-
-        /* set the transition latency value */
-        policy->cpuinfo.transition_latency = 100000;
-
-        cpumask_setall(policy->cpus);
-
-        return cpufreq_frequency_table_cpuinfo(policy, exynos_info->freq_table);
-}
-
-static int exynos_cpufreq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_generic_init(policy, exynos_info->freq_table, 100000);
 }
 
-static struct freq_attr *exynos_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver exynos_driver = {
         .flags          = CPUFREQ_STICKY,
-        .verify         = exynos_verify_speed,
-        .target         = exynos_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = exynos_target,
         .get            = exynos_getspeed,
         .init           = exynos_cpufreq_cpu_init,
-        .exit           = exynos_cpufreq_cpu_exit,
+        .exit           = cpufreq_generic_exit,
         .name           = "exynos_cpufreq",
-        .attr           = exynos_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 #ifdef CONFIG_PM
         .suspend        = exynos_cpufreq_suspend,
         .resume         = exynos_cpufreq_resume,
diff --git a/drivers/cpufreq/exynos4210-cpufreq.c b/drivers/cpufreq/exynos4210-cpufreq.c
index add7fbec4fc9..f2c75065ce19 100644
--- a/drivers/cpufreq/exynos4210-cpufreq.c
+++ b/drivers/cpufreq/exynos4210-cpufreq.c
@@ -81,9 +81,9 @@ static void exynos4210_set_clkdiv(unsigned int div_index)
 
 static void exynos4210_set_apll(unsigned int index)
 {
-        unsigned int tmp;
+        unsigned int tmp, freq = apll_freq_4210[index].freq;
 
-        /* 1. MUX_CORE_SEL = MPLL, ARMCLK uses MPLL for lock time */
+        /* MUX_CORE_SEL = MPLL, ARMCLK uses MPLL for lock time */
         clk_set_parent(moutcore, mout_mpll);
 
         do {
@@ -92,21 +92,9 @@ static void exynos4210_set_apll(unsigned int index)
                 tmp &= 0x7;
         } while (tmp != 0x2);
 
-        /* 2. Set APLL Lock time */
-        __raw_writel(EXYNOS4_APLL_LOCKTIME, EXYNOS4_APLL_LOCK);
-
-        /* 3. Change PLL PMS values */
-        tmp = __raw_readl(EXYNOS4_APLL_CON0);
-        tmp &= ~((0x3ff << 16) | (0x3f << 8) | (0x7 << 0));
-        tmp |= apll_freq_4210[index].mps;
-        __raw_writel(tmp, EXYNOS4_APLL_CON0);
+        clk_set_rate(mout_apll, freq * 1000);
 
-        /* 4. wait_lock_time */
-        do {
-                tmp = __raw_readl(EXYNOS4_APLL_CON0);
-        } while (!(tmp & (0x1 << EXYNOS4_APLLCON0_LOCKED_SHIFT)));
-
-        /* 5. MUX_CORE_SEL = APLL */
+        /* MUX_CORE_SEL = APLL */
         clk_set_parent(moutcore, mout_apll);
 
         do {
@@ -115,53 +103,15 @@ static void exynos4210_set_apll(unsigned int index)
         } while (tmp != (0x1 << EXYNOS4_CLKSRC_CPU_MUXCORE_SHIFT));
 }
 
-static bool exynos4210_pms_change(unsigned int old_index, unsigned int new_index)
-{
-        unsigned int old_pm = apll_freq_4210[old_index].mps >> 8;
-        unsigned int new_pm = apll_freq_4210[new_index].mps >> 8;
-
-        return (old_pm == new_pm) ? 0 : 1;
-}
-
 static void exynos4210_set_frequency(unsigned int old_index,
                                      unsigned int new_index)
 {
-        unsigned int tmp;
-
         if (old_index > new_index) {
-                if (!exynos4210_pms_change(old_index, new_index)) {
-                        /* 1. Change the system clock divider values */
-                        exynos4210_set_clkdiv(new_index);
-
-                        /* 2. Change just s value in apll m,p,s value */
-                        tmp = __raw_readl(EXYNOS4_APLL_CON0);
-                        tmp &= ~(0x7 << 0);
-                        tmp |= apll_freq_4210[new_index].mps & 0x7;
-                        __raw_writel(tmp, EXYNOS4_APLL_CON0);
-                } else {
-                        /* Clock Configuration Procedure */
-                        /* 1. Change the system clock divider values */
-                        exynos4210_set_clkdiv(new_index);
-                        /* 2. Change the apll m,p,s value */
-                        exynos4210_set_apll(new_index);
-                }
+                exynos4210_set_clkdiv(new_index);
+                exynos4210_set_apll(new_index);
         } else if (old_index < new_index) {
-                if (!exynos4210_pms_change(old_index, new_index)) {
-                        /* 1. Change just s value in apll m,p,s value */
-                        tmp = __raw_readl(EXYNOS4_APLL_CON0);
-                        tmp &= ~(0x7 << 0);
-                        tmp |= apll_freq_4210[new_index].mps & 0x7;
-                        __raw_writel(tmp, EXYNOS4_APLL_CON0);
-
-                        /* 2. Change the system clock divider values */
-                        exynos4210_set_clkdiv(new_index);
-                } else {
-                        /* Clock Configuration Procedure */
-                        /* 1. Change the apll m,p,s value */
-                        exynos4210_set_apll(new_index);
-                        /* 2. Change the system clock divider values */
-                        exynos4210_set_clkdiv(new_index);
-                }
+                exynos4210_set_apll(new_index);
+                exynos4210_set_clkdiv(new_index);
         }
 }
 
@@ -194,7 +144,6 @@ int exynos4210_cpufreq_init(struct exynos_dvfs_info *info)
         info->volt_table = exynos4210_volt_table;
         info->freq_table = exynos4210_freq_table;
         info->set_freq = exynos4210_set_frequency;
-        info->need_apll_change = exynos4210_pms_change;
 
         return 0;
 
diff --git a/drivers/cpufreq/exynos4x12-cpufreq.c b/drivers/cpufreq/exynos4x12-cpufreq.c
index 08b7477b0aa2..8683304ce62c 100644
--- a/drivers/cpufreq/exynos4x12-cpufreq.c
+++ b/drivers/cpufreq/exynos4x12-cpufreq.c
@@ -128,9 +128,9 @@ static void exynos4x12_set_clkdiv(unsigned int div_index)
 
 static void exynos4x12_set_apll(unsigned int index)
 {
-        unsigned int tmp, pdiv;
+        unsigned int tmp, freq = apll_freq_4x12[index].freq;
 
-        /* 1. MUX_CORE_SEL = MPLL, ARMCLK uses MPLL for lock time */
+        /* MUX_CORE_SEL = MPLL, ARMCLK uses MPLL for lock time */
         clk_set_parent(moutcore, mout_mpll);
 
         do {
@@ -140,24 +140,9 @@ static void exynos4x12_set_apll(unsigned int index)
                 tmp &= 0x7;
         } while (tmp != 0x2);
 
-        /* 2. Set APLL Lock time */
-        pdiv = ((apll_freq_4x12[index].mps >> 8) & 0x3f);
+        clk_set_rate(mout_apll, freq * 1000);
 
-        __raw_writel((pdiv * 250), EXYNOS4_APLL_LOCK);
-
-        /* 3. Change PLL PMS values */
-        tmp = __raw_readl(EXYNOS4_APLL_CON0);
-        tmp &= ~((0x3ff << 16) | (0x3f << 8) | (0x7 << 0));
-        tmp |= apll_freq_4x12[index].mps;
-        __raw_writel(tmp, EXYNOS4_APLL_CON0);
-
-        /* 4. wait_lock_time */
-        do {
-                cpu_relax();
-                tmp = __raw_readl(EXYNOS4_APLL_CON0);
-        } while (!(tmp & (0x1 << EXYNOS4_APLLCON0_LOCKED_SHIFT)));
-
-        /* 5. MUX_CORE_SEL = APLL */
+        /* MUX_CORE_SEL = APLL */
         clk_set_parent(moutcore, mout_apll);
 
         do {
@@ -167,52 +152,15 @@ static void exynos4x12_set_apll(unsigned int index)
         } while (tmp != (0x1 << EXYNOS4_CLKSRC_CPU_MUXCORE_SHIFT));
 }
 
-static bool exynos4x12_pms_change(unsigned int old_index, unsigned int new_index)
-{
-        unsigned int old_pm = apll_freq_4x12[old_index].mps >> 8;
-        unsigned int new_pm = apll_freq_4x12[new_index].mps >> 8;
-
-        return (old_pm == new_pm) ? 0 : 1;
-}
-
 static void exynos4x12_set_frequency(unsigned int old_index,
                                   unsigned int new_index)
 {
-        unsigned int tmp;
-
         if (old_index > new_index) {
-                if (!exynos4x12_pms_change(old_index, new_index)) {
-                        /* 1. Change the system clock divider values */
-                        exynos4x12_set_clkdiv(new_index);
-                        /* 2. Change just s value in apll m,p,s value */
-                        tmp = __raw_readl(EXYNOS4_APLL_CON0);
-                        tmp &= ~(0x7 << 0);
-                        tmp |= apll_freq_4x12[new_index].mps & 0x7;
-                        __raw_writel(tmp, EXYNOS4_APLL_CON0);
-
-                } else {
-                        /* Clock Configuration Procedure */
-                        /* 1. Change the system clock divider values */
-                        exynos4x12_set_clkdiv(new_index);
-                        /* 2. Change the apll m,p,s value */
-                        exynos4x12_set_apll(new_index);
-                }
+                exynos4x12_set_clkdiv(new_index);
+                exynos4x12_set_apll(new_index);
         } else if (old_index < new_index) {
-                if (!exynos4x12_pms_change(old_index, new_index)) {
-                        /* 1. Change just s value in apll m,p,s value */
-                        tmp = __raw_readl(EXYNOS4_APLL_CON0);
-                        tmp &= ~(0x7 << 0);
-                        tmp |= apll_freq_4x12[new_index].mps & 0x7;
-                        __raw_writel(tmp, EXYNOS4_APLL_CON0);
-                        /* 2. Change the system clock divider values */
-                        exynos4x12_set_clkdiv(new_index);
-                } else {
-                        /* Clock Configuration Procedure */
-                        /* 1. Change the apll m,p,s value */
-                        exynos4x12_set_apll(new_index);
-                        /* 2. Change the system clock divider values */
-                        exynos4x12_set_clkdiv(new_index);
-                }
+                exynos4x12_set_apll(new_index);
+                exynos4x12_set_clkdiv(new_index);
         }
 }
 
@@ -250,7 +198,6 @@ int exynos4x12_cpufreq_init(struct exynos_dvfs_info *info)
         info->volt_table = exynos4x12_volt_table;
         info->freq_table = exynos4x12_freq_table;
         info->set_freq = exynos4x12_set_frequency;
-        info->need_apll_change = exynos4x12_pms_change;
 
         return 0;
 
diff --git a/drivers/cpufreq/exynos5440-cpufreq.c b/drivers/cpufreq/exynos5440-cpufreq.c
index d514c152fd1a..76bef8b078cb 100644
--- a/drivers/cpufreq/exynos5440-cpufreq.c
+++ b/drivers/cpufreq/exynos5440-cpufreq.c
@@ -20,7 +20,7 @@
 #include <linux/module.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
@@ -118,12 +118,12 @@ static int init_div_table(void)
         struct cpufreq_frequency_table *freq_tbl = dvfs_info->freq_table;
         unsigned int tmp, clk_div, ema_div, freq, volt_id;
         int i = 0;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
 
         rcu_read_lock();
         for (i = 0; freq_tbl[i].frequency != CPUFREQ_TABLE_END; i++) {
 
-                opp = opp_find_freq_exact(dvfs_info->dev,
+                opp = dev_pm_opp_find_freq_exact(dvfs_info->dev,
                                         freq_tbl[i].frequency * 1000, true);
                 if (IS_ERR(opp)) {
                         rcu_read_unlock();
@@ -142,7 +142,7 @@ static int init_div_table(void)
                                         << P0_7_CSCLKDEV_SHIFT;
 
                 /* Calculate EMA */
-                volt_id = opp_get_voltage(opp);
+                volt_id = dev_pm_opp_get_voltage(opp);
                 volt_id = (MAX_VOLTAGE - volt_id) / VOLTAGE_STEP;
                 if (volt_id < PMIC_HIGH_VOLT) {
                         ema_div = (CPUEMA_HIGH << P0_7_CPUEMA_SHIFT) |
@@ -209,38 +209,22 @@ static void exynos_enable_dvfs(void)
                                 dvfs_info->base + XMU_DVFS_CTRL);
 }
 
-static int exynos_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                                              dvfs_info->freq_table);
-}
-
 static unsigned int exynos_getspeed(unsigned int cpu)
 {
         return dvfs_info->cur_frequency;
 }
 
-static int exynos_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
+static int exynos_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int index, tmp;
-        int ret = 0, i;
+        unsigned int tmp;
+        int i;
         struct cpufreq_frequency_table *freq_table = dvfs_info->freq_table;
 
         mutex_lock(&cpufreq_lock);
 
-        ret = cpufreq_frequency_table_target(policy, freq_table,
-                                           target_freq, relation, &index);
-        if (ret)
-                goto out;
-
         freqs.old = dvfs_info->cur_frequency;
         freqs.new = freq_table[index].frequency;
 
-        if (freqs.old == freqs.new)
-                goto out;
-
         cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
 
         /* Set the target frequency in all C0_3_PSTATE register */
@@ -251,9 +235,8 @@ static int exynos_target(struct cpufreq_policy *policy,
 
                 __raw_writel(tmp, dvfs_info->base + XMU_C0_3_PSTATE + i * 4);
         }
-out:
         mutex_unlock(&cpufreq_lock);
-        return ret;
+        return 0;
 }
 
 static void exynos_cpufreq_work(struct work_struct *work)
@@ -324,30 +307,19 @@ static void exynos_sort_descend_freq_table(void)
 
 static int exynos_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-        int ret;
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, dvfs_info->freq_table);
-        if (ret) {
-                dev_err(dvfs_info->dev, "Invalid frequency table: %d\n", ret);
-                return ret;
-        }
-
-        policy->cur = dvfs_info->cur_frequency;
-        policy->cpuinfo.transition_latency = dvfs_info->latency;
-        cpumask_setall(policy->cpus);
-
-        cpufreq_frequency_table_get_attr(dvfs_info->freq_table, policy->cpu);
-
-        return 0;
+        return cpufreq_generic_init(policy, dvfs_info->freq_table,
+                        dvfs_info->latency);
 }
 
 static struct cpufreq_driver exynos_driver = {
-        .flags          = CPUFREQ_STICKY,
-        .verify         = exynos_verify_speed,
-        .target         = exynos_target,
+        .flags          = CPUFREQ_STICKY | CPUFREQ_ASYNC_NOTIFICATION,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = exynos_target,
         .get            = exynos_getspeed,
         .init           = exynos_cpufreq_cpu_init,
+        .exit           = cpufreq_generic_exit,
         .name           = CPUFREQ_NAME,
+        .attr           = cpufreq_generic_attr,
 };
 
 static const struct of_device_id exynos_cpufreq_match[] = {
@@ -399,13 +371,14 @@ static int exynos_cpufreq_probe(struct platform_device *pdev)
                 goto err_put_node;
         }
 
-        ret = opp_init_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
+        ret = dev_pm_opp_init_cpufreq_table(dvfs_info->dev,
+                                            &dvfs_info->freq_table);
         if (ret) {
                 dev_err(dvfs_info->dev,
                         "failed to init cpufreq table: %d\n", ret);
                 goto err_put_node;
         }
-        dvfs_info->freq_count = opp_get_opp_count(dvfs_info->dev);
+        dvfs_info->freq_count = dev_pm_opp_get_opp_count(dvfs_info->dev);
         exynos_sort_descend_freq_table();
 
         if (of_property_read_u32(np, "clock-latency", &dvfs_info->latency))
@@ -454,17 +427,17 @@ static int exynos_cpufreq_probe(struct platform_device *pdev)
         return 0;
 
 err_free_table:
-        opp_free_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
+        dev_pm_opp_free_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
 err_put_node:
         of_node_put(np);
-        dev_err(dvfs_info->dev, "%s: failed initialization\n", __func__);
+        dev_err(&pdev->dev, "%s: failed initialization\n", __func__);
         return ret;
 }
 
 static int exynos_cpufreq_remove(struct platform_device *pdev)
 {
         cpufreq_unregister_driver(&exynos_driver);
-        opp_free_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
+        dev_pm_opp_free_cpufreq_table(dvfs_info->dev, &dvfs_info->freq_table);
         return 0;
 }
 
diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c
index f111454a7aea..3458d27f63b4 100644
--- a/drivers/cpufreq/freq_table.c
+++ b/drivers/cpufreq/freq_table.c
@@ -54,31 +54,30 @@ EXPORT_SYMBOL_GPL(cpufreq_frequency_table_cpuinfo);
 int cpufreq_frequency_table_verify(struct cpufreq_policy *policy,
                                    struct cpufreq_frequency_table *table)
 {
-        unsigned int next_larger = ~0;
-        unsigned int i;
-        unsigned int count = 0;
+        unsigned int next_larger = ~0, freq, i = 0;
+        bool found = false;
 
         pr_debug("request for verification of policy (%u - %u kHz) for cpu %u\n",
                                         policy->min, policy->max, policy->cpu);
 
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
 
-        for (i = 0; (table[i].frequency != CPUFREQ_TABLE_END); i++) {
-                unsigned int freq = table[i].frequency;
+        for (; freq = table[i].frequency, freq != CPUFREQ_TABLE_END; i++) {
                 if (freq == CPUFREQ_ENTRY_INVALID)
                         continue;
-                if ((freq >= policy->min) && (freq <= policy->max))
-                        count++;
-                else if ((next_larger > freq) && (freq > policy->max))
+                if ((freq >= policy->min) && (freq <= policy->max)) {
+                        found = true;
+                        break;
+                }
+
+                if ((next_larger > freq) && (freq > policy->max))
                         next_larger = freq;
         }
 
-        if (!count)
+        if (!found) {
                 policy->max = next_larger;
-
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
+                cpufreq_verify_within_cpu_limits(policy);
+        }
 
         pr_debug("verification lead to (%u - %u kHz) for cpu %u\n",
                                 policy->min, policy->max, policy->cpu);
@@ -87,6 +86,20 @@ int cpufreq_frequency_table_verify(struct cpufreq_policy *policy,
 }
 EXPORT_SYMBOL_GPL(cpufreq_frequency_table_verify);
 
+/*
+ * Generic routine to verify policy & frequency table, requires driver to call
+ * cpufreq_frequency_table_get_attr() prior to it.
+ */
+int cpufreq_generic_frequency_table_verify(struct cpufreq_policy *policy)
+{
+        struct cpufreq_frequency_table *table =
+                cpufreq_frequency_get_table(policy->cpu);
+        if (!table)
+                return -ENODEV;
+
+        return cpufreq_frequency_table_verify(policy, table);
+}
+EXPORT_SYMBOL_GPL(cpufreq_generic_frequency_table_verify);
 
 int cpufreq_frequency_table_target(struct cpufreq_policy *policy,
                                    struct cpufreq_frequency_table *table,
@@ -200,6 +213,12 @@ struct freq_attr cpufreq_freq_attr_scaling_available_freqs = {
 };
 EXPORT_SYMBOL_GPL(cpufreq_freq_attr_scaling_available_freqs);
 
+struct freq_attr *cpufreq_generic_attr[] = {
+        &cpufreq_freq_attr_scaling_available_freqs,
+        NULL,
+};
+EXPORT_SYMBOL_GPL(cpufreq_generic_attr);
+
 /*
  * if you use these, you must assure that the frequency table is valid
  * all the time between get_attr and put_attr!
@@ -219,6 +238,18 @@ void cpufreq_frequency_table_put_attr(unsigned int cpu)
 }
 EXPORT_SYMBOL_GPL(cpufreq_frequency_table_put_attr);
 
+int cpufreq_table_validate_and_show(struct cpufreq_policy *policy,
+                                      struct cpufreq_frequency_table *table)
+{
+        int ret = cpufreq_frequency_table_cpuinfo(policy, table);
+
+        if (!ret)
+                cpufreq_frequency_table_get_attr(table, policy->cpu);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(cpufreq_table_validate_and_show);
+
 void cpufreq_frequency_table_update_policy_cpu(struct cpufreq_policy *policy)
 {
         pr_debug("Updating show_table for new_cpu %u from last_cpu %u\n",
diff --git a/drivers/cpufreq/gx-suspmod.c b/drivers/cpufreq/gx-suspmod.c
index 70442c7b5e71..d83e8266a58e 100644
--- a/drivers/cpufreq/gx-suspmod.c
+++ b/drivers/cpufreq/gx-suspmod.c
@@ -401,7 +401,7 @@ static int cpufreq_gx_target(struct cpufreq_policy *policy,
 
 static int cpufreq_gx_cpu_init(struct cpufreq_policy *policy)
 {
-        unsigned int maxfreq, curfreq;
+        unsigned int maxfreq;
 
         if (!policy || policy->cpu != 0)
                 return -ENODEV;
@@ -415,10 +415,8 @@ static int cpufreq_gx_cpu_init(struct cpufreq_policy *policy)
                 maxfreq = 30000 * gx_freq_mult[getCx86(CX86_DIR1) & 0x0f];
 
         stock_freq = maxfreq;
-        curfreq = gx_get_cpuspeed(0);
 
         pr_debug("cpu max frequency is %d.\n", maxfreq);
-        pr_debug("cpu current frequency is %dkHz.\n", curfreq);
 
         /* setup basic struct for cpufreq API */
         policy->cpu = 0;
@@ -428,7 +426,6 @@ static int cpufreq_gx_cpu_init(struct cpufreq_policy *policy)
         else
                 policy->min = maxfreq / POLICY_MIN_DIV;
         policy->max = maxfreq;
-        policy->cur = curfreq;
         policy->cpuinfo.min_freq = maxfreq / max_duration;
         policy->cpuinfo.max_freq = maxfreq;
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
index 794123fcf3e3..bf8902a0866d 100644
--- a/drivers/cpufreq/highbank-cpufreq.c
+++ b/drivers/cpufreq/highbank-cpufreq.c
@@ -66,7 +66,8 @@ static int hb_cpufreq_driver_init(void)
         struct device_node *np;
         int ret;
 
-        if (!of_machine_is_compatible("calxeda,highbank"))
+        if ((!of_machine_is_compatible("calxeda,highbank")) &&
+                (!of_machine_is_compatible("calxeda,ecx-2000")))
                 return -ENODEV;
 
         cpu_dev = get_cpu_device(0);
diff --git a/drivers/cpufreq/ia64-acpi-cpufreq.c b/drivers/cpufreq/ia64-acpi-cpufreq.c
index 3e14f0317175..53c6ac637e10 100644
--- a/drivers/cpufreq/ia64-acpi-cpufreq.c
+++ b/drivers/cpufreq/ia64-acpi-cpufreq.c
@@ -141,7 +141,6 @@ processor_set_freq (
 {
         int                     ret = 0;
         u32                     value = 0;
-        struct cpufreq_freqs    cpufreq_freqs;
         cpumask_t               saved_mask;
         int                     retval;
 
@@ -168,13 +167,6 @@ processor_set_freq (
         pr_debug("Transitioning from P%d to P%d\n",
                 data->acpi_data.state, state);
 
-        /* cpufreq frequency struct */
-        cpufreq_freqs.old = data->freq_table[data->acpi_data.state].frequency;
-        cpufreq_freqs.new = data->freq_table[state].frequency;
-
-        /* notify cpufreq */
-        cpufreq_notify_transition(policy, &cpufreq_freqs, CPUFREQ_PRECHANGE);
-
         /*
          * First we write the target state's 'control' value to the
          * control_register.
@@ -186,22 +178,11 @@ processor_set_freq (
 
         ret = processor_set_pstate(value);
         if (ret) {
-                unsigned int tmp = cpufreq_freqs.new;
-                cpufreq_notify_transition(policy, &cpufreq_freqs,
-                                CPUFREQ_POSTCHANGE);
-                cpufreq_freqs.new = cpufreq_freqs.old;
-                cpufreq_freqs.old = tmp;
-                cpufreq_notify_transition(policy, &cpufreq_freqs,
-                                CPUFREQ_PRECHANGE);
-                cpufreq_notify_transition(policy, &cpufreq_freqs,
-                                CPUFREQ_POSTCHANGE);
                 printk(KERN_WARNING "Transition failed with error %d\n", ret);
                 retval = -ENODEV;
                 goto migrate_end;
         }
 
-        cpufreq_notify_transition(policy, &cpufreq_freqs, CPUFREQ_POSTCHANGE);
-
         data->acpi_data.state = state;
 
         retval = 0;
@@ -227,42 +208,11 @@ acpi_cpufreq_get (
 static int
 acpi_cpufreq_target (
         struct cpufreq_policy   *policy,
-        unsigned int target_freq,
-        unsigned int relation)
-{
-        struct cpufreq_acpi_io *data = acpi_io_data[policy->cpu];
-        unsigned int next_state = 0;
-        unsigned int result = 0;
-
-        pr_debug("acpi_cpufreq_setpolicy\n");
-
-        result = cpufreq_frequency_table_target(policy,
-                        data->freq_table, target_freq, relation, &next_state);
-        if (result)
-                return (result);
-
-        result = processor_set_freq(data, policy, next_state);
-
-        return (result);
-}
-
-
-static int
-acpi_cpufreq_verify (
-        struct cpufreq_policy   *policy)
+        unsigned int index)
 {
-        unsigned int result = 0;
-        struct cpufreq_acpi_io *data = acpi_io_data[policy->cpu];
-
-        pr_debug("acpi_cpufreq_verify\n");
-
-        result = cpufreq_frequency_table_verify(policy,
-                        data->freq_table);
-
-        return (result);
+        return processor_set_freq(acpi_io_data[policy->cpu], policy, index);
 }
 
-
 static int
 acpi_cpufreq_cpu_init (
         struct cpufreq_policy   *policy)
@@ -321,7 +271,6 @@ acpi_cpufreq_cpu_init (
                             data->acpi_data.states[i].transition_latency * 1000;
                 }
         }
-        policy->cur = processor_get_freq(data, policy->cpu);
 
         /* table init */
         for (i = 0; i <= data->acpi_data.state_count; i++)
@@ -335,7 +284,7 @@ acpi_cpufreq_cpu_init (
                 }
         }
 
-        result = cpufreq_frequency_table_cpuinfo(policy, data->freq_table);
+        result = cpufreq_table_validate_and_show(policy, data->freq_table);
         if (result) {
                 goto err_freqfree;
         }
@@ -356,8 +305,6 @@ acpi_cpufreq_cpu_init (
                         (u32) data->acpi_data.states[i].status,
                         (u32) data->acpi_data.states[i].control);
 
-        cpufreq_frequency_table_get_attr(data->freq_table, policy->cpu);
-
         /* the first call to ->target() should result in us actually
          * writing something to the appropriate registers. */
         data->resume = 1;
@@ -396,20 +343,14 @@ acpi_cpufreq_cpu_exit (
 }
 
 
-static struct freq_attr* acpi_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
-
 static struct cpufreq_driver acpi_cpufreq_driver = {
-        .verify         = acpi_cpufreq_verify,
-        .target         = acpi_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = acpi_cpufreq_target,
         .get            = acpi_cpufreq_get,
         .init           = acpi_cpufreq_cpu_init,
         .exit           = acpi_cpufreq_cpu_exit,
         .name           = "acpi-cpufreq",
-        .attr           = acpi_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index c3fd2a101ca0..4b3f18e5f36b 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -13,7 +13,7 @@
 #include <linux/err.h>
 #include <linux/module.h>
 #include <linux/of.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/consumer.h>
 
@@ -35,73 +35,52 @@ static struct device *cpu_dev;
 static struct cpufreq_frequency_table *freq_table;
 static unsigned int transition_latency;
 
-static int imx6q_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, freq_table);
-}
-
 static unsigned int imx6q_get_speed(unsigned int cpu)
 {
         return clk_get_rate(arm_clk) / 1000;
 }
 
-static int imx6q_set_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq, unsigned int relation)
+static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long freq_hz, volt, volt_old;
-        unsigned int index;
+        unsigned int old_freq, new_freq;
         int ret;
 
-        ret = cpufreq_frequency_table_target(policy, freq_table, target_freq,
-                                             relation, &index);
-        if (ret) {
-                dev_err(cpu_dev, "failed to match target frequency %d: %d\n",
-                        target_freq, ret);
-                return ret;
-        }
-
-        freqs.new = freq_table[index].frequency;
-        freq_hz = freqs.new * 1000;
-        freqs.old = clk_get_rate(arm_clk) / 1000;
-
-        if (freqs.old == freqs.new)
-                return 0;
+        new_freq = freq_table[index].frequency;
+        freq_hz = new_freq * 1000;
+        old_freq = clk_get_rate(arm_clk) / 1000;
 
         rcu_read_lock();
-        opp = opp_find_freq_ceil(cpu_dev, &freq_hz);
+        opp = dev_pm_opp_find_freq_ceil(cpu_dev, &freq_hz);
         if (IS_ERR(opp)) {
                 rcu_read_unlock();
                 dev_err(cpu_dev, "failed to find OPP for %ld\n", freq_hz);
                 return PTR_ERR(opp);
         }
 
-        volt = opp_get_voltage(opp);
+        volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
         volt_old = regulator_get_voltage(arm_reg);
 
         dev_dbg(cpu_dev, "%u MHz, %ld mV --> %u MHz, %ld mV\n",
-                freqs.old / 1000, volt_old / 1000,
-                freqs.new / 1000, volt / 1000);
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+                old_freq / 1000, volt_old / 1000,
+                new_freq / 1000, volt / 1000);
 
         /* scaling up?  scale voltage before frequency */
-        if (freqs.new > freqs.old) {
+        if (new_freq > old_freq) {
                 ret = regulator_set_voltage_tol(arm_reg, volt, 0);
                 if (ret) {
                         dev_err(cpu_dev,
                                 "failed to scale vddarm up: %d\n", ret);
-                        freqs.new = freqs.old;
-                        goto post_notify;
+                        return ret;
                 }
 
                 /*
                  * Need to increase vddpu and vddsoc for safety
                  * if we are about to run at 1.2 GHz.
                  */
-                if (freqs.new == FREQ_1P2_GHZ / 1000) {
+                if (new_freq == FREQ_1P2_GHZ / 1000) {
                         regulator_set_voltage_tol(pu_reg,
                                         PU_SOC_VOLTAGE_HIGH, 0);
                         regulator_set_voltage_tol(soc_reg,
@@ -121,21 +100,20 @@ static int imx6q_set_target(struct cpufreq_policy *policy,
         clk_set_parent(step_clk, pll2_pfd2_396m_clk);
         clk_set_parent(pll1_sw_clk, step_clk);
         if (freq_hz > clk_get_rate(pll2_pfd2_396m_clk)) {
-                clk_set_rate(pll1_sys_clk, freqs.new * 1000);
+                clk_set_rate(pll1_sys_clk, new_freq * 1000);
                 clk_set_parent(pll1_sw_clk, pll1_sys_clk);
         }
 
         /* Ensure the arm clock divider is what we expect */
-        ret = clk_set_rate(arm_clk, freqs.new * 1000);
+        ret = clk_set_rate(arm_clk, new_freq * 1000);
         if (ret) {
                 dev_err(cpu_dev, "failed to set clock rate: %d\n", ret);
                 regulator_set_voltage_tol(arm_reg, volt_old, 0);
-                freqs.new = freqs.old;
-                goto post_notify;
+                return ret;
         }
 
         /* scaling down?  scale voltage after frequency */
-        if (freqs.new < freqs.old) {
+        if (new_freq < old_freq) {
                 ret = regulator_set_voltage_tol(arm_reg, volt, 0);
                 if (ret) {
                         dev_warn(cpu_dev,
@@ -143,7 +121,7 @@ static int imx6q_set_target(struct cpufreq_policy *policy,
                         ret = 0;
                 }
 
-                if (freqs.old == FREQ_1P2_GHZ / 1000) {
+                if (old_freq == FREQ_1P2_GHZ / 1000) {
                         regulator_set_voltage_tol(pu_reg,
                                         PU_SOC_VOLTAGE_NORMAL, 0);
                         regulator_set_voltage_tol(soc_reg,
@@ -151,55 +129,28 @@ static int imx6q_set_target(struct cpufreq_policy *policy,
                 }
         }
 
-post_notify:
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        return ret;
-}
-
-static int imx6q_cpufreq_init(struct cpufreq_policy *policy)
-{
-        int ret;
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, freq_table);
-        if (ret) {
-                dev_err(cpu_dev, "invalid frequency table: %d\n", ret);
-                return ret;
-        }
-
-        policy->cpuinfo.transition_latency = transition_latency;
-        policy->cur = clk_get_rate(arm_clk) / 1000;
-        cpumask_setall(policy->cpus);
-        cpufreq_frequency_table_get_attr(freq_table, policy->cpu);
-
         return 0;
 }
 
-static int imx6q_cpufreq_exit(struct cpufreq_policy *policy)
+static int imx6q_cpufreq_init(struct cpufreq_policy *policy)
 {
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_generic_init(policy, freq_table, transition_latency);
 }
 
-static struct freq_attr *imx6q_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver imx6q_cpufreq_driver = {
-        .verify = imx6q_verify_speed,
-        .target = imx6q_set_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = imx6q_set_target,
         .get = imx6q_get_speed,
         .init = imx6q_cpufreq_init,
-        .exit = imx6q_cpufreq_exit,
+        .exit = cpufreq_generic_exit,
         .name = "imx6q-cpufreq",
-        .attr = imx6q_cpufreq_attr,
+        .attr = cpufreq_generic_attr,
 };
 
 static int imx6q_cpufreq_probe(struct platform_device *pdev)
 {
         struct device_node *np;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long min_volt, max_volt;
         int num, ret;
 
@@ -237,14 +188,14 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
         }
 
         /* We expect an OPP table supplied by platform */
-        num = opp_get_opp_count(cpu_dev);
+        num = dev_pm_opp_get_opp_count(cpu_dev);
         if (num < 0) {
                 ret = num;
                 dev_err(cpu_dev, "no OPP table is found: %d\n", ret);
                 goto put_node;
         }
 
-        ret = opp_init_cpufreq_table(cpu_dev, &freq_table);
+        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
         if (ret) {
                 dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
                 goto put_node;
@@ -259,12 +210,12 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
          * same order.
          */
         rcu_read_lock();
-        opp = opp_find_freq_exact(cpu_dev,
+        opp = dev_pm_opp_find_freq_exact(cpu_dev,
                                   freq_table[0].frequency * 1000, true);
-        min_volt = opp_get_voltage(opp);
-        opp = opp_find_freq_exact(cpu_dev,
+        min_volt = dev_pm_opp_get_voltage(opp);
+        opp = dev_pm_opp_find_freq_exact(cpu_dev,
                                   freq_table[--num].frequency * 1000, true);
-        max_volt = opp_get_voltage(opp);
+        max_volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
         ret = regulator_set_voltage_time(arm_reg, min_volt, max_volt);
         if (ret > 0)
@@ -292,7 +243,7 @@ static int imx6q_cpufreq_probe(struct platform_device *pdev)
         return 0;
 
 free_freq_table:
-        opp_free_cpufreq_table(cpu_dev, &freq_table);
+        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
 put_node:
         of_node_put(np);
         return ret;
@@ -301,7 +252,7 @@ put_node:
 static int imx6q_cpufreq_remove(struct platform_device *pdev)
 {
         cpufreq_unregister_driver(&imx6q_cpufreq_driver);
-        opp_free_cpufreq_table(cpu_dev, &freq_table);
+        dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
 
         return 0;
 }
diff --git a/drivers/cpufreq/integrator-cpufreq.c b/drivers/cpufreq/integrator-cpufreq.c
index f7c99df0880b..babf3e40e9fa 100644
--- a/drivers/cpufreq/integrator-cpufreq.c
+++ b/drivers/cpufreq/integrator-cpufreq.c
@@ -59,9 +59,7 @@ static int integrator_verify_policy(struct cpufreq_policy *policy)
 {
         struct icst_vco vco;
 
-        cpufreq_verify_within_limits(policy, 
-                                     policy->cpuinfo.min_freq, 
-                                     policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
 
         vco = icst_hz_to_vco(&cclk_params, policy->max * 1000);
         policy->max = icst_hz(&cclk_params, vco) / 1000;
@@ -69,10 +67,7 @@ static int integrator_verify_policy(struct cpufreq_policy *policy)
         vco = icst_hz_to_vco(&cclk_params, policy->min * 1000);
         policy->min = icst_hz(&cclk_params, vco) / 1000;
 
-        cpufreq_verify_within_limits(policy, 
-                                     policy->cpuinfo.min_freq, 
-                                     policy->cpuinfo.max_freq);
-
+        cpufreq_verify_within_cpu_limits(policy);
         return 0;
 }
 
@@ -186,10 +181,9 @@ static int integrator_cpufreq_init(struct cpufreq_policy *policy)
 {
 
         /* set default policy and cpuinfo */
-        policy->cpuinfo.max_freq = 160000;
-        policy->cpuinfo.min_freq = 12000;
+        policy->max = policy->cpuinfo.max_freq = 160000;
+        policy->min = policy->cpuinfo.min_freq = 12000;
         policy->cpuinfo.transition_latency = 1000000; /* 1 ms, assumed */
-        policy->cur = policy->min = policy->max = integrator_get(policy->cpu);
 
         return 0;
 }
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 9733f29ed148..5f1cbae36961 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -25,6 +25,7 @@
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/debugfs.h>
+#include <linux/acpi.h>
 #include <trace/events/power.h>
 
 #include <asm/div64.h>
@@ -33,6 +34,8 @@
 
 #define SAMPLE_COUNT            3
 
+#define BYT_RATIOS      0x66a
+
 #define FRAC_BITS 8
 #define int_tofp(X) ((int64_t)(X) << FRAC_BITS)
 #define fp_toint(X) ((X) >> FRAC_BITS)
@@ -48,7 +51,7 @@ static inline int32_t div_fp(int32_t x, int32_t y)
 }
 
 struct sample {
-        int core_pct_busy;
+        int32_t core_pct_busy;
         u64 aperf;
         u64 mperf;
         int freq;
@@ -68,7 +71,7 @@ struct _pid {
         int32_t i_gain;
         int32_t d_gain;
         int deadband;
-        int last_err;
+        int32_t last_err;
 };
 
 struct cpudata {
@@ -78,7 +81,6 @@ struct cpudata {
 
         struct timer_list timer;
 
-        struct pstate_adjust_policy *pstate_policy;
         struct pstate_data pstate;
         struct _pid pid;
 
@@ -100,15 +102,21 @@ struct pstate_adjust_policy {
         int i_gain_pct;
 };
 
-static struct pstate_adjust_policy default_policy = {
-        .sample_rate_ms = 10,
-        .deadband = 0,
-        .setpoint = 97,
-        .p_gain_pct = 20,
-        .d_gain_pct = 0,
-        .i_gain_pct = 0,
+struct pstate_funcs {
+        int (*get_max)(void);
+        int (*get_min)(void);
+        int (*get_turbo)(void);
+        void (*set)(int pstate);
+};
+
+struct cpu_defaults {
+        struct pstate_adjust_policy pid_policy;
+        struct pstate_funcs funcs;
 };
 
+static struct pstate_adjust_policy pid_params;
+static struct pstate_funcs pstate_funcs;
+
 struct perf_limits {
         int no_turbo;
         int max_perf_pct;
@@ -153,16 +161,15 @@ static inline void pid_d_gain_set(struct _pid *pid, int percent)
         pid->d_gain = div_fp(int_tofp(percent), int_tofp(100));
 }
 
-static signed int pid_calc(struct _pid *pid, int busy)
+static signed int pid_calc(struct _pid *pid, int32_t busy)
 {
-        signed int err, result;
+        signed int result;
         int32_t pterm, dterm, fp_error;
         int32_t integral_limit;
 
-        err = pid->setpoint - busy;
-        fp_error = int_tofp(err);
+        fp_error = int_tofp(pid->setpoint) - busy;
 
-        if (abs(err) <= pid->deadband)
+        if (abs(fp_error) <= int_tofp(pid->deadband))
                 return 0;
 
         pterm = mul_fp(pid->p_gain, fp_error);
@@ -176,8 +183,8 @@ static signed int pid_calc(struct _pid *pid, int busy)
         if (pid->integral < -integral_limit)
                 pid->integral = -integral_limit;
 
-        dterm = mul_fp(pid->d_gain, (err - pid->last_err));
-        pid->last_err = err;
+        dterm = mul_fp(pid->d_gain, fp_error - pid->last_err);
+        pid->last_err = fp_error;
 
         result = pterm + mul_fp(pid->integral, pid->i_gain) + dterm;
 
@@ -186,14 +193,14 @@ static signed int pid_calc(struct _pid *pid, int busy)
 
 static inline void intel_pstate_busy_pid_reset(struct cpudata *cpu)
 {
-        pid_p_gain_set(&cpu->pid, cpu->pstate_policy->p_gain_pct);
-        pid_d_gain_set(&cpu->pid, cpu->pstate_policy->d_gain_pct);
-        pid_i_gain_set(&cpu->pid, cpu->pstate_policy->i_gain_pct);
+        pid_p_gain_set(&cpu->pid, pid_params.p_gain_pct);
+        pid_d_gain_set(&cpu->pid, pid_params.d_gain_pct);
+        pid_i_gain_set(&cpu->pid, pid_params.i_gain_pct);
 
         pid_reset(&cpu->pid,
-                cpu->pstate_policy->setpoint,
+                pid_params.setpoint,
                 100,
-                cpu->pstate_policy->deadband,
+                pid_params.deadband,
                 0);
 }
 
@@ -227,12 +234,12 @@ struct pid_param {
 };
 
 static struct pid_param pid_files[] = {
-        {"sample_rate_ms", &default_policy.sample_rate_ms},
-        {"d_gain_pct", &default_policy.d_gain_pct},
-        {"i_gain_pct", &default_policy.i_gain_pct},
-        {"deadband", &default_policy.deadband},
-        {"setpoint", &default_policy.setpoint},
-        {"p_gain_pct", &default_policy.p_gain_pct},
+        {"sample_rate_ms", &pid_params.sample_rate_ms},
+        {"d_gain_pct", &pid_params.d_gain_pct},
+        {"i_gain_pct", &pid_params.i_gain_pct},
+        {"deadband", &pid_params.deadband},
+        {"setpoint", &pid_params.setpoint},
+        {"p_gain_pct", &pid_params.p_gain_pct},
         {NULL, NULL}
 };
 
@@ -337,42 +344,102 @@ static void intel_pstate_sysfs_expose_params(void)
 }
 
 /************************** sysfs end ************************/
+static int byt_get_min_pstate(void)
+{
+        u64 value;
+        rdmsrl(BYT_RATIOS, value);
+        return value & 0xFF;
+}
 
-static int intel_pstate_min_pstate(void)
+static int byt_get_max_pstate(void)
+{
+        u64 value;
+        rdmsrl(BYT_RATIOS, value);
+        return (value >> 16) & 0xFF;
+}
+
+static int core_get_min_pstate(void)
 {
         u64 value;
         rdmsrl(MSR_PLATFORM_INFO, value);
         return (value >> 40) & 0xFF;
 }
 
-static int intel_pstate_max_pstate(void)
+static int core_get_max_pstate(void)
 {
         u64 value;
         rdmsrl(MSR_PLATFORM_INFO, value);
         return (value >> 8) & 0xFF;
 }
 
-static int intel_pstate_turbo_pstate(void)
+static int core_get_turbo_pstate(void)
 {
         u64 value;
         int nont, ret;
         rdmsrl(MSR_NHM_TURBO_RATIO_LIMIT, value);
-        nont = intel_pstate_max_pstate();
+        nont = core_get_max_pstate();
         ret = ((value) & 255);
         if (ret <= nont)
                 ret = nont;
         return ret;
 }
 
+static void core_set_pstate(int pstate)
+{
+        u64 val;
+
+        val = pstate << 8;
+        if (limits.no_turbo)
+                val |= (u64)1 << 32;
+
+        wrmsrl(MSR_IA32_PERF_CTL, val);
+}
+
+static struct cpu_defaults core_params = {
+        .pid_policy = {
+                .sample_rate_ms = 10,
+                .deadband = 0,
+                .setpoint = 97,
+                .p_gain_pct = 20,
+                .d_gain_pct = 0,
+                .i_gain_pct = 0,
+        },
+        .funcs = {
+                .get_max = core_get_max_pstate,
+                .get_min = core_get_min_pstate,
+                .get_turbo = core_get_turbo_pstate,
+                .set = core_set_pstate,
+        },
+};
+
+static struct cpu_defaults byt_params = {
+        .pid_policy = {
+                .sample_rate_ms = 10,
+                .deadband = 0,
+                .setpoint = 97,
+                .p_gain_pct = 14,
+                .d_gain_pct = 0,
+                .i_gain_pct = 4,
+        },
+        .funcs = {
+                .get_max = byt_get_max_pstate,
+                .get_min = byt_get_min_pstate,
+                .get_turbo = byt_get_max_pstate,
+                .set = core_set_pstate,
+        },
+};
+
+
 static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
 {
         int max_perf = cpu->pstate.turbo_pstate;
+        int max_perf_adj;
         int min_perf;
         if (limits.no_turbo)
                 max_perf = cpu->pstate.max_pstate;
 
-        max_perf = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
-        *max = clamp_t(int, max_perf,
+        max_perf_adj = fp_toint(mul_fp(int_tofp(max_perf), limits.max_perf));
+        *max = clamp_t(int, max_perf_adj,
                         cpu->pstate.min_pstate, cpu->pstate.turbo_pstate);
 
         min_perf = fp_toint(mul_fp(int_tofp(max_perf), limits.min_perf));
@@ -394,8 +461,8 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
         trace_cpu_frequency(pstate * 100000, cpu->cpu);
 
         cpu->pstate.current_pstate = pstate;
-        wrmsrl(MSR_IA32_PERF_CTL, pstate << 8);
 
+        pstate_funcs.set(pstate);
 }
 
 static inline void intel_pstate_pstate_increase(struct cpudata *cpu, int steps)
@@ -417,9 +484,9 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
 {
         sprintf(cpu->name, "Intel 2nd generation core");
 
-        cpu->pstate.min_pstate = intel_pstate_min_pstate();
-        cpu->pstate.max_pstate = intel_pstate_max_pstate();
-        cpu->pstate.turbo_pstate = intel_pstate_turbo_pstate();
+        cpu->pstate.min_pstate = pstate_funcs.get_min();
+        cpu->pstate.max_pstate = pstate_funcs.get_max();
+        cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
 
         /*
          * goto max pstate so we don't slow up boot if we are built-in if we are
@@ -432,8 +499,9 @@ static inline void intel_pstate_calc_busy(struct cpudata *cpu,
                                         struct sample *sample)
 {
         u64 core_pct;
-        core_pct = div64_u64(sample->aperf * 100, sample->mperf);
-        sample->freq = cpu->pstate.max_pstate * core_pct * 1000;
+        core_pct = div64_u64(int_tofp(sample->aperf * 100),
+                             sample->mperf);
+        sample->freq = fp_toint(cpu->pstate.max_pstate * core_pct * 1000);
 
         sample->core_pct_busy = core_pct;
 }
@@ -460,27 +528,24 @@ static inline void intel_pstate_set_sample_time(struct cpudata *cpu)
 {
         int sample_time, delay;
 
-        sample_time = cpu->pstate_policy->sample_rate_ms;
+        sample_time = pid_params.sample_rate_ms;
         delay = msecs_to_jiffies(sample_time);
         mod_timer_pinned(&cpu->timer, jiffies + delay);
 }
 
-static inline int intel_pstate_get_scaled_busy(struct cpudata *cpu)
+static inline int32_t intel_pstate_get_scaled_busy(struct cpudata *cpu)
 {
-        int32_t busy_scaled;
         int32_t core_busy, max_pstate, current_pstate;
 
-        core_busy = int_tofp(cpu->samples[cpu->sample_ptr].core_pct_busy);
+        core_busy = cpu->samples[cpu->sample_ptr].core_pct_busy;
         max_pstate = int_tofp(cpu->pstate.max_pstate);
         current_pstate = int_tofp(cpu->pstate.current_pstate);
-        busy_scaled = mul_fp(core_busy, div_fp(max_pstate, current_pstate));
-
-        return fp_toint(busy_scaled);
+        return mul_fp(core_busy, div_fp(max_pstate, current_pstate));
 }
 
 static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
 {
-        int busy_scaled;
+        int32_t busy_scaled;
         struct _pid *pid;
         signed int ctl = 0;
         int steps;
@@ -519,14 +584,15 @@ static void intel_pstate_timer_func(unsigned long __data)
         { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&policy }
 
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
-        ICPU(0x2a, default_policy),
-        ICPU(0x2d, default_policy),
-        ICPU(0x3a, default_policy),
-        ICPU(0x3c, default_policy),
-        ICPU(0x3e, default_policy),
-        ICPU(0x3f, default_policy),
-        ICPU(0x45, default_policy),
-        ICPU(0x46, default_policy),
+        ICPU(0x2a, core_params),
+        ICPU(0x2d, core_params),
+        ICPU(0x37, byt_params),
+        ICPU(0x3a, core_params),
+        ICPU(0x3c, core_params),
+        ICPU(0x3e, core_params),
+        ICPU(0x3f, core_params),
+        ICPU(0x45, core_params),
+        ICPU(0x46, core_params),
         {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_pstate_cpu_ids);
@@ -550,8 +616,7 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
         intel_pstate_get_cpu_pstates(cpu);
 
         cpu->cpu = cpunum;
-        cpu->pstate_policy =
-                (struct pstate_adjust_policy *)id->driver_data;
+
         init_timer_deferrable(&cpu->timer);
         cpu->timer.function = intel_pstate_timer_func;
         cpu->timer.data =
@@ -611,9 +676,7 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 
 static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
 {
-        cpufreq_verify_within_limits(policy,
-                                policy->cpuinfo.min_freq,
-                                policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
 
         if ((policy->policy != CPUFREQ_POLICY_POWERSAVE) &&
                 (policy->policy != CPUFREQ_POLICY_PERFORMANCE))
@@ -634,8 +697,8 @@ static int intel_pstate_cpu_exit(struct cpufreq_policy *policy)
 
 static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 {
-        int rc, min_pstate, max_pstate;
         struct cpudata *cpu;
+        int rc;
 
         rc = intel_pstate_init_cpu(policy->cpu);
         if (rc)
@@ -649,9 +712,8 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
         else
                 policy->policy = CPUFREQ_POLICY_POWERSAVE;
 
-        intel_pstate_get_min_max(cpu, &min_pstate, &max_pstate);
-        policy->min = min_pstate * 100000;
-        policy->max = max_pstate * 100000;
+        policy->min = cpu->pstate.min_pstate * 100000;
+        policy->max = cpu->pstate.turbo_pstate * 100000;
 
         /* cpuinfo and default policy values */
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * 100000;
@@ -682,9 +744,9 @@ static int intel_pstate_msrs_not_valid(void)
         rdmsrl(MSR_IA32_APERF, aperf);
         rdmsrl(MSR_IA32_MPERF, mperf);
 
-        if (!intel_pstate_min_pstate() ||
-                !intel_pstate_max_pstate() ||
-                !intel_pstate_turbo_pstate())
+        if (!pstate_funcs.get_max() ||
+                !pstate_funcs.get_min() ||
+                !pstate_funcs.get_turbo())
                 return -ENODEV;
 
         rdmsrl(MSR_IA32_APERF, tmp);
@@ -697,10 +759,96 @@ static int intel_pstate_msrs_not_valid(void)
 
         return 0;
 }
+
+static void copy_pid_params(struct pstate_adjust_policy *policy)
+{
+        pid_params.sample_rate_ms = policy->sample_rate_ms;
+        pid_params.p_gain_pct = policy->p_gain_pct;
+        pid_params.i_gain_pct = policy->i_gain_pct;
+        pid_params.d_gain_pct = policy->d_gain_pct;
+        pid_params.deadband = policy->deadband;
+        pid_params.setpoint = policy->setpoint;
+}
+
+static void copy_cpu_funcs(struct pstate_funcs *funcs)
+{
+        pstate_funcs.get_max   = funcs->get_max;
+        pstate_funcs.get_min   = funcs->get_min;
+        pstate_funcs.get_turbo = funcs->get_turbo;
+        pstate_funcs.set       = funcs->set;
+}
+
+#if IS_ENABLED(CONFIG_ACPI)
+#include <acpi/processor.h>
+
+static bool intel_pstate_no_acpi_pss(void)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                acpi_status status;
+                union acpi_object *pss;
+                struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+                struct acpi_processor *pr = per_cpu(processors, i);
+
+                if (!pr)
+                        continue;
+
+                status = acpi_evaluate_object(pr->handle, "_PSS", NULL, &buffer);
+                if (ACPI_FAILURE(status))
+                        continue;
+
+                pss = buffer.pointer;
+                if (pss && pss->type == ACPI_TYPE_PACKAGE) {
+                        kfree(pss);
+                        return false;
+                }
+
+                kfree(pss);
+        }
+
+        return true;
+}
+
+struct hw_vendor_info {
+        u16  valid;
+        char oem_id[ACPI_OEM_ID_SIZE];
+        char oem_table_id[ACPI_OEM_TABLE_ID_SIZE];
+};
+
+/* Hardware vendor-specific info that has its own power management modes */
+static struct hw_vendor_info vendor_info[] = {
+        {1, "HP    ", "ProLiant"},
+        {0, "", ""},
+};
+
+static bool intel_pstate_platform_pwr_mgmt_exists(void)
+{
+        struct acpi_table_header hdr;
+        struct hw_vendor_info *v_info;
+
+        if (acpi_disabled
+            || ACPI_FAILURE(acpi_get_table_header(ACPI_SIG_FADT, 0, &hdr)))
+                return false;
+
+        for (v_info = vendor_info; v_info->valid; v_info++) {
+                if (!strncmp(hdr.oem_id, v_info->oem_id, ACPI_OEM_ID_SIZE)
+                    && !strncmp(hdr.oem_table_id, v_info->oem_table_id, ACPI_OEM_TABLE_ID_SIZE)
+                    && intel_pstate_no_acpi_pss())
+                        return true;
+        }
+
+        return false;
+}
+#else /* CONFIG_ACPI not enabled */
+static inline bool intel_pstate_platform_pwr_mgmt_exists(void) { return false; }
+#endif /* CONFIG_ACPI */
+
 static int __init intel_pstate_init(void)
 {
         int cpu, rc = 0;
         const struct x86_cpu_id *id;
+        struct cpu_defaults *cpu_info;
 
         if (no_load)
                 return -ENODEV;
@@ -709,6 +857,18 @@ static int __init intel_pstate_init(void)
         if (!id)
                 return -ENODEV;
 
+        /*
+         * The Intel pstate driver will be ignored if the platform
+         * firmware has its own power management modes.
+         */
+        if (intel_pstate_platform_pwr_mgmt_exists())
+                return -ENODEV;
+
+        cpu_info = (struct cpu_defaults *)id->driver_data;
+
+        copy_pid_params(&cpu_info->pid_policy);
+        copy_cpu_funcs(&cpu_info->funcs);
+
         if (intel_pstate_msrs_not_valid())
                 return -ENODEV;
 
diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
index ba10658a9394..0767a4e29dfe 100644
--- a/drivers/cpufreq/kirkwood-cpufreq.c
+++ b/drivers/cpufreq/kirkwood-cpufreq.c
@@ -55,69 +55,37 @@ static unsigned int kirkwood_cpufreq_get_cpu_frequency(unsigned int cpu)
         return kirkwood_freq_table[0].frequency;
 }
 
-static void kirkwood_cpufreq_set_cpu_state(struct cpufreq_policy *policy,
-                unsigned int index)
+static int kirkwood_cpufreq_target(struct cpufreq_policy *policy,
+                            unsigned int index)
 {
-        struct cpufreq_freqs freqs;
         unsigned int state = kirkwood_freq_table[index].driver_data;
         unsigned long reg;
 
-        freqs.old = kirkwood_cpufreq_get_cpu_frequency(0);
-        freqs.new = kirkwood_freq_table[index].frequency;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
-        dev_dbg(priv.dev, "Attempting to set frequency to %i KHz\n",
-                kirkwood_freq_table[index].frequency);
-        dev_dbg(priv.dev, "old frequency was %i KHz\n",
-                kirkwood_cpufreq_get_cpu_frequency(0));
-
-        if (freqs.old != freqs.new) {
-                local_irq_disable();
-
-                /* Disable interrupts to the CPU */
-                reg = readl_relaxed(priv.base);
-                reg |= CPU_SW_INT_BLK;
-                writel_relaxed(reg, priv.base);
-
-                switch (state) {
-                case STATE_CPU_FREQ:
-                        clk_disable(priv.powersave_clk);
-                        break;
-                case STATE_DDR_FREQ:
-                        clk_enable(priv.powersave_clk);
-                        break;
-                }
+        local_irq_disable();
 
-                /* Wait-for-Interrupt, while the hardware changes frequency */
-                cpu_do_idle();
+        /* Disable interrupts to the CPU */
+        reg = readl_relaxed(priv.base);
+        reg |= CPU_SW_INT_BLK;
+        writel_relaxed(reg, priv.base);
 
-                /* Enable interrupts to the CPU */
-                reg = readl_relaxed(priv.base);
-                reg &= ~CPU_SW_INT_BLK;
-                writel_relaxed(reg, priv.base);
-
-                local_irq_enable();
+        switch (state) {
+        case STATE_CPU_FREQ:
+                clk_disable(priv.powersave_clk);
+                break;
+        case STATE_DDR_FREQ:
+                clk_enable(priv.powersave_clk);
+                break;
         }
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-};
-
-static int kirkwood_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, kirkwood_freq_table);
-}
 
-static int kirkwood_cpufreq_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq,
-                            unsigned int relation)
-{
-        unsigned int index = 0;
+        /* Wait-for-Interrupt, while the hardware changes frequency */
+        cpu_do_idle();
 
-        if (cpufreq_frequency_table_target(policy, kirkwood_freq_table,
-                                target_freq, relation, &index))
-                return -EINVAL;
+        /* Enable interrupts to the CPU */
+        reg = readl_relaxed(priv.base);
+        reg &= ~CPU_SW_INT_BLK;
+        writel_relaxed(reg, priv.base);
 
-        kirkwood_cpufreq_set_cpu_state(policy, index);
+        local_irq_enable();
 
         return 0;
 }
@@ -125,40 +93,17 @@ static int kirkwood_cpufreq_target(struct cpufreq_policy *policy,
 /* Module init and exit code */
 static int kirkwood_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-        int result;
-
-        /* cpuinfo and default policy values */
-        policy->cpuinfo.transition_latency = 5000; /* 5uS */
-        policy->cur = kirkwood_cpufreq_get_cpu_frequency(0);
-
-        result = cpufreq_frequency_table_cpuinfo(policy, kirkwood_freq_table);
-        if (result)
-                return result;
-
-        cpufreq_frequency_table_get_attr(kirkwood_freq_table, policy->cpu);
-
-        return 0;
-}
-
-static int kirkwood_cpufreq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_generic_init(policy, kirkwood_freq_table, 5000);
 }
 
-static struct freq_attr *kirkwood_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver kirkwood_cpufreq_driver = {
         .get    = kirkwood_cpufreq_get_cpu_frequency,
-        .verify = kirkwood_cpufreq_verify,
-        .target = kirkwood_cpufreq_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = kirkwood_cpufreq_target,
         .init   = kirkwood_cpufreq_cpu_init,
-        .exit   = kirkwood_cpufreq_cpu_exit,
+        .exit   = cpufreq_generic_exit,
         .name   = "kirkwood-cpufreq",
-        .attr   = kirkwood_cpufreq_attr,
+        .attr   = cpufreq_generic_attr,
 };
 
 static int kirkwood_cpufreq_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 4ada1cccb052..45bafddfd8ea 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -625,28 +625,13 @@ static void longhaul_setup_voltagescaling(void)
 }
 
 
-static int longhaul_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, longhaul_table);
-}
-
-
 static int longhaul_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq, unsigned int relation)
+                            unsigned int table_index)
 {
-        unsigned int table_index = 0;
         unsigned int i;
         unsigned int dir = 0;
         u8 vid, current_vid;
 
-        if (cpufreq_frequency_table_target(policy, longhaul_table, target_freq,
-                                relation, &table_index))
-                return -EINVAL;
-
-        /* Don't set same frequency again */
-        if (longhaul_index == table_index)
-                return 0;
-
         if (!can_scale_voltage)
                 longhaul_setstate(policy, table_index);
         else {
@@ -919,36 +904,18 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 longhaul_setup_voltagescaling();
 
         policy->cpuinfo.transition_latency = 200000;    /* nsec */
-        policy->cur = calc_speed(longhaul_get_cpu_mult());
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, longhaul_table);
-        if (ret)
-                return ret;
-
-        cpufreq_frequency_table_get_attr(longhaul_table, policy->cpu);
 
-        return 0;
+        return cpufreq_table_validate_and_show(policy, longhaul_table);
 }
 
-static int longhaul_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
-}
-
-static struct freq_attr *longhaul_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver longhaul_driver = {
-        .verify = longhaul_verify,
-        .target = longhaul_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = longhaul_target,
         .get    = longhaul_get,
         .init   = longhaul_cpu_init,
-        .exit   = longhaul_cpu_exit,
+        .exit   = cpufreq_generic_exit,
         .name   = "longhaul",
-        .attr   = longhaul_attr,
+        .attr   = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id longhaul_id[] = {
diff --git a/drivers/cpufreq/longrun.c b/drivers/cpufreq/longrun.c
index 5aa031612d53..074971b12635 100644
--- a/drivers/cpufreq/longrun.c
+++ b/drivers/cpufreq/longrun.c
@@ -129,9 +129,7 @@ static int longrun_verify_policy(struct cpufreq_policy *policy)
                 return -EINVAL;
 
         policy->cpu = 0;
-        cpufreq_verify_within_limits(policy,
-                policy->cpuinfo.min_freq,
-                policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
 
         if ((policy->policy != CPUFREQ_POLICY_POWERSAVE) &&
             (policy->policy != CPUFREQ_POLICY_PERFORMANCE))
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index 7bc3c44d34e2..a43609218105 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -53,51 +53,24 @@ static unsigned int loongson2_cpufreq_get(unsigned int cpu)
  * Here we notify other drivers of the proposed change and the final change.
  */
 static int loongson2_cpufreq_target(struct cpufreq_policy *policy,
-                                     unsigned int target_freq,
-                                     unsigned int relation)
+                                     unsigned int index)
 {
         unsigned int cpu = policy->cpu;
-        unsigned int newstate = 0;
         cpumask_t cpus_allowed;
-        struct cpufreq_freqs freqs;
         unsigned int freq;
 
         cpus_allowed = current->cpus_allowed;
         set_cpus_allowed_ptr(current, cpumask_of(cpu));
 
-        if (cpufreq_frequency_table_target
-            (policy, &loongson2_clockmod_table[0], target_freq, relation,
-             &newstate))
-                return -EINVAL;
-
         freq =
             ((cpu_clock_freq / 1000) *
-             loongson2_clockmod_table[newstate].driver_data) / 8;
-        if (freq < policy->min || freq > policy->max)
-                return -EINVAL;
-
-        pr_debug("cpufreq: requested frequency %u Hz\n", target_freq * 1000);
-
-        freqs.old = loongson2_cpufreq_get(cpu);
-        freqs.new = freq;
-        freqs.flags = 0;
-
-        if (freqs.new == freqs.old)
-                return 0;
-
-        /* notifiers */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+             loongson2_clockmod_table[index].driver_data) / 8;
 
         set_cpus_allowed_ptr(current, &cpus_allowed);
 
         /* setting the cpu frequency */
         clk_set_rate(cpuclk, freq);
 
-        /* notifiers */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        pr_debug("cpufreq: set frequency %u kHz\n", freq);
-
         return 0;
 }
 
@@ -131,40 +104,24 @@ static int loongson2_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 return ret;
         }
 
-        policy->cur = loongson2_cpufreq_get(policy->cpu);
-
-        cpufreq_frequency_table_get_attr(&loongson2_clockmod_table[0],
-                                         policy->cpu);
-
-        return cpufreq_frequency_table_cpuinfo(policy,
-                                            &loongson2_clockmod_table[0]);
-}
-
-static int loongson2_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                                              &loongson2_clockmod_table[0]);
+        return cpufreq_generic_init(policy, &loongson2_clockmod_table[0], 0);
 }
 
 static int loongson2_cpufreq_exit(struct cpufreq_policy *policy)
 {
+        cpufreq_frequency_table_put_attr(policy->cpu);
         clk_put(cpuclk);
         return 0;
 }
 
-static struct freq_attr *loongson2_table_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver loongson2_cpufreq_driver = {
         .name = "loongson2",
         .init = loongson2_cpufreq_cpu_init,
-        .verify = loongson2_cpufreq_verify,
-        .target = loongson2_cpufreq_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = loongson2_cpufreq_target,
         .get = loongson2_cpufreq_get,
         .exit = loongson2_cpufreq_exit,
-        .attr = loongson2_table_attr,
+        .attr = cpufreq_generic_attr,
 };
 
 static struct platform_device_id platform_device_ids[] = {
diff --git a/drivers/cpufreq/maple-cpufreq.c b/drivers/cpufreq/maple-cpufreq.c
index 6168d77b296d..c4dfa42a75ac 100644
--- a/drivers/cpufreq/maple-cpufreq.c
+++ b/drivers/cpufreq/maple-cpufreq.c
@@ -64,18 +64,11 @@ static struct cpufreq_frequency_table maple_cpu_freqs[] = {
         {0,                     CPUFREQ_TABLE_END},
 };
 
-static struct freq_attr *maple_cpu_freqs_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 /* Power mode data is an array of the 32 bits PCR values to use for
  * the various frequencies, retrieved from the device-tree
  */
 static int maple_pmode_cur;
 
-static DEFINE_MUTEX(maple_switch_mutex);
-
 static const u32 *maple_pmode_data;
 static int maple_pmode_max;
 
@@ -135,37 +128,10 @@ static int maple_scom_query_freq(void)
  * Common interface to the cpufreq core
  */
 
-static int maple_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, maple_cpu_freqs);
-}
-
 static int maple_cpufreq_target(struct cpufreq_policy *policy,
-        unsigned int target_freq, unsigned int relation)
+        unsigned int index)
 {
-        unsigned int newstate = 0;
-        struct cpufreq_freqs freqs;
-        int rc;
-
-        if (cpufreq_frequency_table_target(policy, maple_cpu_freqs,
-                        target_freq, relation, &newstate))
-                return -EINVAL;
-
-        if (maple_pmode_cur == newstate)
-                return 0;
-
-        mutex_lock(&maple_switch_mutex);
-
-        freqs.old = maple_cpu_freqs[maple_pmode_cur].frequency;
-        freqs.new = maple_cpu_freqs[newstate].frequency;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-        rc = maple_scom_switch_freq(newstate);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        mutex_unlock(&maple_switch_mutex);
-
-        return rc;
+        return maple_scom_switch_freq(index);
 }
 
 static unsigned int maple_cpufreq_get_speed(unsigned int cpu)
@@ -175,27 +141,17 @@ static unsigned int maple_cpufreq_get_speed(unsigned int cpu)
 
 static int maple_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-        policy->cpuinfo.transition_latency = 12000;
-        policy->cur = maple_cpu_freqs[maple_scom_query_freq()].frequency;
-        /* secondary CPUs are tied to the primary one by the
-         * cpufreq core if in the secondary policy we tell it that
-         * it actually must be one policy together with all others. */
-        cpumask_setall(policy->cpus);
-        cpufreq_frequency_table_get_attr(maple_cpu_freqs, policy->cpu);
-
-        return cpufreq_frequency_table_cpuinfo(policy,
-                maple_cpu_freqs);
+        return cpufreq_generic_init(policy, maple_cpu_freqs, 12000);
 }
 
-
 static struct cpufreq_driver maple_cpufreq_driver = {
         .name           = "maple",
         .flags          = CPUFREQ_CONST_LOOPS,
         .init           = maple_cpufreq_cpu_init,
-        .verify         = maple_cpufreq_verify,
-        .target         = maple_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = maple_cpufreq_target,
         .get            = maple_cpufreq_get_speed,
-        .attr           = maple_cpu_freqs_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int __init maple_cpufreq_init(void)
diff --git a/drivers/cpufreq/omap-cpufreq.c b/drivers/cpufreq/omap-cpufreq.c
index f31fcfcad514..be6d14307aa8 100644
--- a/drivers/cpufreq/omap-cpufreq.c
+++ b/drivers/cpufreq/omap-cpufreq.c
@@ -22,7 +22,7 @@
 #include <linux/err.h>
 #include <linux/clk.h>
 #include <linux/io.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/cpu.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -40,13 +40,6 @@ static struct clk *mpu_clk;
 static struct device *mpu_dev;
 static struct regulator *mpu_reg;
 
-static int omap_verify_speed(struct cpufreq_policy *policy)
-{
-        if (!freq_table)
-                return -EINVAL;
-        return cpufreq_frequency_table_verify(policy, freq_table);
-}
-
 static unsigned int omap_getspeed(unsigned int cpu)
 {
         unsigned long rate;
@@ -58,42 +51,16 @@ static unsigned int omap_getspeed(unsigned int cpu)
         return rate;
 }
 
-static int omap_target(struct cpufreq_policy *policy,
-                       unsigned int target_freq,
-                       unsigned int relation)
+static int omap_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int i;
-        int r, ret = 0;
-        struct cpufreq_freqs freqs;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long freq, volt = 0, volt_old = 0, tol = 0;
+        unsigned int old_freq, new_freq;
 
-        if (!freq_table) {
-                dev_err(mpu_dev, "%s: cpu%d: no freq table!\n", __func__,
-                                policy->cpu);
-                return -EINVAL;
-        }
+        old_freq = omap_getspeed(policy->cpu);
+        new_freq = freq_table[index].frequency;
 
-        ret = cpufreq_frequency_table_target(policy, freq_table, target_freq,
-                        relation, &i);
-        if (ret) {
-                dev_dbg(mpu_dev, "%s: cpu%d: no freq match for %d(ret=%d)\n",
-                        __func__, policy->cpu, target_freq, ret);
-                return ret;
-        }
-        freqs.new = freq_table[i].frequency;
-        if (!freqs.new) {
-                dev_err(mpu_dev, "%s: cpu%d: no match for freq %d\n", __func__,
-                        policy->cpu, target_freq);
-                return -EINVAL;
-        }
-
-        freqs.old = omap_getspeed(policy->cpu);
-
-        if (freqs.old == freqs.new && policy->cur == freqs.new)
-                return ret;
-
-        freq = freqs.new * 1000;
+        freq = new_freq * 1000;
         ret = clk_round_rate(mpu_clk, freq);
         if (IS_ERR_VALUE(ret)) {
                 dev_warn(mpu_dev,
@@ -105,143 +72,103 @@ static int omap_target(struct cpufreq_policy *policy,
 
         if (mpu_reg) {
                 rcu_read_lock();
-                opp = opp_find_freq_ceil(mpu_dev, &freq);
+                opp = dev_pm_opp_find_freq_ceil(mpu_dev, &freq);
                 if (IS_ERR(opp)) {
                         rcu_read_unlock();
                         dev_err(mpu_dev, "%s: unable to find MPU OPP for %d\n",
-                                __func__, freqs.new);
+                                __func__, new_freq);
                         return -EINVAL;
                 }
-                volt = opp_get_voltage(opp);
+                volt = dev_pm_opp_get_voltage(opp);
                 rcu_read_unlock();
                 tol = volt * OPP_TOLERANCE / 100;
                 volt_old = regulator_get_voltage(mpu_reg);
         }
 
         dev_dbg(mpu_dev, "cpufreq-omap: %u MHz, %ld mV --> %u MHz, %ld mV\n", 
-                freqs.old / 1000, volt_old ? volt_old / 1000 : -1,
-                freqs.new / 1000, volt ? volt / 1000 : -1);
-
-        /* notifiers */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+                old_freq / 1000, volt_old ? volt_old / 1000 : -1,
+                new_freq / 1000, volt ? volt / 1000 : -1);
 
         /* scaling up?  scale voltage before frequency */
-        if (mpu_reg && (freqs.new > freqs.old)) {
+        if (mpu_reg && (new_freq > old_freq)) {
                 r = regulator_set_voltage(mpu_reg, volt - tol, volt + tol);
                 if (r < 0) {
                         dev_warn(mpu_dev, "%s: unable to scale voltage up.\n",
                                  __func__);
-                        freqs.new = freqs.old;
-                        goto done;
+                        return r;
                 }
         }
 
-        ret = clk_set_rate(mpu_clk, freqs.new * 1000);
+        ret = clk_set_rate(mpu_clk, new_freq * 1000);
 
         /* scaling down?  scale voltage after frequency */
-        if (mpu_reg && (freqs.new < freqs.old)) {
+        if (mpu_reg && (new_freq < old_freq)) {
                 r = regulator_set_voltage(mpu_reg, volt - tol, volt + tol);
                 if (r < 0) {
                         dev_warn(mpu_dev, "%s: unable to scale voltage down.\n",
                                  __func__);
-                        ret = clk_set_rate(mpu_clk, freqs.old * 1000);
-                        freqs.new = freqs.old;
-                        goto done;
+                        clk_set_rate(mpu_clk, old_freq * 1000);
+                        return r;
                 }
         }
 
-        freqs.new = omap_getspeed(policy->cpu);
-
-done:
-        /* notifiers */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         return ret;
 }
 
 static inline void freq_table_free(void)
 {
         if (atomic_dec_and_test(&freq_table_users))
-                opp_free_cpufreq_table(mpu_dev, &freq_table);
+                dev_pm_opp_free_cpufreq_table(mpu_dev, &freq_table);
 }
 
 static int omap_cpu_init(struct cpufreq_policy *policy)
 {
-        int result = 0;
+        int result;
 
         mpu_clk = clk_get(NULL, "cpufreq_ck");
         if (IS_ERR(mpu_clk))
                 return PTR_ERR(mpu_clk);
 
-        if (policy->cpu >= NR_CPUS) {
-                result = -EINVAL;
-                goto fail_ck;
-        }
-
-        policy->cur = omap_getspeed(policy->cpu);
-
-        if (!freq_table)
-                result = opp_init_cpufreq_table(mpu_dev, &freq_table);
-
-        if (result) {
-                dev_err(mpu_dev, "%s: cpu%d: failed creating freq table[%d]\n",
+        if (!freq_table) {
+                result = dev_pm_opp_init_cpufreq_table(mpu_dev, &freq_table);
+                if (result) {
+                        dev_err(mpu_dev,
+                                "%s: cpu%d: failed creating freq table[%d]\n",
                                 __func__, policy->cpu, result);
-                goto fail_ck;
+                        goto fail;
+                }
         }
 
         atomic_inc_return(&freq_table_users);
 
-        result = cpufreq_frequency_table_cpuinfo(policy, freq_table);
-        if (result)
-                goto fail_table;
-
-        cpufreq_frequency_table_get_attr(freq_table, policy->cpu);
-
-        policy->cur = omap_getspeed(policy->cpu);
-
-        /*
-         * On OMAP SMP configuartion, both processors share the voltage
-         * and clock. So both CPUs needs to be scaled together and hence
-         * needs software co-ordination. Use cpufreq affected_cpus
-         * interface to handle this scenario. Additional is_smp() check
-         * is to keep SMP_ON_UP build working.
-         */
-        if (is_smp())
-                cpumask_setall(policy->cpus);
-
         /* FIXME: what's the actual transition time? */
-        policy->cpuinfo.transition_latency = 300 * 1000;
-
-        return 0;
+        result = cpufreq_generic_init(policy, freq_table, 300 * 1000);
+        if (!result)
+                return 0;
 
-fail_table:
         freq_table_free();
-fail_ck:
+fail:
         clk_put(mpu_clk);
         return result;
 }
 
 static int omap_cpu_exit(struct cpufreq_policy *policy)
 {
+        cpufreq_frequency_table_put_attr(policy->cpu);
         freq_table_free();
         clk_put(mpu_clk);
         return 0;
 }
 
-static struct freq_attr *omap_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver omap_driver = {
         .flags          = CPUFREQ_STICKY,
-        .verify         = omap_verify_speed,
-        .target         = omap_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = omap_target,
         .get            = omap_getspeed,
         .init           = omap_cpu_init,
         .exit           = omap_cpu_exit,
         .name           = "omap",
-        .attr           = omap_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int omap_cpufreq_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
index 2f0a2a65c37f..3d1cba9fd5f9 100644
--- a/drivers/cpufreq/p4-clockmod.c
+++ b/drivers/cpufreq/p4-clockmod.c
@@ -105,47 +105,21 @@ static struct cpufreq_frequency_table p4clockmod_table[] = {
 };
 
 
-static int cpufreq_p4_target(struct cpufreq_policy *policy,
-                             unsigned int target_freq,
-                             unsigned int relation)
+static int cpufreq_p4_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int    newstate = DC_RESV;
-        struct cpufreq_freqs freqs;
         int i;
 
-        if (cpufreq_frequency_table_target(policy, &p4clockmod_table[0],
-                                target_freq, relation, &newstate))
-                return -EINVAL;
-
-        freqs.old = cpufreq_p4_get(policy->cpu);
-        freqs.new = stock_freq * p4clockmod_table[newstate].driver_data / 8;
-
-        if (freqs.new == freqs.old)
-                return 0;
-
-        /* notifiers */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         /* run on each logical CPU,
          * see section 13.15.3 of IA32 Intel Architecture Software
          * Developer's Manual, Volume 3
          */
         for_each_cpu(i, policy->cpus)
-                cpufreq_p4_setdc(i, p4clockmod_table[newstate].driver_data);
-
-        /* notifiers */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+                cpufreq_p4_setdc(i, p4clockmod_table[index].driver_data);
 
         return 0;
 }
 
 
-static int cpufreq_p4_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &p4clockmod_table[0]);
-}
-
-
 static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
 {
         if (c->x86 == 0x06) {
@@ -230,25 +204,17 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
                 else
                         p4clockmod_table[i].frequency = (stock_freq * i)/8;
         }
-        cpufreq_frequency_table_get_attr(p4clockmod_table, policy->cpu);
 
         /* cpuinfo and default policy values */
 
         /* the transition latency is set to be 1 higher than the maximum
          * transition latency of the ondemand governor */
         policy->cpuinfo.transition_latency = 10000001;
-        policy->cur = stock_freq;
 
-        return cpufreq_frequency_table_cpuinfo(policy, &p4clockmod_table[0]);
+        return cpufreq_table_validate_and_show(policy, &p4clockmod_table[0]);
 }
 
 
-static int cpufreq_p4_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
-}
-
 static unsigned int cpufreq_p4_get(unsigned int cpu)
 {
         u32 l, h;
@@ -267,19 +233,14 @@ static unsigned int cpufreq_p4_get(unsigned int cpu)
         return stock_freq;
 }
 
-static struct freq_attr *p4clockmod_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver p4clockmod_driver = {
-        .verify         = cpufreq_p4_verify,
-        .target         = cpufreq_p4_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = cpufreq_p4_target,
         .init           = cpufreq_p4_cpu_init,
-        .exit           = cpufreq_p4_cpu_exit,
+        .exit           = cpufreq_generic_exit,
         .get            = cpufreq_p4_get,
         .name           = "p4-clockmod",
-        .attr           = p4clockmod_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id cpufreq_p4_id[] = {
diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
index 534e43a60d1f..1c331369b15b 100644
--- a/drivers/cpufreq/pasemi-cpufreq.c
+++ b/drivers/cpufreq/pasemi-cpufreq.c
@@ -51,8 +51,6 @@
 static void __iomem *sdcpwr_mapbase;
 static void __iomem *sdcasr_mapbase;
 
-static DEFINE_MUTEX(pas_switch_mutex);
-
 /* Current astate, is used when waking up from power savings on
  * one core, in case the other core has switched states during
  * the idle time.
@@ -69,11 +67,6 @@ static struct cpufreq_frequency_table pas_freqs[] = {
         {0,     CPUFREQ_TABLE_END},
 };
 
-static struct freq_attr *pas_cpu_freqs_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 /*
  * hardware specific functions
  */
@@ -209,22 +202,13 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 pr_debug("%d: %d\n", i, pas_freqs[i].frequency);
         }
 
-        policy->cpuinfo.transition_latency = get_gizmo_latency();
-
         cur_astate = get_cur_astate(policy->cpu);
         pr_debug("current astate is at %d\n",cur_astate);
 
         policy->cur = pas_freqs[cur_astate].frequency;
-        cpumask_copy(policy->cpus, cpu_online_mask);
-
         ppc_proc_freq = policy->cur * 1000ul;
 
-        cpufreq_frequency_table_get_attr(pas_freqs, policy->cpu);
-
-        /* this ensures that policy->cpuinfo_min and policy->cpuinfo_max
-         * are set correctly
-         */
-        return cpufreq_frequency_table_cpuinfo(policy, pas_freqs);
+        return cpufreq_generic_init(policy, pas_freqs, get_gizmo_latency());
 
 out_unmap_sdcpwr:
         iounmap(sdcpwr_mapbase);
@@ -253,31 +237,11 @@ static int pas_cpufreq_cpu_exit(struct cpufreq_policy *policy)
         return 0;
 }
 
-static int pas_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, pas_freqs);
-}
-
 static int pas_cpufreq_target(struct cpufreq_policy *policy,
-                              unsigned int target_freq,
-                              unsigned int relation)
+                              unsigned int pas_astate_new)
 {
-        struct cpufreq_freqs freqs;
-        int pas_astate_new;
         int i;
 
-        cpufreq_frequency_table_target(policy,
-                                       pas_freqs,
-                                       target_freq,
-                                       relation,
-                                       &pas_astate_new);
-
-        freqs.old = policy->cur;
-        freqs.new = pas_freqs[pas_astate_new].frequency;
-
-        mutex_lock(&pas_switch_mutex);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         pr_debug("setting frequency for cpu %d to %d kHz, 1/%d of max frequency\n",
                  policy->cpu,
                  pas_freqs[pas_astate_new].frequency,
@@ -288,10 +252,7 @@ static int pas_cpufreq_target(struct cpufreq_policy *policy,
         for_each_online_cpu(i)
                 set_astate(i, pas_astate_new);
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-        mutex_unlock(&pas_switch_mutex);
-
-        ppc_proc_freq = freqs.new * 1000ul;
+        ppc_proc_freq = pas_freqs[pas_astate_new].frequency * 1000ul;
         return 0;
 }
 
@@ -300,9 +261,9 @@ static struct cpufreq_driver pas_cpufreq_driver = {
         .flags          = CPUFREQ_CONST_LOOPS,
         .init           = pas_cpufreq_cpu_init,
         .exit           = pas_cpufreq_cpu_exit,
-        .verify         = pas_cpufreq_verify,
-        .target         = pas_cpufreq_target,
-        .attr           = pas_cpu_freqs_attr,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = pas_cpufreq_target,
+        .attr           = cpufreq_generic_attr,
 };
 
 /*
diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index d81c4e5ea0ad..e2b4f40ff69a 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -111,8 +111,7 @@ static struct pcc_cpu __percpu *pcc_cpu_info;
 
 static int pcc_cpufreq_verify(struct cpufreq_policy *policy)
 {
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
         return 0;
 }
 
@@ -396,15 +395,14 @@ static int __init pcc_cpufreq_probe(void)
         struct pcc_memory_resource *mem_resource;
         struct pcc_register_resource *reg_resource;
         union acpi_object *out_obj, *member;
-        acpi_handle handle, osc_handle, pcch_handle;
+        acpi_handle handle, osc_handle;
         int ret = 0;
 
         status = acpi_get_handle(NULL, "\\_SB", &handle);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        status = acpi_get_handle(handle, "PCCH", &pcch_handle);
-        if (ACPI_FAILURE(status))
+        if (!acpi_has_method(handle, "PCCH"))
                 return -ENODEV;
 
         status = acpi_get_handle(handle, "_OSC", &osc_handle);
@@ -560,13 +558,6 @@ static int pcc_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 ioread32(&pcch_hdr->nominal) * 1000;
         policy->min = policy->cpuinfo.min_freq =
                 ioread32(&pcch_hdr->minimum_frequency) * 1000;
-        policy->cur = pcc_get_freq(cpu);
-
-        if (!policy->cur) {
-                pr_debug("init: Unable to get current CPU frequency\n");
-                result = -EINVAL;
-                goto out;
-        }
 
         pr_debug("init: policy->max is %d, policy->min is %d\n",
                 policy->max, policy->min);
diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c
index a096cd3fa23d..cf55d202f332 100644
--- a/drivers/cpufreq/pmac32-cpufreq.c
+++ b/drivers/cpufreq/pmac32-cpufreq.c
@@ -86,11 +86,6 @@ static struct cpufreq_frequency_table pmac_cpu_freqs[] = {
         {0,                     CPUFREQ_TABLE_END},
 };
 
-static struct freq_attr* pmac_cpu_freqs_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static inline void local_delay(unsigned long ms)
 {
         if (no_schedule)
@@ -336,21 +331,11 @@ static int pmu_set_cpu_speed(int low_speed)
         return 0;
 }
 
-static int do_set_cpu_speed(struct cpufreq_policy *policy, int speed_mode,
-                int notify)
+static int do_set_cpu_speed(struct cpufreq_policy *policy, int speed_mode)
 {
-        struct cpufreq_freqs freqs;
         unsigned long l3cr;
         static unsigned long prev_l3cr;
 
-        freqs.old = cur_freq;
-        freqs.new = (speed_mode == CPUFREQ_HIGH) ? hi_freq : low_freq;
-
-        if (freqs.old == freqs.new)
-                return 0;
-
-        if (notify)
-                cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
         if (speed_mode == CPUFREQ_LOW &&
             cpu_has_feature(CPU_FTR_L3CR)) {
                 l3cr = _get_L3CR();
@@ -366,8 +351,6 @@ static int do_set_cpu_speed(struct cpufreq_policy *policy, int speed_mode,
                 if ((prev_l3cr & L3CR_L3E) && l3cr != prev_l3cr)
                         _set_L3CR(prev_l3cr);
         }
-        if (notify)
-                cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
         cur_freq = (speed_mode == CPUFREQ_HIGH) ? hi_freq : low_freq;
 
         return 0;
@@ -378,23 +361,12 @@ static unsigned int pmac_cpufreq_get_speed(unsigned int cpu)
         return cur_freq;
 }
 
-static int pmac_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, pmac_cpu_freqs);
-}
-
 static int pmac_cpufreq_target( struct cpufreq_policy *policy,
-                                        unsigned int target_freq,
-                                        unsigned int relation)
+                                        unsigned int index)
 {
-        unsigned int    newstate = 0;
         int             rc;
 
-        if (cpufreq_frequency_table_target(policy, pmac_cpu_freqs,
-                        target_freq, relation, &newstate))
-                return -EINVAL;
-
-        rc = do_set_cpu_speed(policy, newstate, 1);
+        rc = do_set_cpu_speed(policy, index);
 
         ppc_proc_freq = cur_freq * 1000ul;
         return rc;
@@ -402,14 +374,7 @@ static int pmac_cpufreq_target(	struct cpufreq_policy *policy,
 
 static int pmac_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-        if (policy->cpu != 0)
-                return -ENODEV;
-
-        policy->cpuinfo.transition_latency      = transition_latency;
-        policy->cur = cur_freq;
-
-        cpufreq_frequency_table_get_attr(pmac_cpu_freqs, policy->cpu);
-        return cpufreq_frequency_table_cpuinfo(policy, pmac_cpu_freqs);
+        return cpufreq_generic_init(policy, pmac_cpu_freqs, transition_latency);
 }
 
 static u32 read_gpio(struct device_node *np)
@@ -443,7 +408,7 @@ static int pmac_cpufreq_suspend(struct cpufreq_policy *policy)
         no_schedule = 1;
         sleep_freq = cur_freq;
         if (cur_freq == low_freq && !is_pmu_based)
-                do_set_cpu_speed(policy, CPUFREQ_HIGH, 0);
+                do_set_cpu_speed(policy, CPUFREQ_HIGH);
         return 0;
 }
 
@@ -460,7 +425,7 @@ static int pmac_cpufreq_resume(struct cpufreq_policy *policy)
          * probably high speed due to our suspend() routine
          */
         do_set_cpu_speed(policy, sleep_freq == low_freq ?
-                         CPUFREQ_LOW : CPUFREQ_HIGH, 0);
+                         CPUFREQ_LOW : CPUFREQ_HIGH);
 
         ppc_proc_freq = cur_freq * 1000ul;
 
@@ -469,14 +434,14 @@ static int pmac_cpufreq_resume(struct cpufreq_policy *policy)
 }
 
 static struct cpufreq_driver pmac_cpufreq_driver = {
-        .verify         = pmac_cpufreq_verify,
-        .target         = pmac_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = pmac_cpufreq_target,
         .get            = pmac_cpufreq_get_speed,
         .init           = pmac_cpufreq_cpu_init,
         .suspend        = pmac_cpufreq_suspend,
         .resume         = pmac_cpufreq_resume,
         .flags          = CPUFREQ_PM_NO_WARN,
-        .attr           = pmac_cpu_freqs_attr,
+        .attr           = cpufreq_generic_attr,
         .name           = "powermac",
 };
 
diff --git a/drivers/cpufreq/pmac64-cpufreq.c b/drivers/cpufreq/pmac64-cpufreq.c
index 3a51ad7e47c8..6a338f8c3860 100644
--- a/drivers/cpufreq/pmac64-cpufreq.c
+++ b/drivers/cpufreq/pmac64-cpufreq.c
@@ -70,11 +70,6 @@ static struct cpufreq_frequency_table g5_cpu_freqs[] = {
         {0,                     CPUFREQ_TABLE_END},
 };
 
-static struct freq_attr* g5_cpu_freqs_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 /* Power mode data is an array of the 32 bits PCR values to use for
  * the various frequencies, retrieved from the device-tree
  */
@@ -84,8 +79,6 @@ static void (*g5_switch_volt)(int speed_mode);
 static int (*g5_switch_freq)(int speed_mode);
 static int (*g5_query_freq)(void);
 
-static DEFINE_MUTEX(g5_switch_mutex);
-
 static unsigned long transition_latency;
 
 #ifdef CONFIG_PMAC_SMU
@@ -142,7 +135,7 @@ static void g5_vdnap_switch_volt(int speed_mode)
                 pmf_call_one(pfunc_vdnap0_complete, &args);
                 if (done)
                         break;
-                msleep(1);
+                usleep_range(1000, 1000);
         }
         if (done == 0)
                 printk(KERN_WARNING "cpufreq: Timeout in clock slewing !\n");
@@ -241,7 +234,7 @@ static void g5_pfunc_switch_volt(int speed_mode)
                 if (pfunc_cpu1_volt_low)
                         pmf_call_one(pfunc_cpu1_volt_low, NULL);
         }
-        msleep(10); /* should be faster , to fix */
+        usleep_range(10000, 10000); /* should be faster , to fix */
 }
 
 /*
@@ -286,7 +279,7 @@ static int g5_pfunc_switch_freq(int speed_mode)
                 pmf_call_one(pfunc_slewing_done, &args);
                 if (done)
                         break;
-                msleep(1);
+                usleep_range(500, 500);
         }
         if (done == 0)
                 printk(KERN_WARNING "cpufreq: Timeout in clock slewing !\n");
@@ -317,37 +310,9 @@ static int g5_pfunc_query_freq(void)
  * Common interface to the cpufreq core
  */
 
-static int g5_cpufreq_verify(struct cpufreq_policy *policy)
+static int g5_cpufreq_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        return cpufreq_frequency_table_verify(policy, g5_cpu_freqs);
-}
-
-static int g5_cpufreq_target(struct cpufreq_policy *policy,
-        unsigned int target_freq, unsigned int relation)
-{
-        unsigned int newstate = 0;
-        struct cpufreq_freqs freqs;
-        int rc;
-
-        if (cpufreq_frequency_table_target(policy, g5_cpu_freqs,
-                        target_freq, relation, &newstate))
-                return -EINVAL;
-
-        if (g5_pmode_cur == newstate)
-                return 0;
-
-        mutex_lock(&g5_switch_mutex);
-
-        freqs.old = g5_cpu_freqs[g5_pmode_cur].frequency;
-        freqs.new = g5_cpu_freqs[newstate].frequency;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-        rc = g5_switch_freq(newstate);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        mutex_unlock(&g5_switch_mutex);
-
-        return rc;
+        return g5_switch_freq(index);
 }
 
 static unsigned int g5_cpufreq_get_speed(unsigned int cpu)
@@ -357,27 +322,17 @@ static unsigned int g5_cpufreq_get_speed(unsigned int cpu)
 
 static int g5_cpufreq_cpu_init(struct cpufreq_policy *policy)
 {
-        policy->cpuinfo.transition_latency = transition_latency;
-        policy->cur = g5_cpu_freqs[g5_query_freq()].frequency;
-        /* secondary CPUs are tied to the primary one by the
-         * cpufreq core if in the secondary policy we tell it that
-         * it actually must be one policy together with all others. */
-        cpumask_copy(policy->cpus, cpu_online_mask);
-        cpufreq_frequency_table_get_attr(g5_cpu_freqs, policy->cpu);
-
-        return cpufreq_frequency_table_cpuinfo(policy,
-                g5_cpu_freqs);
+        return cpufreq_generic_init(policy, g5_cpu_freqs, transition_latency);
 }
 
-
 static struct cpufreq_driver g5_cpufreq_driver = {
         .name           = "powermac",
         .flags          = CPUFREQ_CONST_LOOPS,
         .init           = g5_cpufreq_cpu_init,
-        .verify         = g5_cpufreq_verify,
-        .target         = g5_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = g5_cpufreq_target,
         .get            = g5_cpufreq_get_speed,
-        .attr           = g5_cpu_freqs_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 
@@ -397,7 +352,8 @@ static int __init g5_neo2_cpufreq_init(struct device_node *cpunode)
         /* Check supported platforms */
         if (of_machine_is_compatible("PowerMac8,1") ||
             of_machine_is_compatible("PowerMac8,2") ||
-            of_machine_is_compatible("PowerMac9,1"))
+            of_machine_is_compatible("PowerMac9,1") ||
+            of_machine_is_compatible("PowerMac12,1"))
                 use_volts_smu = 1;
         else if (of_machine_is_compatible("PowerMac11,2"))
                 use_volts_vdnap = 1;
@@ -647,8 +603,10 @@ static int __init g5_pm72_cpufreq_init(struct device_node *cpunode)
         g5_cpu_freqs[0].frequency = max_freq;
         g5_cpu_freqs[1].frequency = min_freq;
 
+        /* Based on a measurement on Xserve G5, rounded up. */
+        transition_latency = 10 * NSEC_PER_MSEC;
+
         /* Set callbacks */
-        transition_latency = CPUFREQ_ETERNAL;
         g5_switch_volt = g5_pfunc_switch_volt;
         g5_switch_freq = g5_pfunc_switch_freq;
         g5_query_freq = g5_pfunc_query_freq;
diff --git a/drivers/cpufreq/powernow-k6.c b/drivers/cpufreq/powernow-k6.c
index 85f1c8c25ddc..643e7952cad3 100644
--- a/drivers/cpufreq/powernow-k6.c
+++ b/drivers/cpufreq/powernow-k6.c
@@ -63,12 +63,12 @@ static int powernow_k6_get_cpu_multiplier(void)
 
 
 /**
- * powernow_k6_set_state - set the PowerNow! multiplier
+ * powernow_k6_target - set the PowerNow! multiplier
  * @best_i: clock_ratio[best_i] is the target multiplier
  *
  *   Tries to change the PowerNow! multiplier
  */
-static void powernow_k6_set_state(struct cpufreq_policy *policy,
+static int powernow_k6_target(struct cpufreq_policy *policy,
                 unsigned int best_i)
 {
         unsigned long outvalue = 0, invalue = 0;
@@ -77,7 +77,7 @@ static void powernow_k6_set_state(struct cpufreq_policy *policy,
 
         if (clock_ratio[best_i].driver_data > max_multiplier) {
                 printk(KERN_ERR PFX "invalid target frequency\n");
-                return;
+                return -EINVAL;
         }
 
         freqs.old = busfreq * powernow_k6_get_cpu_multiplier();
@@ -100,44 +100,6 @@ static void powernow_k6_set_state(struct cpufreq_policy *policy,
 
         cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
 
-        return;
-}
-
-
-/**
- * powernow_k6_verify - verifies a new CPUfreq policy
- * @policy: new policy
- *
- * Policy must be within lowest and highest possible CPU Frequency,
- * and at least one possible state must be within min and max.
- */
-static int powernow_k6_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &clock_ratio[0]);
-}
-
-
-/**
- * powernow_k6_setpolicy - sets a new CPUFreq policy
- * @policy: new policy
- * @target_freq: the target frequency
- * @relation: how that frequency relates to achieved frequency
- *  (CPUFREQ_RELATION_L or CPUFREQ_RELATION_H)
- *
- * sets a new CPUFreq policy
- */
-static int powernow_k6_target(struct cpufreq_policy *policy,
-                               unsigned int target_freq,
-                               unsigned int relation)
-{
-        unsigned int newstate = 0;
-
-        if (cpufreq_frequency_table_target(policy, &clock_ratio[0],
-                                target_freq, relation, &newstate))
-                return -EINVAL;
-
-        powernow_k6_set_state(policy, newstate);
-
         return 0;
 }
 
@@ -145,7 +107,6 @@ static int powernow_k6_target(struct cpufreq_policy *policy,
 static int powernow_k6_cpu_init(struct cpufreq_policy *policy)
 {
         unsigned int i, f;
-        int result;
 
         if (policy->cpu != 0)
                 return -ENODEV;
@@ -165,15 +126,8 @@ static int powernow_k6_cpu_init(struct cpufreq_policy *policy)
 
         /* cpuinfo and default policy values */
         policy->cpuinfo.transition_latency = 200000;
-        policy->cur = busfreq * max_multiplier;
-
-        result = cpufreq_frequency_table_cpuinfo(policy, clock_ratio);
-        if (result)
-                return result;
-
-        cpufreq_frequency_table_get_attr(clock_ratio, policy->cpu);
 
-        return 0;
+        return cpufreq_table_validate_and_show(policy, clock_ratio);
 }
 
 
@@ -182,7 +136,7 @@ static int powernow_k6_cpu_exit(struct cpufreq_policy *policy)
         unsigned int i;
         for (i = 0; i < 8; i++) {
                 if (i == max_multiplier)
-                        powernow_k6_set_state(policy, i);
+                        powernow_k6_target(policy, i);
         }
         cpufreq_frequency_table_put_attr(policy->cpu);
         return 0;
@@ -195,19 +149,14 @@ static unsigned int powernow_k6_get(unsigned int cpu)
         return ret;
 }
 
-static struct freq_attr *powernow_k6_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver powernow_k6_driver = {
-        .verify         = powernow_k6_verify,
-        .target         = powernow_k6_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = powernow_k6_target,
         .init           = powernow_k6_cpu_init,
         .exit           = powernow_k6_cpu_exit,
         .get            = powernow_k6_get,
         .name           = "powernow-k6",
-        .attr           = powernow_k6_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id powernow_k6_ids[] = {
diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
index 14ce480be8ab..946708a1d745 100644
--- a/drivers/cpufreq/powernow-k7.c
+++ b/drivers/cpufreq/powernow-k7.c
@@ -248,7 +248,7 @@ static void change_VID(int vid)
 }
 
 
-static void change_speed(struct cpufreq_policy *policy, unsigned int index)
+static int powernow_target(struct cpufreq_policy *policy, unsigned int index)
 {
         u8 fid, vid;
         struct cpufreq_freqs freqs;
@@ -291,6 +291,8 @@ static void change_speed(struct cpufreq_policy *policy, unsigned int index)
                 local_irq_enable();
 
         cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+
+        return 0;
 }
 
 
@@ -533,27 +535,6 @@ static int powernow_decode_bios(int maxfid, int startvid)
 }
 
 
-static int powernow_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq,
-                            unsigned int relation)
-{
-        unsigned int newstate;
-
-        if (cpufreq_frequency_table_target(policy, powernow_table, target_freq,
-                                relation, &newstate))
-                return -EINVAL;
-
-        change_speed(policy, newstate);
-
-        return 0;
-}
-
-
-static int powernow_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, powernow_table);
-}
-
 /*
  * We use the fact that the bus frequency is somehow
  * a multiple of 100000/3 khz, then we compute sgtc according
@@ -678,11 +659,7 @@ static int powernow_cpu_init(struct cpufreq_policy *policy)
         policy->cpuinfo.transition_latency =
                 cpufreq_scale(2000000UL, fsb, latency);
 
-        policy->cur = powernow_get(0);
-
-        cpufreq_frequency_table_get_attr(powernow_table, policy->cpu);
-
-        return cpufreq_frequency_table_cpuinfo(policy, powernow_table);
+        return cpufreq_table_validate_and_show(policy, powernow_table);
 }
 
 static int powernow_cpu_exit(struct cpufreq_policy *policy)
@@ -701,14 +678,9 @@ static int powernow_cpu_exit(struct cpufreq_policy *policy)
         return 0;
 }
 
-static struct freq_attr *powernow_table_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver powernow_driver = {
-        .verify         = powernow_verify,
-        .target         = powernow_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = powernow_target,
         .get            = powernow_get,
 #ifdef CONFIG_X86_POWERNOW_K7_ACPI
         .bios_limit     = acpi_processor_get_bios_limit,
@@ -716,7 +688,7 @@ static struct cpufreq_driver powernow_driver = {
         .init           = powernow_cpu_init,
         .exit           = powernow_cpu_exit,
         .name           = "powernow-k7",
-        .attr           = powernow_table_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int __init powernow_init(void)
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index 2344a9ed17f3..0023c7d40a51 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -977,20 +977,17 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data,
 
 struct powernowk8_target_arg {
         struct cpufreq_policy           *pol;
-        unsigned                        targfreq;
-        unsigned                        relation;
+        unsigned                        newstate;
 };
 
 static long powernowk8_target_fn(void *arg)
 {
         struct powernowk8_target_arg *pta = arg;
         struct cpufreq_policy *pol = pta->pol;
-        unsigned targfreq = pta->targfreq;
-        unsigned relation = pta->relation;
+        unsigned newstate = pta->newstate;
         struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
         u32 checkfid;
         u32 checkvid;
-        unsigned int newstate;
         int ret;
 
         if (!data)
@@ -1004,8 +1001,9 @@ static long powernowk8_target_fn(void *arg)
                 return -EIO;
         }
 
-        pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
-                pol->cpu, targfreq, pol->min, pol->max, relation);
+        pr_debug("targ: cpu %d, %d kHz, min %d, max %d\n",
+                pol->cpu, data->powernow_table[newstate].frequency, pol->min,
+                pol->max);
 
         if (query_current_values_with_pending_wait(data))
                 return -EIO;
@@ -1021,10 +1019,6 @@ static long powernowk8_target_fn(void *arg)
                        checkvid, data->currvid);
         }
 
-        if (cpufreq_frequency_table_target(pol, data->powernow_table,
-                                targfreq, relation, &newstate))
-                return -EIO;
-
         mutex_lock(&fidvid_mutex);
 
         powernow_k8_acpi_pst_values(data, newstate);
@@ -1044,26 +1038,13 @@ static long powernowk8_target_fn(void *arg)
 }
 
 /* Driver entry point to switch to the target frequency */
-static int powernowk8_target(struct cpufreq_policy *pol,
-                unsigned targfreq, unsigned relation)
+static int powernowk8_target(struct cpufreq_policy *pol, unsigned index)
 {
-        struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
-                                             .relation = relation };
+        struct powernowk8_target_arg pta = { .pol = pol, .newstate = index };
 
         return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 
-/* Driver entry point to verify the policy and range of frequencies */
-static int powernowk8_verify(struct cpufreq_policy *pol)
-{
-        struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
-
-        if (!data)
-                return -EINVAL;
-
-        return cpufreq_frequency_table_verify(pol, data->powernow_table);
-}
-
 struct init_on_cpu {
         struct powernow_k8_data *data;
         int rc;
@@ -1152,11 +1133,8 @@ static int powernowk8_cpu_init(struct cpufreq_policy *pol)
         cpumask_copy(pol->cpus, cpu_core_mask(pol->cpu));
         data->available_cores = pol->cpus;
 
-        pol->cur = find_khz_freq_from_fid(data->currfid);
-        pr_debug("policy current frequency %d kHz\n", pol->cur);
-
         /* min/max the cpu is capable of */
-        if (cpufreq_frequency_table_cpuinfo(pol, data->powernow_table)) {
+        if (cpufreq_table_validate_and_show(pol, data->powernow_table)) {
                 printk(KERN_ERR FW_BUG PFX "invalid powernow_table\n");
                 powernow_k8_cpu_exit_acpi(data);
                 kfree(data->powernow_table);
@@ -1164,8 +1142,6 @@ static int powernowk8_cpu_init(struct cpufreq_policy *pol)
                 return -EINVAL;
         }
 
-        cpufreq_frequency_table_get_attr(data->powernow_table, pol->cpu);
-
         pr_debug("cpu_init done, current fid 0x%x, vid 0x%x\n",
                  data->currfid, data->currvid);
 
@@ -1227,20 +1203,16 @@ out:
         return khz;
 }
 
-static struct freq_attr *powernow_k8_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver cpufreq_amd64_driver = {
-        .verify         = powernowk8_verify,
-        .target         = powernowk8_target,
+        .flags          = CPUFREQ_ASYNC_NOTIFICATION,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = powernowk8_target,
         .bios_limit     = acpi_processor_get_bios_limit,
         .init           = powernowk8_cpu_init,
         .exit           = powernowk8_cpu_exit,
         .get            = powernowk8_get,
         .name           = "powernow-k8",
-        .attr           = powernow_k8_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static void __request_acpi_cpufreq(void)
diff --git a/drivers/cpufreq/ppc-corenet-cpufreq.c b/drivers/cpufreq/ppc-corenet-cpufreq.c
index 60e81d524ea8..3f7be46d2b27 100644
--- a/drivers/cpufreq/ppc-corenet-cpufreq.c
+++ b/drivers/cpufreq/ppc-corenet-cpufreq.c
@@ -69,8 +69,6 @@ static const struct soc_data sdata[] = {
 static u32 min_cpufreq;
 static const u32 *fmask;
 
-/* serialize frequency changes  */
-static DEFINE_MUTEX(cpufreq_lock);
 static DEFINE_PER_CPU(struct cpu_data *, cpu_data);
 
 /* cpumask in a cluster */
@@ -202,7 +200,7 @@ static int corenet_cpufreq_cpu_init(struct cpufreq_policy *policy)
         table[i].frequency = CPUFREQ_TABLE_END;
 
         /* set the min and max frequency properly */
-        ret = cpufreq_frequency_table_cpuinfo(policy, table);
+        ret = cpufreq_table_validate_and_show(policy, table);
         if (ret) {
                 pr_err("invalid frequency table: %d\n", ret);
                 goto err_nomem1;
@@ -217,9 +215,6 @@ static int corenet_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 per_cpu(cpu_data, i) = data;
 
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        policy->cur = corenet_cpufreq_get_speed(policy->cpu);
-
-        cpufreq_frequency_table_get_attr(table, cpu);
         of_node_put(np);
 
         return 0;
@@ -253,60 +248,25 @@ static int __exit corenet_cpufreq_cpu_exit(struct cpufreq_policy *policy)
         return 0;
 }
 
-static int corenet_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        struct cpufreq_frequency_table *table =
-                per_cpu(cpu_data, policy->cpu)->table;
-
-        return cpufreq_frequency_table_verify(policy, table);
-}
-
 static int corenet_cpufreq_target(struct cpufreq_policy *policy,
-                unsigned int target_freq, unsigned int relation)
+                unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        unsigned int new;
         struct clk *parent;
-        int ret;
         struct cpu_data *data = per_cpu(cpu_data, policy->cpu);
 
-        cpufreq_frequency_table_target(policy, data->table,
-                        target_freq, relation, &new);
-
-        if (policy->cur == data->table[new].frequency)
-                return 0;
-
-        freqs.old = policy->cur;
-        freqs.new = data->table[new].frequency;
-
-        mutex_lock(&cpufreq_lock);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
-        parent = of_clk_get(data->parent, data->table[new].driver_data);
-        ret = clk_set_parent(data->clk, parent);
-        if (ret)
-                freqs.new = freqs.old;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-        mutex_unlock(&cpufreq_lock);
-
-        return ret;
+        parent = of_clk_get(data->parent, data->table[index].driver_data);
+        return clk_set_parent(data->clk, parent);
 }
 
-static struct freq_attr *corenet_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver ppc_corenet_cpufreq_driver = {
         .name           = "ppc_cpufreq",
         .flags          = CPUFREQ_CONST_LOOPS,
         .init           = corenet_cpufreq_cpu_init,
         .exit           = __exit_p(corenet_cpufreq_cpu_exit),
-        .verify         = corenet_cpufreq_verify,
-        .target         = corenet_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = corenet_cpufreq_target,
         .get            = corenet_cpufreq_get_speed,
-        .attr           = corenet_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static const struct of_device_id node_matches[] __initdata = {
diff --git a/drivers/cpufreq/ppc_cbe_cpufreq.c b/drivers/cpufreq/ppc_cbe_cpufreq.c
index 2e448f0bbdc5..e42ca9c31cea 100644
--- a/drivers/cpufreq/ppc_cbe_cpufreq.c
+++ b/drivers/cpufreq/ppc_cbe_cpufreq.c
@@ -30,9 +30,6 @@
 
 #include "ppc_cbe_cpufreq.h"
 
-static DEFINE_MUTEX(cbe_switch_mutex);
-
-
 /* the CBE supports an 8 step frequency scaling */
 static struct cpufreq_frequency_table cbe_freqs[] = {
         {1,     0},
@@ -123,63 +120,28 @@ static int cbe_cpufreq_cpu_init(struct cpufreq_policy *policy)
         cpumask_copy(policy->cpus, cpu_sibling_mask(policy->cpu));
 #endif
 
-        cpufreq_frequency_table_get_attr(cbe_freqs, policy->cpu);
-
         /* this ensures that policy->cpuinfo_min
          * and policy->cpuinfo_max are set correctly */
-        return cpufreq_frequency_table_cpuinfo(policy, cbe_freqs);
-}
-
-static int cbe_cpufreq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
-}
-
-static int cbe_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, cbe_freqs);
+        return cpufreq_table_validate_and_show(policy, cbe_freqs);
 }
 
 static int cbe_cpufreq_target(struct cpufreq_policy *policy,
-                              unsigned int target_freq,
-                              unsigned int relation)
+                              unsigned int cbe_pmode_new)
 {
-        int rc;
-        struct cpufreq_freqs freqs;
-        unsigned int cbe_pmode_new;
-
-        cpufreq_frequency_table_target(policy,
-                                       cbe_freqs,
-                                       target_freq,
-                                       relation,
-                                       &cbe_pmode_new);
-
-        freqs.old = policy->cur;
-        freqs.new = cbe_freqs[cbe_pmode_new].frequency;
-
-        mutex_lock(&cbe_switch_mutex);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         pr_debug("setting frequency for cpu %d to %d kHz, " \
                  "1/%d of max frequency\n",
                  policy->cpu,
                  cbe_freqs[cbe_pmode_new].frequency,
                  cbe_freqs[cbe_pmode_new].driver_data);
 
-        rc = set_pmode(policy->cpu, cbe_pmode_new);
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-        mutex_unlock(&cbe_switch_mutex);
-
-        return rc;
+        return set_pmode(policy->cpu, cbe_pmode_new);
 }
 
 static struct cpufreq_driver cbe_cpufreq_driver = {
-        .verify         = cbe_cpufreq_verify,
-        .target         = cbe_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = cbe_cpufreq_target,
         .init           = cbe_cpufreq_cpu_init,
-        .exit           = cbe_cpufreq_cpu_exit,
+        .exit           = cpufreq_generic_exit,
         .name           = "cbe-cpufreq",
         .flags          = CPUFREQ_CONST_LOOPS,
 };
diff --git a/drivers/cpufreq/pxa2xx-cpufreq.c b/drivers/cpufreq/pxa2xx-cpufreq.c
index 8749eaf18793..0a0f4369636a 100644
--- a/drivers/cpufreq/pxa2xx-cpufreq.c
+++ b/drivers/cpufreq/pxa2xx-cpufreq.c
@@ -262,36 +262,15 @@ static u32 mdrefr_dri(unsigned int freq)
         return (interval - (cpu_is_pxa27x() ? 31 : 0)) / 32;
 }
 
-/* find a valid frequency point */
-static int pxa_verify_policy(struct cpufreq_policy *policy)
-{
-        struct cpufreq_frequency_table *pxa_freqs_table;
-        pxa_freqs_t *pxa_freqs;
-        int ret;
-
-        find_freq_tables(&pxa_freqs_table, &pxa_freqs);
-        ret = cpufreq_frequency_table_verify(policy, pxa_freqs_table);
-
-        if (freq_debug)
-                pr_debug("Verified CPU policy: %dKhz min to %dKhz max\n",
-                         policy->min, policy->max);
-
-        return ret;
-}
-
 static unsigned int pxa_cpufreq_get(unsigned int cpu)
 {
         return get_clk_frequency_khz(0);
 }
 
-static int pxa_set_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
+static int pxa_set_target(struct cpufreq_policy *policy, unsigned int idx)
 {
         struct cpufreq_frequency_table *pxa_freqs_table;
         pxa_freqs_t *pxa_freq_settings;
-        struct cpufreq_freqs freqs;
-        unsigned int idx;
         unsigned long flags;
         unsigned int new_freq_cpu, new_freq_mem;
         unsigned int unused, preset_mdrefr, postset_mdrefr, cclkcfg;
@@ -300,32 +279,19 @@ static int pxa_set_target(struct cpufreq_policy *policy,
         /* Get the current policy */
         find_freq_tables(&pxa_freqs_table, &pxa_freq_settings);
 
-        /* Lookup the next frequency */
-        if (cpufreq_frequency_table_target(policy, pxa_freqs_table,
-                                           target_freq, relation, &idx)) {
-                return -EINVAL;
-        }
-
         new_freq_cpu = pxa_freq_settings[idx].khz;
         new_freq_mem = pxa_freq_settings[idx].membus;
-        freqs.old = policy->cur;
-        freqs.new = new_freq_cpu;
 
         if (freq_debug)
                 pr_debug("Changing CPU frequency to %d Mhz, (SDRAM %d Mhz)\n",
-                         freqs.new / 1000, (pxa_freq_settings[idx].div2) ?
+                         new_freq_cpu / 1000, (pxa_freq_settings[idx].div2) ?
                          (new_freq_mem / 2000) : (new_freq_mem / 1000));
 
-        if (vcc_core && freqs.new > freqs.old)
+        if (vcc_core && new_freq_cpu > policy->cur) {
                 ret = pxa_cpufreq_change_voltage(&pxa_freq_settings[idx]);
-        if (ret)
-                return ret;
-        /*
-         * Tell everyone what we're about to do...
-         * you should add a notify client with any platform specific
-         * Vcc changing capability
-         */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+                if (ret)
+                        return ret;
+        }
 
         /* Calculate the next MDREFR.  If we're slowing down the SDRAM clock
          * we need to preset the smaller DRI before the change.  If we're
@@ -376,13 +342,6 @@ static int pxa_set_target(struct cpufreq_policy *policy,
         local_irq_restore(flags);
 
         /*
-         * Tell everyone what we've just done...
-         * you should add a notify client with any platform specific
-         * SDRAM refresh timer adjustments
-         */
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        /*
          * Even if voltage setting fails, we don't report it, as the frequency
          * change succeeded. The voltage reduction is not a critical failure,
          * only power savings will suffer from this.
@@ -391,7 +350,7 @@ static int pxa_set_target(struct cpufreq_policy *policy,
          * bug is triggered (seems a deadlock). Should anybody find out where,
          * the "return 0" should become a "return ret".
          */
-        if (vcc_core && freqs.new < freqs.old)
+        if (vcc_core && new_freq_cpu < policy->cur)
                 ret = pxa_cpufreq_change_voltage(&pxa_freq_settings[idx]);
 
         return 0;
@@ -414,8 +373,6 @@ static int pxa_cpufreq_init(struct cpufreq_policy *policy)
 
         /* set default policy and cpuinfo */
         policy->cpuinfo.transition_latency = 1000; /* FIXME: 1 ms, assumed */
-        policy->cur = get_clk_frequency_khz(0);    /* current freq */
-        policy->min = policy->max = policy->cur;
 
         /* Generate pxa25x the run cpufreq_frequency_table struct */
         for (i = 0; i < NUM_PXA25x_RUN_FREQS; i++) {
@@ -453,10 +410,12 @@ static int pxa_cpufreq_init(struct cpufreq_policy *policy)
                 find_freq_tables(&pxa255_freq_table, &pxa255_freqs);
                 pr_info("PXA255 cpufreq using %s frequency table\n",
                         pxa255_turbo_table ? "turbo" : "run");
-                cpufreq_frequency_table_cpuinfo(policy, pxa255_freq_table);
+
+                cpufreq_table_validate_and_show(policy, pxa255_freq_table);
+        }
+        else if (cpu_is_pxa27x()) {
+                cpufreq_table_validate_and_show(policy, pxa27x_freq_table);
         }
-        else if (cpu_is_pxa27x())
-                cpufreq_frequency_table_cpuinfo(policy, pxa27x_freq_table);
 
         printk(KERN_INFO "PXA CPU frequency change support initialized\n");
 
@@ -464,9 +423,10 @@ static int pxa_cpufreq_init(struct cpufreq_policy *policy)
 }
 
 static struct cpufreq_driver pxa_cpufreq_driver = {
-        .verify = pxa_verify_policy,
-        .target = pxa_set_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = pxa_set_target,
         .init   = pxa_cpufreq_init,
+        .exit   = cpufreq_generic_exit,
         .get    = pxa_cpufreq_get,
         .name   = "PXA2xx",
 };
diff --git a/drivers/cpufreq/pxa3xx-cpufreq.c b/drivers/cpufreq/pxa3xx-cpufreq.c
index d26306fb00d2..93840048dd11 100644
--- a/drivers/cpufreq/pxa3xx-cpufreq.c
+++ b/drivers/cpufreq/pxa3xx-cpufreq.c
@@ -108,7 +108,7 @@ static int setup_freqs_table(struct cpufreq_policy *policy,
         pxa3xx_freqs_num = num;
         pxa3xx_freqs_table = table;
 
-        return cpufreq_frequency_table_cpuinfo(policy, table);
+        return cpufreq_table_validate_and_show(policy, table);
 }
 
 static void __update_core_freq(struct pxa3xx_freq_info *info)
@@ -150,54 +150,26 @@ static void __update_bus_freq(struct pxa3xx_freq_info *info)
                 cpu_relax();
 }
 
-static int pxa3xx_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, pxa3xx_freqs_table);
-}
-
 static unsigned int pxa3xx_cpufreq_get(unsigned int cpu)
 {
         return pxa3xx_get_clk_frequency_khz(0);
 }
 
-static int pxa3xx_cpufreq_set(struct cpufreq_policy *policy,
-                              unsigned int target_freq,
-                              unsigned int relation)
+static int pxa3xx_cpufreq_set(struct cpufreq_policy *policy, unsigned int index)
 {
         struct pxa3xx_freq_info *next;
-        struct cpufreq_freqs freqs;
         unsigned long flags;
-        int idx;
 
         if (policy->cpu != 0)
                 return -EINVAL;
 
-        /* Lookup the next frequency */
-        if (cpufreq_frequency_table_target(policy, pxa3xx_freqs_table,
-                                target_freq, relation, &idx))
-                return -EINVAL;
-
-        next = &pxa3xx_freqs[idx];
-
-        freqs.old = policy->cur;
-        freqs.new = next->cpufreq_mhz * 1000;
-
-        pr_debug("CPU frequency from %d MHz to %d MHz%s\n",
-                        freqs.old / 1000, freqs.new / 1000,
-                        (freqs.old == freqs.new) ? " (skipped)" : "");
-
-        if (freqs.old == target_freq)
-                return 0;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+        next = &pxa3xx_freqs[index];
 
         local_irq_save(flags);
         __update_core_freq(next);
         __update_bus_freq(next);
         local_irq_restore(flags);
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         return 0;
 }
 
@@ -206,11 +178,10 @@ static int pxa3xx_cpufreq_init(struct cpufreq_policy *policy)
         int ret = -EINVAL;
 
         /* set default policy and cpuinfo */
-        policy->cpuinfo.min_freq = 104000;
-        policy->cpuinfo.max_freq = (cpu_is_pxa320()) ? 806000 : 624000;
+        policy->min = policy->cpuinfo.min_freq = 104000;
+        policy->max = policy->cpuinfo.max_freq =
+                (cpu_is_pxa320()) ? 806000 : 624000;
         policy->cpuinfo.transition_latency = 1000; /* FIXME: 1 ms, assumed */
-        policy->max = pxa3xx_get_clk_frequency_khz(0);
-        policy->cur = policy->min = policy->max;
 
         if (cpu_is_pxa300() || cpu_is_pxa310())
                 ret = setup_freqs_table(policy, pxa300_freqs,
@@ -230,9 +201,10 @@ static int pxa3xx_cpufreq_init(struct cpufreq_policy *policy)
 }
 
 static struct cpufreq_driver pxa3xx_cpufreq_driver = {
-        .verify         = pxa3xx_cpufreq_verify,
-        .target         = pxa3xx_cpufreq_set,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = pxa3xx_cpufreq_set,
         .init           = pxa3xx_cpufreq_init,
+        .exit           = cpufreq_generic_exit,
         .get            = pxa3xx_cpufreq_get,
         .name           = "pxa3xx-cpufreq",
 };
diff --git a/drivers/cpufreq/s3c2416-cpufreq.c b/drivers/cpufreq/s3c2416-cpufreq.c
index 22dcb81ef9d0..8d904a00027b 100644
--- a/drivers/cpufreq/s3c2416-cpufreq.c
+++ b/drivers/cpufreq/s3c2416-cpufreq.c
@@ -87,16 +87,6 @@ static struct cpufreq_frequency_table s3c2450_freq_table[] = {
         { 0, CPUFREQ_TABLE_END },
 };
 
-static int s3c2416_cpufreq_verify_speed(struct cpufreq_policy *policy)
-{
-        struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
-
-        if (policy->cpu != 0)
-                return -EINVAL;
-
-        return cpufreq_frequency_table_verify(policy, s3c_freq->freq_table);
-}
-
 static unsigned int s3c2416_cpufreq_get_speed(unsigned int cpu)
 {
         struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
@@ -227,24 +217,15 @@ static int s3c2416_cpufreq_leave_dvs(struct s3c2416_data *s3c_freq, int idx)
 }
 
 static int s3c2416_cpufreq_set_target(struct cpufreq_policy *policy,
-                                      unsigned int target_freq,
-                                      unsigned int relation)
+                                      unsigned int index)
 {
         struct s3c2416_data *s3c_freq = &s3c2416_cpufreq;
-        struct cpufreq_freqs freqs;
+        unsigned int new_freq;
         int idx, ret, to_dvs = 0;
-        unsigned int i;
 
         mutex_lock(&cpufreq_lock);
 
-        pr_debug("cpufreq: to %dKHz, relation %d\n", target_freq, relation);
-
-        ret = cpufreq_frequency_table_target(policy, s3c_freq->freq_table,
-                                             target_freq, relation, &i);
-        if (ret != 0)
-                goto out;
-
-        idx = s3c_freq->freq_table[i].driver_data;
+        idx = s3c_freq->freq_table[index].driver_data;
 
         if (idx == SOURCE_HCLK)
                 to_dvs = 1;
@@ -256,24 +237,13 @@ static int s3c2416_cpufreq_set_target(struct cpufreq_policy *policy,
                 goto out;
         }
 
-        freqs.flags = 0;
-        freqs.old = s3c_freq->is_dvs ? FREQ_DVS
-                                     : clk_get_rate(s3c_freq->armclk) / 1000;
-
         /* When leavin dvs mode, always switch the armdiv to the hclk rate
          * The S3C2416 has stability issues when switching directly to
          * higher frequencies.
          */
-        freqs.new = (s3c_freq->is_dvs && !to_dvs)
+        new_freq = (s3c_freq->is_dvs && !to_dvs)
                                 ? clk_get_rate(s3c_freq->hclk) / 1000
-                                : s3c_freq->freq_table[i].frequency;
-
-        pr_debug("cpufreq: Transition %d-%dkHz\n", freqs.old, freqs.new);
-
-        if (!to_dvs && freqs.old == freqs.new)
-                goto out;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+                                : s3c_freq->freq_table[index].frequency;
 
         if (to_dvs) {
                 pr_debug("cpufreq: enter dvs\n");
@@ -282,12 +252,10 @@ static int s3c2416_cpufreq_set_target(struct cpufreq_policy *policy,
                 pr_debug("cpufreq: leave dvs\n");
                 ret = s3c2416_cpufreq_leave_dvs(s3c_freq, idx);
         } else {
-                pr_debug("cpufreq: change armdiv to %dkHz\n", freqs.new);
-                ret = s3c2416_cpufreq_set_armdiv(s3c_freq, freqs.new);
+                pr_debug("cpufreq: change armdiv to %dkHz\n", new_freq);
+                ret = s3c2416_cpufreq_set_armdiv(s3c_freq, new_freq);
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
 out:
         mutex_unlock(&cpufreq_lock);
 
@@ -486,20 +454,14 @@ static int __init s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy)
                 freq++;
         }
 
-        policy->cur = clk_get_rate(s3c_freq->armclk) / 1000;
-
         /* Datasheet says PLL stabalisation time must be at least 300us,
          * so but add some fudge. (reference in LOCKCON0 register description)
          */
-        policy->cpuinfo.transition_latency = (500 * 1000) +
-                                             s3c_freq->regulator_latency;
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, s3c_freq->freq_table);
+        ret = cpufreq_generic_init(policy, s3c_freq->freq_table,
+                        (500 * 1000) + s3c_freq->regulator_latency);
         if (ret)
                 goto err_freq_table;
 
-        cpufreq_frequency_table_get_attr(s3c_freq->freq_table, 0);
-
         register_reboot_notifier(&s3c2416_cpufreq_reboot_notifier);
 
         return 0;
@@ -518,19 +480,14 @@ err_hclk:
         return ret;
 }
 
-static struct freq_attr *s3c2416_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver s3c2416_cpufreq_driver = {
         .flags          = 0,
-        .verify         = s3c2416_cpufreq_verify_speed,
-        .target         = s3c2416_cpufreq_set_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = s3c2416_cpufreq_set_target,
         .get            = s3c2416_cpufreq_get_speed,
         .init           = s3c2416_cpufreq_driver_init,
         .name           = "s3c2416",
-        .attr           = s3c2416_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int __init s3c2416_cpufreq_init(void)
diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c
index b0f343fcb7ee..485088253358 100644
--- a/drivers/cpufreq/s3c24xx-cpufreq.c
+++ b/drivers/cpufreq/s3c24xx-cpufreq.c
@@ -373,23 +373,7 @@ struct clk *s3c_cpufreq_clk_get(struct device *dev, const char *name)
 
 static int s3c_cpufreq_init(struct cpufreq_policy *policy)
 {
-        printk(KERN_INFO "%s: initialising policy %p\n", __func__, policy);
-
-        if (policy->cpu != 0)
-                return -EINVAL;
-
-        policy->cur = s3c_cpufreq_get(0);
-        policy->min = policy->cpuinfo.min_freq = 0;
-        policy->max = policy->cpuinfo.max_freq = cpu_cur.info->max.fclk / 1000;
-        policy->governor = CPUFREQ_DEFAULT_GOVERNOR;
-
-        /* feed the latency information from the cpu driver */
-        policy->cpuinfo.transition_latency = cpu_cur.info->latency;
-
-        if (ftab)
-                cpufreq_frequency_table_cpuinfo(policy, ftab);
-
-        return 0;
+        return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency);
 }
 
 static int __init s3c_cpufreq_initclks(void)
@@ -416,14 +400,6 @@ static int __init s3c_cpufreq_initclks(void)
         return 0;
 }
 
-static int s3c_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        if (policy->cpu != 0)
-                return -EINVAL;
-
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static struct cpufreq_frequency_table suspend_pll;
 static unsigned int suspend_freq;
@@ -473,7 +449,6 @@ static int s3c_cpufreq_resume(struct cpufreq_policy *policy)
 
 static struct cpufreq_driver s3c24xx_driver = {
         .flags          = CPUFREQ_STICKY,
-        .verify         = s3c_cpufreq_verify,
         .target         = s3c_cpufreq_target,
         .get            = s3c_cpufreq_get,
         .init           = s3c_cpufreq_init,
diff --git a/drivers/cpufreq/s3c64xx-cpufreq.c b/drivers/cpufreq/s3c64xx-cpufreq.c
index 8a72b0c555f8..67e302eeefec 100644
--- a/drivers/cpufreq/s3c64xx-cpufreq.c
+++ b/drivers/cpufreq/s3c64xx-cpufreq.c
@@ -54,14 +54,6 @@ static struct cpufreq_frequency_table s3c64xx_freq_table[] = {
 };
 #endif
 
-static int s3c64xx_cpufreq_verify_speed(struct cpufreq_policy *policy)
-{
-        if (policy->cpu != 0)
-                return -EINVAL;
-
-        return cpufreq_frequency_table_verify(policy, s3c64xx_freq_table);
-}
-
 static unsigned int s3c64xx_cpufreq_get_speed(unsigned int cpu)
 {
         if (cpu != 0)
@@ -71,66 +63,48 @@ static unsigned int s3c64xx_cpufreq_get_speed(unsigned int cpu)
 }
 
 static int s3c64xx_cpufreq_set_target(struct cpufreq_policy *policy,
-                                      unsigned int target_freq,
-                                      unsigned int relation)
+                                      unsigned int index)
 {
-        int ret;
-        unsigned int i;
-        struct cpufreq_freqs freqs;
         struct s3c64xx_dvfs *dvfs;
+        unsigned int old_freq, new_freq;
+        int ret;
 
-        ret = cpufreq_frequency_table_target(policy, s3c64xx_freq_table,
-                                             target_freq, relation, &i);
-        if (ret != 0)
-                return ret;
-
-        freqs.old = clk_get_rate(armclk) / 1000;
-        freqs.new = s3c64xx_freq_table[i].frequency;
-        freqs.flags = 0;
-        dvfs = &s3c64xx_dvfs_table[s3c64xx_freq_table[i].driver_data];
-
-        if (freqs.old == freqs.new)
-                return 0;
-
-        pr_debug("Transition %d-%dkHz\n", freqs.old, freqs.new);
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+        old_freq = clk_get_rate(armclk) / 1000;
+        new_freq = s3c64xx_freq_table[index].frequency;
+        dvfs = &s3c64xx_dvfs_table[s3c64xx_freq_table[index].driver_data];
 
 #ifdef CONFIG_REGULATOR
-        if (vddarm && freqs.new > freqs.old) {
+        if (vddarm && new_freq > old_freq) {
                 ret = regulator_set_voltage(vddarm,
                                             dvfs->vddarm_min,
                                             dvfs->vddarm_max);
                 if (ret != 0) {
                         pr_err("Failed to set VDDARM for %dkHz: %d\n",
-                               freqs.new, ret);
-                        freqs.new = freqs.old;
-                        goto post_notify;
+                               new_freq, ret);
+                        return ret;
                 }
         }
 #endif
 
-        ret = clk_set_rate(armclk, freqs.new * 1000);
+        ret = clk_set_rate(armclk, new_freq * 1000);
         if (ret < 0) {
                 pr_err("Failed to set rate %dkHz: %d\n",
-                       freqs.new, ret);
-                freqs.new = freqs.old;
+                       new_freq, ret);
+                return ret;
         }
 
-post_notify:
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-        if (ret)
-                goto err;
-
 #ifdef CONFIG_REGULATOR
-        if (vddarm && freqs.new < freqs.old) {
+        if (vddarm && new_freq < old_freq) {
                 ret = regulator_set_voltage(vddarm,
                                             dvfs->vddarm_min,
                                             dvfs->vddarm_max);
                 if (ret != 0) {
                         pr_err("Failed to set VDDARM for %dkHz: %d\n",
-                               freqs.new, ret);
-                        goto err_clk;
+                               new_freq, ret);
+                        if (clk_set_rate(armclk, old_freq * 1000) < 0)
+                                pr_err("Failed to restore original clock rate\n");
+
+                        return ret;
                 }
         }
 #endif
@@ -139,14 +113,6 @@ post_notify:
                  clk_get_rate(armclk) / 1000);
 
         return 0;
-
-err_clk:
-        if (clk_set_rate(armclk, freqs.old * 1000) < 0)
-                pr_err("Failed to restore original clock rate\n");
-err:
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        return ret;
 }
 
 #ifdef CONFIG_REGULATOR
@@ -166,7 +132,7 @@ static void __init s3c64xx_cpufreq_config_regulator(void)
                 if (freq->frequency == CPUFREQ_ENTRY_INVALID)
                         continue;
 
-                dvfs = &s3c64xx_dvfs_table[freq->index];
+                dvfs = &s3c64xx_dvfs_table[freq->driver_data];
                 found = 0;
 
                 for (i = 0; i < count; i++) {
@@ -243,15 +209,12 @@ static int s3c64xx_cpufreq_driver_init(struct cpufreq_policy *policy)
                 freq++;
         }
 
-        policy->cur = clk_get_rate(armclk) / 1000;
-
         /* Datasheet says PLL stabalisation time (if we were to use
          * the PLLs, which we don't currently) is ~300us worst case,
          * but add some fudge.
          */
-        policy->cpuinfo.transition_latency = (500 * 1000) + regulator_latency;
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, s3c64xx_freq_table);
+        ret = cpufreq_generic_init(policy, s3c64xx_freq_table,
+                        (500 * 1000) + regulator_latency);
         if (ret != 0) {
                 pr_err("Failed to configure frequency table: %d\n",
                        ret);
@@ -264,8 +227,8 @@ static int s3c64xx_cpufreq_driver_init(struct cpufreq_policy *policy)
 
 static struct cpufreq_driver s3c64xx_cpufreq_driver = {
         .flags          = 0,
-        .verify         = s3c64xx_cpufreq_verify_speed,
-        .target         = s3c64xx_cpufreq_set_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = s3c64xx_cpufreq_set_target,
         .get            = s3c64xx_cpufreq_get_speed,
         .init           = s3c64xx_cpufreq_driver_init,
         .name           = "s3c",
diff --git a/drivers/cpufreq/s5pv210-cpufreq.c b/drivers/cpufreq/s5pv210-cpufreq.c
index 5c7757073793..e3973dae28a7 100644
--- a/drivers/cpufreq/s5pv210-cpufreq.c
+++ b/drivers/cpufreq/s5pv210-cpufreq.c
@@ -26,7 +26,6 @@
 static struct clk *cpu_clk;
 static struct clk *dmc0_clk;
 static struct clk *dmc1_clk;
-static struct cpufreq_freqs freqs;
 static DEFINE_MUTEX(set_freq_lock);
 
 /* APLL M,P,S values for 1G/800Mhz */
@@ -36,16 +35,7 @@ static DEFINE_MUTEX(set_freq_lock);
 /* Use 800MHz when entering sleep mode */
 #define SLEEP_FREQ      (800 * 1000)
 
-/*
- * relation has an additional symantics other than the standard of cpufreq
- * DISALBE_FURTHER_CPUFREQ: disable further access to target
- * ENABLE_FURTUER_CPUFREQ: enable access to target
- */
-enum cpufreq_access {
-        DISABLE_FURTHER_CPUFREQ = 0x10,
-        ENABLE_FURTHER_CPUFREQ = 0x20,
-};
-
+/* Tracks if cpu freqency can be updated anymore */
 static bool no_cpufreq_access;
 
 /*
@@ -174,14 +164,6 @@ static void s5pv210_set_refresh(enum s5pv210_dmc_port ch, unsigned long freq)
         __raw_writel(tmp1, reg);
 }
 
-static int s5pv210_verify_speed(struct cpufreq_policy *policy)
-{
-        if (policy->cpu)
-                return -EINVAL;
-
-        return cpufreq_frequency_table_verify(policy, s5pv210_freq_table);
-}
-
 static unsigned int s5pv210_getspeed(unsigned int cpu)
 {
         if (cpu)
@@ -190,22 +172,18 @@ static unsigned int s5pv210_getspeed(unsigned int cpu)
         return clk_get_rate(cpu_clk) / 1000;
 }
 
-static int s5pv210_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
+static int s5pv210_target(struct cpufreq_policy *policy, unsigned int index)
 {
         unsigned long reg;
-        unsigned int index, priv_index;
+        unsigned int priv_index;
         unsigned int pll_changing = 0;
         unsigned int bus_speed_changing = 0;
+        unsigned int old_freq, new_freq;
         int arm_volt, int_volt;
         int ret = 0;
 
         mutex_lock(&set_freq_lock);
 
-        if (relation & ENABLE_FURTHER_CPUFREQ)
-                no_cpufreq_access = false;
-
         if (no_cpufreq_access) {
 #ifdef CONFIG_PM_VERBOSE
                 pr_err("%s:%d denied access to %s as it is disabled"
@@ -215,27 +193,13 @@ static int s5pv210_target(struct cpufreq_policy *policy,
                 goto exit;
         }
 
-        if (relation & DISABLE_FURTHER_CPUFREQ)
-                no_cpufreq_access = true;
-
-        relation &= ~(ENABLE_FURTHER_CPUFREQ | DISABLE_FURTHER_CPUFREQ);
-
-        freqs.old = s5pv210_getspeed(0);
-
-        if (cpufreq_frequency_table_target(policy, s5pv210_freq_table,
-                                           target_freq, relation, &index)) {
-                ret = -EINVAL;
-                goto exit;
-        }
-
-        freqs.new = s5pv210_freq_table[index].frequency;
-
-        if (freqs.new == freqs.old)
-                goto exit;
+        old_freq = s5pv210_getspeed(0);
+        new_freq = s5pv210_freq_table[index].frequency;
 
         /* Finding current running level index */
         if (cpufreq_frequency_table_target(policy, s5pv210_freq_table,
-                                           freqs.old, relation, &priv_index)) {
+                                           old_freq, CPUFREQ_RELATION_H,
+                                           &priv_index)) {
                 ret = -EINVAL;
                 goto exit;
         }
@@ -243,7 +207,7 @@ static int s5pv210_target(struct cpufreq_policy *policy,
         arm_volt = dvs_conf[index].arm_volt;
         int_volt = dvs_conf[index].int_volt;
 
-        if (freqs.new > freqs.old) {
+        if (new_freq > old_freq) {
                 ret = regulator_set_voltage(arm_regulator,
                                 arm_volt, arm_volt_max);
                 if (ret)
@@ -255,8 +219,6 @@ static int s5pv210_target(struct cpufreq_policy *policy,
                         goto exit;
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         /* Check if there need to change PLL */
         if ((index == L0) || (priv_index == L0))
                 pll_changing = 1;
@@ -467,9 +429,7 @@ static int s5pv210_target(struct cpufreq_policy *policy,
                 }
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
-        if (freqs.new < freqs.old) {
+        if (new_freq < old_freq) {
                 regulator_set_voltage(int_regulator,
                                 int_volt, int_volt_max);
 
@@ -551,13 +511,7 @@ static int __init s5pv210_cpu_init(struct cpufreq_policy *policy)
         s5pv210_dram_conf[1].refresh = (__raw_readl(S5P_VA_DMC1 + 0x30) * 1000);
         s5pv210_dram_conf[1].freq = clk_get_rate(dmc1_clk);
 
-        policy->cur = policy->min = policy->max = s5pv210_getspeed(0);
-
-        cpufreq_frequency_table_get_attr(s5pv210_freq_table, policy->cpu);
-
-        policy->cpuinfo.transition_latency = 40000;
-
-        return cpufreq_frequency_table_cpuinfo(policy, s5pv210_freq_table);
+        return cpufreq_generic_init(policy, s5pv210_freq_table, 40000);
 
 out_dmc1:
         clk_put(dmc0_clk);
@@ -573,16 +527,18 @@ static int s5pv210_cpufreq_notifier_event(struct notifier_block *this,
 
         switch (event) {
         case PM_SUSPEND_PREPARE:
-                ret = cpufreq_driver_target(cpufreq_cpu_get(0), SLEEP_FREQ,
-                                            DISABLE_FURTHER_CPUFREQ);
+                ret = cpufreq_driver_target(cpufreq_cpu_get(0), SLEEP_FREQ, 0);
                 if (ret < 0)
                         return NOTIFY_BAD;
 
+                /* Disable updation of cpu frequency */
+                no_cpufreq_access = true;
                 return NOTIFY_OK;
         case PM_POST_RESTORE:
         case PM_POST_SUSPEND:
-                cpufreq_driver_target(cpufreq_cpu_get(0), SLEEP_FREQ,
-                                      ENABLE_FURTHER_CPUFREQ);
+                /* Enable updation of cpu frequency */
+                no_cpufreq_access = false;
+                cpufreq_driver_target(cpufreq_cpu_get(0), SLEEP_FREQ, 0);
 
                 return NOTIFY_OK;
         }
@@ -595,18 +551,18 @@ static int s5pv210_cpufreq_reboot_notifier_event(struct notifier_block *this,
 {
         int ret;
 
-        ret = cpufreq_driver_target(cpufreq_cpu_get(0), SLEEP_FREQ,
-                                    DISABLE_FURTHER_CPUFREQ);
+        ret = cpufreq_driver_target(cpufreq_cpu_get(0), SLEEP_FREQ, 0);
         if (ret < 0)
                 return NOTIFY_BAD;
 
+        no_cpufreq_access = true;
         return NOTIFY_DONE;
 }
 
 static struct cpufreq_driver s5pv210_driver = {
         .flags          = CPUFREQ_STICKY,
-        .verify         = s5pv210_verify_speed,
-        .target         = s5pv210_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = s5pv210_target,
         .get            = s5pv210_getspeed,
         .init           = s5pv210_cpu_init,
         .name           = "s5pv210",
diff --git a/drivers/cpufreq/sa1100-cpufreq.c b/drivers/cpufreq/sa1100-cpufreq.c
index cff18e87ca58..623da742f8e7 100644
--- a/drivers/cpufreq/sa1100-cpufreq.c
+++ b/drivers/cpufreq/sa1100-cpufreq.c
@@ -177,60 +177,33 @@ static void sa1100_update_dram_timings(int current_speed, int new_speed)
         }
 }
 
-static int sa1100_target(struct cpufreq_policy *policy,
-                         unsigned int target_freq,
-                         unsigned int relation)
+static int sa1100_target(struct cpufreq_policy *policy, unsigned int ppcr)
 {
         unsigned int cur = sa11x0_getspeed(0);
-        unsigned int new_ppcr;
-        struct cpufreq_freqs freqs;
-
-        new_ppcr = sa11x0_freq_to_ppcr(target_freq);
-        switch (relation) {
-        case CPUFREQ_RELATION_L:
-                if (sa11x0_ppcr_to_freq(new_ppcr) > policy->max)
-                        new_ppcr--;
-                break;
-        case CPUFREQ_RELATION_H:
-                if ((sa11x0_ppcr_to_freq(new_ppcr) > target_freq) &&
-                    (sa11x0_ppcr_to_freq(new_ppcr - 1) >= policy->min))
-                        new_ppcr--;
-                break;
-        }
-
-        freqs.old = cur;
-        freqs.new = sa11x0_ppcr_to_freq(new_ppcr);
+        unsigned int new_freq;
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
+        new_freq = sa11x0_freq_table[ppcr].frequency;
 
-        if (freqs.new > cur)
-                sa1100_update_dram_timings(cur, freqs.new);
+        if (new_freq > cur)
+                sa1100_update_dram_timings(cur, new_freq);
 
-        PPCR = new_ppcr;
+        PPCR = ppcr;
 
-        if (freqs.new < cur)
-                sa1100_update_dram_timings(cur, freqs.new);
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+        if (new_freq < cur)
+                sa1100_update_dram_timings(cur, new_freq);
 
         return 0;
 }
 
 static int __init sa1100_cpu_init(struct cpufreq_policy *policy)
 {
-        if (policy->cpu != 0)
-                return -EINVAL;
-        policy->cur = policy->min = policy->max = sa11x0_getspeed(0);
-        policy->cpuinfo.min_freq = 59000;
-        policy->cpuinfo.max_freq = 287000;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        return 0;
+        return cpufreq_generic_init(policy, sa11x0_freq_table, CPUFREQ_ETERNAL);
 }
 
 static struct cpufreq_driver sa1100_driver __refdata = {
         .flags          = CPUFREQ_STICKY,
-        .verify         = sa11x0_verify_speed,
-        .target         = sa1100_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = sa1100_target,
         .get            = sa11x0_getspeed,
         .init           = sa1100_cpu_init,
         .name           = "sa1100",
diff --git a/drivers/cpufreq/sa1110-cpufreq.c b/drivers/cpufreq/sa1110-cpufreq.c
index 39c90b6f4286..2c2b2e601d13 100644
--- a/drivers/cpufreq/sa1110-cpufreq.c
+++ b/drivers/cpufreq/sa1110-cpufreq.c
@@ -229,36 +229,14 @@ sdram_update_refresh(u_int cpu_khz, struct sdram_params *sdram)
 /*
  * Ok, set the CPU frequency.
  */
-static int sa1110_target(struct cpufreq_policy *policy,
-                         unsigned int target_freq,
-                         unsigned int relation)
+static int sa1110_target(struct cpufreq_policy *policy, unsigned int ppcr)
 {
         struct sdram_params *sdram = &sdram_params;
-        struct cpufreq_freqs freqs;
         struct sdram_info sd;
         unsigned long flags;
-        unsigned int ppcr, unused;
-
-        switch (relation) {
-        case CPUFREQ_RELATION_L:
-                ppcr = sa11x0_freq_to_ppcr(target_freq);
-                if (sa11x0_ppcr_to_freq(ppcr) > policy->max)
-                        ppcr--;
-                break;
-        case CPUFREQ_RELATION_H:
-                ppcr = sa11x0_freq_to_ppcr(target_freq);
-                if (ppcr && (sa11x0_ppcr_to_freq(ppcr) > target_freq) &&
-                    (sa11x0_ppcr_to_freq(ppcr-1) >= policy->min))
-                        ppcr--;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        freqs.old = sa11x0_getspeed(0);
-        freqs.new = sa11x0_ppcr_to_freq(ppcr);
+        unsigned int unused;
 
-        sdram_calculate_timing(&sd, freqs.new, sdram);
+        sdram_calculate_timing(&sd, sa11x0_freq_table[ppcr].frequency, sdram);
 
 #if 0
         /*
@@ -277,8 +255,6 @@ static int sa1110_target(struct cpufreq_policy *policy,
         sd.mdcas[2] = 0xaaaaaaaa;
 #endif
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         /*
          * The clock could be going away for some time.  Set the SDRAMs
          * to refresh rapidly (every 64 memory clock cycles).  To get
@@ -323,30 +299,22 @@ static int sa1110_target(struct cpufreq_policy *policy,
         /*
          * Now, return the SDRAM refresh back to normal.
          */
-        sdram_update_refresh(freqs.new, sdram);
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+        sdram_update_refresh(sa11x0_freq_table[ppcr].frequency, sdram);
 
         return 0;
 }
 
 static int __init sa1110_cpu_init(struct cpufreq_policy *policy)
 {
-        if (policy->cpu != 0)
-                return -EINVAL;
-        policy->cur = policy->min = policy->max = sa11x0_getspeed(0);
-        policy->cpuinfo.min_freq = 59000;
-        policy->cpuinfo.max_freq = 287000;
-        policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        return 0;
+        return cpufreq_generic_init(policy, sa11x0_freq_table, CPUFREQ_ETERNAL);
 }
 
 /* sa1110_driver needs __refdata because it must remain after init registers
  * it with cpufreq_register_driver() */
 static struct cpufreq_driver sa1110_driver __refdata = {
         .flags          = CPUFREQ_STICKY,
-        .verify         = sa11x0_verify_speed,
-        .target         = sa1110_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = sa1110_target,
         .get            = sa11x0_getspeed,
         .init           = sa1110_cpu_init,
         .name           = "sa1110",
diff --git a/drivers/cpufreq/sc520_freq.c b/drivers/cpufreq/sc520_freq.c
index d6f6c6f4efa7..6adb354e359c 100644
--- a/drivers/cpufreq/sc520_freq.c
+++ b/drivers/cpufreq/sc520_freq.c
@@ -53,21 +53,11 @@ static unsigned int sc520_freq_get_cpu_frequency(unsigned int cpu)
         }
 }
 
-static void sc520_freq_set_cpu_state(struct cpufreq_policy *policy,
-                unsigned int state)
+static int sc520_freq_target(struct cpufreq_policy *policy, unsigned int state)
 {
 
-        struct cpufreq_freqs    freqs;
         u8 clockspeed_reg;
 
-        freqs.old = sc520_freq_get_cpu_frequency(0);
-        freqs.new = sc520_freq_table[state].frequency;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
-        pr_debug("attempting to set frequency to %i kHz\n",
-                        sc520_freq_table[state].frequency);
-
         local_irq_disable();
 
         clockspeed_reg = *cpuctl & ~0x03;
@@ -75,30 +65,9 @@ static void sc520_freq_set_cpu_state(struct cpufreq_policy *policy,
 
         local_irq_enable();
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-};
-
-static int sc520_freq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &sc520_freq_table[0]);
-}
-
-static int sc520_freq_target(struct cpufreq_policy *policy,
-                            unsigned int target_freq,
-                            unsigned int relation)
-{
-        unsigned int newstate = 0;
-
-        if (cpufreq_frequency_table_target(policy, sc520_freq_table,
-                                target_freq, relation, &newstate))
-                return -EINVAL;
-
-        sc520_freq_set_cpu_state(policy, newstate);
-
         return 0;
 }
 
-
 /*
  *      Module init and exit code
  */
@@ -106,7 +75,6 @@ static int sc520_freq_target(struct cpufreq_policy *policy,
 static int sc520_freq_cpu_init(struct cpufreq_policy *policy)
 {
         struct cpuinfo_x86 *c = &cpu_data(0);
-        int result;
 
         /* capability check */
         if (c->x86_vendor != X86_VENDOR_AMD ||
@@ -115,39 +83,19 @@ static int sc520_freq_cpu_init(struct cpufreq_policy *policy)
 
         /* cpuinfo and default policy values */
         policy->cpuinfo.transition_latency = 1000000; /* 1ms */
-        policy->cur = sc520_freq_get_cpu_frequency(0);
-
-        result = cpufreq_frequency_table_cpuinfo(policy, sc520_freq_table);
-        if (result)
-                return result;
-
-        cpufreq_frequency_table_get_attr(sc520_freq_table, policy->cpu);
-
-        return 0;
-}
 
-
-static int sc520_freq_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_table_validate_and_show(policy, sc520_freq_table);
 }
 
 
-static struct freq_attr *sc520_freq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
-
 static struct cpufreq_driver sc520_freq_driver = {
         .get    = sc520_freq_get_cpu_frequency,
-        .verify = sc520_freq_verify,
-        .target = sc520_freq_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = sc520_freq_target,
         .init   = sc520_freq_cpu_init,
-        .exit   = sc520_freq_cpu_exit,
+        .exit   = cpufreq_generic_exit,
         .name   = "sc520_freq",
-        .attr   = sc520_freq_attr,
+        .attr   = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id sc520_ids[] = {
diff --git a/drivers/cpufreq/sh-cpufreq.c b/drivers/cpufreq/sh-cpufreq.c
index ffc6d24b0cfb..387af12503a6 100644
--- a/drivers/cpufreq/sh-cpufreq.c
+++ b/drivers/cpufreq/sh-cpufreq.c
@@ -87,15 +87,12 @@ static int sh_cpufreq_verify(struct cpufreq_policy *policy)
         if (freq_table)
                 return cpufreq_frequency_table_verify(policy, freq_table);
 
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
+        cpufreq_verify_within_cpu_limits(policy);
 
         policy->min = (clk_round_rate(cpuclk, 1) + 500) / 1000;
         policy->max = (clk_round_rate(cpuclk, ~0UL) + 500) / 1000;
 
-        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
-                                     policy->cpuinfo.max_freq);
-
+        cpufreq_verify_within_cpu_limits(policy);
         return 0;
 }
 
@@ -114,15 +111,13 @@ static int sh_cpufreq_cpu_init(struct cpufreq_policy *policy)
                 return PTR_ERR(cpuclk);
         }
 
-        policy->cur = sh_cpufreq_get(cpu);
-
         freq_table = cpuclk->nr_freqs ? cpuclk->freq_table : NULL;
         if (freq_table) {
                 int result;
 
-                result = cpufreq_frequency_table_cpuinfo(policy, freq_table);
-                if (!result)
-                        cpufreq_frequency_table_get_attr(freq_table, cpu);
+                result = cpufreq_table_validate_and_show(policy, freq_table);
+                if (result)
+                        return result;
         } else {
                 dev_notice(dev, "no frequency table found, falling back "
                            "to rate rounding.\n");
@@ -154,11 +149,6 @@ static int sh_cpufreq_cpu_exit(struct cpufreq_policy *policy)
         return 0;
 }
 
-static struct freq_attr *sh_freq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver sh_cpufreq_driver = {
         .name           = "sh",
         .get            = sh_cpufreq_get,
@@ -166,7 +156,7 @@ static struct cpufreq_driver sh_cpufreq_driver = {
         .verify         = sh_cpufreq_verify,
         .init           = sh_cpufreq_cpu_init,
         .exit           = sh_cpufreq_cpu_exit,
-        .attr           = sh_freq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int __init sh_cpufreq_module_init(void)
diff --git a/drivers/cpufreq/sparc-us2e-cpufreq.c b/drivers/cpufreq/sparc-us2e-cpufreq.c
index cf5bc2ca16fa..62aa23e219d4 100644
--- a/drivers/cpufreq/sparc-us2e-cpufreq.c
+++ b/drivers/cpufreq/sparc-us2e-cpufreq.c
@@ -245,14 +245,12 @@ static unsigned int us2e_freq_get(unsigned int cpu)
         return clock_tick / estar_to_divisor(estar);
 }
 
-static void us2e_set_cpu_divider_index(struct cpufreq_policy *policy,
-                unsigned int index)
+static int us2e_freq_target(struct cpufreq_policy *policy, unsigned int index)
 {
         unsigned int cpu = policy->cpu;
         unsigned long new_bits, new_freq;
         unsigned long clock_tick, divisor, old_divisor, estar;
         cpumask_t cpus_allowed;
-        struct cpufreq_freqs freqs;
 
         cpumask_copy(&cpus_allowed, tsk_cpus_allowed(current));
         set_cpus_allowed_ptr(current, cpumask_of(cpu));
@@ -266,41 +264,15 @@ static void us2e_set_cpu_divider_index(struct cpufreq_policy *policy,
 
         old_divisor = estar_to_divisor(estar);
 
-        freqs.old = clock_tick / old_divisor;
-        freqs.new = new_freq;
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         if (old_divisor != divisor)
                 us2e_transition(estar, new_bits, clock_tick * 1000,
                                 old_divisor, divisor);
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         set_cpus_allowed_ptr(current, &cpus_allowed);
-}
-
-static int us2e_freq_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
-{
-        unsigned int new_index = 0;
-
-        if (cpufreq_frequency_table_target(policy,
-                                           &us2e_freq_table[policy->cpu].table[0],
-                                           target_freq, relation, &new_index))
-                return -EINVAL;
-
-        us2e_set_cpu_divider_index(policy, new_index);
 
         return 0;
 }
 
-static int us2e_freq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                                              &us2e_freq_table[policy->cpu].table[0]);
-}
-
 static int __init us2e_freq_cpu_init(struct cpufreq_policy *policy)
 {
         unsigned int cpu = policy->cpu;
@@ -324,13 +296,15 @@ static int __init us2e_freq_cpu_init(struct cpufreq_policy *policy)
         policy->cpuinfo.transition_latency = 0;
         policy->cur = clock_tick;
 
-        return cpufreq_frequency_table_cpuinfo(policy, table);
+        return cpufreq_table_validate_and_show(policy, table);
 }
 
 static int us2e_freq_cpu_exit(struct cpufreq_policy *policy)
 {
-        if (cpufreq_us2e_driver)
-                us2e_set_cpu_divider_index(policy, 0);
+        if (cpufreq_us2e_driver) {
+                cpufreq_frequency_table_put_attr(policy->cpu);
+                us2e_freq_target(policy, 0);
+        }
 
         return 0;
 }
@@ -361,8 +335,8 @@ static int __init us2e_freq_init(void)
                         goto err_out;
 
                 driver->init = us2e_freq_cpu_init;
-                driver->verify = us2e_freq_verify;
-                driver->target = us2e_freq_target;
+                driver->verify = cpufreq_generic_frequency_table_verify;
+                driver->target_index = us2e_freq_target;
                 driver->get = us2e_freq_get;
                 driver->exit = us2e_freq_cpu_exit;
                 strcpy(driver->name, "UltraSPARC-IIe");
diff --git a/drivers/cpufreq/sparc-us3-cpufreq.c b/drivers/cpufreq/sparc-us3-cpufreq.c
index ac76b489979d..724ffbd7105d 100644
--- a/drivers/cpufreq/sparc-us3-cpufreq.c
+++ b/drivers/cpufreq/sparc-us3-cpufreq.c
@@ -93,13 +93,11 @@ static unsigned int us3_freq_get(unsigned int cpu)
         return ret;
 }
 
-static void us3_set_cpu_divider_index(struct cpufreq_policy *policy,
-                unsigned int index)
+static int us3_freq_target(struct cpufreq_policy *policy, unsigned int index)
 {
         unsigned int cpu = policy->cpu;
         unsigned long new_bits, new_freq, reg;
         cpumask_t cpus_allowed;
-        struct cpufreq_freqs freqs;
 
         cpumask_copy(&cpus_allowed, tsk_cpus_allowed(current));
         set_cpus_allowed_ptr(current, cpumask_of(cpu));
@@ -125,43 +123,15 @@ static void us3_set_cpu_divider_index(struct cpufreq_policy *policy,
 
         reg = read_safari_cfg();
 
-        freqs.old = get_current_freq(cpu, reg);
-        freqs.new = new_freq;
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         reg &= ~SAFARI_CFG_DIV_MASK;
         reg |= new_bits;
         write_safari_cfg(reg);
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         set_cpus_allowed_ptr(current, &cpus_allowed);
-}
-
-static int us3_freq_target(struct cpufreq_policy *policy,
-                          unsigned int target_freq,
-                          unsigned int relation)
-{
-        unsigned int new_index = 0;
-
-        if (cpufreq_frequency_table_target(policy,
-                                           &us3_freq_table[policy->cpu].table[0],
-                                           target_freq,
-                                           relation,
-                                           &new_index))
-                return -EINVAL;
-
-        us3_set_cpu_divider_index(policy, new_index);
 
         return 0;
 }
 
-static int us3_freq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                                              &us3_freq_table[policy->cpu].table[0]);
-}
-
 static int __init us3_freq_cpu_init(struct cpufreq_policy *policy)
 {
         unsigned int cpu = policy->cpu;
@@ -181,13 +151,15 @@ static int __init us3_freq_cpu_init(struct cpufreq_policy *policy)
         policy->cpuinfo.transition_latency = 0;
         policy->cur = clock_tick;
 
-        return cpufreq_frequency_table_cpuinfo(policy, table);
+        return cpufreq_table_validate_and_show(policy, table);
 }
 
 static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
 {
-        if (cpufreq_us3_driver)
-                us3_set_cpu_divider_index(policy, 0);
+        if (cpufreq_us3_driver) {
+                cpufreq_frequency_table_put_attr(policy->cpu);
+                us3_freq_target(policy, 0);
+        }
 
         return 0;
 }
@@ -222,8 +194,8 @@ static int __init us3_freq_init(void)
                         goto err_out;
 
                 driver->init = us3_freq_cpu_init;
-                driver->verify = us3_freq_verify;
-                driver->target = us3_freq_target;
+                driver->verify = cpufreq_generic_frequency_table_verify;
+                driver->target_index = us3_freq_target;
                 driver->get = us3_freq_get;
                 driver->exit = us3_freq_cpu_exit;
                 strcpy(driver->name, "UltraSPARC-III");
diff --git a/drivers/cpufreq/spear-cpufreq.c b/drivers/cpufreq/spear-cpufreq.c
index 19e364fa5955..d02ccd19c9c4 100644
--- a/drivers/cpufreq/spear-cpufreq.c
+++ b/drivers/cpufreq/spear-cpufreq.c
@@ -30,11 +30,6 @@ static struct {
         u32 cnt;
 } spear_cpufreq;
 
-static int spear_cpufreq_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, spear_cpufreq.freq_tbl);
-}
-
 static unsigned int spear_cpufreq_get(unsigned int cpu)
 {
         return clk_get_rate(spear_cpufreq.clk) / 1000;
@@ -110,20 +105,14 @@ static int spear1340_set_cpu_rate(struct clk *sys_pclk, unsigned long newfreq)
 }
 
 static int spear_cpufreq_target(struct cpufreq_policy *policy,
-                unsigned int target_freq, unsigned int relation)
+                unsigned int index)
 {
-        struct cpufreq_freqs freqs;
-        unsigned long newfreq;
+        long newfreq;
         struct clk *srcclk;
-        int index, ret, mult = 1;
-
-        if (cpufreq_frequency_table_target(policy, spear_cpufreq.freq_tbl,
-                                target_freq, relation, &index))
-                return -EINVAL;
-
-        freqs.old = spear_cpufreq_get(0);
+        int ret, mult = 1;
 
         newfreq = spear_cpufreq.freq_tbl[index].frequency * 1000;
+
         if (of_machine_is_compatible("st,spear1340")) {
                 /*
                  * SPEAr1340 is special in the sense that due to the possibility
@@ -154,65 +143,32 @@ static int spear_cpufreq_target(struct cpufreq_policy *policy,
                 return newfreq;
         }
 
-        freqs.new = newfreq / 1000;
-        freqs.new /= mult;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
         if (mult == 2)
                 ret = spear1340_set_cpu_rate(srcclk, newfreq);
         else
                 ret = clk_set_rate(spear_cpufreq.clk, newfreq);
 
-        /* Get current rate after clk_set_rate, in case of failure */
-        if (ret) {
+        if (ret)
                 pr_err("CPU Freq: cpu clk_set_rate failed: %d\n", ret);
-                freqs.new = clk_get_rate(spear_cpufreq.clk) / 1000;
-        }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
         return ret;
 }
 
 static int spear_cpufreq_init(struct cpufreq_policy *policy)
 {
-        int ret;
-
-        ret = cpufreq_frequency_table_cpuinfo(policy, spear_cpufreq.freq_tbl);
-        if (ret) {
-                pr_err("cpufreq_frequency_table_cpuinfo() failed");
-                return ret;
-        }
-
-        cpufreq_frequency_table_get_attr(spear_cpufreq.freq_tbl, policy->cpu);
-        policy->cpuinfo.transition_latency = spear_cpufreq.transition_latency;
-        policy->cur = spear_cpufreq_get(0);
-
-        cpumask_setall(policy->cpus);
-
-        return 0;
-}
-
-static int spear_cpufreq_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_generic_init(policy, spear_cpufreq.freq_tbl,
+                        spear_cpufreq.transition_latency);
 }
 
-static struct freq_attr *spear_cpufreq_attr[] = {
-         &cpufreq_freq_attr_scaling_available_freqs,
-         NULL,
-};
-
 static struct cpufreq_driver spear_cpufreq_driver = {
         .name           = "cpufreq-spear",
         .flags          = CPUFREQ_STICKY,
-        .verify         = spear_cpufreq_verify,
-        .target         = spear_cpufreq_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = spear_cpufreq_target,
         .get            = spear_cpufreq_get,
         .init           = spear_cpufreq_init,
-        .exit           = spear_cpufreq_exit,
-        .attr           = spear_cpufreq_attr,
+        .exit           = cpufreq_generic_exit,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int spear_cpufreq_driver_init(void)
diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
index f897d5105842..4e1daca5ce3b 100644
--- a/drivers/cpufreq/speedstep-centrino.c
+++ b/drivers/cpufreq/speedstep-centrino.c
@@ -343,9 +343,7 @@ static unsigned int get_cur_freq(unsigned int cpu)
 static int centrino_cpu_init(struct cpufreq_policy *policy)
 {
         struct cpuinfo_x86 *cpu = &cpu_data(policy->cpu);
-        unsigned freq;
         unsigned l, h;
-        int ret;
         int i;
 
         /* Only Intel makes Enhanced Speedstep-capable CPUs */
@@ -373,9 +371,8 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
                 return -ENODEV;
         }
 
-        if (centrino_cpu_init_table(policy)) {
+        if (centrino_cpu_init_table(policy))
                 return -ENODEV;
-        }
 
         /* Check to see if Enhanced SpeedStep is enabled, and try to
            enable it if not. */
@@ -395,22 +392,11 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
                 }
         }
 
-        freq = get_cur_freq(policy->cpu);
         policy->cpuinfo.transition_latency = 10000;
                                                 /* 10uS transition latency */
-        policy->cur = freq;
-
-        pr_debug("centrino_cpu_init: cur=%dkHz\n", policy->cur);
 
-        ret = cpufreq_frequency_table_cpuinfo(policy,
+        return cpufreq_table_validate_and_show(policy,
                 per_cpu(centrino_model, policy->cpu)->op_points);
-        if (ret)
-                return (ret);
-
-        cpufreq_frequency_table_get_attr(
-                per_cpu(centrino_model, policy->cpu)->op_points, policy->cpu);
-
-        return 0;
 }
 
 static int centrino_cpu_exit(struct cpufreq_policy *policy)
@@ -428,36 +414,18 @@ static int centrino_cpu_exit(struct cpufreq_policy *policy)
 }
 
 /**
- * centrino_verify - verifies a new CPUFreq policy
- * @policy: new policy
- *
- * Limit must be within this model's frequency range at least one
- * border included.
- */
-static int centrino_verify (struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy,
-                        per_cpu(centrino_model, policy->cpu)->op_points);
-}
-
-/**
  * centrino_setpolicy - set a new CPUFreq policy
  * @policy: new policy
- * @target_freq: the target frequency
- * @relation: how that frequency relates to achieved frequency
- *      (CPUFREQ_RELATION_L or CPUFREQ_RELATION_H)
+ * @index: index of target frequency
  *
  * Sets a new CPUFreq policy.
  */
-static int centrino_target (struct cpufreq_policy *policy,
-                            unsigned int target_freq,
-                            unsigned int relation)
+static int centrino_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int    newstate = 0;
         unsigned int    msr, oldmsr = 0, h = 0, cpu = policy->cpu;
-        struct cpufreq_freqs    freqs;
         int                     retval = 0;
-        unsigned int            j, first_cpu, tmp;
+        unsigned int            j, first_cpu;
+        struct cpufreq_frequency_table *op_points;
         cpumask_var_t covered_cpus;
 
         if (unlikely(!zalloc_cpumask_var(&covered_cpus, GFP_KERNEL)))
@@ -468,16 +436,8 @@ static int centrino_target (struct cpufreq_policy *policy,
                 goto out;
         }
 
-        if (unlikely(cpufreq_frequency_table_target(policy,
-                        per_cpu(centrino_model, cpu)->op_points,
-                        target_freq,
-                        relation,
-                        &newstate))) {
-                retval = -EINVAL;
-                goto out;
-        }
-
         first_cpu = 1;
+        op_points = &per_cpu(centrino_model, cpu)->op_points[index];
         for_each_cpu(j, policy->cpus) {
                 int good_cpu;
 
@@ -501,7 +461,7 @@ static int centrino_target (struct cpufreq_policy *policy,
                         break;
                 }
 
-                msr = per_cpu(centrino_model, cpu)->op_points[newstate].driver_data;
+                msr = op_points->driver_data;
 
                 if (first_cpu) {
                         rdmsr_on_cpu(good_cpu, MSR_IA32_PERF_CTL, &oldmsr, &h);
@@ -512,15 +472,6 @@ static int centrino_target (struct cpufreq_policy *policy,
                                 goto out;
                         }
 
-                        freqs.old = extract_clock(oldmsr, cpu, 0);
-                        freqs.new = extract_clock(msr, cpu, 0);
-
-                        pr_debug("target=%dkHz old=%d new=%d msr=%04x\n",
-                                target_freq, freqs.old, freqs.new, msr);
-
-                        cpufreq_notify_transition(policy, &freqs,
-                                        CPUFREQ_PRECHANGE);
-
                         first_cpu = 0;
                         /* all but 16 LSB are reserved, treat them with care */
                         oldmsr &= ~0xffff;
@@ -535,8 +486,6 @@ static int centrino_target (struct cpufreq_policy *policy,
                 cpumask_set_cpu(j, covered_cpus);
         }
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         if (unlikely(retval)) {
                 /*
                  * We have failed halfway through the frequency change.
@@ -547,12 +496,6 @@ static int centrino_target (struct cpufreq_policy *policy,
 
                 for_each_cpu(j, covered_cpus)
                         wrmsr_on_cpu(j, MSR_IA32_PERF_CTL, oldmsr, h);
-
-                tmp = freqs.new;
-                freqs.new = freqs.old;
-                freqs.old = tmp;
-                cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-                cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
         }
         retval = 0;
 
@@ -561,20 +504,15 @@ out:
         return retval;
 }
 
-static struct freq_attr* centrino_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver centrino_driver = {
         .name           = "centrino", /* should be speedstep-centrino,
                                          but there's a 16 char limit */
         .init           = centrino_cpu_init,
         .exit           = centrino_cpu_exit,
-        .verify         = centrino_verify,
-        .target         = centrino_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = centrino_target,
         .get            = get_cur_freq,
-        .attr           = centrino_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 /*
diff --git a/drivers/cpufreq/speedstep-ich.c b/drivers/cpufreq/speedstep-ich.c
index 5355abb69afc..7639b2be2a90 100644
--- a/drivers/cpufreq/speedstep-ich.c
+++ b/drivers/cpufreq/speedstep-ich.c
@@ -251,56 +251,23 @@ static unsigned int speedstep_get(unsigned int cpu)
 /**
  * speedstep_target - set a new CPUFreq policy
  * @policy: new policy
- * @target_freq: the target frequency
- * @relation: how that frequency relates to achieved frequency
- *      (CPUFREQ_RELATION_L or CPUFREQ_RELATION_H)
+ * @index: index of target frequency
  *
  * Sets a new CPUFreq policy.
  */
-static int speedstep_target(struct cpufreq_policy *policy,
-                             unsigned int target_freq,
-                             unsigned int relation)
+static int speedstep_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int newstate = 0, policy_cpu;
-        struct cpufreq_freqs freqs;
-
-        if (cpufreq_frequency_table_target(policy, &speedstep_freqs[0],
-                                target_freq, relation, &newstate))
-                return -EINVAL;
+        unsigned int policy_cpu;
 
         policy_cpu = cpumask_any_and(policy->cpus, cpu_online_mask);
-        freqs.old = speedstep_get(policy_cpu);
-        freqs.new = speedstep_freqs[newstate].frequency;
-
-        pr_debug("transiting from %u to %u kHz\n", freqs.old, freqs.new);
-
-        /* no transition necessary */
-        if (freqs.old == freqs.new)
-                return 0;
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
-        smp_call_function_single(policy_cpu, _speedstep_set_state, &newstate,
+        smp_call_function_single(policy_cpu, _speedstep_set_state, &index,
                                  true);
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
-
         return 0;
 }
 
 
-/**
- * speedstep_verify - verifies a new CPUFreq policy
- * @policy: new policy
- *
- * Limit must be within speedstep_low_freq and speedstep_high_freq, with
- * at least one border included.
- */
-static int speedstep_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &speedstep_freqs[0]);
-}
-
 struct get_freqs {
         struct cpufreq_policy *policy;
         int ret;
@@ -320,8 +287,7 @@ static void get_freqs_on_cpu(void *_get_freqs)
 
 static int speedstep_cpu_init(struct cpufreq_policy *policy)
 {
-        int result;
-        unsigned int policy_cpu, speed;
+        unsigned int policy_cpu;
         struct get_freqs gf;
 
         /* only run on CPU to be set, or on its sibling */
@@ -336,49 +302,18 @@ static int speedstep_cpu_init(struct cpufreq_policy *policy)
         if (gf.ret)
                 return gf.ret;
 
-        /* get current speed setting */
-        speed = speedstep_get(policy_cpu);
-        if (!speed)
-                return -EIO;
-
-        pr_debug("currently at %s speed setting - %i MHz\n",
-                (speed == speedstep_freqs[SPEEDSTEP_LOW].frequency)
-                ? "low" : "high",
-                (speed / 1000));
-
-        /* cpuinfo and default policy values */
-        policy->cur = speed;
-
-        result = cpufreq_frequency_table_cpuinfo(policy, speedstep_freqs);
-        if (result)
-                return result;
-
-        cpufreq_frequency_table_get_attr(speedstep_freqs, policy->cpu);
-
-        return 0;
+        return cpufreq_table_validate_and_show(policy, speedstep_freqs);
 }
 
 
-static int speedstep_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
-}
-
-static struct freq_attr *speedstep_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
-
 static struct cpufreq_driver speedstep_driver = {
         .name   = "speedstep-ich",
-        .verify = speedstep_verify,
-        .target = speedstep_target,
+        .verify = cpufreq_generic_frequency_table_verify,
+        .target_index = speedstep_target,
         .init   = speedstep_cpu_init,
-        .exit   = speedstep_cpu_exit,
+        .exit   = cpufreq_generic_exit,
         .get    = speedstep_get,
-        .attr   = speedstep_attr,
+        .attr   = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id ss_smi_ids[] = {
diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c
index abfba4f731eb..0f5326d6f79f 100644
--- a/drivers/cpufreq/speedstep-smi.c
+++ b/drivers/cpufreq/speedstep-smi.c
@@ -235,52 +235,21 @@ static void speedstep_set_state(unsigned int state)
 /**
  * speedstep_target - set a new CPUFreq policy
  * @policy: new policy
- * @target_freq: new freq
- * @relation:
+ * @index: index of new freq
  *
  * Sets a new CPUFreq policy/freq.
  */
-static int speedstep_target(struct cpufreq_policy *policy,
-                        unsigned int target_freq, unsigned int relation)
+static int speedstep_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int newstate = 0;
-        struct cpufreq_freqs freqs;
-
-        if (cpufreq_frequency_table_target(policy, &speedstep_freqs[0],
-                                target_freq, relation, &newstate))
-                return -EINVAL;
-
-        freqs.old = speedstep_freqs[speedstep_get_state()].frequency;
-        freqs.new = speedstep_freqs[newstate].frequency;
-
-        if (freqs.old == freqs.new)
-                return 0;
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-        speedstep_set_state(newstate);
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+        speedstep_set_state(index);
 
         return 0;
 }
 
 
-/**
- * speedstep_verify - verifies a new CPUFreq policy
- * @policy: new policy
- *
- * Limit must be within speedstep_low_freq and speedstep_high_freq, with
- * at least one border included.
- */
-static int speedstep_verify(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, &speedstep_freqs[0]);
-}
-
-
 static int speedstep_cpu_init(struct cpufreq_policy *policy)
 {
         int result;
-        unsigned int speed, state;
         unsigned int *low, *high;
 
         /* capability check */
@@ -316,32 +285,8 @@ static int speedstep_cpu_init(struct cpufreq_policy *policy)
                         pr_debug("workaround worked.\n");
         }
 
-        /* get current speed setting */
-        state = speedstep_get_state();
-        speed = speedstep_freqs[state].frequency;
-
-        pr_debug("currently at %s speed setting - %i MHz\n",
-                (speed == speedstep_freqs[SPEEDSTEP_LOW].frequency)
-                ? "low" : "high",
-                (speed / 1000));
-
-        /* cpuinfo and default policy values */
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        policy->cur = speed;
-
-        result = cpufreq_frequency_table_cpuinfo(policy, speedstep_freqs);
-        if (result)
-                return result;
-
-        cpufreq_frequency_table_get_attr(speedstep_freqs, policy->cpu);
-
-        return 0;
-}
-
-static int speedstep_cpu_exit(struct cpufreq_policy *policy)
-{
-        cpufreq_frequency_table_put_attr(policy->cpu);
-        return 0;
+        return cpufreq_table_validate_and_show(policy, speedstep_freqs);
 }
 
 static unsigned int speedstep_get(unsigned int cpu)
@@ -362,20 +307,15 @@ static int speedstep_resume(struct cpufreq_policy *policy)
         return result;
 }
 
-static struct freq_attr *speedstep_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver speedstep_driver = {
         .name           = "speedstep-smi",
-        .verify         = speedstep_verify,
-        .target         = speedstep_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = speedstep_target,
         .init           = speedstep_cpu_init,
-        .exit           = speedstep_cpu_exit,
+        .exit           = cpufreq_generic_exit,
         .get            = speedstep_get,
         .resume         = speedstep_resume,
-        .attr           = speedstep_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static const struct x86_cpu_id ss_smi_ids[] = {
diff --git a/drivers/cpufreq/tegra-cpufreq.c b/drivers/cpufreq/tegra-cpufreq.c
index a7b876fdc1d8..f42df7ec03c5 100644
--- a/drivers/cpufreq/tegra-cpufreq.c
+++ b/drivers/cpufreq/tegra-cpufreq.c
@@ -51,11 +51,6 @@ static unsigned long target_cpu_speed[NUM_CPUS];
 static DEFINE_MUTEX(tegra_cpu_lock);
 static bool is_suspended;
 
-static int tegra_verify_speed(struct cpufreq_policy *policy)
-{
-        return cpufreq_frequency_table_verify(policy, freq_table);
-}
-
 static unsigned int tegra_getspeed(unsigned int cpu)
 {
         unsigned long rate;
@@ -107,12 +102,8 @@ static int tegra_update_cpu_speed(struct cpufreq_policy *policy,
                 unsigned long rate)
 {
         int ret = 0;
-        struct cpufreq_freqs freqs;
 
-        freqs.old = tegra_getspeed(0);
-        freqs.new = rate;
-
-        if (freqs.old == freqs.new)
+        if (tegra_getspeed(0) == rate)
                 return ret;
 
         /*
@@ -126,21 +117,10 @@ static int tegra_update_cpu_speed(struct cpufreq_policy *policy,
         else
                 clk_set_rate(emc_clk, 100000000);  /* emc 50Mhz */
 
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_PRECHANGE);
-
-#ifdef CONFIG_CPU_FREQ_DEBUG
-        printk(KERN_DEBUG "cpufreq-tegra: transition: %u --> %u\n",
-               freqs.old, freqs.new);
-#endif
-
-        ret = tegra_cpu_clk_set_rate(freqs.new * 1000);
-        if (ret) {
-                pr_err("cpu-tegra: Failed to set cpu frequency to %d kHz\n",
-                        freqs.new);
-                freqs.new = freqs.old;
-        }
-
-        cpufreq_notify_transition(policy, &freqs, CPUFREQ_POSTCHANGE);
+        ret = tegra_cpu_clk_set_rate(rate * 1000);
+        if (ret)
+                pr_err("cpu-tegra: Failed to set cpu frequency to %lu kHz\n",
+                        rate);
 
         return ret;
 }
@@ -155,11 +135,8 @@ static unsigned long tegra_cpu_highest_speed(void)
         return rate;
 }
 
-static int tegra_target(struct cpufreq_policy *policy,
-                       unsigned int target_freq,
-                       unsigned int relation)
+static int tegra_target(struct cpufreq_policy *policy, unsigned int index)
 {
-        unsigned int idx;
         unsigned int freq;
         int ret = 0;
 
@@ -170,10 +147,7 @@ static int tegra_target(struct cpufreq_policy *policy,
                 goto out;
         }
 
-        cpufreq_frequency_table_target(policy, freq_table, target_freq,
-                relation, &idx);
-
-        freq = freq_table[idx].frequency;
+        freq = freq_table[index].frequency;
 
         target_cpu_speed[policy->cpu] = freq;
 
@@ -209,21 +183,23 @@ static struct notifier_block tegra_cpu_pm_notifier = {
 
 static int tegra_cpu_init(struct cpufreq_policy *policy)
 {
+        int ret;
+
         if (policy->cpu >= NUM_CPUS)
                 return -EINVAL;
 
         clk_prepare_enable(emc_clk);
         clk_prepare_enable(cpu_clk);
 
-        cpufreq_frequency_table_cpuinfo(policy, freq_table);
-        cpufreq_frequency_table_get_attr(freq_table, policy->cpu);
-        policy->cur = tegra_getspeed(policy->cpu);
-        target_cpu_speed[policy->cpu] = policy->cur;
+        target_cpu_speed[policy->cpu] = tegra_getspeed(policy->cpu);
 
         /* FIXME: what's the actual transition time? */
-        policy->cpuinfo.transition_latency = 300 * 1000;
-
-        cpumask_copy(policy->cpus, cpu_possible_mask);
+        ret = cpufreq_generic_init(policy, freq_table, 300 * 1000);
+        if (ret) {
+                clk_disable_unprepare(cpu_clk);
+                clk_disable_unprepare(emc_clk);
+                return ret;
+        }
 
         if (policy->cpu == 0)
                 register_pm_notifier(&tegra_cpu_pm_notifier);
@@ -233,24 +209,20 @@ static int tegra_cpu_init(struct cpufreq_policy *policy)
 
 static int tegra_cpu_exit(struct cpufreq_policy *policy)
 {
-        cpufreq_frequency_table_cpuinfo(policy, freq_table);
+        cpufreq_frequency_table_put_attr(policy->cpu);
+        clk_disable_unprepare(cpu_clk);
         clk_disable_unprepare(emc_clk);
         return 0;
 }
 
-static struct freq_attr *tegra_cpufreq_attr[] = {
-        &cpufreq_freq_attr_scaling_available_freqs,
-        NULL,
-};
-
 static struct cpufreq_driver tegra_cpufreq_driver = {
-        .verify         = tegra_verify_speed,
-        .target         = tegra_target,
+        .verify         = cpufreq_generic_frequency_table_verify,
+        .target_index   = tegra_target,
         .get            = tegra_getspeed,
         .init           = tegra_cpu_init,
         .exit           = tegra_cpu_exit,
         .name           = "tegra",
-        .attr           = tegra_cpufreq_attr,
+        .attr           = cpufreq_generic_attr,
 };
 
 static int __init tegra_cpufreq_init(void)
diff --git a/drivers/cpufreq/unicore2-cpufreq.c b/drivers/cpufreq/unicore2-cpufreq.c
index b225f04d8ae5..653ae2955b55 100644
--- a/drivers/cpufreq/unicore2-cpufreq.c
+++ b/drivers/cpufreq/unicore2-cpufreq.c
@@ -29,9 +29,7 @@ static int ucv2_verify_speed(struct cpufreq_policy *policy)
         if (policy->cpu)
                 return -EINVAL;
 
-        cpufreq_verify_within_limits(policy,
-                        policy->cpuinfo.min_freq, policy->cpuinfo.max_freq);
-
+        cpufreq_verify_within_cpu_limits(policy);
         return 0;
 }
 
@@ -68,7 +66,6 @@ static int __init ucv2_cpu_init(struct cpufreq_policy *policy)
 {
         if (policy->cpu != 0)
                 return -EINVAL;
-        policy->cur = ucv2_getspeed(0);
         policy->min = policy->cpuinfo.min_freq = 250000;
         policy->max = policy->cpuinfo.max_freq = 1000000;
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
diff --git a/drivers/cpufreq/vexpress-spc-cpufreq.c b/drivers/cpufreq/vexpress-spc-cpufreq.c
new file mode 100644
index 000000000000..7f7c9c01b44e
--- /dev/null
+++ b/drivers/cpufreq/vexpress-spc-cpufreq.c
@@ -0,0 +1,70 @@
+/*
+ * Versatile Express SPC CPUFreq Interface driver
+ *
+ * It provides necessary ops to arm_big_little cpufreq driver.
+ *
+ * Copyright (C) 2013 ARM Ltd.
+ * Sudeep KarkadaNagesha <sudeep.karkadanagesha@arm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/cpufreq.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/pm_opp.h>
+#include <linux/types.h>
+
+#include "arm_big_little.h"
+
+static int ve_spc_init_opp_table(struct device *cpu_dev)
+{
+        /*
+         * platform specific SPC code must initialise the opp table
+         * so just check if the OPP count is non-zero
+         */
+        return dev_pm_opp_get_opp_count(cpu_dev) <= 0;
+}
+
+static int ve_spc_get_transition_latency(struct device *cpu_dev)
+{
+        return 1000000; /* 1 ms */
+}
+
+static struct cpufreq_arm_bL_ops ve_spc_cpufreq_ops = {
+        .name   = "vexpress-spc",
+        .get_transition_latency = ve_spc_get_transition_latency,
+        .init_opp_table = ve_spc_init_opp_table,
+};
+
+static int ve_spc_cpufreq_probe(struct platform_device *pdev)
+{
+        return bL_cpufreq_register(&ve_spc_cpufreq_ops);
+}
+
+static int ve_spc_cpufreq_remove(struct platform_device *pdev)
+{
+        bL_cpufreq_unregister(&ve_spc_cpufreq_ops);
+        return 0;
+}
+
+static struct platform_driver ve_spc_cpufreq_platdrv = {
+        .driver = {
+                .name   = "vexpress-spc-cpufreq",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = ve_spc_cpufreq_probe,
+        .remove         = ve_spc_cpufreq_remove,
+};
+module_platform_driver(ve_spc_cpufreq_platdrv);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/cpuidle/Kconfig.arm b/drivers/cpuidle/Kconfig.arm
index 8e3660322308..f23bd75426cd 100644
--- a/drivers/cpuidle/Kconfig.arm
+++ b/drivers/cpuidle/Kconfig.arm
@@ -2,6 +2,17 @@
 # ARM CPU Idle drivers
 #
 
+config ARM_BIG_LITTLE_CPUIDLE
+        bool "Support for ARM big.LITTLE processors"
+        depends on ARCH_VEXPRESS_TC2_PM
+        select ARM_CPU_SUSPEND
+        select CPU_IDLE_MULTIPLE_DRIVERS
+        help
+          Select this option to enable CPU idle driver for big.LITTLE based
+          ARM systems. Driver manages CPUs coordination through MCPM and
+          define different C-states for little and big cores through the
+          multiple CPU idle drivers infrastructure.
+
 config ARM_HIGHBANK_CPUIDLE
         bool "CPU Idle Driver for Calxeda processors"
         depends on ARCH_HIGHBANK
@@ -27,13 +38,9 @@ config ARM_U8500_CPUIDLE
         help
           Select this to enable cpuidle for ST-E u8500 processors
 
-config CPU_IDLE_BIG_LITTLE
-        bool "Support for ARM big.LITTLE processors"
-        depends on ARCH_VEXPRESS_TC2_PM
-        select ARM_CPU_SUSPEND
-        select CPU_IDLE_MULTIPLE_DRIVERS
+config ARM_AT91_CPUIDLE
+        bool "Cpu Idle Driver for the AT91 processors"
+        default y
+        depends on ARCH_AT91
         help
-          Select this option to enable CPU idle driver for big.LITTLE based
-          ARM systems. Driver manages CPUs coordination through MCPM and
-          define different C-states for little and big cores through the
-          multiple CPU idle drivers infrastructure.
+          Select this to enable cpuidle for AT91 processors
diff --git a/drivers/cpuidle/Makefile b/drivers/cpuidle/Makefile
index cea5ef58876d..527be28e5c1e 100644
--- a/drivers/cpuidle/Makefile
+++ b/drivers/cpuidle/Makefile
@@ -7,8 +7,9 @@ obj-$(CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED) += coupled.o
 
 ##################################################################################
 # ARM SoC drivers
+obj-$(CONFIG_ARM_BIG_LITTLE_CPUIDLE)    += cpuidle-big_little.o
 obj-$(CONFIG_ARM_HIGHBANK_CPUIDLE)      += cpuidle-calxeda.o
 obj-$(CONFIG_ARM_KIRKWOOD_CPUIDLE)      += cpuidle-kirkwood.o
 obj-$(CONFIG_ARM_ZYNQ_CPUIDLE)          += cpuidle-zynq.o
 obj-$(CONFIG_ARM_U8500_CPUIDLE)         += cpuidle-ux500.o
-obj-$(CONFIG_CPU_IDLE_BIG_LITTLE)       += cpuidle-big_little.o
+obj-$(CONFIG_ARM_AT91_CPUIDLE)          += cpuidle-at91.o
diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
index f8a86364c6b6..e952936418d0 100644
--- a/drivers/cpuidle/coupled.c
+++ b/drivers/cpuidle/coupled.c
@@ -147,7 +147,7 @@ static cpumask_t cpuidle_coupled_poked;
  * has returned from this function, the barrier is immediately available for
  * reuse.
  *
- * The atomic variable a must be initialized to 0 before any cpu calls
+ * The atomic variable must be initialized to 0 before any cpu calls
  * this function, will be reset to 0 before any cpu returns from this function.
  *
  * Must only be called from within a coupled idle state handler
diff --git a/arch/arm/mach-at91/cpuidle.c b/drivers/cpuidle/cpuidle-at91.c
index 4ec6a6d9b9be..a0774370c6bc 100644
--- a/arch/arm/mach-at91/cpuidle.c
+++ b/drivers/cpuidle/cpuidle-at91.c
@@ -21,26 +21,17 @@
 #include <linux/export.h>
 #include <asm/proc-fns.h>
 #include <asm/cpuidle.h>
-#include <mach/cpu.h>
-
-#include "pm.h"
 
 #define AT91_MAX_STATES 2
 
+static void (*at91_standby)(void);
+
 /* Actual code that puts the SoC in different idle states */
 static int at91_enter_idle(struct cpuidle_device *dev,
                         struct cpuidle_driver *drv,
                                int index)
 {
-        if (cpu_is_at91rm9200())
-                at91rm9200_standby();
-        else if (cpu_is_at91sam9g45())
-                at91sam9g45_standby();
-        else if (cpu_is_at91sam9263())
-                at91sam9263_standby();
-        else
-                at91sam9_standby();
-
+        at91_standby();
         return index;
 }
 
@@ -60,9 +51,19 @@ static struct cpuidle_driver at91_idle_driver = {
 };
 
 /* Initialize CPU idle by registering the idle states */
-static int __init at91_init_cpuidle(void)
+static int at91_cpuidle_probe(struct platform_device *dev)
 {
+        at91_standby = (void *)(dev->dev.platform_data);
+        
         return cpuidle_register(&at91_idle_driver, NULL);
 }
 
-device_initcall(at91_init_cpuidle);
+static struct platform_driver at91_cpuidle_driver = {
+        .driver = {
+                .name = "cpuidle-at91",
+                .owner = THIS_MODULE,
+        },
+        .probe = at91_cpuidle_probe,
+};
+
+module_platform_driver(at91_cpuidle_driver);
diff --git a/drivers/cpuidle/cpuidle-ux500.c b/drivers/cpuidle/cpuidle-ux500.c
index e0564652af35..5e35804b1a95 100644
--- a/drivers/cpuidle/cpuidle-ux500.c
+++ b/drivers/cpuidle/cpuidle-ux500.c
@@ -111,7 +111,7 @@ static struct cpuidle_driver ux500_idle_driver = {
         .state_count = 2,
 };
 
-static int __init dbx500_cpuidle_probe(struct platform_device *pdev)
+static int dbx500_cpuidle_probe(struct platform_device *pdev)
 {
         /* Configure wake up reasons */
         prcmu_enable_wakeups(PRCMU_WAKEUP(ARM) | PRCMU_WAKEUP(RTC) |
diff --git a/drivers/cpuidle/cpuidle-zynq.c b/drivers/cpuidle/cpuidle-zynq.c
index 38e03a183591..aded75928028 100644
--- a/drivers/cpuidle/cpuidle-zynq.c
+++ b/drivers/cpuidle/cpuidle-zynq.c
@@ -28,7 +28,7 @@
 #include <linux/init.h>
 #include <linux/cpu_pm.h>
 #include <linux/cpuidle.h>
-#include <linux/of.h>
+#include <linux/platform_device.h>
 #include <asm/proc-fns.h>
 #include <asm/cpuidle.h>
 
@@ -70,14 +70,19 @@ static struct cpuidle_driver zynq_idle_driver = {
 };
 
 /* Initialize CPU idle by registering the idle states */
-static int __init zynq_cpuidle_init(void)
+static int zynq_cpuidle_probe(struct platform_device *pdev)
 {
-        if (!of_machine_is_compatible("xlnx,zynq-7000"))
-                return -ENODEV;
-
         pr_info("Xilinx Zynq CpuIdle Driver started\n");
 
         return cpuidle_register(&zynq_idle_driver, NULL);
 }
 
-device_initcall(zynq_cpuidle_init);
+static struct platform_driver zynq_cpuidle_driver = {
+        .driver = {
+                .name = "cpuidle-zynq",
+                .owner = THIS_MODULE,
+        },
+        .probe = zynq_cpuidle_probe,
+};
+
+module_platform_driver(zynq_cpuidle_driver);
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index d75040ddd2b3..2a991e468f78 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -118,11 +118,9 @@ int cpuidle_idle_call(void)
         struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
         struct cpuidle_driver *drv;
         int next_state, entered_state;
+        bool broadcast;
 
-        if (off)
-                return -ENODEV;
-
-        if (!initialized)
+        if (off || !initialized)
                 return -ENODEV;
 
         /* check if the device is ready */
@@ -144,9 +142,10 @@ int cpuidle_idle_call(void)
 
         trace_cpu_idle_rcuidle(next_state, dev->cpu);
 
-        if (drv->states[next_state].flags & CPUIDLE_FLAG_TIMER_STOP)
-                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER,
-                                   &dev->cpu);
+        broadcast = !!(drv->states[next_state].flags & CPUIDLE_FLAG_TIMER_STOP);
+
+        if (broadcast)
+                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &dev->cpu);
 
         if (cpuidle_state_is_coupled(dev, drv, next_state))
                 entered_state = cpuidle_enter_state_coupled(dev, drv,
@@ -154,9 +153,8 @@ int cpuidle_idle_call(void)
         else
                 entered_state = cpuidle_enter_state(dev, drv, next_state);
 
-        if (drv->states[next_state].flags & CPUIDLE_FLAG_TIMER_STOP)
-                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT,
-                                   &dev->cpu);
+        if (broadcast)
+                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &dev->cpu);
 
         trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, dev->cpu);
 
@@ -228,45 +226,6 @@ void cpuidle_resume(void)
         mutex_unlock(&cpuidle_lock);
 }
 
-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
-static int poll_idle(struct cpuidle_device *dev,
-                struct cpuidle_driver *drv, int index)
-{
-        ktime_t t1, t2;
-        s64 diff;
-
-        t1 = ktime_get();
-        local_irq_enable();
-        while (!need_resched())
-                cpu_relax();
-
-        t2 = ktime_get();
-        diff = ktime_to_us(ktime_sub(t2, t1));
-        if (diff > INT_MAX)
-                diff = INT_MAX;
-
-        dev->last_residency = (int) diff;
-
-        return index;
-}
-
-static void poll_idle_init(struct cpuidle_driver *drv)
-{
-        struct cpuidle_state *state = &drv->states[0];
-
-        snprintf(state->name, CPUIDLE_NAME_LEN, "POLL");
-        snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
-        state->exit_latency = 0;
-        state->target_residency = 0;
-        state->power_usage = -1;
-        state->flags = 0;
-        state->enter = poll_idle;
-        state->disabled = false;
-}
-#else
-static void poll_idle_init(struct cpuidle_driver *drv) {}
-#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
-
 /**
  * cpuidle_enable_device - enables idle PM for a CPU
  * @dev: the CPU
@@ -296,8 +255,6 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
         if (!dev->state_count)
                 dev->state_count = drv->state_count;
 
-        poll_idle_init(drv);
-
         ret = cpuidle_add_device_sysfs(dev);
         if (ret)
                 return ret;
@@ -358,12 +315,10 @@ static void __cpuidle_unregister_device(struct cpuidle_device *dev)
         module_put(drv->owner);
 }
 
-static int __cpuidle_device_init(struct cpuidle_device *dev)
+static void __cpuidle_device_init(struct cpuidle_device *dev)
 {
         memset(dev->states_usage, 0, sizeof(dev->states_usage));
         dev->last_residency = 0;
-
-        return 0;
 }
 
 /**
@@ -385,13 +340,12 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
         list_add(&dev->device_list, &cpuidle_detected_devices);
 
         ret = cpuidle_coupled_register_device(dev);
-        if (ret) {
+        if (ret)
                 __cpuidle_unregister_device(dev);
-                return ret;
-        }
+        else
+                dev->registered = 1;
 
-        dev->registered = 1;
-        return 0;
+        return ret;
 }
 
 /**
@@ -410,9 +364,7 @@ int cpuidle_register_device(struct cpuidle_device *dev)
         if (dev->registered)
                 goto out_unlock;
 
-        ret = __cpuidle_device_init(dev);
-        if (ret)
-                goto out_unlock;
+        __cpuidle_device_init(dev);
 
         ret = __cpuidle_register_device(dev);
         if (ret)
@@ -516,7 +468,7 @@ int cpuidle_register(struct cpuidle_driver *drv,
 
 #ifdef CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED
                 /*
-                 * On multiplatform for ARM, the coupled idle states could
+                 * On multiplatform for ARM, the coupled idle states could be
                  * enabled in the kernel even if the cpuidle driver does not
                  * use it. Note, coupled_cpus is a struct copy.
                  */
diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
index 6e11701f0fca..06dbe7c86199 100644
--- a/drivers/cpuidle/driver.c
+++ b/drivers/cpuidle/driver.c
@@ -10,6 +10,7 @@
 
 #include <linux/mutex.h>
 #include <linux/module.h>
+#include <linux/sched.h>
 #include <linux/cpuidle.h>
 #include <linux/cpumask.h>
 #include <linux/clockchips.h>
@@ -56,7 +57,7 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv)
 }
 
 /**
- * __cpuidle_set_driver - set per CPU driver variables the the given driver.
+ * __cpuidle_set_driver - set per CPU driver variables for the given driver.
  * @drv: a valid pointer to a struct cpuidle_driver
  *
  * For each CPU in the driver's cpumask, unset the registered driver per CPU
@@ -132,7 +133,7 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv)
  * cpuidle_setup_broadcast_timer - enable/disable the broadcast timer
  * @arg: a void pointer used to match the SMP cross call API
  *
- * @arg is used as a value of type 'long' with on of the two values:
+ * @arg is used as a value of type 'long' with one of the two values:
  * - CLOCK_EVT_NOTIFY_BROADCAST_ON
  * - CLOCK_EVT_NOTIFY_BROADCAST_OFF
  *
@@ -149,10 +150,8 @@ static void cpuidle_setup_broadcast_timer(void *arg)
 /**
  * __cpuidle_driver_init - initialize the driver's internal data
  * @drv: a valid pointer to a struct cpuidle_driver
- *
- * Returns 0 on success, a negative error code otherwise.
  */
-static int __cpuidle_driver_init(struct cpuidle_driver *drv)
+static void __cpuidle_driver_init(struct cpuidle_driver *drv)
 {
         int i;
 
@@ -169,20 +168,55 @@ static int __cpuidle_driver_init(struct cpuidle_driver *drv)
         /*
          * Look for the timer stop flag in the different states, so that we know
          * if the broadcast timer has to be set up.  The loop is in the reverse
-         * order, because usually on of the the deeper states has this flag set.
+         * order, because usually one of the deeper states have this flag set.
          */
         for (i = drv->state_count - 1; i >= 0 ; i--) {
+                if (drv->states[i].flags & CPUIDLE_FLAG_TIMER_STOP) {
+                        drv->bctimer = 1;
+                        break;
+                }
+        }
+}
 
-                if (!(drv->states[i].flags & CPUIDLE_FLAG_TIMER_STOP))
-                        continue;
+#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+static int poll_idle(struct cpuidle_device *dev,
+                struct cpuidle_driver *drv, int index)
+{
+        ktime_t t1, t2;
+        s64 diff;
 
-                drv->bctimer = 1;
-                break;
-        }
+        t1 = ktime_get();
+        local_irq_enable();
+        while (!need_resched())
+                cpu_relax();
 
-        return 0;
+        t2 = ktime_get();
+        diff = ktime_to_us(ktime_sub(t2, t1));
+        if (diff > INT_MAX)
+                diff = INT_MAX;
+
+        dev->last_residency = (int) diff;
+
+        return index;
 }
 
+static void poll_idle_init(struct cpuidle_driver *drv)
+{
+        struct cpuidle_state *state = &drv->states[0];
+
+        snprintf(state->name, CPUIDLE_NAME_LEN, "POLL");
+        snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
+        state->exit_latency = 0;
+        state->target_residency = 0;
+        state->power_usage = -1;
+        state->flags = 0;
+        state->enter = poll_idle;
+        state->disabled = false;
+}
+#else
+static void poll_idle_init(struct cpuidle_driver *drv) {}
+#endif /* !CONFIG_ARCH_HAS_CPU_RELAX */
+
 /**
  * __cpuidle_register_driver: register the driver
  * @drv: a valid pointer to a struct cpuidle_driver
@@ -206,9 +240,7 @@ static int __cpuidle_register_driver(struct cpuidle_driver *drv)
         if (cpuidle_disabled())
                 return -ENODEV;
 
-        ret = __cpuidle_driver_init(drv);
-        if (ret)
-                return ret;
+        __cpuidle_driver_init(drv);
 
         ret = __cpuidle_set_driver(drv);
         if (ret)
@@ -218,6 +250,8 @@ static int __cpuidle_register_driver(struct cpuidle_driver *drv)
                 on_each_cpu_mask(drv->cpumask, cpuidle_setup_broadcast_timer,
                                  (void *)CLOCK_EVT_NOTIFY_BROADCAST_ON, 1);
 
+        poll_idle_init(drv);
+
         return 0;
 }
 
@@ -346,10 +380,11 @@ struct cpuidle_driver *cpuidle_driver_ref(void)
  */
 void cpuidle_driver_unref(void)
 {
-        struct cpuidle_driver *drv = cpuidle_get_driver();
+        struct cpuidle_driver *drv;
 
         spin_lock(&cpuidle_driver_lock);
 
+        drv = cpuidle_get_driver();
         if (drv && !WARN_ON(drv->refcnt <= 0))
                 drv->refcnt--;
 
diff --git a/drivers/cpuidle/governor.c b/drivers/cpuidle/governor.c
index ea2f8e7aa24a..ca89412f5122 100644
--- a/drivers/cpuidle/governor.c
+++ b/drivers/cpuidle/governor.c
@@ -96,46 +96,3 @@ int cpuidle_register_governor(struct cpuidle_governor *gov)
 
         return ret;
 }
-
-/**
- * cpuidle_replace_governor - find a replacement governor
- * @exclude_rating: the rating that will be skipped while looking for
- * new governor.
- */
-static struct cpuidle_governor *cpuidle_replace_governor(int exclude_rating)
-{
-        struct cpuidle_governor *gov;
-        struct cpuidle_governor *ret_gov = NULL;
-        unsigned int max_rating = 0;
-
-        list_for_each_entry(gov, &cpuidle_governors, governor_list) {
-                if (gov->rating == exclude_rating)
-                        continue;
-                if (gov->rating > max_rating) {
-                        max_rating = gov->rating;
-                        ret_gov = gov;
-                }
-        }
-
-        return ret_gov;
-}
-
-/**
- * cpuidle_unregister_governor - unregisters a governor
- * @gov: the governor
- */
-void cpuidle_unregister_governor(struct cpuidle_governor *gov)
-{
-        if (!gov)
-                return;
-
-        mutex_lock(&cpuidle_lock);
-        if (gov == cpuidle_curr_governor) {
-                struct cpuidle_governor *new_gov;
-                new_gov = cpuidle_replace_governor(gov->rating);
-                cpuidle_switch_governor(new_gov);
-        }
-        list_del(&gov->governor_list);
-        mutex_unlock(&cpuidle_lock);
-}
-
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 8739cc05228c..e918b6d0caf7 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -52,11 +52,12 @@ static ssize_t show_current_driver(struct device *dev,
                                    char *buf)
 {
         ssize_t ret;
-        struct cpuidle_driver *cpuidle_driver = cpuidle_get_driver();
+        struct cpuidle_driver *drv;
 
         spin_lock(&cpuidle_driver_lock);
-        if (cpuidle_driver)
-                ret = sprintf(buf, "%s\n", cpuidle_driver->name);
+        drv = cpuidle_get_driver();
+        if (drv)
+                ret = sprintf(buf, "%s\n", drv->name);
         else
                 ret = sprintf(buf, "none\n");
         spin_unlock(&cpuidle_driver_lock);
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index c99c00d35d34..a0b2f7e0eedb 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -18,7 +18,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/stat.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/devfreq.h>
 #include <linux/workqueue.h>
 #include <linux/platform_device.h>
@@ -902,13 +902,13 @@ static ssize_t available_frequencies_show(struct device *d,
 {
         struct devfreq *df = to_devfreq(d);
         struct device *dev = df->dev.parent;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         ssize_t count = 0;
         unsigned long freq = 0;
 
         rcu_read_lock();
         do {
-                opp = opp_find_freq_ceil(dev, &freq);
+                opp = dev_pm_opp_find_freq_ceil(dev, &freq);
                 if (IS_ERR(opp))
                         break;
 
@@ -993,10 +993,10 @@ static int __init devfreq_init(void)
         }
 
         devfreq_wq = create_freezable_workqueue("devfreq_wq");
-        if (IS_ERR(devfreq_wq)) {
+        if (!devfreq_wq) {
                 class_destroy(devfreq_class);
                 pr_err("%s: couldn't create workqueue\n", __FILE__);
-                return PTR_ERR(devfreq_wq);
+                return -ENOMEM;
         }
         devfreq_class->dev_groups = devfreq_groups;
 
@@ -1029,25 +1029,26 @@ module_exit(devfreq_exit);
  * under the locked area. The pointer returned must be used prior to unlocking
  * with rcu_read_unlock() to maintain the integrity of the pointer.
  */
-struct opp *devfreq_recommended_opp(struct device *dev, unsigned long *freq,
-                                    u32 flags)
+struct dev_pm_opp *devfreq_recommended_opp(struct device *dev,
+                                           unsigned long *freq,
+                                           u32 flags)
 {
-        struct opp *opp;
+        struct dev_pm_opp *opp;
 
         if (flags & DEVFREQ_FLAG_LEAST_UPPER_BOUND) {
                 /* The freq is an upper bound. opp should be lower */
-                opp = opp_find_freq_floor(dev, freq);
+                opp = dev_pm_opp_find_freq_floor(dev, freq);
 
                 /* If not available, use the closest opp */
                 if (opp == ERR_PTR(-ERANGE))
-                        opp = opp_find_freq_ceil(dev, freq);
+                        opp = dev_pm_opp_find_freq_ceil(dev, freq);
         } else {
                 /* The freq is an lower bound. opp should be higher */
-                opp = opp_find_freq_ceil(dev, freq);
+                opp = dev_pm_opp_find_freq_ceil(dev, freq);
 
                 /* If not available, use the closest opp */
                 if (opp == ERR_PTR(-ERANGE))
-                        opp = opp_find_freq_floor(dev, freq);
+                        opp = dev_pm_opp_find_freq_floor(dev, freq);
         }
 
         return opp;
@@ -1066,7 +1067,7 @@ int devfreq_register_opp_notifier(struct device *dev, struct devfreq *devfreq)
         int ret = 0;
 
         rcu_read_lock();
-        nh = opp_get_notifier(dev);
+        nh = dev_pm_opp_get_notifier(dev);
         if (IS_ERR(nh))
                 ret = PTR_ERR(nh);
         rcu_read_unlock();
@@ -1092,7 +1093,7 @@ int devfreq_unregister_opp_notifier(struct device *dev, struct devfreq *devfreq)
         int ret = 0;
 
         rcu_read_lock();
-        nh = opp_get_notifier(dev);
+        nh = dev_pm_opp_get_notifier(dev);
         if (IS_ERR(nh))
                 ret = PTR_ERR(nh);
         rcu_read_unlock();
diff --git a/drivers/devfreq/exynos/exynos4_bus.c b/drivers/devfreq/exynos/exynos4_bus.c
index c5f86d8caca3..cede6f71cd63 100644
--- a/drivers/devfreq/exynos/exynos4_bus.c
+++ b/drivers/devfreq/exynos/exynos4_bus.c
@@ -19,7 +19,7 @@
 #include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/suspend.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/devfreq.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/consumer.h>
@@ -639,7 +639,7 @@ static int exynos4_bus_target(struct device *dev, unsigned long *_freq,
         struct platform_device *pdev = container_of(dev, struct platform_device,
                                                     dev);
         struct busfreq_data *data = platform_get_drvdata(pdev);
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long freq;
         unsigned long old_freq = data->curr_oppinfo.rate;
         struct busfreq_opp_info new_oppinfo;
@@ -650,8 +650,8 @@ static int exynos4_bus_target(struct device *dev, unsigned long *_freq,
                 rcu_read_unlock();
                 return PTR_ERR(opp);
         }
-        new_oppinfo.rate = opp_get_freq(opp);
-        new_oppinfo.volt = opp_get_voltage(opp);
+        new_oppinfo.rate = dev_pm_opp_get_freq(opp);
+        new_oppinfo.volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
         freq = new_oppinfo.rate;
 
@@ -873,7 +873,7 @@ static int exynos4210_init_tables(struct busfreq_data *data)
                 exynos4210_busclk_table[i].volt = exynos4210_asv_volt[mgrp][i];
 
         for (i = LV_0; i < EX4210_LV_NUM; i++) {
-                err = opp_add(data->dev, exynos4210_busclk_table[i].clk,
+                err = dev_pm_opp_add(data->dev, exynos4210_busclk_table[i].clk,
                               exynos4210_busclk_table[i].volt);
                 if (err) {
                         dev_err(data->dev, "Cannot add opp entries.\n");
@@ -940,7 +940,7 @@ static int exynos4x12_init_tables(struct busfreq_data *data)
         }
 
         for (i = 0; i < EX4x12_LV_NUM; i++) {
-                ret = opp_add(data->dev, exynos4x12_mifclk_table[i].clk,
+                ret = dev_pm_opp_add(data->dev, exynos4x12_mifclk_table[i].clk,
                               exynos4x12_mifclk_table[i].volt);
                 if (ret) {
                         dev_err(data->dev, "Fail to add opp entries.\n");
@@ -956,7 +956,7 @@ static int exynos4_busfreq_pm_notifier_event(struct notifier_block *this,
 {
         struct busfreq_data *data = container_of(this, struct busfreq_data,
                                                  pm_notifier);
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         struct busfreq_opp_info new_oppinfo;
         unsigned long maxfreq = ULONG_MAX;
         int err = 0;
@@ -969,7 +969,7 @@ static int exynos4_busfreq_pm_notifier_event(struct notifier_block *this,
                 data->disabled = true;
 
                 rcu_read_lock();
-                opp = opp_find_freq_floor(data->dev, &maxfreq);
+                opp = dev_pm_opp_find_freq_floor(data->dev, &maxfreq);
                 if (IS_ERR(opp)) {
                         rcu_read_unlock();
                         dev_err(data->dev, "%s: unable to find a min freq\n",
@@ -977,8 +977,8 @@ static int exynos4_busfreq_pm_notifier_event(struct notifier_block *this,
                         mutex_unlock(&data->lock);
                         return PTR_ERR(opp);
                 }
-                new_oppinfo.rate = opp_get_freq(opp);
-                new_oppinfo.volt = opp_get_voltage(opp);
+                new_oppinfo.rate = dev_pm_opp_get_freq(opp);
+                new_oppinfo.volt = dev_pm_opp_get_voltage(opp);
                 rcu_read_unlock();
 
                 err = exynos4_bus_setvolt(data, &new_oppinfo,
@@ -1020,7 +1020,7 @@ unlock:
 static int exynos4_busfreq_probe(struct platform_device *pdev)
 {
         struct busfreq_data *data;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         struct device *dev = &pdev->dev;
         int err = 0;
 
@@ -1065,15 +1065,16 @@ static int exynos4_busfreq_probe(struct platform_device *pdev)
         }
 
         rcu_read_lock();
-        opp = opp_find_freq_floor(dev, &exynos4_devfreq_profile.initial_freq);
+        opp = dev_pm_opp_find_freq_floor(dev,
+                                         &exynos4_devfreq_profile.initial_freq);
         if (IS_ERR(opp)) {
                 rcu_read_unlock();
                 dev_err(dev, "Invalid initial frequency %lu kHz.\n",
                         exynos4_devfreq_profile.initial_freq);
                 return PTR_ERR(opp);
         }
-        data->curr_oppinfo.rate = opp_get_freq(opp);
-        data->curr_oppinfo.volt = opp_get_voltage(opp);
+        data->curr_oppinfo.rate = dev_pm_opp_get_freq(opp);
+        data->curr_oppinfo.volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
 
         platform_set_drvdata(pdev, data);
diff --git a/drivers/devfreq/exynos/exynos5_bus.c b/drivers/devfreq/exynos/exynos5_bus.c
index 574b16b59be5..a60da3c1c48e 100644
--- a/drivers/devfreq/exynos/exynos5_bus.c
+++ b/drivers/devfreq/exynos/exynos5_bus.c
@@ -15,10 +15,9 @@
 #include <linux/module.h>
 #include <linux/devfreq.h>
 #include <linux/io.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 #include <linux/slab.h>
 #include <linux/suspend.h>
-#include <linux/opp.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/platform_device.h>
@@ -132,7 +131,7 @@ static int exynos5_busfreq_int_target(struct device *dev, unsigned long *_freq,
         struct platform_device *pdev = container_of(dev, struct platform_device,
                                                     dev);
         struct busfreq_data_int *data = platform_get_drvdata(pdev);
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long old_freq, freq;
         unsigned long volt;
 
@@ -144,8 +143,8 @@ static int exynos5_busfreq_int_target(struct device *dev, unsigned long *_freq,
                 return PTR_ERR(opp);
         }
 
-        freq = opp_get_freq(opp);
-        volt = opp_get_voltage(opp);
+        freq = dev_pm_opp_get_freq(opp);
+        volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
 
         old_freq = data->curr_freq;
@@ -246,7 +245,7 @@ static int exynos5250_init_int_tables(struct busfreq_data_int *data)
         int i, err = 0;
 
         for (i = LV_0; i < _LV_END; i++) {
-                err = opp_add(data->dev, exynos5_int_opp_table[i].clk,
+                err = dev_pm_opp_add(data->dev, exynos5_int_opp_table[i].clk,
                                 exynos5_int_opp_table[i].volt);
                 if (err) {
                         dev_err(data->dev, "Cannot add opp entries.\n");
@@ -262,7 +261,7 @@ static int exynos5_busfreq_int_pm_notifier_event(struct notifier_block *this,
 {
         struct busfreq_data_int *data = container_of(this,
                                         struct busfreq_data_int, pm_notifier);
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         unsigned long maxfreq = ULONG_MAX;
         unsigned long freq;
         unsigned long volt;
@@ -276,14 +275,14 @@ static int exynos5_busfreq_int_pm_notifier_event(struct notifier_block *this,
                 data->disabled = true;
 
                 rcu_read_lock();
-                opp = opp_find_freq_floor(data->dev, &maxfreq);
+                opp = dev_pm_opp_find_freq_floor(data->dev, &maxfreq);
                 if (IS_ERR(opp)) {
                         rcu_read_unlock();
                         err = PTR_ERR(opp);
                         goto unlock;
                 }
-                freq = opp_get_freq(opp);
-                volt = opp_get_voltage(opp);
+                freq = dev_pm_opp_get_freq(opp);
+                volt = dev_pm_opp_get_voltage(opp);
                 rcu_read_unlock();
 
                 err = exynos5_int_setvolt(data, volt);
@@ -316,7 +315,7 @@ unlock:
 static int exynos5_busfreq_int_probe(struct platform_device *pdev)
 {
         struct busfreq_data_int *data;
-        struct opp *opp;
+        struct dev_pm_opp *opp;
         struct device *dev = &pdev->dev;
         struct device_node *np;
         unsigned long initial_freq;
@@ -351,46 +350,43 @@ static int exynos5_busfreq_int_probe(struct platform_device *pdev)
 
         err = exynos5250_init_int_tables(data);
         if (err)
-                goto err_regulator;
+                return err;
 
-        data->vdd_int = regulator_get(dev, "vdd_int");
+        data->vdd_int = devm_regulator_get(dev, "vdd_int");
         if (IS_ERR(data->vdd_int)) {
                 dev_err(dev, "Cannot get the regulator \"vdd_int\"\n");
-                err = PTR_ERR(data->vdd_int);
-                goto err_regulator;
+                return PTR_ERR(data->vdd_int);
         }
 
-        data->int_clk = clk_get(dev, "int_clk");
+        data->int_clk = devm_clk_get(dev, "int_clk");
         if (IS_ERR(data->int_clk)) {
                 dev_err(dev, "Cannot get clock \"int_clk\"\n");
-                err = PTR_ERR(data->int_clk);
-                goto err_clock;
+                return PTR_ERR(data->int_clk);
         }
 
         rcu_read_lock();
-        opp = opp_find_freq_floor(dev,
+        opp = dev_pm_opp_find_freq_floor(dev,
                         &exynos5_devfreq_int_profile.initial_freq);
         if (IS_ERR(opp)) {
                 rcu_read_unlock();
                 dev_err(dev, "Invalid initial frequency %lu kHz.\n",
                        exynos5_devfreq_int_profile.initial_freq);
-                err = PTR_ERR(opp);
-                goto err_opp_add;
+                return PTR_ERR(opp);
         }
-        initial_freq = opp_get_freq(opp);
-        initial_volt = opp_get_voltage(opp);
+        initial_freq = dev_pm_opp_get_freq(opp);
+        initial_volt = dev_pm_opp_get_voltage(opp);
         rcu_read_unlock();
         data->curr_freq = initial_freq;
 
         err = clk_set_rate(data->int_clk, initial_freq * 1000);
         if (err) {
                 dev_err(dev, "Failed to set initial frequency\n");
-                goto err_opp_add;
+                return err;
         }
 
         err = exynos5_int_setvolt(data, initial_volt);
         if (err)
-                goto err_opp_add;
+                return err;
 
         platform_set_drvdata(pdev, data);
 
@@ -419,12 +415,6 @@ static int exynos5_busfreq_int_probe(struct platform_device *pdev)
 
 err_devfreq_add:
         devfreq_remove_device(data->devfreq);
-        platform_set_drvdata(pdev, NULL);
-err_opp_add:
-        clk_put(data->int_clk);
-err_clock:
-        regulator_put(data->vdd_int);
-err_regulator:
         return err;
 }
 
@@ -435,9 +425,6 @@ static int exynos5_busfreq_int_remove(struct platform_device *pdev)
         pm_qos_remove_request(&data->int_req);
         unregister_pm_notifier(&data->pm_notifier);
         devfreq_remove_device(data->devfreq);
-        regulator_put(data->vdd_int);
-        clk_put(data->int_clk);
-        platform_set_drvdata(pdev, NULL);
 
         return 0;
 }
@@ -479,7 +466,7 @@ static int __init exynos5_busfreq_int_init(void)
 
         exynos5_devfreq_pdev =
                 platform_device_register_simple("exynos5-bus-int", -1, NULL, 0);
-        if (IS_ERR_OR_NULL(exynos5_devfreq_pdev)) {
+        if (IS_ERR(exynos5_devfreq_pdev)) {
                 ret = PTR_ERR(exynos5_devfreq_pdev);
                 goto out1;
         }
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 526ec77c7ba0..f238cfd33847 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -198,6 +198,7 @@ config TI_EDMA
         depends on ARCH_DAVINCI || ARCH_OMAP
         select DMA_ENGINE
         select DMA_VIRTUAL_CHANNELS
+        select TI_PRIV_EDMA
         default n
         help
           Enable support for the TI EDMA controller. This DMA
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index ff50ff4c6a57..10b577fcf48d 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -305,7 +305,9 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                                 edma_alloc_slot(EDMA_CTLR(echan->ch_num),
                                                 EDMA_SLOT_ANY);
                         if (echan->slot[i] < 0) {
+                                kfree(edesc);
                                 dev_err(dev, "Failed to allocate slot\n");
+                                kfree(edesc);
                                 return NULL;
                         }
                 }
@@ -345,6 +347,7 @@ static struct dma_async_tx_descriptor *edma_prep_slave_sg(
                         ccnt = sg_dma_len(sg) / (acnt * bcnt);
                         if (ccnt > (SZ_64K - 1)) {
                                 dev_err(dev, "Exceeded max SG segment size\n");
+                                kfree(edesc);
                                 return NULL;
                         }
                         cidx = acnt * bcnt;
@@ -749,6 +752,6 @@ static void __exit edma_exit(void)
 }
 module_exit(edma_exit);
 
-MODULE_AUTHOR("Matt Porter <mporter@ti.com>");
+MODULE_AUTHOR("Matt Porter <matt.porter@linaro.org>");
 MODULE_DESCRIPTION("TI EDMA DMA engine driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 78f8ca5fccee..55852c026791 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -437,17 +437,18 @@ static void dma_irq_handle_channel(struct imxdma_channel *imxdmac)
         struct imxdma_engine *imxdma = imxdmac->imxdma;
         int chno = imxdmac->channel;
         struct imxdma_desc *desc;
+        unsigned long flags;
 
-        spin_lock(&imxdma->lock);
+        spin_lock_irqsave(&imxdma->lock, flags);
         if (list_empty(&imxdmac->ld_active)) {
-                spin_unlock(&imxdma->lock);
+                spin_unlock_irqrestore(&imxdma->lock, flags);
                 goto out;
         }
 
         desc = list_first_entry(&imxdmac->ld_active,
                                 struct imxdma_desc,
                                 node);
-        spin_unlock(&imxdma->lock);
+        spin_unlock_irqrestore(&imxdma->lock, flags);
 
         if (desc->sg) {
                 u32 tmp;
@@ -519,7 +520,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
 {
         struct imxdma_channel *imxdmac = to_imxdma_chan(d->desc.chan);
         struct imxdma_engine *imxdma = imxdmac->imxdma;
-        unsigned long flags;
         int slot = -1;
         int i;
 
@@ -527,7 +527,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
         switch (d->type) {
         case IMXDMA_DESC_INTERLEAVED:
                 /* Try to get a free 2D slot */
-                spin_lock_irqsave(&imxdma->lock, flags);
                 for (i = 0; i < IMX_DMA_2D_SLOTS; i++) {
                         if ((imxdma->slots_2d[i].count > 0) &&
                         ((imxdma->slots_2d[i].xsr != d->x) ||
@@ -537,10 +536,8 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
                         slot = i;
                         break;
                 }
-                if (slot < 0) {
-                        spin_unlock_irqrestore(&imxdma->lock, flags);
+                if (slot < 0)
                         return -EBUSY;
-                }
 
                 imxdma->slots_2d[slot].xsr = d->x;
                 imxdma->slots_2d[slot].ysr = d->y;
@@ -549,7 +546,6 @@ static int imxdma_xfer_desc(struct imxdma_desc *d)
 
                 imxdmac->slot_2d = slot;
                 imxdmac->enabled_2d = true;
-                spin_unlock_irqrestore(&imxdma->lock, flags);
 
                 if (slot == IMX_DMA_2D_SLOT_A) {
                         d->config_mem &= ~CCR_MSEL_B;
@@ -625,18 +621,17 @@ static void imxdma_tasklet(unsigned long data)
         struct imxdma_channel *imxdmac = (void *)data;
         struct imxdma_engine *imxdma = imxdmac->imxdma;
         struct imxdma_desc *desc;
+        unsigned long flags;
 
-        spin_lock(&imxdma->lock);
+        spin_lock_irqsave(&imxdma->lock, flags);
 
         if (list_empty(&imxdmac->ld_active)) {
                 /* Someone might have called terminate all */
-                goto out;
+                spin_unlock_irqrestore(&imxdma->lock, flags);
+                return;
         }
         desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);
 
-        if (desc->desc.callback)
-                desc->desc.callback(desc->desc.callback_param);
-
         /* If we are dealing with a cyclic descriptor, keep it on ld_active
          * and dont mark the descriptor as complete.
          * Only in non-cyclic cases it would be marked as complete
@@ -663,7 +658,11 @@ static void imxdma_tasklet(unsigned long data)
                                  __func__, imxdmac->channel);
         }
 out:
-        spin_unlock(&imxdma->lock);
+        spin_unlock_irqrestore(&imxdma->lock, flags);
+
+        if (desc->desc.callback)
+                desc->desc.callback(desc->desc.callback_param);
+
 }
 
 static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
@@ -883,7 +882,7 @@ static struct dma_async_tx_descriptor *imxdma_prep_dma_cyclic(
         kfree(imxdmac->sg_list);
 
         imxdmac->sg_list = kcalloc(periods + 1,
-                        sizeof(struct scatterlist), GFP_KERNEL);
+                        sizeof(struct scatterlist), GFP_ATOMIC);
         if (!imxdmac->sg_list)
                 return NULL;
 
diff --git a/drivers/dma/sh/rcar-hpbdma.c b/drivers/dma/sh/rcar-hpbdma.c
index 45a520281ce1..ebad84591a6e 100644
--- a/drivers/dma/sh/rcar-hpbdma.c
+++ b/drivers/dma/sh/rcar-hpbdma.c
@@ -93,6 +93,7 @@ struct hpb_dmae_chan {
         void __iomem *base;
         const struct hpb_dmae_slave_config *cfg;
         char dev_id[16];                /* unique name per DMAC of channel */
+        dma_addr_t slave_addr;
 };
 
 struct hpb_dmae_device {
@@ -432,7 +433,6 @@ hpb_dmae_alloc_chan_resources(struct hpb_dmae_chan *hpb_chan,
                 hpb_chan->xfer_mode = XFER_DOUBLE;
         } else {
                 dev_err(hpb_chan->shdma_chan.dev, "DCR setting error");
-                shdma_free_irq(&hpb_chan->shdma_chan);
                 return -EINVAL;
         }
 
@@ -446,7 +446,8 @@ hpb_dmae_alloc_chan_resources(struct hpb_dmae_chan *hpb_chan,
         return 0;
 }
 
-static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id, bool try)
+static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id,
+                              dma_addr_t slave_addr, bool try)
 {
         struct hpb_dmae_chan *chan = to_chan(schan);
         const struct hpb_dmae_slave_config *sc =
@@ -457,6 +458,7 @@ static int hpb_dmae_set_slave(struct shdma_chan *schan, int slave_id, bool try)
         if (try)
                 return 0;
         chan->cfg = sc;
+        chan->slave_addr = slave_addr ? : sc->addr;
         return hpb_dmae_alloc_chan_resources(chan, sc);
 }
 
@@ -468,7 +470,7 @@ static dma_addr_t hpb_dmae_slave_addr(struct shdma_chan *schan)
 {
         struct hpb_dmae_chan *chan = to_chan(schan);
 
-        return chan->cfg->addr;
+        return chan->slave_addr;
 }
 
 static struct shdma_desc *hpb_dmae_embedded_desc(void *buf, int i)
@@ -614,7 +616,6 @@ static void hpb_dmae_chan_remove(struct hpb_dmae_device *hpbdev)
         shdma_for_each_chan(schan, &hpbdev->shdma_dev, i) {
                 BUG_ON(!schan);
 
-                shdma_free_irq(schan);
                 shdma_chan_remove(schan);
         }
         dma_dev->chancnt = 0;
diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c
index 2d9ca6055e5e..41b5913ddabe 100644
--- a/drivers/gpio/gpio-lynxpoint.c
+++ b/drivers/gpio/gpio-lynxpoint.c
@@ -248,14 +248,15 @@ static void lp_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
         struct lp_gpio *lg = irq_data_get_irq_handler_data(data);
         struct irq_chip *chip = irq_data_get_irq_chip(data);
         u32 base, pin, mask;
-        unsigned long reg, pending;
+        unsigned long reg, ena, pending;
         unsigned virq;
 
         /* check from GPIO controller which pin triggered the interrupt */
         for (base = 0; base < lg->chip.ngpio; base += 32) {
                 reg = lp_gpio_reg(&lg->chip, base, LP_INT_STAT);
+                ena = lp_gpio_reg(&lg->chip, base, LP_INT_ENABLE);
 
-                while ((pending = inl(reg))) {
+                while ((pending = (inl(reg) & inl(ena)))) {
                         pin = __ffs(pending);
                         mask = BIT(pin);
                         /* Clear before handling so we don't lose an edge */
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 0ff43552d472..89675f862308 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -63,6 +63,7 @@ struct gpio_bank {
         struct gpio_chip chip;
         struct clk *dbck;
         u32 mod_usage;
+        u32 irq_usage;
         u32 dbck_enable_mask;
         bool dbck_enabled;
         struct device *dev;
@@ -86,6 +87,9 @@ struct gpio_bank {
 #define GPIO_BIT(bank, gpio) (1 << GPIO_INDEX(bank, gpio))
 #define GPIO_MOD_CTRL_BIT       BIT(0)
 
+#define BANK_USED(bank) (bank->mod_usage || bank->irq_usage)
+#define LINE_USED(line, offset) (line & (1 << offset))
+
 static int irq_to_gpio(struct gpio_bank *bank, unsigned int gpio_irq)
 {
         return bank->chip.base + gpio_irq;
@@ -420,15 +424,69 @@ static int _set_gpio_triggering(struct gpio_bank *bank, int gpio,
         return 0;
 }
 
+static void _enable_gpio_module(struct gpio_bank *bank, unsigned offset)
+{
+        if (bank->regs->pinctrl) {
+                void __iomem *reg = bank->base + bank->regs->pinctrl;
+
+                /* Claim the pin for MPU */
+                __raw_writel(__raw_readl(reg) | (1 << offset), reg);
+        }
+
+        if (bank->regs->ctrl && !BANK_USED(bank)) {
+                void __iomem *reg = bank->base + bank->regs->ctrl;
+                u32 ctrl;
+
+                ctrl = __raw_readl(reg);
+                /* Module is enabled, clocks are not gated */
+                ctrl &= ~GPIO_MOD_CTRL_BIT;
+                __raw_writel(ctrl, reg);
+                bank->context.ctrl = ctrl;
+        }
+}
+
+static void _disable_gpio_module(struct gpio_bank *bank, unsigned offset)
+{
+        void __iomem *base = bank->base;
+
+        if (bank->regs->wkup_en &&
+            !LINE_USED(bank->mod_usage, offset) &&
+            !LINE_USED(bank->irq_usage, offset)) {
+                /* Disable wake-up during idle for dynamic tick */
+                _gpio_rmw(base, bank->regs->wkup_en, 1 << offset, 0);
+                bank->context.wake_en =
+                        __raw_readl(bank->base + bank->regs->wkup_en);
+        }
+
+        if (bank->regs->ctrl && !BANK_USED(bank)) {
+                void __iomem *reg = bank->base + bank->regs->ctrl;
+                u32 ctrl;
+
+                ctrl = __raw_readl(reg);
+                /* Module is disabled, clocks are gated */
+                ctrl |= GPIO_MOD_CTRL_BIT;
+                __raw_writel(ctrl, reg);
+                bank->context.ctrl = ctrl;
+        }
+}
+
+static int gpio_is_input(struct gpio_bank *bank, int mask)
+{
+        void __iomem *reg = bank->base + bank->regs->direction;
+
+        return __raw_readl(reg) & mask;
+}
+
 static int gpio_irq_type(struct irq_data *d, unsigned type)
 {
         struct gpio_bank *bank = irq_data_get_irq_chip_data(d);
         unsigned gpio = 0;
         int retval;
         unsigned long flags;
+        unsigned offset;
 
-        if (WARN_ON(!bank->mod_usage))
-                return -EINVAL;
+        if (!BANK_USED(bank))
+                pm_runtime_get_sync(bank->dev);
 
 #ifdef CONFIG_ARCH_OMAP1
         if (d->irq > IH_MPUIO_BASE)
@@ -446,7 +504,17 @@ static int gpio_irq_type(struct irq_data *d, unsigned type)
                 return -EINVAL;
 
         spin_lock_irqsave(&bank->lock, flags);
-        retval = _set_gpio_triggering(bank, GPIO_INDEX(bank, gpio), type);
+        offset = GPIO_INDEX(bank, gpio);
+        retval = _set_gpio_triggering(bank, offset, type);
+        if (!LINE_USED(bank->mod_usage, offset)) {
+                _enable_gpio_module(bank, offset);
+                _set_gpio_direction(bank, offset, 1);
+        } else if (!gpio_is_input(bank, 1 << offset)) {
+                spin_unlock_irqrestore(&bank->lock, flags);
+                return -EINVAL;
+        }
+
+        bank->irq_usage |= 1 << GPIO_INDEX(bank, gpio);
         spin_unlock_irqrestore(&bank->lock, flags);
 
         if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
@@ -603,35 +671,19 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset)
          * If this is the first gpio_request for the bank,
          * enable the bank module.
          */
-        if (!bank->mod_usage)
+        if (!BANK_USED(bank))
                 pm_runtime_get_sync(bank->dev);
 
         spin_lock_irqsave(&bank->lock, flags);
         /* Set trigger to none. You need to enable the desired trigger with
-         * request_irq() or set_irq_type().
+         * request_irq() or set_irq_type(). Only do this if the IRQ line has
+         * not already been requested.
          */
-        _set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
-
-        if (bank->regs->pinctrl) {
-                void __iomem *reg = bank->base + bank->regs->pinctrl;
-
-                /* Claim the pin for MPU */
-                __raw_writel(__raw_readl(reg) | (1 << offset), reg);
-        }
-
-        if (bank->regs->ctrl && !bank->mod_usage) {
-                void __iomem *reg = bank->base + bank->regs->ctrl;
-                u32 ctrl;
-
-                ctrl = __raw_readl(reg);
-                /* Module is enabled, clocks are not gated */
-                ctrl &= ~GPIO_MOD_CTRL_BIT;
-                __raw_writel(ctrl, reg);
-                bank->context.ctrl = ctrl;
+        if (!LINE_USED(bank->irq_usage, offset)) {
+                _set_gpio_triggering(bank, offset, IRQ_TYPE_NONE);
+                _enable_gpio_module(bank, offset);
         }
-
         bank->mod_usage |= 1 << offset;
-
         spin_unlock_irqrestore(&bank->lock, flags);
 
         return 0;
@@ -640,31 +692,11 @@ static int omap_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
         struct gpio_bank *bank = container_of(chip, struct gpio_bank, chip);
-        void __iomem *base = bank->base;
         unsigned long flags;
 
         spin_lock_irqsave(&bank->lock, flags);
-
-        if (bank->regs->wkup_en) {
-                /* Disable wake-up during idle for dynamic tick */
-                _gpio_rmw(base, bank->regs->wkup_en, 1 << offset, 0);
-                bank->context.wake_en =
-                        __raw_readl(bank->base + bank->regs->wkup_en);
-        }
-
         bank->mod_usage &= ~(1 << offset);
-
-        if (bank->regs->ctrl && !bank->mod_usage) {
-                void __iomem *reg = bank->base + bank->regs->ctrl;
-                u32 ctrl;
-
-                ctrl = __raw_readl(reg);
-                /* Module is disabled, clocks are gated */
-                ctrl |= GPIO_MOD_CTRL_BIT;
-                __raw_writel(ctrl, reg);
-                bank->context.ctrl = ctrl;
-        }
-
+        _disable_gpio_module(bank, offset);
         _reset_gpio(bank, bank->chip.base + offset);
         spin_unlock_irqrestore(&bank->lock, flags);
 
@@ -672,7 +704,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
          * If this is the last gpio to be freed in the bank,
          * disable the bank module.
          */
-        if (!bank->mod_usage)
+        if (!BANK_USED(bank))
                 pm_runtime_put(bank->dev);
 }
 
@@ -762,10 +794,20 @@ static void gpio_irq_shutdown(struct irq_data *d)
         struct gpio_bank *bank = irq_data_get_irq_chip_data(d);
         unsigned int gpio = irq_to_gpio(bank, d->hwirq);
         unsigned long flags;
+        unsigned offset = GPIO_INDEX(bank, gpio);
 
         spin_lock_irqsave(&bank->lock, flags);
+        bank->irq_usage &= ~(1 << offset);
+        _disable_gpio_module(bank, offset);
         _reset_gpio(bank, gpio);
         spin_unlock_irqrestore(&bank->lock, flags);
+
+        /*
+         * If this is the last IRQ to be freed in the bank,
+         * disable the bank module.
+         */
+        if (!BANK_USED(bank))
+                pm_runtime_put(bank->dev);
 }
 
 static void gpio_ack_irq(struct irq_data *d)
@@ -897,13 +939,6 @@ static int gpio_input(struct gpio_chip *chip, unsigned offset)
         return 0;
 }
 
-static int gpio_is_input(struct gpio_bank *bank, int mask)
-{
-        void __iomem *reg = bank->base + bank->regs->direction;
-
-        return __raw_readl(reg) & mask;
-}
-
 static int gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         struct gpio_bank *bank;
@@ -922,13 +957,22 @@ static int gpio_output(struct gpio_chip *chip, unsigned offset, int value)
 {
         struct gpio_bank *bank;
         unsigned long flags;
+        int retval = 0;
 
         bank = container_of(chip, struct gpio_bank, chip);
         spin_lock_irqsave(&bank->lock, flags);
+
+        if (LINE_USED(bank->irq_usage, offset)) {
+                        retval = -EINVAL;
+                        goto exit;
+        }
+
         bank->set_dataout(bank, offset, value);
         _set_gpio_direction(bank, offset, 0);
+
+exit:
         spin_unlock_irqrestore(&bank->lock, flags);
-        return 0;
+        return retval;
 }
 
 static int gpio_debounce(struct gpio_chip *chip, unsigned offset,
@@ -1400,7 +1444,7 @@ void omap2_gpio_prepare_for_idle(int pwr_mode)
         struct gpio_bank *bank;
 
         list_for_each_entry(bank, &omap_gpio_list, node) {
-                if (!bank->mod_usage || !bank->loses_context)
+                if (!BANK_USED(bank) || !bank->loses_context)
                         continue;
 
                 bank->power_mode = pwr_mode;
@@ -1414,7 +1458,7 @@ void omap2_gpio_resume_after_idle(void)
         struct gpio_bank *bank;
 
         list_for_each_entry(bank, &omap_gpio_list, node) {
-                if (!bank->mod_usage || !bank->loses_context)
+                if (!BANK_USED(bank) || !bank->loses_context)
                         continue;
 
                 pm_runtime_get_sync(bank->dev);
diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index e3745eb07570..6038966ab045 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -293,10 +293,9 @@ static void gpio_rcar_parse_pdata(struct gpio_rcar_priv *p)
         if (pdata) {
                 p->config = *pdata;
         } else if (IS_ENABLED(CONFIG_OF) && np) {
-                ret = of_parse_phandle_with_args(np, "gpio-ranges",
-                                "#gpio-range-cells", 0, &args);
-                p->config.number_of_pins = ret == 0 && args.args_count == 3
-                                         ? args.args[2]
+                ret = of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, 0,
+                                                       &args);
+                p->config.number_of_pins = ret == 0 ? args.args[2]
                                          : RCAR_MAX_GPIO_PER_BANK;
                 p->config.gpio_base = -1;
         }
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 5c1ef2b3ef18..f2beb728ed8f 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -73,15 +73,8 @@ static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
 static irqreturn_t acpi_gpio_irq_handler_evt(int irq, void *data)
 {
         struct acpi_gpio_evt_pin *evt_pin = data;
-        struct acpi_object_list args;
-        union acpi_object arg;
 
-        arg.type = ACPI_TYPE_INTEGER;
-        arg.integer.value = evt_pin->pin;
-        args.count = 1;
-        args.pointer = &arg;
-
-        acpi_evaluate_object(evt_pin->evt_handle, NULL, &args, NULL);
+        acpi_execute_simple_method(evt_pin->evt_handle, NULL, evt_pin->pin);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 86ef3461ec06..0dee0e0c247a 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -136,7 +136,7 @@ static struct gpio_desc *gpio_to_desc(unsigned gpio)
  */
 static int desc_to_gpio(const struct gpio_desc *desc)
 {
-        return desc->chip->base + gpio_chip_hwgpio(desc);
+        return desc - &gpio_desc[0];
 }
 
 
@@ -1398,7 +1398,7 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
         int                     status = -EPROBE_DEFER;
         unsigned long           flags;
 
-        if (!desc || !desc->chip) {
+        if (!desc) {
                 pr_warn("%s: invalid GPIO\n", __func__);
                 return -EINVAL;
         }
@@ -1406,6 +1406,8 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
         spin_lock_irqsave(&gpio_lock, flags);
 
         chip = desc->chip;
+        if (chip == NULL)
+                goto done;
 
         if (!try_module_get(chip->owner))
                 goto done;
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e572dd20bdee..05ad9ba0a67e 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp,
                 cmd = ioctl->cmd_drv;
         }
         else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
+                u32 drv_size;
+
                 ioctl = &drm_ioctls[nr];
-                cmd = ioctl->cmd;
+
+                drv_size = _IOC_SIZE(ioctl->cmd);
                 usize = asize = _IOC_SIZE(cmd);
+                if (drv_size > asize)
+                        asize = drv_size;
+
+                cmd = ioctl->cmd;
         } else
                 goto err_i1;
 
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 1688ff500513..830f7501cb4d 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -2925,6 +2925,8 @@ int drm_edid_to_speaker_allocation(struct edid *edid, u8 **sadb)
                         /* Speaker Allocation Data Block */
                         if (dbl == 3) {
                                 *sadb = kmalloc(dbl, GFP_KERNEL);
+                                if (!*sadb)
+                                        return -ENOMEM;
                                 memcpy(*sadb, &db[1], dbl);
                                 count = dbl;
                                 break;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f6f6cc7fc133..3d13ca6e257f 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -416,14 +416,6 @@ static void drm_fb_helper_dpms(struct fb_info *info, int dpms_mode)
                 return;
 
         /*
-         * fbdev->blank can be called from irq context in case of a panic.
-         * Since we already have our own special panic handler which will
-         * restore the fbdev console mode completely, just bail out early.
-         */
-        if (oops_in_progress)
-                return;
-
-        /*
          * For each CRTC in this fb, turn the connectors on/off.
          */
         drm_modeset_lock_all(dev);
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 92babac362ec..2db731f00930 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -204,6 +204,7 @@ static int psb_gtt_attach_pages(struct gtt_range *gt)
         if (IS_ERR(pages))
                 return PTR_ERR(pages);
 
+        gt->npage = gt->gem.size / PAGE_SIZE;
         gt->pages = pages;
 
         return 0;
diff --git a/drivers/gpu/drm/i2c/tda998x_drv.c b/drivers/gpu/drm/i2c/tda998x_drv.c
index b1f8fc69023f..60e84043aa34 100644
--- a/drivers/gpu/drm/i2c/tda998x_drv.c
+++ b/drivers/gpu/drm/i2c/tda998x_drv.c
@@ -707,8 +707,7 @@ tda998x_encoder_dpms(struct drm_encoder *encoder, int mode)
                 reg_write(encoder, REG_VIP_CNTRL_2, priv->vip_cntrl_2);
                 break;
         case DRM_MODE_DPMS_OFF:
-                /* disable audio and video ports */
-                reg_write(encoder, REG_ENA_AP, 0x00);
+                /* disable video ports */
                 reg_write(encoder, REG_ENA_VP_0, 0x00);
                 reg_write(encoder, REG_ENA_VP_1, 0x00);
                 reg_write(encoder, REG_ENA_VP_2, 0x00);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index c27a21034a5e..d5c784d48671 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1290,12 +1290,9 @@ static int i915_load_modeset_init(struct drm_device *dev)
          * then we do not take part in VGA arbitration and the
          * vga_client_register() fails with -ENODEV.
          */
-        if (!HAS_PCH_SPLIT(dev)) {
-                ret = vga_client_register(dev->pdev, dev, NULL,
-                                          i915_vga_set_decode);
-                if (ret && ret != -ENODEV)
-                        goto out;
-        }
+        ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
+        if (ret && ret != -ENODEV)
+                goto out;
 
         intel_register_dsm_handler();
 
@@ -1351,12 +1348,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
          */
         intel_fbdev_initial_config(dev);
 
-        /*
-         * Must do this after fbcon init so that
-         * vgacon_save_screen() works during the handover.
-         */
-        i915_disable_vga_mem(dev);
-
         /* Only enable hotplug handling once the fbdev is fully set up. */
         dev_priv->enable_hotplug_processing = true;
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 69d8ed5416c3..2ad27880cd04 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -505,6 +505,8 @@ static int i915_drm_freeze(struct drm_device *dev)
                 intel_modeset_suspend_hw(dev);
         }
 
+        i915_gem_suspend_gtt_mappings(dev);
+
         i915_save_state(dev);
 
         intel_opregion_fini(dev);
@@ -648,7 +650,8 @@ static int i915_drm_thaw(struct drm_device *dev)
                 mutex_lock(&dev->struct_mutex);
                 i915_gem_restore_gtt_mappings(dev);
                 mutex_unlock(&dev->struct_mutex);
-        }
+        } else if (drm_core_check_feature(dev, DRIVER_MODESET))
+                i915_check_and_clear_faults(dev);
 
         __i915_drm_thaw(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 35874b3a86dc..ab0f2c0a440c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -497,10 +497,12 @@ struct i915_address_space {
 
         /* FIXME: Need a more generic return type */
         gen6_gtt_pte_t (*pte_encode)(dma_addr_t addr,
-                                     enum i915_cache_level level);
+                                     enum i915_cache_level level,
+                                     bool valid); /* Create a valid PTE */
         void (*clear_range)(struct i915_address_space *vm,
                             unsigned int first_entry,
-                            unsigned int num_entries);
+                            unsigned int num_entries,
+                            bool use_scratch);
         void (*insert_entries)(struct i915_address_space *vm,
                                struct sg_table *st,
                                unsigned int first_entry,
@@ -2065,6 +2067,8 @@ void i915_ppgtt_bind_object(struct i915_hw_ppgtt *ppgtt,
 void i915_ppgtt_unbind_object(struct i915_hw_ppgtt *ppgtt,
                               struct drm_i915_gem_object *obj);
 
+void i915_check_and_clear_faults(struct drm_device *dev);
+void i915_gem_suspend_gtt_mappings(struct drm_device *dev);
 void i915_gem_restore_gtt_mappings(struct drm_device *dev);
 int __must_check i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj);
 void i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj,
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index df9253d890ee..cdfb9da0e4ce 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4800,10 +4800,10 @@ i915_gem_inactive_count(struct shrinker *shrinker, struct shrink_control *sc)
 
         if (!mutex_trylock(&dev->struct_mutex)) {
                 if (!mutex_is_locked_by(&dev->struct_mutex, current))
-                        return SHRINK_STOP;
+                        return 0;
 
                 if (dev_priv->mm.shrinker_no_lock_stealing)
-                        return SHRINK_STOP;
+                        return 0;
 
                 unlock = false;
         }
@@ -4901,10 +4901,10 @@ i915_gem_inactive_scan(struct shrinker *shrinker, struct shrink_control *sc)
 
         if (!mutex_trylock(&dev->struct_mutex)) {
                 if (!mutex_is_locked_by(&dev->struct_mutex, current))
-                        return 0;
+                        return SHRINK_STOP;
 
                 if (dev_priv->mm.shrinker_no_lock_stealing)
-                        return 0;
+                        return SHRINK_STOP;
 
                 unlock = false;
         }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 212f6d8c35ec..1f7b4caefb6e 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -58,9 +58,10 @@
 #define HSW_WT_ELLC_LLC_AGE0            HSW_CACHEABILITY_CONTROL(0x6)
 
 static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
         pte |= GEN6_PTE_ADDR_ENCODE(addr);
 
         switch (level) {
@@ -79,9 +80,10 @@ static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
 }
 
 static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
         pte |= GEN6_PTE_ADDR_ENCODE(addr);
 
         switch (level) {
@@ -105,9 +107,10 @@ static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
 #define BYT_PTE_SNOOPED_BY_CPU_CACHES   (1 << 2)
 
 static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
         pte |= GEN6_PTE_ADDR_ENCODE(addr);
 
         /* Mark the page as writeable.  Other platforms don't have a
@@ -122,9 +125,10 @@ static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
 }
 
 static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level)
+                                     enum i915_cache_level level,
+                                     bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
         pte |= HSW_PTE_ADDR_ENCODE(addr);
 
         if (level != I915_CACHE_NONE)
@@ -134,9 +138,10 @@ static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
 }
 
 static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
-                                      enum i915_cache_level level)
+                                      enum i915_cache_level level,
+                                      bool valid)
 {
-        gen6_gtt_pte_t pte = GEN6_PTE_VALID;
+        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
         pte |= HSW_PTE_ADDR_ENCODE(addr);
 
         switch (level) {
@@ -236,7 +241,8 @@ static int gen6_ppgtt_enable(struct drm_device *dev)
 /* PPGTT support for Sandybdrige/Gen6 and later */
 static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
                                    unsigned first_entry,
-                                   unsigned num_entries)
+                                   unsigned num_entries,
+                                   bool use_scratch)
 {
         struct i915_hw_ppgtt *ppgtt =
                 container_of(vm, struct i915_hw_ppgtt, base);
@@ -245,7 +251,7 @@ static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
         unsigned first_pte = first_entry % I915_PPGTT_PT_ENTRIES;
         unsigned last_pte, i;
 
-        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC);
+        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, true);
 
         while (num_entries) {
                 last_pte = first_pte + num_entries;
@@ -282,7 +288,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
                 dma_addr_t page_addr;
 
                 page_addr = sg_page_iter_dma_address(&sg_iter);
-                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level);
+                pt_vaddr[act_pte] = vm->pte_encode(page_addr, cache_level, true);
                 if (++act_pte == I915_PPGTT_PT_ENTRIES) {
                         kunmap_atomic(pt_vaddr);
                         act_pt++;
@@ -367,7 +373,7 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
         }
 
         ppgtt->base.clear_range(&ppgtt->base, 0,
-                                ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES);
+                                ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES, true);
 
         ppgtt->pd_offset = first_pd_entry_in_global_pt * sizeof(gen6_gtt_pte_t);
 
@@ -444,7 +450,8 @@ void i915_ppgtt_unbind_object(struct i915_hw_ppgtt *ppgtt,
 {
         ppgtt->base.clear_range(&ppgtt->base,
                                 i915_gem_obj_ggtt_offset(obj) >> PAGE_SHIFT,
-                                obj->base.size >> PAGE_SHIFT);
+                                obj->base.size >> PAGE_SHIFT,
+                                true);
 }
 
 extern int intel_iommu_gfx_mapped;
@@ -485,15 +492,65 @@ static void undo_idling(struct drm_i915_private *dev_priv, bool interruptible)
                 dev_priv->mm.interruptible = interruptible;
 }
 
+void i915_check_and_clear_faults(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct intel_ring_buffer *ring;
+        int i;
+
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+
+        for_each_ring(ring, dev_priv, i) {
+                u32 fault_reg;
+                fault_reg = I915_READ(RING_FAULT_REG(ring));
+                if (fault_reg & RING_FAULT_VALID) {
+                        DRM_DEBUG_DRIVER("Unexpected fault\n"
+                                         "\tAddr: 0x%08lx\\n"
+                                         "\tAddress space: %s\n"
+                                         "\tSource ID: %d\n"
+                                         "\tType: %d\n",
+                                         fault_reg & PAGE_MASK,
+                                         fault_reg & RING_FAULT_GTTSEL_MASK ? "GGTT" : "PPGTT",
+                                         RING_FAULT_SRCID(fault_reg),
+                                         RING_FAULT_FAULT_TYPE(fault_reg));
+                        I915_WRITE(RING_FAULT_REG(ring),
+                                   fault_reg & ~RING_FAULT_VALID);
+                }
+        }
+        POSTING_READ(RING_FAULT_REG(&dev_priv->ring[RCS]));
+}
+
+void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        /* Don't bother messing with faults pre GEN6 as we have little
+         * documentation supporting that it's a good idea.
+         */
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+
+        i915_check_and_clear_faults(dev);
+
+        dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
+                                       dev_priv->gtt.base.start / PAGE_SIZE,
+                                       dev_priv->gtt.base.total / PAGE_SIZE,
+                                       false);
+}
+
 void i915_gem_restore_gtt_mappings(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj;
 
+        i915_check_and_clear_faults(dev);
+
         /* First fill our portion of the GTT with scratch pages */
         dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                        dev_priv->gtt.base.start / PAGE_SIZE,
-                                       dev_priv->gtt.base.total / PAGE_SIZE);
+                                       dev_priv->gtt.base.total / PAGE_SIZE,
+                                       true);
 
         list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
                 i915_gem_clflush_object(obj, obj->pin_display);
@@ -536,7 +593,7 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
 
         for_each_sg_page(st->sgl, &sg_iter, st->nents, 0) {
                 addr = sg_page_iter_dma_address(&sg_iter);
-                iowrite32(vm->pte_encode(addr, level), &gtt_entries[i]);
+                iowrite32(vm->pte_encode(addr, level, true), &gtt_entries[i]);
                 i++;
         }
 
@@ -548,7 +605,7 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
          */
         if (i != 0)
                 WARN_ON(readl(&gtt_entries[i-1]) !=
-                        vm->pte_encode(addr, level));
+                        vm->pte_encode(addr, level, true));
 
         /* This next bit makes the above posting read even more important. We
          * want to flush the TLBs only after we're certain all the PTE updates
@@ -560,7 +617,8 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
 
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                   unsigned int first_entry,
-                                  unsigned int num_entries)
+                                  unsigned int num_entries,
+                                  bool use_scratch)
 {
         struct drm_i915_private *dev_priv = vm->dev->dev_private;
         gen6_gtt_pte_t scratch_pte, __iomem *gtt_base =
@@ -573,7 +631,8 @@ static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                  first_entry, num_entries, max_entries))
                 num_entries = max_entries;
 
-        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC);
+        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, use_scratch);
+
         for (i = 0; i < num_entries; i++)
                 iowrite32(scratch_pte, &gtt_base[i]);
         readl(gtt_base);
@@ -594,7 +653,8 @@ static void i915_ggtt_insert_entries(struct i915_address_space *vm,
 
 static void i915_ggtt_clear_range(struct i915_address_space *vm,
                                   unsigned int first_entry,
-                                  unsigned int num_entries)
+                                  unsigned int num_entries,
+                                  bool unused)
 {
         intel_gtt_clear_range(first_entry, num_entries);
 }
@@ -622,7 +682,8 @@ void i915_gem_gtt_unbind_object(struct drm_i915_gem_object *obj)
 
         dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
                                        entry,
-                                       obj->base.size >> PAGE_SHIFT);
+                                       obj->base.size >> PAGE_SHIFT,
+                                       true);
 
         obj->has_global_gtt_mapping = 0;
 }
@@ -709,11 +770,11 @@ void i915_gem_setup_global_gtt(struct drm_device *dev,
                 const unsigned long count = (hole_end - hole_start) / PAGE_SIZE;
                 DRM_DEBUG_KMS("clearing unused GTT space: [%lx, %lx]\n",
                               hole_start, hole_end);
-                ggtt_vm->clear_range(ggtt_vm, hole_start / PAGE_SIZE, count);
+                ggtt_vm->clear_range(ggtt_vm, hole_start / PAGE_SIZE, count, true);
         }
 
         /* And finally clear the reserved guard page */
-        ggtt_vm->clear_range(ggtt_vm, end / PAGE_SIZE - 1, 1);
+        ggtt_vm->clear_range(ggtt_vm, end / PAGE_SIZE - 1, 1, true);
 }
 
 static bool
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index aba9d7498996..dae364f0028c 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -143,8 +143,10 @@ static void i915_error_vprintf(struct drm_i915_error_state_buf *e,
 
         /* Seek the first printf which is hits start position */
         if (e->pos < e->start) {
-                len = vsnprintf(NULL, 0, f, args);
-                if (!__i915_error_seek(e, len))
+                va_list tmp;
+
+                va_copy(tmp, args);
+                if (!__i915_error_seek(e, vsnprintf(NULL, 0, f, tmp)))
                         return;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index c159e1a6810f..ef9b35479f01 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -604,6 +604,10 @@
 #define   ARB_MODE_SWIZZLE_IVB  (1<<5)
 #define RENDER_HWS_PGA_GEN7     (0x04080)
 #define RING_FAULT_REG(ring)    (0x4094 + 0x100*(ring)->id)
+#define   RING_FAULT_GTTSEL_MASK (1<<11)
+#define   RING_FAULT_SRCID(x)   ((x >> 3) & 0xff)
+#define   RING_FAULT_FAULT_TYPE(x) ((x >> 1) & 0x3)
+#define   RING_FAULT_VALID      (1<<0)
 #define DONE_REG                0x40b0
 #define BSD_HWS_PGA_GEN7        (0x04180)
 #define BLT_HWS_PGA_GEN7        (0x04280)
@@ -3881,6 +3885,9 @@
 #define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG          0x9030
 #define  GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB       (1<<11)
 
+#define HSW_SCRATCH1                            0xb038
+#define  HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE   (1<<27)
+
 #define HSW_FUSE_STRAP          0x42014
 #define  HSW_CDCLK_LIMIT        (1 << 24)
 
@@ -4276,7 +4283,9 @@
 #define FDI_RX_CHICKEN(pipe) _PIPE(pipe, _FDI_RXA_CHICKEN, _FDI_RXB_CHICKEN)
 
 #define SOUTH_DSPCLK_GATE_D     0xc2020
+#define  PCH_DPLUNIT_CLOCK_GATE_DISABLE (1<<30)
 #define  PCH_DPLSUNIT_CLOCK_GATE_DISABLE (1<<29)
+#define  PCH_CPUNIT_CLOCK_GATE_DISABLE (1<<14)
 #define  PCH_LP_PARTITION_LEVEL_DISABLE  (1<<12)
 
 /* CPU: FDI_TX */
@@ -4728,6 +4737,9 @@
 #define GEN7_ROW_CHICKEN2_GT2           0xf4f4
 #define   DOP_CLOCK_GATING_DISABLE      (1<<0)
 
+#define HSW_ROW_CHICKEN3                0xe49c
+#define  HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE    (1 << 6)
+
 #define G4X_AUD_VID_DID                 (dev_priv->info->display_mmio_offset + 0x62020)
 #define INTEL_AUDIO_DEVCL               0x808629FB
 #define INTEL_AUDIO_DEVBLC              0x80862801
diff --git a/drivers/gpu/drm/i915/intel_acpi.c b/drivers/gpu/drm/i915/intel_acpi.c
index 57fe1ae32a0d..43959edd4291 100644
--- a/drivers/gpu/drm/i915/intel_acpi.c
+++ b/drivers/gpu/drm/i915/intel_acpi.c
@@ -193,16 +193,14 @@ out:
 
 static bool intel_dsm_pci_probe(struct pci_dev *pdev)
 {
-        acpi_handle dhandle, intel_handle;
-        acpi_status status;
+        acpi_handle dhandle;
         int ret;
 
         dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
         if (!dhandle)
                 return false;
 
-        status = acpi_get_handle(dhandle, "_DSM", &intel_handle);
-        if (ACPI_FAILURE(status)) {
+        if (!acpi_has_method(dhandle, "_DSM")) {
                 DRM_DEBUG_KMS("no _DSM method for intel device\n");
                 return false;
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d8a1d98693e7..581fb4b2f766 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3941,8 +3941,6 @@ static void intel_connector_check_state(struct intel_connector *connector)
  * consider. */
 void intel_connector_dpms(struct drm_connector *connector, int mode)
 {
-        struct intel_encoder *encoder = intel_attached_encoder(connector);
-
         /* All the simple cases only support two dpms states. */
         if (mode != DRM_MODE_DPMS_ON)
                 mode = DRM_MODE_DPMS_OFF;
@@ -3953,10 +3951,8 @@ void intel_connector_dpms(struct drm_connector *connector, int mode)
         connector->dpms = mode;
 
         /* Only need to change hw state when actually enabled */
-        if (encoder->base.crtc)
-                intel_encoder_dpms(encoder, mode);
-        else
-                WARN_ON(encoder->connectors_active != false);
+        if (connector->encoder)
+                intel_encoder_dpms(to_intel_encoder(connector->encoder), mode);
 
         intel_modeset_check_state(connector->dev);
 }
@@ -4775,6 +4771,10 @@ static void i9xx_set_pipeconf(struct intel_crtc *intel_crtc)
 
         pipeconf = 0;
 
+        if (dev_priv->quirks & QUIRK_PIPEA_FORCE &&
+            I915_READ(PIPECONF(intel_crtc->pipe)) & PIPECONF_ENABLE)
+                pipeconf |= PIPECONF_ENABLE;
+
         if (intel_crtc->pipe == 0 && INTEL_INFO(dev)->gen < 4) {
                 /* Enable pixel doubling when the dot clock is > 90% of the (display)
                  * core speed.
@@ -10045,33 +10045,6 @@ static void i915_disable_vga(struct drm_device *dev)
         POSTING_READ(vga_reg);
 }
 
-static void i915_enable_vga_mem(struct drm_device *dev)
-{
-        /* Enable VGA memory on Intel HD */
-        if (HAS_PCH_SPLIT(dev)) {
-                vga_get_uninterruptible(dev->pdev, VGA_RSRC_LEGACY_IO);
-                outb(inb(VGA_MSR_READ) | VGA_MSR_MEM_EN, VGA_MSR_WRITE);
-                vga_set_legacy_decoding(dev->pdev, VGA_RSRC_LEGACY_IO |
-                                                   VGA_RSRC_LEGACY_MEM |
-                                                   VGA_RSRC_NORMAL_IO |
-                                                   VGA_RSRC_NORMAL_MEM);
-                vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
-        }
-}
-
-void i915_disable_vga_mem(struct drm_device *dev)
-{
-        /* Disable VGA memory on Intel HD */
-        if (HAS_PCH_SPLIT(dev)) {
-                vga_get_uninterruptible(dev->pdev, VGA_RSRC_LEGACY_IO);
-                outb(inb(VGA_MSR_READ) & ~VGA_MSR_MEM_EN, VGA_MSR_WRITE);
-                vga_set_legacy_decoding(dev->pdev, VGA_RSRC_LEGACY_IO |
-                                                   VGA_RSRC_NORMAL_IO |
-                                                   VGA_RSRC_NORMAL_MEM);
-                vga_put(dev->pdev, VGA_RSRC_LEGACY_IO);
-        }
-}
-
 void intel_modeset_init_hw(struct drm_device *dev)
 {
         intel_init_power_well(dev);
@@ -10350,7 +10323,6 @@ void i915_redisable_vga(struct drm_device *dev)
         if (I915_READ(vga_reg) != VGA_DISP_DISABLE) {
                 DRM_DEBUG_KMS("Something enabled VGA plane, disabling it\n");
                 i915_disable_vga(dev);
-                i915_disable_vga_mem(dev);
         }
 }
 
@@ -10564,8 +10536,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
 
         intel_disable_fbc(dev);
 
-        i915_enable_vga_mem(dev);
-
         intel_disable_gt_powersave(dev);
 
         ironlake_teardown_rc6(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 2151d13772b8..2c555f91bfae 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -588,7 +588,18 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                         DRM_DEBUG_KMS("aux_ch native nack\n");
                         return -EREMOTEIO;
                 case AUX_NATIVE_REPLY_DEFER:
-                        udelay(100);
+                        /*
+                         * For now, just give more slack to branch devices. We
+                         * could check the DPCD for I2C bit rate capabilities,
+                         * and if available, adjust the interval. We could also
+                         * be more careful with DP-to-Legacy adapters where a
+                         * long legacy cable may force very low I2C bit rates.
+                         */
+                        if (intel_dp->dpcd[DP_DOWNSTREAMPORT_PRESENT] &
+                            DP_DWN_STRM_PORT_PRESENT)
+                                usleep_range(500, 600);
+                        else
+                                usleep_range(300, 400);
                         continue;
                 default:
                         DRM_ERROR("aux_ch invalid native reply 0x%02x\n",
@@ -1456,7 +1467,7 @@ static void intel_edp_psr_setup(struct intel_dp *intel_dp)
 
         /* Avoid continuous PSR exit by masking memup and hpd */
         I915_WRITE(EDP_PSR_DEBUG_CTL, EDP_PSR_DEBUG_MASK_MEMUP |
-                   EDP_PSR_DEBUG_MASK_HPD);
+                   EDP_PSR_DEBUG_MASK_HPD | EDP_PSR_DEBUG_MASK_LPSP);
 
         intel_dp->psr_setup_done = true;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 28cae80495e2..9b7b68fd5d47 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -793,6 +793,5 @@ extern void hsw_pc8_disable_interrupts(struct drm_device *dev);
 extern void hsw_pc8_restore_interrupts(struct drm_device *dev);
 extern void intel_aux_display_runtime_get(struct drm_i915_private *dev_priv);
 extern void intel_aux_display_runtime_put(struct drm_i915_private *dev_priv);
-extern void i915_disable_vga_mem(struct drm_device *dev);
 
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index dd176b7296c1..26c2ea3e985c 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3864,8 +3864,6 @@ static void valleyview_enable_rps(struct drm_device *dev)
                                       dev_priv->rps.rpe_delay),
                          dev_priv->rps.rpe_delay);
 
-        INIT_DELAYED_WORK(&dev_priv->rps.vlv_work, vlv_rps_timer_work);
-
         valleyview_set_rps(dev_priv->dev, dev_priv->rps.rpe_delay);
 
         gen6_enable_rps_interrupts(dev);
@@ -4761,7 +4759,9 @@ static void cpt_init_clock_gating(struct drm_device *dev)
          * gating for the panel power sequencer or it will fail to
          * start up when no ports are active.
          */
-        I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE);
+        I915_WRITE(SOUTH_DSPCLK_GATE_D, PCH_DPLSUNIT_CLOCK_GATE_DISABLE |
+                   PCH_DPLUNIT_CLOCK_GATE_DISABLE |
+                   PCH_CPUNIT_CLOCK_GATE_DISABLE);
         I915_WRITE(SOUTH_CHICKEN2, I915_READ(SOUTH_CHICKEN2) |
                    DPLS_EDP_PPS_FIX_DIS);
         /* The below fixes the weird display corruption, a few pixels shifted
@@ -4955,6 +4955,11 @@ static void haswell_init_clock_gating(struct drm_device *dev)
         I915_WRITE(GEN7_L3_CHICKEN_MODE_REGISTER,
                         GEN7_WA_L3_CHICKEN_MODE);
 
+        /* L3 caching of data atomics doesn't work -- disable it. */
+        I915_WRITE(HSW_SCRATCH1, HSW_SCRATCH1_L3_DATA_ATOMICS_DISABLE);
+        I915_WRITE(HSW_ROW_CHICKEN3,
+                   _MASKED_BIT_ENABLE(HSW_ROW_CHICKEN3_L3_GLOBAL_ATOMICS_DISABLE));
+
         /* This is required by WaCatErrorRejectionIssue:hsw */
         I915_WRITE(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG,
                         I915_READ(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG) |
@@ -5681,5 +5686,7 @@ void intel_pm_init(struct drm_device *dev)
 
         INIT_DELAYED_WORK(&dev_priv->rps.delayed_resume_work,
                           intel_gen6_powersave_work);
+
+        INIT_DELAYED_WORK(&dev_priv->rps.vlv_work, vlv_rps_timer_work);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index f2c6d7909ae2..dd6f84bf6c22 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -916,6 +916,14 @@ intel_tv_compute_config(struct intel_encoder *encoder,
         DRM_DEBUG_KMS("forcing bpc to 8 for TV\n");
         pipe_config->pipe_bpp = 8*3;
 
+        /* TV has it's own notion of sync and other mode flags, so clear them. */
+        pipe_config->adjusted_mode.flags = 0;
+
+        /*
+         * FIXME: We don't check whether the input mode is actually what we want
+         * or whether userspace is doing something stupid.
+         */
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/msm/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
index 5db5bbaedae2..bc7fd11ad8be 100644
--- a/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/mdp4/mdp4_kms.c
@@ -19,8 +19,6 @@
 #include "msm_drv.h"
 #include "mdp4_kms.h"
 
-#include <mach/iommu.h>
-
 static struct mdp4_platform_config *mdp4_get_config(struct platform_device *dev);
 
 static int mdp4_hw_init(struct msm_kms *kms)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 008d772384c7..b3a2f1629041 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -18,8 +18,6 @@
 #include "msm_drv.h"
 #include "msm_gpu.h"
 
-#include <mach/iommu.h>
-
 static void msm_fb_output_poll_changed(struct drm_device *dev)
 {
         struct msm_drm_private *priv = dev->dev_private;
@@ -62,6 +60,8 @@ int msm_iommu_attach(struct drm_device *dev, struct iommu_domain *iommu,
         int i, ret;
 
         for (i = 0; i < cnt; i++) {
+                /* TODO maybe some day msm iommu won't require this hack: */
+                struct device *msm_iommu_get_ctx(const char *ctx_name);
                 struct device *ctx = msm_iommu_get_ctx(names[i]);
                 if (!ctx)
                         continue;
@@ -199,7 +199,7 @@ static int msm_load(struct drm_device *dev, unsigned long flags)
                  * imx drm driver on iMX5
                  */
                 dev_err(dev->dev, "failed to load kms\n");
-                ret = PTR_ERR(priv->kms);
+                ret = PTR_ERR(kms);
                 goto fail;
         }
 
@@ -697,7 +697,7 @@ static struct drm_driver msm_driver = {
         .gem_vm_ops         = &vm_ops,
         .dumb_create        = msm_gem_dumb_create,
         .dumb_map_offset    = msm_gem_dumb_map_offset,
-        .dumb_destroy       = msm_gem_dumb_destroy,
+        .dumb_destroy       = drm_gem_dumb_destroy,
 #ifdef CONFIG_DEBUG_FS
         .debugfs_init       = msm_debugfs_init,
         .debugfs_cleanup    = msm_debugfs_cleanup,
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 29eacfa29cfb..2bae46c66a30 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -319,13 +319,6 @@ int msm_gem_dumb_create(struct drm_file *file, struct drm_device *dev,
                         MSM_BO_SCANOUT | MSM_BO_WC, &args->handle);
 }
 
-int msm_gem_dumb_destroy(struct drm_file *file, struct drm_device *dev,
-                uint32_t handle)
-{
-        /* No special work needed, drop the reference and see what falls out */
-        return drm_gem_handle_delete(file, handle);
-}
-
 int msm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,
                 uint32_t handle, uint64_t *offset)
 {
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
index 37712a6df923..e290cfa4acee 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/base.c
@@ -113,7 +113,7 @@ nouveau_mc_create_(struct nouveau_object *parent, struct nouveau_object *engine,
                 pmc->use_msi = false;
                 break;
         default:
-                pmc->use_msi = nouveau_boolopt(device->cfgopt, "NvMSI", true);
+                pmc->use_msi = nouveau_boolopt(device->cfgopt, "NvMSI", false);
                 if (pmc->use_msi) {
                         pmc->use_msi = pci_enable_msi(device->pdev) == 0;
                         if (pmc->use_msi) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index dd7d2e182719..cfbeee607b3a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -253,18 +253,15 @@ static struct vga_switcheroo_handler nouveau_dsm_handler = {
 
 static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
 {
-        acpi_handle dhandle, nvidia_handle;
-        acpi_status status;
+        acpi_handle dhandle;
         int retval = 0;
 
         dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
         if (!dhandle)
                 return false;
 
-        status = acpi_get_handle(dhandle, "_DSM", &nvidia_handle);
-        if (ACPI_FAILURE(status)) {
+        if (!acpi_has_method(dhandle, "_DSM"))
                 return false;
-        }
 
         if (nouveau_test_dsm(dhandle, nouveau_dsm, NOUVEAU_DSM_POWER))
                 retval |= NOUVEAU_DSM_HAS_MUX;
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index 32923d2f6002..5e891b226acf 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -707,24 +707,37 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         switch (connector->connector_type) {
         case DRM_MODE_CONNECTOR_DVII:
         case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
-                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
-                        return ATOM_ENCODER_MODE_HDMI;
-                else if (radeon_connector->use_digital)
+                if (radeon_audio != 0) {
+                        if (radeon_connector->use_digital &&
+                            (radeon_connector->audio == RADEON_AUDIO_ENABLE))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else if (radeon_connector->use_digital)
+                                return ATOM_ENCODER_MODE_DVI;
+                        else
+                                return ATOM_ENCODER_MODE_CRT;
+                } else if (radeon_connector->use_digital) {
                         return ATOM_ENCODER_MODE_DVI;
-                else
+                } else {
                         return ATOM_ENCODER_MODE_CRT;
+                }
                 break;
         case DRM_MODE_CONNECTOR_DVID:
         case DRM_MODE_CONNECTOR_HDMIA:
         default:
-                if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
-                    (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                     (radeon_connector->audio == RADEON_AUDIO_AUTO)))
-                        return ATOM_ENCODER_MODE_HDMI;
-                else
+                if (radeon_audio != 0) {
+                        if (radeon_connector->audio == RADEON_AUDIO_ENABLE)
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else
+                                return ATOM_ENCODER_MODE_DVI;
+                } else {
                         return ATOM_ENCODER_MODE_DVI;
+                }
                 break;
         case DRM_MODE_CONNECTOR_LVDS:
                 return ATOM_ENCODER_MODE_LVDS;
@@ -732,14 +745,19 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         case DRM_MODE_CONNECTOR_DisplayPort:
                 dig_connector = radeon_connector->con_priv;
                 if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
-                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
+                    (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP)) {
                         return ATOM_ENCODER_MODE_DP;
-                else if ((radeon_connector->audio == RADEON_AUDIO_ENABLE) ||
-                         (drm_detect_hdmi_monitor(radeon_connector->edid) &&
-                          (radeon_connector->audio == RADEON_AUDIO_AUTO)))
-                        return ATOM_ENCODER_MODE_HDMI;
-                else
+                } else if (radeon_audio != 0) {
+                        if (radeon_connector->audio == RADEON_AUDIO_ENABLE)
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else if (drm_detect_hdmi_monitor(radeon_connector->edid) &&
+                                 (radeon_connector->audio == RADEON_AUDIO_AUTO))
+                                return ATOM_ENCODER_MODE_HDMI;
+                        else
+                                return ATOM_ENCODER_MODE_DVI;
+                } else {
                         return ATOM_ENCODER_MODE_DVI;
+                }
                 break;
         case DRM_MODE_CONNECTOR_eDP:
                 return ATOM_ENCODER_MODE_DP;
@@ -1655,7 +1673,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                          * does the same thing and more.
                          */
                         if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
-                            (rdev->family != CHIP_RS880))
+                            (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880))
                                 atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                 }
                 if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.c b/drivers/gpu/drm/radeon/btc_dpm.c
index 05ff315e8e9e..9b6950d9b3c0 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.c
+++ b/drivers/gpu/drm/radeon/btc_dpm.c
@@ -1168,6 +1168,23 @@ static const struct radeon_blacklist_clocks btc_blacklist_clocks[] =
         { 25000, 30000, RADEON_SCLK_UP }
 };
 
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock)
+{
+        u32 i, clock = 0;
+
+        if ((table == NULL) || (table->count == 0)) {
+                *max_clock = clock;
+                return;
+        }
+
+        for (i = 0; i < table->count; i++) {
+                if (clock < table->entries[i].clk)
+                        clock = table->entries[i].clk;
+        }
+        *max_clock = clock;
+}
+
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                         u32 clock, u16 max_voltage, u16 *voltage)
 {
@@ -1913,7 +1930,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                         }
                         j++;
 
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                 return -EINVAL;
 
                         tmp = RREG32(MC_PMG_CMD_MRS);
@@ -1928,7 +1945,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                         }
                         j++;
 
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                 return -EINVAL;
                         break;
                 case MC_SEQ_RESERVE_M >> 2:
@@ -1942,7 +1959,7 @@ static int btc_set_mc_special_registers(struct radeon_device *rdev,
                         }
                         j++;
 
-                        if (j > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)
                                 return -EINVAL;
                         break;
                 default:
@@ -2080,6 +2097,7 @@ static void btc_apply_state_adjust_rules(struct radeon_device *rdev,
         bool disable_mclk_switching;
         u32 mclk, sclk;
         u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
 
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
             btc_dpm_vblank_too_short(rdev))
@@ -2121,6 +2139,39 @@ static void btc_apply_state_adjust_rules(struct radeon_device *rdev,
                         ps->low.vddci = max_limits->vddci;
         }
 
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+
+        if (max_sclk_vddc) {
+                if (ps->low.sclk > max_sclk_vddc)
+                        ps->low.sclk = max_sclk_vddc;
+                if (ps->medium.sclk > max_sclk_vddc)
+                        ps->medium.sclk = max_sclk_vddc;
+                if (ps->high.sclk > max_sclk_vddc)
+                        ps->high.sclk = max_sclk_vddc;
+        }
+        if (max_mclk_vddci) {
+                if (ps->low.mclk > max_mclk_vddci)
+                        ps->low.mclk = max_mclk_vddci;
+                if (ps->medium.mclk > max_mclk_vddci)
+                        ps->medium.mclk = max_mclk_vddci;
+                if (ps->high.mclk > max_mclk_vddci)
+                        ps->high.mclk = max_mclk_vddci;
+        }
+        if (max_mclk_vddc) {
+                if (ps->low.mclk > max_mclk_vddc)
+                        ps->low.mclk = max_mclk_vddc;
+                if (ps->medium.mclk > max_mclk_vddc)
+                        ps->medium.mclk = max_mclk_vddc;
+                if (ps->high.mclk > max_mclk_vddc)
+                        ps->high.mclk = max_mclk_vddc;
+        }
+
         /* XXX validate the min clocks required for display */
 
         if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/btc_dpm.h b/drivers/gpu/drm/radeon/btc_dpm.h
index 1a15e0e41950..3b6f12b7760b 100644
--- a/drivers/gpu/drm/radeon/btc_dpm.h
+++ b/drivers/gpu/drm/radeon/btc_dpm.h
@@ -46,6 +46,8 @@ void btc_adjust_clock_combinations(struct radeon_device *rdev,
                                    struct rv7xx_pl *pl);
 void btc_apply_voltage_dependency_rules(struct radeon_clock_voltage_dependency_table *table,
                                         u32 clock, u16 max_voltage, u16 *voltage);
+void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                     u32 *max_clock);
 void btc_apply_voltage_delta_rules(struct radeon_device *rdev,
                                    u16 max_vddc, u16 max_vddci,
                                    u16 *vddc, u16 *vddci);
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 899627443030..51e947a97edf 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -146,6 +146,8 @@ static const struct ci_pt_config_reg didt_config_ci[] =
 };
 
 extern u8 rv770_get_memory_module_index(struct radeon_device *rdev);
+extern void btc_get_max_clock_from_voltage_dependency_table(struct radeon_clock_voltage_dependency_table *table,
+                                                            u32 *max_clock);
 extern int ni_copy_and_switch_arb_sets(struct radeon_device *rdev,
                                        u32 arb_freq_src, u32 arb_freq_dest);
 extern u8 si_get_ddr3_mclk_frequency_ratio(u32 memory_clock);
@@ -712,6 +714,7 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
         struct radeon_clock_and_voltage_limits *max_limits;
         bool disable_mclk_switching;
         u32 sclk, mclk;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -739,6 +742,29 @@ static void ci_apply_state_adjust_rules(struct radeon_device *rdev,
                 }
         }
 
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
+
         /* XXX validate the min clocks required for display */
 
         if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index adbdb6503b05..9cd2bc989ac7 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -77,6 +77,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev);
 static void cik_program_aspm(struct radeon_device *rdev);
 static void cik_init_pg(struct radeon_device *rdev);
 static void cik_init_cg(struct radeon_device *rdev);
+static void cik_fini_pg(struct radeon_device *rdev);
+static void cik_fini_cg(struct radeon_device *rdev);
 static void cik_enable_gui_idle_interrupt(struct radeon_device *rdev,
                                           bool enable);
 
@@ -1692,6 +1694,7 @@ static int cik_init_microcode(struct radeon_device *rdev)
                                fw_name);
                         release_firmware(rdev->smc_fw);
                         rdev->smc_fw = NULL;
+                        err = 0;
                 } else if (rdev->smc_fw->size != smc_req_size) {
                         printk(KERN_ERR
                                "cik_smc: Bogus length %zu in firmware \"%s\"\n",
@@ -2845,10 +2848,8 @@ static void cik_gpu_init(struct radeon_device *rdev)
                 rdev->config.cik.tile_config |= (3 << 0);
                 break;
         }
-        if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
-                rdev->config.cik.tile_config |= 1 << 4;
-        else
-                rdev->config.cik.tile_config |= 0 << 4;
+        rdev->config.cik.tile_config |=
+                ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
         rdev->config.cik.tile_config |=
                 ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
         rdev->config.cik.tile_config |=
@@ -3182,6 +3183,7 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
                 DRM_ERROR("radeon: failed to get ib (%d).\n", r);
+                radeon_scratch_free(rdev, scratch);
                 return r;
         }
         ib.ptr[0] = PACKET3(PACKET3_SET_UCONFIG_REG, 1);
@@ -3198,6 +3200,8 @@ int cik_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         r = radeon_fence_wait(ib.fence, false);
         if (r) {
                 DRM_ERROR("radeon: fence wait failed (%d).\n", r);
+                radeon_scratch_free(rdev, scratch);
+                radeon_ib_free(rdev, &ib);
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
@@ -4187,6 +4191,10 @@ static void cik_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
         dev_info(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                  RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS));
 
+        /* disable CG/PG */
+        cik_fini_pg(rdev);
+        cik_fini_cg(rdev);
+
         /* stop the rlc */
         cik_rlc_stop(rdev);
 
@@ -4456,8 +4464,8 @@ static int cik_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         /* size in MB on si */
-        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
-        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
+        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
+        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024ULL * 1024ULL;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
         si_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
@@ -4735,12 +4743,13 @@ static void cik_vm_decode_fault(struct radeon_device *rdev,
         u32 mc_id = (status & MEMORY_CLIENT_ID_MASK) >> MEMORY_CLIENT_ID_SHIFT;
         u32 vmid = (status & FAULT_VMID_MASK) >> FAULT_VMID_SHIFT;
         u32 protections = (status & PROTECTIONS_MASK) >> PROTECTIONS_SHIFT;
-        char *block = (char *)&mc_client;
+        char block[5] = { mc_client >> 24, (mc_client >> 16) & 0xff,
+                (mc_client >> 8) & 0xff, mc_client & 0xff, 0 };
 
-        printk("VM fault (0x%02x, vmid %d) at page %u, %s from %s (%d)\n",
+        printk("VM fault (0x%02x, vmid %d) at page %u, %s from '%s' (0x%08x) (%d)\n",
                protections, vmid, addr,
                (status & MEMORY_CLIENT_RW_MASK) ? "write" : "read",
-               block, mc_id);
+               block, mc_client, mc_id);
 }
 
 /**
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index 85a69d2ea3d2..9fcd338c0fcf 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -113,6 +113,9 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
+        /* XXX: setting this register causes hangs on some asics */
+        return;
+
         if (!dig->afmt->pin)
                 return;
 
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 555164e270a7..b5c67a99dda9 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3131,7 +3131,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                 rdev->config.evergreen.sx_max_export_size = 256;
                 rdev->config.evergreen.sx_max_export_pos_size = 64;
                 rdev->config.evergreen.sx_max_export_smx_size = 192;
-                rdev->config.evergreen.max_hw_contexts = 8;
+                rdev->config.evergreen.max_hw_contexts = 4;
                 rdev->config.evergreen.sq_num_cf_insts = 2;
 
                 rdev->config.evergreen.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index f71ce390aebe..fe1de855775e 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -67,6 +67,9 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
+        /* XXX: setting this register causes hangs on some asics */
+        return;
+
         list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                 if (connector->encoder == encoder)
                         radeon_connector = to_radeon_connector(connector);
@@ -288,8 +291,7 @@ void evergreen_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode
         /* fglrx clears sth in AFMT_AUDIO_PACKET_CONTROL2 here */
 
         WREG32(HDMI_ACR_PACKET_CONTROL + offset,
-               HDMI_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
-               HDMI_ACR_SOURCE); /* select SW CTS value */
+               HDMI_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
 
         evergreen_hdmi_update_ACR(encoder, mode->clock);
 
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 8768fd6a1e27..4f6d2962767d 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -1501,7 +1501,7 @@
  * 6. COMMAND [29:22] | BYTE_COUNT [20:0]
  */
 #              define PACKET3_CP_DMA_DST_SEL(x)    ((x) << 20)
-                /* 0 - SRC_ADDR
+                /* 0 - DST_ADDR
                  * 1 - GDS
                  */
 #              define PACKET3_CP_DMA_ENGINE(x)     ((x) << 27)
@@ -1516,7 +1516,7 @@
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
 #              define PACKET3_CP_DMA_DIS_WC        (1 << 21)
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                 /* 0 - none
                  * 1 - 8 in 16
                  * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 93c1f9ef5da9..cac2866d79da 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -804,6 +804,7 @@ int ni_init_microcode(struct radeon_device *rdev)
                                fw_name);
                         release_firmware(rdev->smc_fw);
                         rdev->smc_fw = NULL;
+                        err = 0;
                 } else if (rdev->smc_fw->size != smc_req_size) {
                         printk(KERN_ERR
                                "ni_mc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c
index 6c398a456d78..f26339028154 100644
--- a/drivers/gpu/drm/radeon/ni_dpm.c
+++ b/drivers/gpu/drm/radeon/ni_dpm.c
@@ -787,6 +787,7 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
         bool disable_mclk_switching;
         u32 mclk, sclk;
         u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -813,6 +814,29 @@ static void ni_apply_state_adjust_rules(struct radeon_device *rdev,
                 }
         }
 
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
+
         /* XXX validate the min clocks required for display */
 
         if (disable_mclk_switching) {
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 24175717307b..d71333033b2b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2933,9 +2933,11 @@ static int r100_debugfs_cp_ring_info(struct seq_file *m, void *data)
         seq_printf(m, "CP_RB_RPTR 0x%08x\n", rdp);
         seq_printf(m, "%u free dwords in ring\n", ring->ring_free_dw);
         seq_printf(m, "%u dwords in ring\n", count);
-        for (j = 0; j <= count; j++) {
-                i = (rdp + j) & ring->ptr_mask;
-                seq_printf(m, "r[%04d]=0x%08x\n", i, ring->ring[i]);
+        if (ring->ready) {
+                for (j = 0; j <= count; j++) {
+                        i = (rdp + j) & ring->ptr_mask;
+                        seq_printf(m, "r[%04d]=0x%08x\n", i, ring->ring[i]);
+                }
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 2a1b1876b431..f9be22062df1 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2302,6 +2302,7 @@ int r600_init_microcode(struct radeon_device *rdev)
                                fw_name);
                         release_firmware(rdev->smc_fw);
                         rdev->smc_fw = NULL;
+                        err = 0;
                 } else if (rdev->smc_fw->size != smc_req_size) {
                         printk(KERN_ERR
                                "smc: Bogus length %zu in firmware \"%s\"\n",
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index e65f211a7be0..5513d8f06252 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -1084,7 +1084,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                 rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries[i].dclk =
                                         le16_to_cpu(uvd_clk->usDClkLow) | (uvd_clk->ucDClkHigh << 16);
                                 rdev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries[i].v =
-                                        le16_to_cpu(limits->entries[i].usVoltage);
+                                        le16_to_cpu(entry->usVoltage);
                                 entry = (ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record *)
                                         ((u8 *)entry + sizeof(ATOM_PPLIB_UVD_Clock_Voltage_Limit_Record));
                         }
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index f443010ce90b..06022e3b9c3b 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -57,15 +57,15 @@ enum r600_hdmi_iec_status_bits {
 static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
     /*       32kHz        44.1kHz       48kHz    */
     /* Clock      N     CTS      N     CTS      N     CTS */
-    {  25174,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
+    {  25175,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
     {  25200,  4096,  25200,  6272,  28000,  6144,  25200 }, /*  25.20       MHz */
     {  27000,  4096,  27000,  6272,  30000,  6144,  27000 }, /*  27.00       MHz */
     {  27027,  4096,  27027,  6272,  30030,  6144,  27027 }, /*  27.00*1.001 MHz */
     {  54000,  4096,  54000,  6272,  60000,  6144,  54000 }, /*  54.00       MHz */
     {  54054,  4096,  54054,  6272,  60060,  6144,  54054 }, /*  54.00*1.001 MHz */
-    {  74175, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
+    {  74176, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
     {  74250,  4096,  74250,  6272,  82500,  6144,  74250 }, /*  74.25       MHz */
-    { 148351, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
+    { 148352, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
     { 148500,  4096, 148500,  6272, 165000,  6144, 148500 }, /* 148.50       MHz */
     {      0,  4096,      0,  6272,      0,  6144,      0 }  /* Other */
 };
@@ -75,8 +75,15 @@ static const struct radeon_hdmi_acr r600_hdmi_predefined_acr[] = {
  */
 static void r600_hdmi_calc_cts(uint32_t clock, int *CTS, int N, int freq)
 {
-        if (*CTS == 0)
-                *CTS = clock * N / (128 * freq) * 1000;
+        u64 n;
+        u32 d;
+
+        if (*CTS == 0) {
+                n = (u64)clock * (u64)N * 1000ULL;
+                d = 128 * freq;
+                do_div(n, d);
+                *CTS = n;
+        }
         DRM_DEBUG("Using ACR timing N=%d CTS=%d for frequency %d\n",
                   N, *CTS, freq);
 }
@@ -257,10 +264,7 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
          * number (coefficient of two integer numbers.  DCCG_AUDIO_DTOx_PHASE
          * is the numerator, DCCG_AUDIO_DTOx_MODULE is the denominator
          */
-        if (ASIC_IS_DCE3(rdev)) {
-                /* according to the reg specs, this should DCE3.2 only, but in
-                 * practice it seems to cover DCE3.0 as well.
-                 */
+        if (ASIC_IS_DCE32(rdev)) {
                 if (dig->dig_encoder == 0) {
                         dto_cntl = RREG32(DCCG_AUDIO_DTO0_CNTL) & ~DCCG_AUDIO_DTO_WALLCLOCK_RATIO_MASK;
                         dto_cntl |= DCCG_AUDIO_DTO_WALLCLOCK_RATIO(wallclock_ratio);
@@ -276,8 +280,21 @@ void r600_audio_set_dto(struct drm_encoder *encoder, u32 clock)
                         WREG32(DCCG_AUDIO_DTO1_MODULE, dto_modulo);
                         WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
                 }
+        } else if (ASIC_IS_DCE3(rdev)) {
+                /* according to the reg specs, this should DCE3.2 only, but in
+                 * practice it seems to cover DCE3.0/3.1 as well.
+                 */
+                if (dig->dig_encoder == 0) {
+                        WREG32(DCCG_AUDIO_DTO0_PHASE, base_rate * 100);
+                        WREG32(DCCG_AUDIO_DTO0_MODULE, clock * 100);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 0); /* select DTO0 */
+                } else {
+                        WREG32(DCCG_AUDIO_DTO1_PHASE, base_rate * 100);
+                        WREG32(DCCG_AUDIO_DTO1_MODULE, clock * 100);
+                        WREG32(DCCG_AUDIO_DTO_SELECT, 1); /* select DTO1 */
+                }
         } else {
-                /* according to the reg specs, this should be DCE2.0 and DCE3.0 */
+                /* according to the reg specs, this should be DCE2.0 and DCE3.0/3.1 */
                 WREG32(AUDIO_DTO, AUDIO_DTO_PHASE(base_rate / 10) |
                        AUDIO_DTO_MODULE(clock / 10));
         }
@@ -292,6 +309,9 @@ static void dce3_2_afmt_write_speaker_allocation(struct drm_encoder *encoder)
         u8 *sadb;
         int sad_count;
 
+        /* XXX: setting this register causes hangs on some asics */
+        return;
+
         list_for_each_entry(connector, &encoder->dev->mode_config.connector_list, head) {
                 if (connector->encoder == encoder)
                         radeon_connector = to_radeon_connector(connector);
@@ -434,8 +454,8 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
         }
 
         WREG32(HDMI0_ACR_PACKET_CONTROL + offset,
-               HDMI0_ACR_AUTO_SEND | /* allow hw to sent ACR packets when required */
-               HDMI0_ACR_SOURCE); /* select SW CTS value */
+               HDMI0_ACR_SOURCE | /* select SW CTS value - XXX verify that hw CTS works on all families */
+               HDMI0_ACR_AUTO_SEND); /* allow hw to sent ACR packets when required */
 
         WREG32(HDMI0_VBI_PACKET_CONTROL + offset,
                HDMI0_NULL_SEND | /* send null packets when required */
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index e673fe26ea84..7b3c7b5932c5 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -1523,7 +1523,7 @@
  */
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                 /* 0 - none
                  * 1 - 8 in 16
                  * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 5003385a7512..8f7e04538fd6 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1004,6 +1004,8 @@ static struct radeon_asic rv6xx_asic = {
                 .wait_for_vblank = &avivo_wait_for_vblank,
                 .set_backlight_level = &atombios_set_backlight_level,
                 .get_backlight_level = &atombios_get_backlight_level,
+                .hdmi_enable = &r600_hdmi_enable,
+                .hdmi_setmode = &r600_hdmi_setmode,
         },
         .copy = {
                 .blit = &r600_copy_cpdma,
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 404e25d285ba..f79ee184ffd5 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1367,6 +1367,7 @@ bool radeon_atombios_get_ppll_ss_info(struct radeon_device *rdev,
         int index = GetIndexIntoMasterTable(DATA, PPLL_SS_Info);
         uint16_t data_offset, size;
         struct _ATOM_SPREAD_SPECTRUM_INFO *ss_info;
+        struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT *ss_assign;
         uint8_t frev, crev;
         int i, num_indices;
 
@@ -1378,18 +1379,21 @@ bool radeon_atombios_get_ppll_ss_info(struct radeon_device *rdev,
 
                 num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                         sizeof(ATOM_SPREAD_SPECTRUM_ASSIGNMENT);
-
+                ss_assign = (struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT*)
+                        ((u8 *)&ss_info->asSS_Info[0]);
                 for (i = 0; i < num_indices; i++) {
-                        if (ss_info->asSS_Info[i].ucSS_Id == id) {
+                        if (ss_assign->ucSS_Id == id) {
                                 ss->percentage =
-                                        le16_to_cpu(ss_info->asSS_Info[i].usSpreadSpectrumPercentage);
-                                ss->type = ss_info->asSS_Info[i].ucSpreadSpectrumType;
-                                ss->step = ss_info->asSS_Info[i].ucSS_Step;
-                                ss->delay = ss_info->asSS_Info[i].ucSS_Delay;
-                                ss->range = ss_info->asSS_Info[i].ucSS_Range;
-                                ss->refdiv = ss_info->asSS_Info[i].ucRecommendedRef_Div;
+                                        le16_to_cpu(ss_assign->usSpreadSpectrumPercentage);
+                                ss->type = ss_assign->ucSpreadSpectrumType;
+                                ss->step = ss_assign->ucSS_Step;
+                                ss->delay = ss_assign->ucSS_Delay;
+                                ss->range = ss_assign->ucSS_Range;
+                                ss->refdiv = ss_assign->ucRecommendedRef_Div;
                                 return true;
                         }
+                        ss_assign = (struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT*)
+                                ((u8 *)ss_assign + sizeof(struct _ATOM_SPREAD_SPECTRUM_ASSIGNMENT));
                 }
         }
         return false;
@@ -1477,6 +1481,12 @@ union asic_ss_info {
         struct _ATOM_ASIC_INTERNAL_SS_INFO_V3 info_3;
 };
 
+union asic_ss_assignment {
+        struct _ATOM_ASIC_SS_ASSIGNMENT v1;
+        struct _ATOM_ASIC_SS_ASSIGNMENT_V2 v2;
+        struct _ATOM_ASIC_SS_ASSIGNMENT_V3 v3;
+};
+
 bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                       struct radeon_atom_ss *ss,
                                       int id, u32 clock)
@@ -1485,6 +1495,7 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
         int index = GetIndexIntoMasterTable(DATA, ASIC_InternalSS_Info);
         uint16_t data_offset, size;
         union asic_ss_info *ss_info;
+        union asic_ss_assignment *ss_assign;
         uint8_t frev, crev;
         int i, num_indices;
 
@@ -1509,45 +1520,52 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                         num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                 sizeof(ATOM_ASIC_SS_ASSIGNMENT);
 
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info.asSpreadSpectrum[0]);
                         for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info.asSpreadSpectrum[i].ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                if ((ss_assign->v1.ucClockIndication == id) &&
+                                    (clock <= le32_to_cpu(ss_assign->v1.ulTargetClockRange))) {
                                         ss->percentage =
-                                                le16_to_cpu(ss_info->info.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info.asSpreadSpectrum[i].ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info.asSpreadSpectrum[i].usSpreadRateInKhz);
+                                                le16_to_cpu(ss_assign->v1.usSpreadSpectrumPercentage);
+                                        ss->type = ss_assign->v1.ucSpreadSpectrumMode;
+                                        ss->rate = le16_to_cpu(ss_assign->v1.usSpreadRateInKhz);
                                         return true;
                                 }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT));
                         }
                         break;
                 case 2:
                         num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                 sizeof(ATOM_ASIC_SS_ASSIGNMENT_V2);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info_2.asSpreadSpectrum[0]);
                         for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info_2.asSpreadSpectrum[i].ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info_2.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                if ((ss_assign->v2.ucClockIndication == id) &&
+                                    (clock <= le32_to_cpu(ss_assign->v2.ulTargetClockRange))) {
                                         ss->percentage =
-                                                le16_to_cpu(ss_info->info_2.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info_2.asSpreadSpectrum[i].ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info_2.asSpreadSpectrum[i].usSpreadRateIn10Hz);
+                                                le16_to_cpu(ss_assign->v2.usSpreadSpectrumPercentage);
+                                        ss->type = ss_assign->v2.ucSpreadSpectrumMode;
+                                        ss->rate = le16_to_cpu(ss_assign->v2.usSpreadRateIn10Hz);
                                         if ((crev == 2) &&
                                             ((id == ASIC_INTERNAL_ENGINE_SS) ||
                                              (id == ASIC_INTERNAL_MEMORY_SS)))
                                                 ss->rate /= 100;
                                         return true;
                                 }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V2));
                         }
                         break;
                 case 3:
                         num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
                                 sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3);
+                        ss_assign = (union asic_ss_assignment *)((u8 *)&ss_info->info_3.asSpreadSpectrum[0]);
                         for (i = 0; i < num_indices; i++) {
-                                if ((ss_info->info_3.asSpreadSpectrum[i].ucClockIndication == id) &&
-                                    (clock <= le32_to_cpu(ss_info->info_3.asSpreadSpectrum[i].ulTargetClockRange))) {
+                                if ((ss_assign->v3.ucClockIndication == id) &&
+                                    (clock <= le32_to_cpu(ss_assign->v3.ulTargetClockRange))) {
                                         ss->percentage =
-                                                le16_to_cpu(ss_info->info_3.asSpreadSpectrum[i].usSpreadSpectrumPercentage);
-                                        ss->type = ss_info->info_3.asSpreadSpectrum[i].ucSpreadSpectrumMode;
-                                        ss->rate = le16_to_cpu(ss_info->info_3.asSpreadSpectrum[i].usSpreadRateIn10Hz);
+                                                le16_to_cpu(ss_assign->v3.usSpreadSpectrumPercentage);
+                                        ss->type = ss_assign->v3.ucSpreadSpectrumMode;
+                                        ss->rate = le16_to_cpu(ss_assign->v3.usSpreadRateIn10Hz);
                                         if ((id == ASIC_INTERNAL_ENGINE_SS) ||
                                             (id == ASIC_INTERNAL_MEMORY_SS))
                                                 ss->rate /= 100;
@@ -1555,6 +1573,8 @@ bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                                 radeon_atombios_get_igp_ss_overrides(rdev, ss, id);
                                         return true;
                                 }
+                                ss_assign = (union asic_ss_assignment *)
+                                        ((u8 *)ss_assign + sizeof(ATOM_ASIC_SS_ASSIGNMENT_V3));
                         }
                         break;
                 default:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 79159b5da05b..64565732cb98 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1658,9 +1658,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                         drm_object_attach_property(&radeon_connector->base.base,
                                                       rdev->mode_info.underscan_vborder_property,
                                                       0);
-                        drm_object_attach_property(&radeon_connector->base.base,
-                                                   rdev->mode_info.audio_property,
-                                                   RADEON_AUDIO_DISABLE);
+                        if (radeon_audio != 0)
+                                drm_object_attach_property(&radeon_connector->base.base,
+                                                           rdev->mode_info.audio_property,
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                         subpixel_order = SubPixelHorizontalRGB;
                         connector->interlace_allowed = true;
                         if (connector_type == DRM_MODE_CONNECTOR_HDMIB)
@@ -1754,10 +1757,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                               rdev->mode_info.underscan_vborder_property,
                                                               0);
                         }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                 drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           rdev->mode_info.audio_property,
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                         }
                         if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                                 radeon_connector->dac_load_detect = true;
@@ -1799,10 +1804,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                               rdev->mode_info.underscan_vborder_property,
                                                               0);
                         }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                 drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           rdev->mode_info.audio_property,
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                         }
                         subpixel_order = SubPixelHorizontalRGB;
                         connector->interlace_allowed = true;
@@ -1843,10 +1850,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                                               rdev->mode_info.underscan_vborder_property,
                                                               0);
                         }
-                        if (ASIC_IS_DCE2(rdev)) {
+                        if (ASIC_IS_DCE2(rdev) && (radeon_audio != 0)) {
                                 drm_object_attach_property(&radeon_connector->base.base,
-                                                              rdev->mode_info.audio_property,
-                                                              RADEON_AUDIO_DISABLE);
+                                                           rdev->mode_info.audio_property,
+                                                           (radeon_audio == 1) ?
+                                                           RADEON_AUDIO_AUTO :
+                                                           RADEON_AUDIO_DISABLE);
                         }
                         connector->interlace_allowed = true;
                         /* in theory with a DP to VGA converter... */
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index ac6ece61a476..80285e35bc65 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -85,7 +85,7 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                    VRAM, also but everything into VRAM on AGP cards to avoid
                    image corruptions */
                 if (p->ring == R600_RING_TYPE_UVD_INDEX &&
-                    (i == 0 || p->rdev->flags & RADEON_IS_AGP)) {
+                    (i == 0 || drm_pci_device_is_agp(p->rdev->ddev))) {
                         /* TODO: is this still needed for NI+ ? */
                         p->relocs[i].lobj.domain =
                                 RADEON_GEM_DOMAIN_VRAM;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index e29faa73b574..841d0e09be3e 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1320,13 +1320,22 @@ int radeon_device_init(struct radeon_device *rdev,
                         return r;
         }
         if ((radeon_testing & 1)) {
-                radeon_test_moves(rdev);
+                if (rdev->accel_working)
+                        radeon_test_moves(rdev);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping move tests\n");
         }
         if ((radeon_testing & 2)) {
-                radeon_test_syncing(rdev);
+                if (rdev->accel_working)
+                        radeon_test_syncing(rdev);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping sync tests\n");
         }
         if (radeon_benchmarking) {
-                radeon_benchmark(rdev, radeon_benchmarking);
+                if (rdev->accel_working)
+                        radeon_benchmark(rdev, radeon_benchmarking);
+                else
+                        DRM_INFO("radeon: acceleration disabled, skipping benchmarks\n");
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index cdd12dcd988b..9c14a1ba1de4 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -153,7 +153,7 @@ int radeon_benchmarking = 0;
 int radeon_testing = 0;
 int radeon_connector_table = 0;
 int radeon_tv = 1;
-int radeon_audio = 1;
+int radeon_audio = -1;
 int radeon_disp_priority = 0;
 int radeon_hw_i2c = 0;
 int radeon_pcie_gen2 = -1;
@@ -196,7 +196,7 @@ module_param_named(connector_table, radeon_connector_table, int, 0444);
 MODULE_PARM_DESC(tv, "TV enable (0 = disable)");
 module_param_named(tv, radeon_tv, int, 0444);
 
-MODULE_PARM_DESC(audio, "Audio enable (1 = enable)");
+MODULE_PARM_DESC(audio, "Audio enable (-1 = auto, 0 = disable, 1 = enable)");
 module_param_named(audio, radeon_audio, int, 0444);
 
 MODULE_PARM_DESC(disp_priority, "Display Priority (0 = auto, 1 = normal, 2 = high)");
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 87e1d69e8fdb..4f6b7fc7ad3c 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -945,6 +945,8 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                 if (enable) {
                         mutex_lock(&rdev->pm.mutex);
                         rdev->pm.dpm.uvd_active = true;
+                        /* disable this for now */
+#if 0
                         if ((rdev->pm.dpm.sd == 1) && (rdev->pm.dpm.hd == 0))
                                 dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_SD;
                         else if ((rdev->pm.dpm.sd == 2) && (rdev->pm.dpm.hd == 0))
@@ -954,6 +956,7 @@ void radeon_dpm_enable_uvd(struct radeon_device *rdev, bool enable)
                         else if ((rdev->pm.dpm.sd == 0) && (rdev->pm.dpm.hd == 2))
                                 dpm_state = POWER_STATE_TYPE_INTERNAL_UVD_HD2;
                         else
+#endif
                                 dpm_state = POWER_STATE_TYPE_INTERNAL_UVD;
                         rdev->pm.dpm.state = dpm_state;
                         mutex_unlock(&rdev->pm.mutex);
@@ -1002,7 +1005,7 @@ static void radeon_pm_resume_old(struct radeon_device *rdev)
 {
         /* set up the default clocks if the MC ucode is loaded */
         if ((rdev->family >= CHIP_BARTS) &&
-            (rdev->family <= CHIP_HAINAN) &&
+            (rdev->family <= CHIP_CAYMAN) &&
             rdev->mc_fw) {
                 if (rdev->pm.default_vddc)
                         radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1046,7 +1049,7 @@ static void radeon_pm_resume_dpm(struct radeon_device *rdev)
         if (ret) {
                 DRM_ERROR("radeon: dpm resume failed\n");
                 if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                     rdev->mc_fw) {
                         if (rdev->pm.default_vddc)
                                 radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1097,7 +1100,7 @@ static int radeon_pm_init_old(struct radeon_device *rdev)
                 radeon_pm_init_profile(rdev);
                 /* set up the default clocks if the MC ucode is loaded */
                 if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                     rdev->mc_fw) {
                         if (rdev->pm.default_vddc)
                                 radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
@@ -1183,7 +1186,7 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev)
         if (ret) {
                 rdev->pm.dpm_enabled = false;
                 if ((rdev->family >= CHIP_BARTS) &&
-                    (rdev->family <= CHIP_HAINAN) &&
+                    (rdev->family <= CHIP_CAYMAN) &&
                     rdev->mc_fw) {
                         if (rdev->pm.default_vddc)
                                 radeon_atom_set_voltage(rdev, rdev->pm.default_vddc,
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 46a25f037b84..18254e1c3e71 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -839,9 +839,11 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
          * packet that is the root issue
          */
         i = (ring->rptr + ring->ptr_mask + 1 - 32) & ring->ptr_mask;
-        for (j = 0; j <= (count + 32); j++) {
-                seq_printf(m, "r[%5d]=0x%08x\n", i, ring->ring[i]);
-                i = (i + 1) & ring->ptr_mask;
+        if (ring->ready) {
+                for (j = 0; j <= (count + 32); j++) {
+                        seq_printf(m, "r[%5d]=0x%08x\n", i, ring->ring[i]);
+                        i = (i + 1) & ring->ptr_mask;
+                }
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index f4d6bcee9006..12e8099a0823 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -36,8 +36,8 @@ static void radeon_do_test_moves(struct radeon_device *rdev, int flag)
         struct radeon_bo *vram_obj = NULL;
         struct radeon_bo **gtt_obj = NULL;
         uint64_t gtt_addr, vram_addr;
-        unsigned i, n, size;
-        int r, ring;
+        unsigned n, size;
+        int i, r, ring;
 
         switch (flag) {
         case RADEON_TEST_COPY_DMA:
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 1a01bbff9bfa..308eff5be1b4 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -799,7 +799,8 @@ void radeon_uvd_note_usage(struct radeon_device *rdev)
                     (rdev->pm.dpm.hd != hd)) {
                         rdev->pm.dpm.sd = sd;
                         rdev->pm.dpm.hd = hd;
-                        streams_changed = true;
+                        /* disable this for now */
+                        /*streams_changed = true;*/
                 }
         }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index c354c1094967..d96f7cbca0a1 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -85,6 +85,9 @@ extern void si_dma_vm_set_page(struct radeon_device *rdev,
                                uint32_t incr, uint32_t flags);
 static void si_enable_gui_idle_interrupt(struct radeon_device *rdev,
                                          bool enable);
+static void si_fini_pg(struct radeon_device *rdev);
+static void si_fini_cg(struct radeon_device *rdev);
+static void si_rlc_stop(struct radeon_device *rdev);
 
 static const u32 verde_rlc_save_restore_register_list[] =
 {
@@ -1678,6 +1681,7 @@ static int si_init_microcode(struct radeon_device *rdev)
                        fw_name);
                 release_firmware(rdev->smc_fw);
                 rdev->smc_fw = NULL;
+                err = 0;
         } else if (rdev->smc_fw->size != smc_req_size) {
                 printk(KERN_ERR
                        "si_smc: Bogus length %zu in firmware \"%s\"\n",
@@ -3608,6 +3612,13 @@ static void si_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
         dev_info(rdev->dev, "  VM_CONTEXT1_PROTECTION_FAULT_STATUS 0x%08X\n",
                  RREG32(VM_CONTEXT1_PROTECTION_FAULT_STATUS));
 
+        /* disable PG/CG */
+        si_fini_pg(rdev);
+        si_fini_cg(rdev);
+
+        /* stop the rlc */
+        si_rlc_stop(rdev);
+
         /* Disable CP parsing/prefetching */
         WREG32(CP_ME_CNTL, CP_ME_HALT | CP_PFP_HALT | CP_CE_HALT);
 
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index cfe5d4d28915..2332aa1bf93c 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2910,6 +2910,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
         bool disable_sclk_switching = false;
         u32 mclk, sclk;
         u16 vddc, vddci;
+        u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
         int i;
 
         if ((rdev->pm.dpm.new_active_crtc_count > 1) ||
@@ -2943,6 +2944,29 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                 }
         }
 
+        /* limit clocks to max supported clocks based on voltage dependency tables */
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+                                                        &max_sclk_vddc);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+                                                        &max_mclk_vddci);
+        btc_get_max_clock_from_voltage_dependency_table(&rdev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+                                                        &max_mclk_vddc);
+
+        for (i = 0; i < ps->performance_level_count; i++) {
+                if (max_sclk_vddc) {
+                        if (ps->performance_levels[i].sclk > max_sclk_vddc)
+                                ps->performance_levels[i].sclk = max_sclk_vddc;
+                }
+                if (max_mclk_vddci) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddci)
+                                ps->performance_levels[i].mclk = max_mclk_vddci;
+                }
+                if (max_mclk_vddc) {
+                        if (ps->performance_levels[i].mclk > max_mclk_vddc)
+                                ps->performance_levels[i].mclk = max_mclk_vddc;
+                }
+        }
+
         /* XXX validate the min clocks required for display */
 
         if (disable_mclk_switching) {
@@ -5184,7 +5208,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                         table->mc_reg_table_entry[k].mc_data[j] |= 0x100;
                         }
                         j++;
-                        if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                 return -EINVAL;
 
                         if (!pi->mem_gddr5) {
@@ -5194,7 +5218,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                         table->mc_reg_table_entry[k].mc_data[j] =
                                                 (table->mc_reg_table_entry[k].mc_data[i] & 0xffff0000) >> 16;
                                 j++;
-                                if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                                if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                         return -EINVAL;
                         }
                         break;
@@ -5207,7 +5231,7 @@ static int si_set_mc_special_registers(struct radeon_device *rdev,
                                         (temp_reg & 0xffff0000) |
                                         (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff);
                         j++;
-                        if (j > SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
+                        if (j >= SMC_SISLANDS_MC_REGISTER_ARRAY_SIZE)
                                 return -EINVAL;
                         break;
                 default:
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 52d2ab6b67a0..7e2e0ea66a00 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -1553,7 +1553,7 @@
  * 6. COMMAND [30:21] | BYTE_COUNT [20:0]
  */
 #              define PACKET3_CP_DMA_DST_SEL(x)    ((x) << 20)
-                /* 0 - SRC_ADDR
+                /* 0 - DST_ADDR
                  * 1 - GDS
                  */
 #              define PACKET3_CP_DMA_ENGINE(x)     ((x) << 27)
@@ -1568,7 +1568,7 @@
 #              define PACKET3_CP_DMA_CP_SYNC       (1 << 31)
 /* COMMAND */
 #              define PACKET3_CP_DMA_DIS_WC        (1 << 21)
-#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 23)
+#              define PACKET3_CP_DMA_CMD_SRC_SWAP(x) ((x) << 22)
                 /* 0 - none
                  * 1 - 8 in 16
                  * 2 - 8 in 32
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 7f998bf1cc9d..9364129ba292 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1868,7 +1868,7 @@ int trinity_dpm_init(struct radeon_device *rdev)
         for (i = 0; i < SUMO_MAX_HARDWARE_POWERLEVELS; i++)
                 pi->at[i] = TRINITY_AT_DFLT;
 
-        pi->enable_bapm = true;
+        pi->enable_bapm = false;
         pi->enable_nbps_policy = true;
         pi->enable_sclk_ds = true;
         pi->enable_gfx_power_gating = true;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 1a90f0a2f7e5..0508f93b9795 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -740,9 +740,17 @@ static void vmw_postclose(struct drm_device *dev,
         struct vmw_fpriv *vmw_fp;
 
         vmw_fp = vmw_fpriv(file_priv);
-        ttm_object_file_release(&vmw_fp->tfile);
-        if (vmw_fp->locked_master)
+
+        if (vmw_fp->locked_master) {
+                struct vmw_master *vmaster =
+                        vmw_master(vmw_fp->locked_master);
+
+                ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+                ttm_vt_unlock(&vmaster->lock);
                 drm_master_put(&vmw_fp->locked_master);
+        }
+
+        ttm_object_file_release(&vmw_fp->tfile);
         kfree(vmw_fp);
 }
 
@@ -925,14 +933,13 @@ static void vmw_master_drop(struct drm_device *dev,
 
         vmw_fp->locked_master = drm_master_get(file_priv->master);
         ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
-        vmw_execbuf_release_pinned_bo(dev_priv);
-
         if (unlikely((ret != 0))) {
                 DRM_ERROR("Unable to lock TTM at VT switch.\n");
                 drm_master_put(&vmw_fp->locked_master);
         }
 
-        ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+        ttm_lock_set_kill(&vmaster->lock, false, SIGTERM);
+        vmw_execbuf_release_pinned_bo(dev_priv);
 
         if (!dev_priv->enable_fb) {
                 ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 0e67cf41065d..37fb4befec82 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -970,7 +970,7 @@ void vmw_resource_unreserve(struct vmw_resource *res,
         if (new_backup)
                 res->backup_offset = new_backup_offset;
 
-        if (!res->func->may_evict)
+        if (!res->func->may_evict || res->id == -1)
                 return;
 
         write_lock(&dev_priv->resource_lock);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 71b70e3a7a71..c91d547191dd 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -241,6 +241,7 @@ config HID_HOLTEK
           - Sharkoon Drakonia / Perixx MX-2000 gaming mice
           - Tracer Sniper TRM-503 / NOVA Gaming Slider X200 /
             Zalman ZM-GM1
+          - SHARKOON DarkGlider Gaming mouse
 
 config HOLTEK_FF
         bool "Holtek On Line Grip force feedback support"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index b8470b1a10fe..e80da62363bc 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -319,7 +319,7 @@ static s32 item_sdata(struct hid_item *item)
 
 static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
 {
-        __u32 raw_value;
+        __s32 raw_value;
         switch (item->tag) {
         case HID_GLOBAL_ITEM_TAG_PUSH:
 
@@ -370,10 +370,11 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
                 return 0;
 
         case HID_GLOBAL_ITEM_TAG_UNIT_EXPONENT:
-                /* Units exponent negative numbers are given through a
-                 * two's complement.
-                 * See "6.2.2.7 Global Items" for more information. */
-                raw_value = item_udata(item);
+                /* Many devices provide unit exponent as a two's complement
+                 * nibble due to the common misunderstanding of HID
+                 * specification 1.11, 6.2.2.7 Global Items. Attempt to handle
+                 * both this and the standard encoding. */
+                raw_value = item_sdata(item);
                 if (!(raw_value & 0xfffffff0))
                         parser->global.unit_exponent = hid_snto32(raw_value, 4);
                 else
@@ -1715,6 +1716,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_580) },
         { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
@@ -1869,6 +1871,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
 
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
 };
diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
index 7e6db3cf46f9..e696566cde46 100644
--- a/drivers/hid/hid-holtek-mouse.c
+++ b/drivers/hid/hid-holtek-mouse.c
@@ -27,6 +27,7 @@
  * - USB ID 04d9:a067, sold as Sharkoon Drakonia and Perixx MX-2000
  * - USB ID 04d9:a04a, sold as Tracer Sniper TRM-503, NOVA Gaming Slider X200
  *   and Zalman ZM-GM1
+ * - USB ID 04d9:a081, sold as SHARKOON DarkGlider Gaming mouse
  */
 
 static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -46,6 +47,7 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                         }
                         break;
                 case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A:
+                case USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081:
                         if (*rsize >= 113 && rdesc[106] == 0xff && rdesc[107] == 0x7f
                                         && rdesc[111] == 0xff && rdesc[112] == 0x7f) {
                                 hid_info(hdev, "Fixing up report descriptor\n");
@@ -63,6 +65,8 @@ static const struct hid_device_id holtek_mouse_devices[] = {
                         USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
                         USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+                        USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, holtek_mouse_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index e60e8d530697..f0296a50be5f 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -450,6 +450,7 @@
 #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD       0xa055
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067     0xa067
 #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A     0xa04a
+#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081     0xa081
 
 #define USB_VENDOR_ID_IMATION           0x0718
 #define USB_DEVICE_ID_DISC_STAKKA       0xd000
@@ -632,6 +633,7 @@
 #define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN    0x0003
 
 #define USB_VENDOR_ID_NINTENDO          0x057e
+#define USB_VENDOR_ID_NINTENDO2         0x054c
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE2 0x0330
 
@@ -791,6 +793,8 @@
 #define USB_DEVICE_ID_SYNAPTICS_COMP_TP 0x0009
 #define USB_DEVICE_ID_SYNAPTICS_WTP     0x0010
 #define USB_DEVICE_ID_SYNAPTICS_DPAD    0x0013
+#define USB_DEVICE_ID_SYNAPTICS_LTS1    0x0af8
+#define USB_DEVICE_ID_SYNAPTICS_LTS2    0x1d10
 
 #define USB_VENDOR_ID_THINGM            0x27b8
 #define USB_DEVICE_ID_BLINK1            0x01ed
@@ -918,4 +922,7 @@
 #define USB_VENDOR_ID_PRIMAX    0x0461
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
 
+#define USB_VENDOR_ID_SIS       0x0457
+#define USB_DEVICE_ID_SIS_TS    0x1013
+
 #endif
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 8741d953dcc8..d97f2323af57 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -192,6 +192,7 @@ static int hidinput_setkeycode(struct input_dev *dev,
         return -EINVAL;
 }
 
+
 /**
  * hidinput_calc_abs_res - calculate an absolute axis resolution
  * @field: the HID report field to calculate resolution for
@@ -234,23 +235,17 @@ __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code)
         case ABS_MT_TOOL_Y:
         case ABS_MT_TOUCH_MAJOR:
         case ABS_MT_TOUCH_MINOR:
-                if (field->unit & 0xffffff00)           /* Not a length */
-                        return 0;
-                unit_exponent += hid_snto32(field->unit >> 4, 4) - 1;
-                switch (field->unit & 0xf) {
-                case 0x1:                               /* If centimeters */
+                if (field->unit == 0x11) {              /* If centimeters */
                         /* Convert to millimeters */
                         unit_exponent += 1;
-                        break;
-                case 0x3:                               /* If inches */
+                } else if (field->unit == 0x13) {       /* If inches */
                         /* Convert to millimeters */
                         prev = physical_extents;
                         physical_extents *= 254;
                         if (physical_extents < prev)
                                 return 0;
                         unit_exponent -= 1;
-                        break;
-                default:
+                } else {
                         return 0;
                 }
                 break;
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 602c188e9d86..6101816a7ddd 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -382,7 +382,7 @@ static ssize_t kone_sysfs_write_profilex(struct file *fp,
 }
 #define PROFILE_ATTR(number)                                    \
 static struct bin_attribute bin_attr_profile##number = {        \
-        .attr = { .name = "profile##number", .mode = 0660 },    \
+        .attr = { .name = "profile" #number, .mode = 0660 },    \
         .size = sizeof(struct kone_profile),                    \
         .read = kone_sysfs_read_profilex,                       \
         .write = kone_sysfs_write_profilex,                     \
diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 5ddf605b6b89..5e99fcdc71b9 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -229,13 +229,13 @@ static ssize_t koneplus_sysfs_read_profilex_buttons(struct file *fp,
 
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
         .size = KONEPLUS_SIZE_PROFILE_SETTINGS,                         \
         .read = koneplus_sysfs_read_profilex_settings,                  \
         .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
         .size = KONEPLUS_SIZE_PROFILE_BUTTONS,                          \
         .read = koneplus_sysfs_read_profilex_buttons,                   \
         .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index 515bc03136c0..0c8e1ef0b67d 100644
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -257,13 +257,13 @@ static ssize_t kovaplus_sysfs_read_profilex_buttons(struct file *fp,
 
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
         .size = KOVAPLUS_SIZE_PROFILE_SETTINGS,                         \
         .read = kovaplus_sysfs_read_profilex_settings,                  \
         .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
         .size = KOVAPLUS_SIZE_PROFILE_BUTTONS,                          \
         .read = kovaplus_sysfs_read_profilex_buttons,                   \
         .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index 5a6dbbeee790..1a07e07d99a0 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -225,13 +225,13 @@ static ssize_t pyra_sysfs_read_profilex_buttons(struct file *fp,
 
 #define PROFILE_ATTR(number)                                            \
 static struct bin_attribute bin_attr_profile##number##_settings = {     \
-        .attr = { .name = "profile##number##_settings", .mode = 0440 }, \
+        .attr = { .name = "profile" #number "_settings", .mode = 0440 },        \
         .size = PYRA_SIZE_PROFILE_SETTINGS,                             \
         .read = pyra_sysfs_read_profilex_settings,                      \
         .private = &profile_numbers[number-1],                          \
 };                                                                      \
 static struct bin_attribute bin_attr_profile##number##_buttons = {      \
-        .attr = { .name = "profile##number##_buttons", .mode = 0440 },  \
+        .attr = { .name = "profile" #number "_buttons", .mode = 0440 }, \
         .size = PYRA_SIZE_PROFILE_BUTTONS,                              \
         .read = pyra_sysfs_read_profilex_buttons,                       \
         .private = &profile_numbers[number-1],                          \
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
index abb20db2b443..1446f526ee8b 100644
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -834,7 +834,8 @@ static void wiimote_init_set_type(struct wiimote_data *wdata,
                 goto done;
         }
 
-        if (vendor == USB_VENDOR_ID_NINTENDO) {
+        if (vendor == USB_VENDOR_ID_NINTENDO ||
+            vendor == USB_VENDOR_ID_NINTENDO2) {
                 if (product == USB_DEVICE_ID_NINTENDO_WIIMOTE) {
                         devtype = WIIMOTE_DEV_GEN10;
                         goto done;
@@ -1855,6 +1856,8 @@ static void wiimote_hid_remove(struct hid_device *hdev)
 static const struct hid_device_id wiimote_hid_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO2,
+                                USB_DEVICE_ID_NINTENDO_WIIMOTE) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO,
                                 USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
         { }
diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c
index 2e7d644dba18..71adf9e60b13 100644
--- a/drivers/hid/hid-wiimote-modules.c
+++ b/drivers/hid/hid-wiimote-modules.c
@@ -119,12 +119,22 @@ static const struct wiimod_ops wiimod_keys = {
  * the rumble motor, this flag shouldn't be set.
  */
 
+/* used by wiimod_rumble and wiipro_rumble */
+static void wiimod_rumble_worker(struct work_struct *work)
+{
+        struct wiimote_data *wdata = container_of(work, struct wiimote_data,
+                                                  rumble_worker);
+
+        spin_lock_irq(&wdata->state.lock);
+        wiiproto_req_rumble(wdata, wdata->state.cache_rumble);
+        spin_unlock_irq(&wdata->state.lock);
+}
+
 static int wiimod_rumble_play(struct input_dev *dev, void *data,
                               struct ff_effect *eff)
 {
         struct wiimote_data *wdata = input_get_drvdata(dev);
         __u8 value;
-        unsigned long flags;
 
         /*
          * The wiimote supports only a single rumble motor so if any magnitude
@@ -137,9 +147,10 @@ static int wiimod_rumble_play(struct input_dev *dev, void *data,
         else
                 value = 0;
 
-        spin_lock_irqsave(&wdata->state.lock, flags);
-        wiiproto_req_rumble(wdata, value);
-        spin_unlock_irqrestore(&wdata->state.lock, flags);
+        /* Locking state.lock here might deadlock with input_event() calls.
+         * schedule_work acts as barrier. Merging multiple changes is fine. */
+        wdata->state.cache_rumble = value;
+        schedule_work(&wdata->rumble_worker);
 
         return 0;
 }
@@ -147,6 +158,8 @@ static int wiimod_rumble_play(struct input_dev *dev, void *data,
 static int wiimod_rumble_probe(const struct wiimod_ops *ops,
                                struct wiimote_data *wdata)
 {
+        INIT_WORK(&wdata->rumble_worker, wiimod_rumble_worker);
+
         set_bit(FF_RUMBLE, wdata->input->ffbit);
         if (input_ff_create_memless(wdata->input, NULL, wiimod_rumble_play))
                 return -ENOMEM;
@@ -159,6 +172,8 @@ static void wiimod_rumble_remove(const struct wiimod_ops *ops,
 {
         unsigned long flags;
 
+        cancel_work_sync(&wdata->rumble_worker);
+
         spin_lock_irqsave(&wdata->state.lock, flags);
         wiiproto_req_rumble(wdata, 0);
         spin_unlock_irqrestore(&wdata->state.lock, flags);
@@ -1731,7 +1746,6 @@ static int wiimod_pro_play(struct input_dev *dev, void *data,
 {
         struct wiimote_data *wdata = input_get_drvdata(dev);
         __u8 value;
-        unsigned long flags;
 
         /*
          * The wiimote supports only a single rumble motor so if any magnitude
@@ -1744,9 +1758,10 @@ static int wiimod_pro_play(struct input_dev *dev, void *data,
         else
                 value = 0;
 
-        spin_lock_irqsave(&wdata->state.lock, flags);
-        wiiproto_req_rumble(wdata, value);
-        spin_unlock_irqrestore(&wdata->state.lock, flags);
+        /* Locking state.lock here might deadlock with input_event() calls.
+         * schedule_work acts as barrier. Merging multiple changes is fine. */
+        wdata->state.cache_rumble = value;
+        schedule_work(&wdata->rumble_worker);
 
         return 0;
 }
@@ -1756,6 +1771,8 @@ static int wiimod_pro_probe(const struct wiimod_ops *ops,
 {
         int ret, i;
 
+        INIT_WORK(&wdata->rumble_worker, wiimod_rumble_worker);
+
         wdata->extension.input = input_allocate_device();
         if (!wdata->extension.input)
                 return -ENOMEM;
@@ -1817,12 +1834,13 @@ static void wiimod_pro_remove(const struct wiimod_ops *ops,
         if (!wdata->extension.input)
                 return;
 
+        input_unregister_device(wdata->extension.input);
+        wdata->extension.input = NULL;
+        cancel_work_sync(&wdata->rumble_worker);
+
         spin_lock_irqsave(&wdata->state.lock, flags);
         wiiproto_req_rumble(wdata, 0);
         spin_unlock_irqrestore(&wdata->state.lock, flags);
-
-        input_unregister_device(wdata->extension.input);
-        wdata->extension.input = NULL;
 }
 
 static const struct wiimod_ops wiimod_pro = {
diff --git a/drivers/hid/hid-wiimote.h b/drivers/hid/hid-wiimote.h
index f1474f372c0b..75db0c400037 100644
--- a/drivers/hid/hid-wiimote.h
+++ b/drivers/hid/hid-wiimote.h
@@ -133,13 +133,15 @@ struct wiimote_state {
         __u8 *cmd_read_buf;
         __u8 cmd_read_size;
 
-        /* calibration data */
+        /* calibration/cache data */
         __u16 calib_bboard[4][3];
+        __u8 cache_rumble;
 };
 
 struct wiimote_data {
         struct hid_device *hdev;
         struct input_dev *input;
+        struct work_struct rumble_worker;
         struct led_classdev *leds[4];
         struct input_dev *accel;
         struct input_dev *ir;
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 8918dd12bb69..6a6dd5cd7833 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -308,18 +308,25 @@ static int hidraw_fasync(int fd, struct file *file, int on)
 static void drop_ref(struct hidraw *hidraw, int exists_bit)
 {
         if (exists_bit) {
-                hid_hw_close(hidraw->hid);
                 hidraw->exist = 0;
-                if (hidraw->open)
+                if (hidraw->open) {
+                        hid_hw_close(hidraw->hid);
                         wake_up_interruptible(&hidraw->wait);
+                }
         } else {
                 --hidraw->open;
         }
-
-        if (!hidraw->open && !hidraw->exist) {
-                device_destroy(hidraw_class, MKDEV(hidraw_major, hidraw->minor));
-                hidraw_table[hidraw->minor] = NULL;
-                kfree(hidraw);
+        if (!hidraw->open) {
+                if (!hidraw->exist) {
+                        device_destroy(hidraw_class,
+                                        MKDEV(hidraw_major, hidraw->minor));
+                        hidraw_table[hidraw->minor] = NULL;
+                        kfree(hidraw);
+                } else {
+                        /* close device for last reader */
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
+                        hid_hw_close(hidraw->hid);
+                }
         }
 }
 
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index c1336193b04b..fd7ce374f812 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -854,10 +854,10 @@ static int i2c_hid_acpi_pdata(struct i2c_client *client,
                 0xF7, 0xF6, 0xDF, 0x3C, 0x67, 0x42, 0x55, 0x45,
                 0xAD, 0x05, 0xB3, 0x0A, 0x3D, 0x89, 0x38, 0xDE,
         };
-        struct acpi_buffer buf = { ACPI_ALLOCATE_BUFFER, NULL };
-        union acpi_object params[4], *obj;
+        union acpi_object params[4];
         struct acpi_object_list input;
         struct acpi_device *adev;
+        unsigned long long value;
         acpi_handle handle;
 
         handle = ACPI_HANDLE(&client->dev);
@@ -878,22 +878,14 @@ static int i2c_hid_acpi_pdata(struct i2c_client *client,
         params[3].package.count = 0;
         params[3].package.elements = NULL;
 
-        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DSM", &input, &buf))) {
+        if (ACPI_FAILURE(acpi_evaluate_integer(handle, "_DSM", &input,
+                                                                &value))) {
                 dev_err(&client->dev, "device _DSM execution failed\n");
                 return -ENODEV;
         }
 
-        obj = (union acpi_object *)buf.pointer;
-        if (obj->type != ACPI_TYPE_INTEGER) {
-                dev_err(&client->dev, "device _DSM returned invalid type: %d\n",
-                        obj->type);
-                kfree(buf.pointer);
-                return -EINVAL;
-        }
-
-        pdata->hid_descriptor_address = obj->integer.value;
+        pdata->hid_descriptor_address = value;
 
-        kfree(buf.pointer);
         return 0;
 }
 
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index 5bf2fb785844..93b00d76374c 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -615,7 +615,7 @@ static const struct file_operations uhid_fops = {
 
 static struct miscdevice uhid_misc = {
         .fops           = &uhid_fops,
-        .minor          = MISC_DYNAMIC_MINOR,
+        .minor          = UHID_MINOR,
         .name           = UHID_NAME,
 };
 
@@ -634,4 +634,5 @@ module_exit(uhid_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
 MODULE_DESCRIPTION("User-space I/O driver support for HID subsystem");
+MODULE_ALIAS_MISCDEV(UHID_MINOR);
 MODULE_ALIAS("devname:" UHID_NAME);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 07345521f421..3fca3be08337 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -110,6 +110,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_SIS, USB_DEVICE_ID_SIS_TS, HID_QUIRK_NO_INIT_REPORTS },
 
         { 0, 0 }
 };
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index 8f4743ab5fb2..936093e0271e 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -195,7 +195,7 @@ int vmbus_connect(void)
 
         do {
                 ret = vmbus_negotiate_version(msginfo, version);
-                if (ret)
+                if (ret == -ETIMEDOUT)
                         goto cleanup;
 
                 if (vmbus_connection.conn_state == CONNECTED)
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index 28b03325b872..09988b289622 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -32,13 +32,17 @@
 /*
  * Pre win8 version numbers used in ws2008 and ws 2008 r2 (win7)
  */
+#define WS2008_SRV_MAJOR        1
+#define WS2008_SRV_MINOR        0
+#define WS2008_SRV_VERSION     (WS2008_SRV_MAJOR << 16 | WS2008_SRV_MINOR)
+
 #define WIN7_SRV_MAJOR   3
 #define WIN7_SRV_MINOR   0
-#define WIN7_SRV_MAJOR_MINOR     (WIN7_SRV_MAJOR << 16 | WIN7_SRV_MINOR)
+#define WIN7_SRV_VERSION     (WIN7_SRV_MAJOR << 16 | WIN7_SRV_MINOR)
 
 #define WIN8_SRV_MAJOR   4
 #define WIN8_SRV_MINOR   0
-#define WIN8_SRV_MAJOR_MINOR     (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)
+#define WIN8_SRV_VERSION     (WIN8_SRV_MAJOR << 16 | WIN8_SRV_MINOR)
 
 /*
  * Global state maintained for transaction that is being processed.
@@ -587,6 +591,8 @@ void hv_kvp_onchannelcallback(void *context)
 
         struct icmsg_hdr *icmsghdrp;
         struct icmsg_negotiate *negop = NULL;
+        int util_fw_version;
+        int kvp_srv_version;
 
         if (kvp_transaction.active) {
                 /*
@@ -606,17 +612,26 @@ void hv_kvp_onchannelcallback(void *context)
 
                 if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                         /*
-                         * We start with win8 version and if the host cannot
-                         * support that we use the previous version.
+                         * Based on the host, select appropriate
+                         * framework and service versions we will
+                         * negotiate.
                          */
-                        if (vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
-                                 WIN8_SRV_MAJOR_MINOR))
-                                goto done;
-
+                        switch (vmbus_proto_version) {
+                        case (VERSION_WS2008):
+                                util_fw_version = UTIL_WS2K8_FW_VERSION;
+                                kvp_srv_version = WS2008_SRV_VERSION;
+                                break;
+                        case (VERSION_WIN7):
+                                util_fw_version = UTIL_FW_VERSION;
+                                kvp_srv_version = WIN7_SRV_VERSION;
+                                break;
+                        default:
+                                util_fw_version = UTIL_FW_VERSION;
+                                kvp_srv_version = WIN8_SRV_VERSION;
+                        }
                         vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
-                                 WIN7_SRV_MAJOR_MINOR);
+                                 recv_buffer, util_fw_version,
+                                 kvp_srv_version);
 
                 } else {
                         kvp_msg = (struct hv_kvp_msg *)&recv_buffer[
@@ -649,7 +664,6 @@ void hv_kvp_onchannelcallback(void *context)
                         return;
 
                 }
-done:
 
                 icmsghdrp->icflags = ICMSGHDRFLAG_TRANSACTION
                         | ICMSGHDRFLAG_RESPONSE;
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index e4572f3f2834..0c3546224376 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -26,7 +26,7 @@
 
 #define VSS_MAJOR  5
 #define VSS_MINOR  0
-#define VSS_MAJOR_MINOR    (VSS_MAJOR << 16 | VSS_MINOR)
+#define VSS_VERSION    (VSS_MAJOR << 16 | VSS_MINOR)
 
 
 
@@ -190,8 +190,8 @@ void hv_vss_onchannelcallback(void *context)
 
                 if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                         vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                 recv_buffer, UTIL_FW_MAJOR_MINOR,
-                                 VSS_MAJOR_MINOR);
+                                 recv_buffer, UTIL_FW_VERSION,
+                                 VSS_VERSION);
                 } else {
                         vss_msg = (struct hv_vss_msg *)&recv_buffer[
                                 sizeof(struct vmbuspipe_hdr) +
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index cb82233541b1..273e3ddb3a20 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -28,17 +28,32 @@
 #include <linux/reboot.h>
 #include <linux/hyperv.h>
 
-#define SHUTDOWN_MAJOR  3
-#define SHUTDOWN_MINOR  0
-#define SHUTDOWN_MAJOR_MINOR    (SHUTDOWN_MAJOR << 16 | SHUTDOWN_MINOR)
 
-#define TIMESYNCH_MAJOR 3
-#define TIMESYNCH_MINOR 0
-#define TIMESYNCH_MAJOR_MINOR   (TIMESYNCH_MAJOR << 16 | TIMESYNCH_MINOR)
+#define SD_MAJOR        3
+#define SD_MINOR        0
+#define SD_VERSION      (SD_MAJOR << 16 | SD_MINOR)
 
-#define HEARTBEAT_MAJOR 3
-#define HEARTBEAT_MINOR 0
-#define HEARTBEAT_MAJOR_MINOR   (HEARTBEAT_MAJOR << 16 | HEARTBEAT_MINOR)
+#define SD_WS2008_MAJOR         1
+#define SD_WS2008_VERSION       (SD_WS2008_MAJOR << 16 | SD_MINOR)
+
+#define TS_MAJOR        3
+#define TS_MINOR        0
+#define TS_VERSION      (TS_MAJOR << 16 | TS_MINOR)
+
+#define TS_WS2008_MAJOR         1
+#define TS_WS2008_VERSION       (TS_WS2008_MAJOR << 16 | TS_MINOR)
+
+#define HB_MAJOR        3
+#define HB_MINOR 0
+#define HB_VERSION      (HB_MAJOR << 16 | HB_MINOR)
+
+#define HB_WS2008_MAJOR 1
+#define HB_WS2008_VERSION       (HB_WS2008_MAJOR << 16 | HB_MINOR)
+
+static int sd_srv_version;
+static int ts_srv_version;
+static int hb_srv_version;
+static int util_fw_version;
 
 static void shutdown_onchannelcallback(void *context);
 static struct hv_util_service util_shutdown = {
@@ -99,8 +114,8 @@ static void shutdown_onchannelcallback(void *context)
 
                 if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
                         vmbus_prep_negotiate_resp(icmsghdrp, negop,
-                                        shut_txf_buf, UTIL_FW_MAJOR_MINOR,
-                                        SHUTDOWN_MAJOR_MINOR);
+                                        shut_txf_buf, util_fw_version,
+                                        sd_srv_version);
                 } else {
                         shutdown_msg =
                                 (struct shutdown_msg_data *)&shut_txf_buf[
@@ -216,6 +231,7 @@ static void timesync_onchannelcallback(void *context)
         struct icmsg_hdr *icmsghdrp;
         struct ictimesync_data *timedatap;
         u8 *time_txf_buf = util_timesynch.recv_buffer;
+        struct icmsg_negotiate *negop = NULL;
 
         vmbus_recvpacket(channel, time_txf_buf,
                          PAGE_SIZE, &recvlen, &requestid);
@@ -225,9 +241,10 @@ static void timesync_onchannelcallback(void *context)
                                 sizeof(struct vmbuspipe_hdr)];
 
                 if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
-                        vmbus_prep_negotiate_resp(icmsghdrp, NULL, time_txf_buf,
-                                                UTIL_FW_MAJOR_MINOR,
-                                                TIMESYNCH_MAJOR_MINOR);
+                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
+                                                time_txf_buf,
+                                                util_fw_version,
+                                                ts_srv_version);
                 } else {
                         timedatap = (struct ictimesync_data *)&time_txf_buf[
                                 sizeof(struct vmbuspipe_hdr) +
@@ -257,6 +274,7 @@ static void heartbeat_onchannelcallback(void *context)
         struct icmsg_hdr *icmsghdrp;
         struct heartbeat_msg_data *heartbeat_msg;
         u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
+        struct icmsg_negotiate *negop = NULL;
 
         vmbus_recvpacket(channel, hbeat_txf_buf,
                          PAGE_SIZE, &recvlen, &requestid);
@@ -266,9 +284,9 @@ static void heartbeat_onchannelcallback(void *context)
                                 sizeof(struct vmbuspipe_hdr)];
 
                 if (icmsghdrp->icmsgtype == ICMSGTYPE_NEGOTIATE) {
-                        vmbus_prep_negotiate_resp(icmsghdrp, NULL,
-                                hbeat_txf_buf, UTIL_FW_MAJOR_MINOR,
-                                HEARTBEAT_MAJOR_MINOR);
+                        vmbus_prep_negotiate_resp(icmsghdrp, negop,
+                                hbeat_txf_buf, util_fw_version,
+                                hb_srv_version);
                 } else {
                         heartbeat_msg =
                                 (struct heartbeat_msg_data *)&hbeat_txf_buf[
@@ -321,6 +339,25 @@ static int util_probe(struct hv_device *dev,
                 goto error;
 
         hv_set_drvdata(dev, srv);
+        /*
+         * Based on the host; initialize the framework and
+         * service version numbers we will negotiate.
+         */
+        switch (vmbus_proto_version) {
+        case (VERSION_WS2008):
+                util_fw_version = UTIL_WS2K8_FW_VERSION;
+                sd_srv_version = SD_WS2008_VERSION;
+                ts_srv_version = TS_WS2008_VERSION;
+                hb_srv_version = HB_WS2008_VERSION;
+                break;
+
+        default:
+                util_fw_version = UTIL_FW_VERSION;
+                sd_srv_version = SD_VERSION;
+                ts_srv_version = TS_VERSION;
+                hb_srv_version = HB_VERSION;
+        }
+
         return 0;
 
 error:
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 62c2e32e25ef..3288f13d2d87 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -230,6 +230,7 @@ static int send_argument(const char *key)
 
 static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
 {
+        u8 status, data = 0;
         int i;
 
         if (send_command(cmd) || send_argument(key)) {
@@ -237,6 +238,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
                 return -EIO;
         }
 
+        /* This has no effect on newer (2012) SMCs */
         if (send_byte(len, APPLESMC_DATA_PORT)) {
                 pr_warn("%.4s: read len fail\n", key);
                 return -EIO;
@@ -250,6 +252,17 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
                 buffer[i] = inb(APPLESMC_DATA_PORT);
         }
 
+        /* Read the data port until bit0 is cleared */
+        for (i = 0; i < 16; i++) {
+                udelay(APPLESMC_MIN_WAIT);
+                status = inb(APPLESMC_CMD_PORT);
+                if (!(status & 0x01))
+                        break;
+                data = inb(APPLESMC_DATA_PORT);
+        }
+        if (i)
+                pr_warn("flushed %d bytes, last value is: %d\n", i, data);
+
         return 0;
 }
 
@@ -525,16 +538,25 @@ static int applesmc_init_smcreg_try(void)
 {
         struct applesmc_registers *s = &smcreg;
         bool left_light_sensor, right_light_sensor;
+        unsigned int count;
         u8 tmp[1];
         int ret;
 
         if (s->init_complete)
                 return 0;
 
-        ret = read_register_count(&s->key_count);
+        ret = read_register_count(&count);
         if (ret)
                 return ret;
 
+        if (s->cache && s->key_count != count) {
+                pr_warn("key count changed from %d to %d\n",
+                        s->key_count, count);
+                kfree(s->cache);
+                s->cache = NULL;
+        }
+        s->key_count = count;
+
         if (!s->cache)
                 s->cache = kcalloc(s->key_count, sizeof(*s->cache), GFP_KERNEL);
         if (!s->cache)
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index dbecf08399f8..5888feef1ac5 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -98,6 +98,8 @@
 
 #define DW_IC_ERR_TX_ABRT       0x1
 
+#define DW_IC_TAR_10BITADDR_MASTER BIT(12)
+
 /*
  * status codes
  */
@@ -388,22 +390,34 @@ static int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev)
 static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
 {
         struct i2c_msg *msgs = dev->msgs;
-        u32 ic_con;
+        u32 ic_con, ic_tar = 0;
 
         /* Disable the adapter */
         __i2c_dw_enable(dev, false);
 
-        /* set the slave (target) address */
-        dw_writel(dev, msgs[dev->msg_write_idx].addr, DW_IC_TAR);
-
         /* if the slave address is ten bit address, enable 10BITADDR */
         ic_con = dw_readl(dev, DW_IC_CON);
-        if (msgs[dev->msg_write_idx].flags & I2C_M_TEN)
+        if (msgs[dev->msg_write_idx].flags & I2C_M_TEN) {
                 ic_con |= DW_IC_CON_10BITADDR_MASTER;
-        else
+                /*
+                 * If I2C_DYNAMIC_TAR_UPDATE is set, the 10-bit addressing
+                 * mode has to be enabled via bit 12 of IC_TAR register.
+                 * We set it always as I2C_DYNAMIC_TAR_UPDATE can't be
+                 * detected from registers.
+                 */
+                ic_tar = DW_IC_TAR_10BITADDR_MASTER;
+        } else {
                 ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+        }
+
         dw_writel(dev, ic_con, DW_IC_CON);
 
+        /*
+         * Set the slave (target) address and enable 10-bit addressing mode
+         * if applicable.
+         */
+        dw_writel(dev, msgs[dev->msg_write_idx].addr | ic_tar, DW_IC_TAR);
+
         /* Enable the adapter */
         __i2c_dw_enable(dev, true);
 
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 4c1b60539a25..0aa01136f8d9 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -270,7 +270,8 @@ static SIMPLE_DEV_PM_OPS(dw_i2c_dev_pm_ops, dw_i2c_suspend, dw_i2c_resume);
 MODULE_ALIAS("platform:i2c_designware");
 
 static struct platform_driver dw_i2c_driver = {
-        .remove         = dw_i2c_remove,
+        .probe = dw_i2c_probe,
+        .remove = dw_i2c_remove,
         .driver         = {
                 .name   = "i2c_designware",
                 .owner  = THIS_MODULE,
@@ -282,7 +283,7 @@ static struct platform_driver dw_i2c_driver = {
 
 static int __init dw_i2c_init_driver(void)
 {
-        return platform_driver_probe(&dw_i2c_driver, dw_i2c_probe);
+        return platform_driver_register(&dw_i2c_driver);
 }
 subsys_initcall(dw_i2c_init_driver);
 
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index ccf46656bdad..1d7efa3169cd 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -365,7 +365,7 @@ static void i2c_imx_stop(struct imx_i2c_struct *i2c_imx)
         clk_disable_unprepare(i2c_imx->clk);
 }
 
-static void __init i2c_imx_set_clk(struct imx_i2c_struct *i2c_imx,
+static void i2c_imx_set_clk(struct imx_i2c_struct *i2c_imx,
                                                         unsigned int rate)
 {
         struct imx_i2c_clk_pair *i2c_clk_div = i2c_imx->hwdata->clk_div;
@@ -589,7 +589,7 @@ static struct i2c_algorithm i2c_imx_algo = {
         .functionality  = i2c_imx_func,
 };
 
-static int __init i2c_imx_probe(struct platform_device *pdev)
+static int i2c_imx_probe(struct platform_device *pdev)
 {
         const struct of_device_id *of_id = of_match_device(i2c_imx_dt_ids,
                                                            &pdev->dev);
@@ -697,7 +697,7 @@ static int __init i2c_imx_probe(struct platform_device *pdev)
         return 0;   /* Return OK */
 }
 
-static int __exit i2c_imx_remove(struct platform_device *pdev)
+static int i2c_imx_remove(struct platform_device *pdev)
 {
         struct imx_i2c_struct *i2c_imx = platform_get_drvdata(pdev);
 
@@ -715,7 +715,8 @@ static int __exit i2c_imx_remove(struct platform_device *pdev)
 }
 
 static struct platform_driver i2c_imx_driver = {
-        .remove         = __exit_p(i2c_imx_remove),
+        .probe = i2c_imx_probe,
+        .remove = i2c_imx_remove,
         .driver = {
                 .name   = DRIVER_NAME,
                 .owner  = THIS_MODULE,
@@ -726,7 +727,7 @@ static struct platform_driver i2c_imx_driver = {
 
 static int __init i2c_adap_imx_init(void)
 {
-        return platform_driver_probe(&i2c_imx_driver, i2c_imx_probe);
+        return platform_driver_register(&i2c_imx_driver);
 }
 subsys_initcall(i2c_adap_imx_init);
 
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 8ed79a086f85..1672effbcebb 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -393,6 +393,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
 
         desc = &priv->hw[priv->head];
 
+        /* Initialize the DMA buffer */
+        memset(priv->dma_buffer, 0, sizeof(priv->dma_buffer));
+
         /* Initialize the descriptor */
         memset(desc, 0, sizeof(struct ismt_desc));
         desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write);
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 7f3a47443494..d3e9cc3153a9 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -234,9 +234,9 @@ static int mv64xxx_i2c_offload_msg(struct mv64xxx_i2c_data *drv_data)
                 ctrl_reg |= MV64XXX_I2C_BRIDGE_CONTROL_WR |
                     (msg->len - 1) << MV64XXX_I2C_BRIDGE_CONTROL_TX_SIZE_SHIFT;
 
-                writel_relaxed(data_reg_lo,
+                writel(data_reg_lo,
                         drv_data->reg_base + MV64XXX_I2C_REG_TX_DATA_LO);
-                writel_relaxed(data_reg_hi,
+                writel(data_reg_hi,
                         drv_data->reg_base + MV64XXX_I2C_REG_TX_DATA_HI);
 
         } else {
@@ -697,6 +697,7 @@ static const struct of_device_id mv64xxx_i2c_of_match_table[] = {
 MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
 
 #ifdef CONFIG_OF
+#ifdef CONFIG_HAVE_CLK
 static int
 mv64xxx_calc_freq(const int tclk, const int n, const int m)
 {
@@ -726,16 +727,12 @@ mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
                 return false;
         return true;
 }
+#endif /* CONFIG_HAVE_CLK */
 
 static int
 mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
                   struct device *dev)
 {
-        const struct of_device_id *device;
-        struct device_node *np = dev->of_node;
-        u32 bus_freq, tclk;
-        int rc = 0;
-
         /* CLK is mandatory when using DT to describe the i2c bus. We
          * need to know tclk in order to calculate bus clock
          * factors.
@@ -744,6 +741,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
         /* Have OF but no CLK */
         return -ENODEV;
 #else
+        const struct of_device_id *device;
+        struct device_node *np = dev->of_node;
+        u32 bus_freq, tclk;
+        int rc = 0;
+
         if (IS_ERR(drv_data->clk)) {
                 rc = -ENODEV;
                 goto out;
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index f4a01675fa71..b7c857774708 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -780,12 +780,13 @@ static struct platform_driver mxs_i2c_driver = {
                    .owner = THIS_MODULE,
                    .of_match_table = mxs_i2c_dt_ids,
                    },
+        .probe = mxs_i2c_probe,
         .remove = mxs_i2c_remove,
 };
 
 static int __init mxs_i2c_init(void)
 {
-        return platform_driver_probe(&mxs_i2c_driver, mxs_i2c_probe);
+        return platform_driver_register(&mxs_i2c_driver);
 }
 subsys_initcall(mxs_i2c_init);
 
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 6d8308d5dc4e..9967a6f9c2ff 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -939,6 +939,9 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                 /*
                  * ProDB0017052: Clear ARDY bit twice
                  */
+                if (stat & OMAP_I2C_STAT_ARDY)
+                        omap_i2c_ack_stat(dev, OMAP_I2C_STAT_ARDY);
+
                 if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                         OMAP_I2C_STAT_AL)) {
                         omap_i2c_ack_stat(dev, (OMAP_I2C_STAT_RRDY |
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 3535f3c0f7b4..3747b9bf67d6 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1178,8 +1178,6 @@ static int s3c24xx_i2c_remove(struct platform_device *pdev)
 
         i2c_del_adapter(&i2c->adap);
 
-        clk_disable_unprepare(i2c->clk);
-
         if (pdev->dev.of_node && IS_ERR(i2c->pctrl))
                 s3c24xx_i2c_dt_gpio_free(i2c);
 
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index f8f6f2e552db..04a17b9b38bb 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -859,8 +859,7 @@ static const struct i2c_algorithm stu300_algo = {
         .functionality  = stu300_func,
 };
 
-static int __init
-stu300_probe(struct platform_device *pdev)
+static int stu300_probe(struct platform_device *pdev)
 {
         struct stu300_dev *dev;
         struct i2c_adapter *adap;
@@ -966,8 +965,7 @@ static SIMPLE_DEV_PM_OPS(stu300_pm, stu300_suspend, stu300_resume);
 #define STU300_I2C_PM   NULL
 #endif
 
-static int __exit
-stu300_remove(struct platform_device *pdev)
+static int stu300_remove(struct platform_device *pdev)
 {
         struct stu300_dev *dev = platform_get_drvdata(pdev);
 
@@ -989,13 +987,14 @@ static struct platform_driver stu300_i2c_driver = {
                 .pm     = STU300_I2C_PM,
                 .of_match_table = stu300_dt_match,
         },
-        .remove         = __exit_p(stu300_remove),
+        .probe = stu300_probe,
+        .remove = stu300_remove,
 
 };
 
 static int __init stu300_init(void)
 {
-        return platform_driver_probe(&stu300_i2c_driver, stu300_probe);
+        return platform_driver_register(&stu300_i2c_driver);
 }
 
 static void __exit stu300_exit(void)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 29d3f045a2bf..75ba8608383e 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -254,10 +254,12 @@ static int i2c_device_probe(struct device *dev)
                                         client->flags & I2C_CLIENT_WAKE);
         dev_dbg(dev, "probe\n");
 
+        acpi_dev_pm_attach(&client->dev, true);
         status = driver->probe(client, i2c_match_id(driver->id_table, client));
         if (status) {
                 client->driver = NULL;
                 i2c_set_clientdata(client, NULL);
+                acpi_dev_pm_detach(&client->dev, true);
         }
         return status;
 }
@@ -283,6 +285,7 @@ static int i2c_device_remove(struct device *dev)
                 client->driver = NULL;
                 i2c_set_clientdata(client, NULL);
         }
+        acpi_dev_pm_detach(&client->dev, true);
         return status;
 }
 
@@ -1111,8 +1114,10 @@ static acpi_status acpi_i2c_add_device(acpi_handle handle, u32 level,
         if (ret < 0 || !info.addr)
                 return AE_OK;
 
+        adev->power.flags.ignore_parent = true;
         strlcpy(info.type, dev_name(&adev->dev), sizeof(info.type));
         if (!i2c_new_device(adapter, &info)) {
+                adev->power.flags.ignore_parent = false;
                 dev_err(&adapter->dev,
                         "failed to add I2C device %s from ACPI\n",
                         dev_name(&adev->dev));
@@ -1134,6 +1139,9 @@ static void acpi_i2c_register_devices(struct i2c_adapter *adap)
         acpi_handle handle;
         acpi_status status;
 
+        if (!adap->dev.parent)
+                return;
+
         handle = ACPI_HANDLE(adap->dev.parent);
         if (!handle)
                 return;
diff --git a/drivers/i2c/muxes/i2c-arb-gpio-challenge.c b/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
index 74b41ae690f3..928656e241dd 100644
--- a/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
+++ b/drivers/i2c/muxes/i2c-arb-gpio-challenge.c
@@ -200,7 +200,7 @@ static int i2c_arbitrator_probe(struct platform_device *pdev)
         arb->parent = of_find_i2c_adapter_by_node(parent_np);
         if (!arb->parent) {
                 dev_err(dev, "Cannot find parent bus\n");
-                return -EINVAL;
+                return -EPROBE_DEFER;
         }
 
         /* Actually add the mux adapter */
diff --git a/drivers/i2c/muxes/i2c-mux-gpio.c b/drivers/i2c/muxes/i2c-mux-gpio.c
index 5d4a99ba743e..a764da777f08 100644
--- a/drivers/i2c/muxes/i2c-mux-gpio.c
+++ b/drivers/i2c/muxes/i2c-mux-gpio.c
@@ -66,7 +66,7 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
         struct device_node *adapter_np, *child;
         struct i2c_adapter *adapter;
         unsigned *values, *gpios;
-        int i = 0;
+        int i = 0, ret;
 
         if (!np)
                 return -ENODEV;
@@ -79,7 +79,7 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
         adapter = of_find_i2c_adapter_by_node(adapter_np);
         if (!adapter) {
                 dev_err(&pdev->dev, "Cannot find parent bus\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
         mux->data.parent = i2c_adapter_id(adapter);
         put_device(&adapter->dev);
@@ -116,8 +116,12 @@ static int i2c_mux_gpio_probe_dt(struct gpiomux *mux,
                 return -ENOMEM;
         }
 
-        for (i = 0; i < mux->data.n_gpios; i++)
-                gpios[i] = of_get_named_gpio(np, "mux-gpios", i);
+        for (i = 0; i < mux->data.n_gpios; i++) {
+                ret = of_get_named_gpio(np, "mux-gpios", i);
+                if (ret < 0)
+                        return ret;
+                gpios[i] = ret;
+        }
 
         mux->data.gpios = gpios;
 
@@ -177,7 +181,7 @@ static int i2c_mux_gpio_probe(struct platform_device *pdev)
         if (!parent) {
                 dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
                         mux->data.parent);
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
 
         mux->parent = parent;
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
index 69a91732ae65..68a37157377d 100644
--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -113,7 +113,7 @@ static int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
         adapter = of_find_i2c_adapter_by_node(adapter_np);
         if (!adapter) {
                 dev_err(mux->dev, "Cannot find parent bus\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
         mux->pdata->parent_bus_num = i2c_adapter_id(adapter);
         put_device(&adapter->dev);
@@ -211,7 +211,7 @@ static int i2c_mux_pinctrl_probe(struct platform_device *pdev)
         if (!mux->parent) {
                 dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
                         mux->pdata->parent_bus_num);
-                ret = -ENODEV;
+                ret = -EPROBE_DEFER;
                 goto err;
         }
 
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index fa6964d8681a..3f95a533c1a8 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -123,7 +123,7 @@ static struct cpuidle_state *cpuidle_state_table;
  * which is also the index into the MWAIT hint array.
  * Thus C0 is a dummy.
  */
-static struct cpuidle_state nehalem_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state nehalem_cstates[] __initdata = {
         {
                 .name = "C1-NHM",
                 .desc = "MWAIT 0x00",
@@ -156,7 +156,7 @@ static struct cpuidle_state nehalem_cstates[CPUIDLE_STATE_MAX] = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state snb_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state snb_cstates[] __initdata = {
         {
                 .name = "C1-SNB",
                 .desc = "MWAIT 0x00",
@@ -196,7 +196,7 @@ static struct cpuidle_state snb_cstates[CPUIDLE_STATE_MAX] = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state ivb_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state ivb_cstates[] __initdata = {
         {
                 .name = "C1-IVB",
                 .desc = "MWAIT 0x00",
@@ -236,7 +236,7 @@ static struct cpuidle_state ivb_cstates[CPUIDLE_STATE_MAX] = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state hsw_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state hsw_cstates[] __initdata = {
         {
                 .name = "C1-HSW",
                 .desc = "MWAIT 0x00",
@@ -297,7 +297,7 @@ static struct cpuidle_state hsw_cstates[CPUIDLE_STATE_MAX] = {
                 .enter = NULL }
 };
 
-static struct cpuidle_state atom_cstates[CPUIDLE_STATE_MAX] = {
+static struct cpuidle_state atom_cstates[] __initdata = {
         {
                 .name = "C1E-ATM",
                 .desc = "MWAIT 0x00",
@@ -390,7 +390,7 @@ static int cpu_hotplug_notify(struct notifier_block *n,
         int hotcpu = (unsigned long)hcpu;
         struct cpuidle_device *dev;
 
-        switch (action & 0xf) {
+        switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_ONLINE:
 
                 if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE)
@@ -490,7 +490,7 @@ MODULE_DEVICE_TABLE(x86cpu, intel_idle_ids);
 /*
  * intel_idle_probe()
  */
-static int intel_idle_probe(void)
+static int __init intel_idle_probe(void)
 {
         unsigned int eax, ebx, ecx;
         const struct x86_cpu_id *id;
@@ -558,7 +558,7 @@ static void intel_idle_cpuidle_devices_uninit(void)
  * intel_idle_cpuidle_driver_init()
  * allocate, initialize cpuidle_states
  */
-static int intel_idle_cpuidle_driver_init(void)
+static int __init intel_idle_cpuidle_driver_init(void)
 {
         int cstate;
         struct cpuidle_driver *drv = &intel_idle_driver;
@@ -628,7 +628,7 @@ static int intel_idle_cpu_init(int cpu)
                 int num_substates, mwait_hint, mwait_cstate, mwait_substate;
 
                 if (cpuidle_state_table[cstate].enter == NULL)
-                        continue;
+                        break;
 
                 if (cstate + 1 > max_cstate) {
                         printk(PREFIX "max_cstate %d reached\n", max_cstate);
diff --git a/drivers/iio/amplifiers/ad8366.c b/drivers/iio/amplifiers/ad8366.c
index d0a79a4bce1c..ba6f6a91dfff 100644
--- a/drivers/iio/amplifiers/ad8366.c
+++ b/drivers/iio/amplifiers/ad8366.c
@@ -185,10 +185,8 @@ static int ad8366_remove(struct spi_device *spi)
 
         iio_device_unregister(indio_dev);
 
-        if (!IS_ERR(reg)) {
+        if (!IS_ERR(reg))
                 regulator_disable(reg);
-                regulator_put(reg);
-        }
 
         return 0;
 }
diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
index a7b30be86ae0..52605c0ea3a6 100644
--- a/drivers/iio/frequency/adf4350.c
+++ b/drivers/iio/frequency/adf4350.c
@@ -525,8 +525,10 @@ static int adf4350_probe(struct spi_device *spi)
         }
 
         indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
-        if (indio_dev == NULL)
-                return -ENOMEM;
+        if (indio_dev == NULL) {
+                ret =  -ENOMEM;
+                goto error_disable_clk;
+        }
 
         st = iio_priv(indio_dev);
 
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 2710f7245c3b..2db7dcd826b9 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -477,6 +477,9 @@ void iio_disable_all_buffers(struct iio_dev *indio_dev)
         indio_dev->currentmode = INDIO_DIRECT_MODE;
         if (indio_dev->setup_ops->postdisable)
                 indio_dev->setup_ops->postdisable(indio_dev);
+
+        if (indio_dev->available_scan_masks == NULL)
+                kfree(indio_dev->active_scan_mask);
 }
 
 int iio_update_buffers(struct iio_dev *indio_dev,
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 8e84cd522e49..f95c6979efd8 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -852,7 +852,6 @@ static void iio_dev_release(struct device *device)
                 iio_device_unregister_trigger_consumer(indio_dev);
         iio_device_unregister_eventset(indio_dev);
         iio_device_unregister_sysfs(indio_dev);
-        iio_device_unregister_debugfs(indio_dev);
 
         ida_simple_remove(&iio_ida, indio_dev->id);
         kfree(indio_dev);
@@ -1087,6 +1086,7 @@ void iio_device_unregister(struct iio_dev *indio_dev)
 
         if (indio_dev->chrdev.dev)
                 cdev_del(&indio_dev->chrdev);
+        iio_device_unregister_debugfs(indio_dev);
 
         iio_disable_all_buffers(indio_dev);
 
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index e8d2849cc81d..cab3bc7494a2 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -29,9 +29,9 @@
 #define ST_MAGN_NUMBER_DATA_CHANNELS            3
 
 /* DEFAULT VALUE FOR SENSORS */
-#define ST_MAGN_DEFAULT_OUT_X_L_ADDR            0X04
-#define ST_MAGN_DEFAULT_OUT_Y_L_ADDR            0X08
-#define ST_MAGN_DEFAULT_OUT_Z_L_ADDR            0X06
+#define ST_MAGN_DEFAULT_OUT_X_H_ADDR            0X03
+#define ST_MAGN_DEFAULT_OUT_Y_H_ADDR            0X07
+#define ST_MAGN_DEFAULT_OUT_Z_H_ADDR            0X05
 
 /* FULLSCALE */
 #define ST_MAGN_FS_AVL_1300MG                   1300
@@ -117,16 +117,16 @@
 static const struct iio_chan_spec st_magn_16bit_channels[] = {
         ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                         BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_X, 1, IIO_MOD_X, 's', IIO_LE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_X_L_ADDR),
+                        ST_SENSORS_SCAN_X, 1, IIO_MOD_X, 's', IIO_BE, 16, 16,
+                        ST_MAGN_DEFAULT_OUT_X_H_ADDR),
         ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                         BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_Y, 1, IIO_MOD_Y, 's', IIO_LE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_Y_L_ADDR),
+                        ST_SENSORS_SCAN_Y, 1, IIO_MOD_Y, 's', IIO_BE, 16, 16,
+                        ST_MAGN_DEFAULT_OUT_Y_H_ADDR),
         ST_SENSORS_LSM_CHANNELS(IIO_MAGN,
                         BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
-                        ST_SENSORS_SCAN_Z, 1, IIO_MOD_Z, 's', IIO_LE, 16, 16,
-                        ST_MAGN_DEFAULT_OUT_Z_L_ADDR),
+                        ST_SENSORS_SCAN_Z, 1, IIO_MOD_Z, 's', IIO_BE, 16, 16,
+                        ST_MAGN_DEFAULT_OUT_Z_H_ADDR),
         IIO_CHAN_SOFT_TIMESTAMP(3)
 };
 
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 5ceda710f516..b84791f03a27 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -31,6 +31,17 @@ config INFINIBAND_USER_ACCESS
           libibverbs, libibcm and a hardware driver library from
           <http://www.openfabrics.org/git/>.
 
+config INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
+       bool "Experimental and unstable ABI for userspace access to flow steering verbs"
+       depends on INFINIBAND_USER_ACCESS
+       depends on STAGING
+        ---help---
+          The final ABI for userspace access to flow steering verbs
+          has not been defined.  To use the current ABI, *WHICH WILL
+          CHANGE IN THE FUTURE*, say Y here.
+
+          If unsure, say N.
+
 config INFINIBAND_USER_MEM
         bool
         depends on INFINIBAND_USER_ACCESS != n
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index d040b877475f..d8f9c6c272d7 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -217,7 +217,9 @@ IB_UVERBS_DECLARE_CMD(destroy_srq);
 IB_UVERBS_DECLARE_CMD(create_xsrq);
 IB_UVERBS_DECLARE_CMD(open_xrcd);
 IB_UVERBS_DECLARE_CMD(close_xrcd);
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 IB_UVERBS_DECLARE_CMD(create_flow);
 IB_UVERBS_DECLARE_CMD(destroy_flow);
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 
 #endif /* UVERBS_H */
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index f2b81b9ee0d6..2f0f01b70e3b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -54,7 +54,9 @@ static struct uverbs_lock_class qp_lock_class	= { .name = "QP-uobj" };
 static struct uverbs_lock_class ah_lock_class   = { .name = "AH-uobj" };
 static struct uverbs_lock_class srq_lock_class  = { .name = "SRQ-uobj" };
 static struct uverbs_lock_class xrcd_lock_class = { .name = "XRCD-uobj" };
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 static struct uverbs_lock_class rule_lock_class = { .name = "RULE-uobj" };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
         do {                                                            \
@@ -2599,6 +2601,7 @@ out_put:
         return ret ? ret : in_len;
 }
 
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 static int kern_spec_to_ib_spec(struct ib_kern_spec *kern_spec,
                                 union ib_flow_spec *ib_spec)
 {
@@ -2824,6 +2827,7 @@ ssize_t ib_uverbs_destroy_flow(struct ib_uverbs_file *file,
 
         return ret ? ret : in_len;
 }
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 
 static int __uverbs_create_xsrq(struct ib_uverbs_file *file,
                                 struct ib_uverbs_create_xsrq *cmd,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 75ad86c4abf8..2df31f68ea09 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -115,8 +115,10 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
         [IB_USER_VERBS_CMD_CLOSE_XRCD]          = ib_uverbs_close_xrcd,
         [IB_USER_VERBS_CMD_CREATE_XSRQ]         = ib_uverbs_create_xsrq,
         [IB_USER_VERBS_CMD_OPEN_QP]             = ib_uverbs_open_qp,
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
         [IB_USER_VERBS_CMD_CREATE_FLOW]         = ib_uverbs_create_flow,
         [IB_USER_VERBS_CMD_DESTROY_FLOW]        = ib_uverbs_destroy_flow
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 };
 
 static void ib_uverbs_add_one(struct ib_device *device);
@@ -605,6 +607,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
         if (!(file->device->ib_dev->uverbs_cmd_mask & (1ull << hdr.command)))
                 return -ENOSYS;
 
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
         if (hdr.command >= IB_USER_VERBS_CMD_THRESHOLD) {
                 struct ib_uverbs_cmd_hdr_ex hdr_ex;
 
@@ -621,6 +624,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                      (hdr_ex.out_words +
                                                       hdr_ex.provider_out_words) * 4);
         } else {
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
                 if (hdr.in_words * 4 != count)
                         return -EINVAL;
 
@@ -628,7 +632,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                                                      buf + sizeof(hdr),
                                                      hdr.in_words * 4,
                                                      hdr.out_words * 4);
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
         }
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 }
 
 static int ib_uverbs_mmap(struct file *filp, struct vm_area_struct *vma)
diff --git a/drivers/infiniband/hw/amso1100/c2_ae.c b/drivers/infiniband/hw/amso1100/c2_ae.c
index d5d1929753e4..cedda25232be 100644
--- a/drivers/infiniband/hw/amso1100/c2_ae.c
+++ b/drivers/infiniband/hw/amso1100/c2_ae.c
@@ -141,7 +141,7 @@ static const char *to_qp_state_str(int state)
                 return "C2_QP_STATE_ERROR";
         default:
                 return "<invalid QP state>";
-        };
+        }
 }
 
 void c2_ae_event(struct c2_dev *c2dev, u32 mq_index)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index d6c5a73becf4..f0612645de99 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1691,9 +1691,11 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
                 ibdev->ib_dev.create_flow       = mlx4_ib_create_flow;
                 ibdev->ib_dev.destroy_flow      = mlx4_ib_destroy_flow;
 
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
                 ibdev->ib_dev.uverbs_cmd_mask   |=
                         (1ull << IB_USER_VERBS_CMD_CREATE_FLOW) |
                         (1ull << IB_USER_VERBS_CMD_DESTROY_FLOW);
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
         }
 
         mlx4_ib_alloc_eqs(dev, ibdev);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 3f831de9a4d8..b1a6cb3a2809 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -164,6 +164,7 @@ int mlx5_vector2eqn(struct mlx5_ib_dev *dev, int vector, int *eqn, int *irqn)
 static int alloc_comp_eqs(struct mlx5_ib_dev *dev)
 {
         struct mlx5_eq_table *table = &dev->mdev.priv.eq_table;
+        char name[MLX5_MAX_EQ_NAME];
         struct mlx5_eq *eq, *n;
         int ncomp_vec;
         int nent;
@@ -180,11 +181,10 @@ static int alloc_comp_eqs(struct mlx5_ib_dev *dev)
                         goto clean;
                 }
 
-                snprintf(eq->name, MLX5_MAX_EQ_NAME, "mlx5_comp%d", i);
+                snprintf(name, MLX5_MAX_EQ_NAME, "mlx5_comp%d", i);
                 err = mlx5_create_map_eq(&dev->mdev, eq,
                                          i + MLX5_EQ_VEC_COMP_BASE, nent, 0,
-                                         eq->name,
-                                         &dev->mdev.priv.uuari.uars[0]);
+                                         name, &dev->mdev.priv.uuari.uars[0]);
                 if (err) {
                         kfree(eq);
                         goto clean;
@@ -301,9 +301,8 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
         props->max_srq_sge         = max_rq_sg - 1;
         props->max_fast_reg_page_list_len = (unsigned int)-1;
         props->local_ca_ack_delay  = dev->mdev.caps.local_ca_ack_delay;
-        props->atomic_cap          = dev->mdev.caps.flags & MLX5_DEV_CAP_FLAG_ATOMIC ?
-                IB_ATOMIC_HCA : IB_ATOMIC_NONE;
-        props->masked_atomic_cap   = IB_ATOMIC_HCA;
+        props->atomic_cap          = IB_ATOMIC_NONE;
+        props->masked_atomic_cap   = IB_ATOMIC_NONE;
         props->max_pkeys           = be16_to_cpup((__be16 *)(out_mad->data + 28));
         props->max_mcast_grp       = 1 << dev->mdev.caps.log_max_mcg;
         props->max_mcast_qp_attach = dev->mdev.caps.max_qp_mcg;
@@ -1006,6 +1005,11 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, enum mlx5_dev_event event,
         ibev.device           = &ibdev->ib_dev;
         ibev.element.port_num = port;
 
+        if (port < 1 || port > ibdev->num_ports) {
+                mlx5_ib_warn(ibdev, "warning: event on port %d\n", port);
+                return;
+        }
+
         if (ibdev->ib_active)
                 ib_dispatch_event(&ibev);
 }
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index bd41df95b6f0..3453580b1eb2 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -42,6 +42,10 @@ enum {
         DEF_CACHE_SIZE  = 10,
 };
 
+enum {
+        MLX5_UMR_ALIGN  = 2048
+};
+
 static __be64 *mr_align(__be64 *ptr, int align)
 {
         unsigned long mask = align - 1;
@@ -61,13 +65,11 @@ static int order2idx(struct mlx5_ib_dev *dev, int order)
 
 static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
         struct mlx5_mr_cache *cache = &dev->cache;
         struct mlx5_cache_ent *ent = &cache->ent[c];
         struct mlx5_create_mkey_mbox_in *in;
         struct mlx5_ib_mr *mr;
         int npages = 1 << ent->order;
-        int size = sizeof(u64) * npages;
         int err = 0;
         int i;
 
@@ -83,21 +85,6 @@ static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
                 }
                 mr->order = ent->order;
                 mr->umred = 1;
-                mr->pas = kmalloc(size + 0x3f, GFP_KERNEL);
-                if (!mr->pas) {
-                        kfree(mr);
-                        err = -ENOMEM;
-                        goto out;
-                }
-                mr->dma = dma_map_single(ddev, mr_align(mr->pas, 0x40), size,
-                                         DMA_TO_DEVICE);
-                if (dma_mapping_error(ddev, mr->dma)) {
-                        kfree(mr->pas);
-                        kfree(mr);
-                        err = -ENOMEM;
-                        goto out;
-                }
-
                 in->seg.status = 1 << 6;
                 in->seg.xlt_oct_size = cpu_to_be32((npages + 1) / 2);
                 in->seg.qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
@@ -108,8 +95,6 @@ static int add_keys(struct mlx5_ib_dev *dev, int c, int num)
                                             sizeof(*in));
                 if (err) {
                         mlx5_ib_warn(dev, "create mkey failed %d\n", err);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
                         kfree(mr);
                         goto out;
                 }
@@ -129,11 +114,9 @@ out:
 
 static void remove_keys(struct mlx5_ib_dev *dev, int c, int num)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
         struct mlx5_mr_cache *cache = &dev->cache;
         struct mlx5_cache_ent *ent = &cache->ent[c];
         struct mlx5_ib_mr *mr;
-        int size;
         int err;
         int i;
 
@@ -149,14 +132,10 @@ static void remove_keys(struct mlx5_ib_dev *dev, int c, int num)
                 ent->size--;
                 spin_unlock(&ent->lock);
                 err = mlx5_core_destroy_mkey(&dev->mdev, &mr->mmr);
-                if (err) {
+                if (err)
                         mlx5_ib_warn(dev, "failed destroy mkey\n");
-                } else {
-                        size = ALIGN(sizeof(u64) * (1 << mr->order), 0x40);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
+                else
                         kfree(mr);
-                }
         }
 }
 
@@ -408,13 +387,12 @@ static void free_cached_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 
 static void clean_keys(struct mlx5_ib_dev *dev, int c)
 {
-        struct device *ddev = dev->ib_dev.dma_device;
         struct mlx5_mr_cache *cache = &dev->cache;
         struct mlx5_cache_ent *ent = &cache->ent[c];
         struct mlx5_ib_mr *mr;
-        int size;
         int err;
 
+        cancel_delayed_work(&ent->dwork);
         while (1) {
                 spin_lock(&ent->lock);
                 if (list_empty(&ent->head)) {
@@ -427,14 +405,10 @@ static void clean_keys(struct mlx5_ib_dev *dev, int c)
                 ent->size--;
                 spin_unlock(&ent->lock);
                 err = mlx5_core_destroy_mkey(&dev->mdev, &mr->mmr);
-                if (err) {
+                if (err)
                         mlx5_ib_warn(dev, "failed destroy mkey\n");
-                } else {
-                        size = ALIGN(sizeof(u64) * (1 << mr->order), 0x40);
-                        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
-                        kfree(mr->pas);
+                else
                         kfree(mr);
-                }
         }
 }
 
@@ -540,13 +514,15 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
         int i;
 
         dev->cache.stopped = 1;
-        destroy_workqueue(dev->cache.wq);
+        flush_workqueue(dev->cache.wq);
 
         mlx5_mr_cache_debugfs_cleanup(dev);
 
         for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++)
                 clean_keys(dev, i);
 
+        destroy_workqueue(dev->cache.wq);
+
         return 0;
 }
 
@@ -675,10 +651,12 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
                                   int page_shift, int order, int access_flags)
 {
         struct mlx5_ib_dev *dev = to_mdev(pd->device);
+        struct device *ddev = dev->ib_dev.dma_device;
         struct umr_common *umrc = &dev->umrc;
         struct ib_send_wr wr, *bad;
         struct mlx5_ib_mr *mr;
         struct ib_sge sg;
+        int size = sizeof(u64) * npages;
         int err;
         int i;
 
@@ -697,7 +675,22 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
         if (!mr)
                 return ERR_PTR(-EAGAIN);
 
-        mlx5_ib_populate_pas(dev, umem, page_shift, mr_align(mr->pas, 0x40), 1);
+        mr->pas = kmalloc(size + MLX5_UMR_ALIGN - 1, GFP_KERNEL);
+        if (!mr->pas) {
+                err = -ENOMEM;
+                goto error;
+        }
+
+        mlx5_ib_populate_pas(dev, umem, page_shift,
+                             mr_align(mr->pas, MLX5_UMR_ALIGN), 1);
+
+        mr->dma = dma_map_single(ddev, mr_align(mr->pas, MLX5_UMR_ALIGN), size,
+                                 DMA_TO_DEVICE);
+        if (dma_mapping_error(ddev, mr->dma)) {
+                kfree(mr->pas);
+                err = -ENOMEM;
+                goto error;
+        }
 
         memset(&wr, 0, sizeof(wr));
         wr.wr_id = (u64)(unsigned long)mr;
@@ -718,6 +711,9 @@ static struct mlx5_ib_mr *reg_umr(struct ib_pd *pd, struct ib_umem *umem,
         wait_for_completion(&mr->done);
         up(&umrc->sem);
 
+        dma_unmap_single(ddev, mr->dma, size, DMA_TO_DEVICE);
+        kfree(mr->pas);
+
         if (mr->status != IB_WC_SUCCESS) {
                 mlx5_ib_warn(dev, "reg umr failed\n");
                 err = -EFAULT;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 045f8cdbd303..5659ea880741 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -203,7 +203,7 @@ static int sq_overhead(enum ib_qp_type qp_type)
 
         switch (qp_type) {
         case IB_QPT_XRC_INI:
-                size = sizeof(struct mlx5_wqe_xrc_seg);
+                size += sizeof(struct mlx5_wqe_xrc_seg);
                 /* fall through */
         case IB_QPT_RC:
                 size += sizeof(struct mlx5_wqe_ctrl_seg) +
@@ -211,20 +211,23 @@ static int sq_overhead(enum ib_qp_type qp_type)
                         sizeof(struct mlx5_wqe_raddr_seg);
                 break;
 
+        case IB_QPT_XRC_TGT:
+                return 0;
+
         case IB_QPT_UC:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                         sizeof(struct mlx5_wqe_raddr_seg);
                 break;
 
         case IB_QPT_UD:
         case IB_QPT_SMI:
         case IB_QPT_GSI:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                         sizeof(struct mlx5_wqe_datagram_seg);
                 break;
 
         case MLX5_IB_QPT_REG_UMR:
-                size = sizeof(struct mlx5_wqe_ctrl_seg) +
+                size += sizeof(struct mlx5_wqe_ctrl_seg) +
                         sizeof(struct mlx5_wqe_umr_ctrl_seg) +
                         sizeof(struct mlx5_mkey_seg);
                 break;
@@ -270,7 +273,8 @@ static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
                 return wqe_size;
 
         if (wqe_size > dev->mdev.caps.max_sq_desc_sz) {
-                mlx5_ib_dbg(dev, "\n");
+                mlx5_ib_dbg(dev, "wqe_size(%d) > max_sq_desc_sz(%d)\n",
+                            wqe_size, dev->mdev.caps.max_sq_desc_sz);
                 return -EINVAL;
         }
 
@@ -280,9 +284,15 @@ static int calc_sq_size(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
 
         wq_size = roundup_pow_of_two(attr->cap.max_send_wr * wqe_size);
         qp->sq.wqe_cnt = wq_size / MLX5_SEND_WQE_BB;
+        if (qp->sq.wqe_cnt > dev->mdev.caps.max_wqes) {
+                mlx5_ib_dbg(dev, "wqe count(%d) exceeds limits(%d)\n",
+                            qp->sq.wqe_cnt, dev->mdev.caps.max_wqes);
+                return -ENOMEM;
+        }
         qp->sq.wqe_shift = ilog2(MLX5_SEND_WQE_BB);
         qp->sq.max_gs = attr->cap.max_send_sge;
-        qp->sq.max_post = 1 << ilog2(wq_size / wqe_size);
+        qp->sq.max_post = wq_size / wqe_size;
+        attr->cap.max_send_wr = qp->sq.max_post;
 
         return wq_size;
 }
@@ -1280,6 +1290,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
                                           MLX5_QP_OPTPAR_Q_KEY,
                         [MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_PKEY_INDEX    |
                                            MLX5_QP_OPTPAR_Q_KEY,
+                        [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
+                                          MLX5_QP_OPTPAR_RRE            |
+                                          MLX5_QP_OPTPAR_RAE            |
+                                          MLX5_QP_OPTPAR_RWE            |
+                                          MLX5_QP_OPTPAR_PKEY_INDEX,
                 },
         },
         [MLX5_QP_STATE_RTR] = {
@@ -1314,6 +1329,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
                 [MLX5_QP_STATE_RTS] = {
                         [MLX5_QP_ST_UD]  = MLX5_QP_OPTPAR_Q_KEY,
                         [MLX5_QP_ST_MLX] = MLX5_QP_OPTPAR_Q_KEY,
+                        [MLX5_QP_ST_UC]  = MLX5_QP_OPTPAR_RWE,
+                        [MLX5_QP_ST_RC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT   |
+                                           MLX5_QP_OPTPAR_RWE           |
+                                           MLX5_QP_OPTPAR_RAE           |
+                                           MLX5_QP_OPTPAR_RRE,
                 },
         },
 };
@@ -1651,29 +1671,6 @@ static __always_inline void set_raddr_seg(struct mlx5_wqe_raddr_seg *rseg,
         rseg->reserved = 0;
 }
 
-static void set_atomic_seg(struct mlx5_wqe_atomic_seg *aseg, struct ib_send_wr *wr)
-{
-        if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.swap);
-                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add);
-        } else if (wr->opcode == IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
-                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add_mask);
-        } else {
-                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
-                aseg->compare  = 0;
-        }
-}
-
-static void set_masked_atomic_seg(struct mlx5_wqe_masked_atomic_seg *aseg,
-                                  struct ib_send_wr *wr)
-{
-        aseg->swap_add          = cpu_to_be64(wr->wr.atomic.swap);
-        aseg->swap_add_mask     = cpu_to_be64(wr->wr.atomic.swap_mask);
-        aseg->compare           = cpu_to_be64(wr->wr.atomic.compare_add);
-        aseg->compare_mask      = cpu_to_be64(wr->wr.atomic.compare_add_mask);
-}
-
 static void set_datagram_seg(struct mlx5_wqe_datagram_seg *dseg,
                              struct ib_send_wr *wr)
 {
@@ -2063,28 +2060,11 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
                         case IB_WR_ATOMIC_CMP_AND_SWP:
                         case IB_WR_ATOMIC_FETCH_AND_ADD:
-                                set_raddr_seg(seg, wr->wr.atomic.remote_addr,
-                                              wr->wr.atomic.rkey);
-                                seg  += sizeof(struct mlx5_wqe_raddr_seg);
-
-                                set_atomic_seg(seg, wr);
-                                seg  += sizeof(struct mlx5_wqe_atomic_seg);
-
-                                size += (sizeof(struct mlx5_wqe_raddr_seg) +
-                                         sizeof(struct mlx5_wqe_atomic_seg)) / 16;
-                                break;
-
                         case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
-                                set_raddr_seg(seg, wr->wr.atomic.remote_addr,
-                                              wr->wr.atomic.rkey);
-                                seg  += sizeof(struct mlx5_wqe_raddr_seg);
-
-                                set_masked_atomic_seg(seg, wr);
-                                seg  += sizeof(struct mlx5_wqe_masked_atomic_seg);
-
-                                size += (sizeof(struct mlx5_wqe_raddr_seg) +
-                                         sizeof(struct mlx5_wqe_masked_atomic_seg)) / 16;
-                                break;
+                                mlx5_ib_warn(dev, "Atomic operations are not supported yet\n");
+                                err = -ENOSYS;
+                                *bad_wr = wr;
+                                goto out;
 
                         case IB_WR_LOCAL_INV:
                                 next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 84d297afd6a9..0aa478bc291a 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -295,7 +295,7 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
         mlx5_vfree(in);
         if (err) {
                 mlx5_ib_dbg(dev, "create SRQ failed, err %d\n", err);
-                goto err_srq;
+                goto err_usr_kern_srq;
         }
 
         mlx5_ib_dbg(dev, "create SRQ with srqn 0x%x\n", srq->msrq.srqn);
@@ -316,6 +316,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd,
 
 err_core:
         mlx5_core_destroy_srq(&dev->mdev, &srq->msrq);
+
+err_usr_kern_srq:
         if (pd->uobject)
                 destroy_srq_user(pd, srq);
         else
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 7c9d35f39d75..690201738993 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -357,7 +357,7 @@ static int mthca_eq_int(struct mthca_dev *dev, struct mthca_eq *eq)
                         mthca_warn(dev, "Unhandled event %02x(%02x) on EQ %d\n",
                                    eqe->type, eqe->subtype, eq->eqn);
                         break;
-                };
+                }
 
                 set_eqe_hw(eqe);
                 ++eq->cons_index;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 4ed8235d2d36..50219ab2279d 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -150,7 +150,7 @@ enum ib_qp_state get_ibqp_state(enum ocrdma_qp_state qps)
                 return IB_QPS_SQE;
         case OCRDMA_QPS_ERR:
                 return IB_QPS_ERR;
-        };
+        }
         return IB_QPS_ERR;
 }
 
@@ -171,7 +171,7 @@ static enum ocrdma_qp_state get_ocrdma_qp_state(enum ib_qp_state qps)
                 return OCRDMA_QPS_SQE;
         case IB_QPS_ERR:
                 return OCRDMA_QPS_ERR;
-        };
+        }
         return OCRDMA_QPS_ERR;
 }
 
@@ -1982,7 +1982,7 @@ int ocrdma_mbx_create_qp(struct ocrdma_qp *qp, struct ib_qp_init_attr *attrs,
                 break;
         default:
                 return -EINVAL;
-        };
+        }
 
         cmd = ocrdma_init_emb_mqe(OCRDMA_CMD_CREATE_QP, sizeof(*cmd));
         if (!cmd)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 56e004940f18..0ce7674621ea 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -531,7 +531,7 @@ static void ocrdma_event_handler(struct ocrdma_dev *dev, u32 event)
         case BE_DEV_DOWN:
                 ocrdma_close(dev);
                 break;
-        };
+        }
 }
 
 static struct ocrdma_driver ocrdma_drv = {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 6e982bb43c31..69f1d1221a6b 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -141,7 +141,7 @@ static inline void get_link_speed_and_width(struct ocrdma_dev *dev,
                 /* Unsupported */
                 *ib_speed = IB_SPEED_SDR;
                 *ib_width = IB_WIDTH_1X;
-        };
+        }
 }
 
 
@@ -2331,7 +2331,7 @@ static enum ib_wc_status ocrdma_to_ibwc_err(u16 status)
         default:
                 ibwc_status = IB_WC_GENERAL_ERR;
                 break;
-        };
+        }
         return ibwc_status;
 }
 
@@ -2370,7 +2370,7 @@ static void ocrdma_update_wc(struct ocrdma_qp *qp, struct ib_wc *ibwc,
                 pr_err("%s() invalid opcode received = 0x%x\n",
                        __func__, hdr->cw & OCRDMA_WQE_OPCODE_MASK);
                 break;
-        };
+        }
 }
 
 static void ocrdma_set_cqe_status_flushed(struct ocrdma_qp *qp,
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 3591855cc5b5..6df23502059a 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -594,7 +594,7 @@ isert_connect_release(struct isert_conn *isert_conn)
 
         pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
 
-        if (device->use_frwr)
+        if (device && device->use_frwr)
                 isert_conn_free_frwr_pool(isert_conn);
 
         if (isert_conn->conn_qp) {
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 653ac6bfc57a..6c923c7039a1 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1588,7 +1588,7 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
         int resp_data_len;
         int resp_len;
 
-        resp_data_len = (rsp_code == SRP_TSK_MGMT_SUCCESS) ? 0 : 4;
+        resp_data_len = 4;
         resp_len = sizeof(*srp_rsp) + resp_data_len;
 
         srp_rsp = ioctx->ioctx.buf;
@@ -1600,11 +1600,9 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
                                     + atomic_xchg(&ch->req_lim_delta, 0));
         srp_rsp->tag = tag;
 
-        if (rsp_code != SRP_TSK_MGMT_SUCCESS) {
-                srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
-                srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
-                srp_rsp->data[3] = rsp_code;
-        }
+        srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
+        srp_rsp->resp_data_len = cpu_to_be32(resp_data_len);
+        srp_rsp->data[3] = rsp_code;
 
         return resp_len;
 }
@@ -2358,6 +2356,8 @@ static void srpt_release_channel_work(struct work_struct *w)
         transport_deregister_session(se_sess);
         ch->sess = NULL;
 
+        ib_destroy_cm_id(ch->cm_id);
+
         srpt_destroy_ch_ib(ch);
 
         srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring,
@@ -2368,8 +2368,6 @@ static void srpt_release_channel_work(struct work_struct *w)
         list_del(&ch->list);
         spin_unlock_irq(&sdev->spinlock);
 
-        ib_destroy_cm_id(ch->cm_id);
-
         if (ch->release_done)
                 complete(ch->release_done);
 
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index fe302e33f72e..c880ebaf1553 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -52,7 +52,7 @@ config AMD_IOMMU
         select PCI_PRI
         select PCI_PASID
         select IOMMU_API
-        depends on X86_64 && PCI && ACPI && X86_IO_APIC
+        depends on X86_64 && PCI && ACPI
         ---help---
           With this option you can enable support for AMD IOMMU hardware in
           your system. An IOMMU is a hardware component which provides
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index f417e89e1e7e..181c9ba929cd 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -377,6 +377,7 @@ struct arm_smmu_cfg {
         u32                             cbar;
         pgd_t                           *pgd;
 };
+#define INVALID_IRPTNDX                 0xff
 
 #define ARM_SMMU_CB_ASID(cfg)           ((cfg)->cbndx)
 #define ARM_SMMU_CB_VMID(cfg)           ((cfg)->cbndx + 1)
@@ -840,7 +841,7 @@ static int arm_smmu_init_domain_context(struct iommu_domain *domain,
         if (IS_ERR_VALUE(ret)) {
                 dev_err(smmu->dev, "failed to request context IRQ %d (%u)\n",
                         root_cfg->irptndx, irq);
-                root_cfg->irptndx = -1;
+                root_cfg->irptndx = INVALID_IRPTNDX;
                 goto out_free_context;
         }
 
@@ -869,7 +870,7 @@ static void arm_smmu_destroy_domain_context(struct iommu_domain *domain)
         writel_relaxed(0, cb_base + ARM_SMMU_CB_SCTLR);
         arm_smmu_tlb_inv_context(root_cfg);
 
-        if (root_cfg->irptndx != -1) {
+        if (root_cfg->irptndx != INVALID_IRPTNDX) {
                 irq = smmu->irqs[smmu->num_global_irqs + root_cfg->irptndx];
                 free_irq(irq, domain);
         }
@@ -1857,8 +1858,6 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
                 goto out_put_parent;
         }
 
-        arm_smmu_device_reset(smmu);
-
         for (i = 0; i < smmu->num_global_irqs; ++i) {
                 err = request_irq(smmu->irqs[i],
                                   arm_smmu_global_fault,
@@ -1876,6 +1875,8 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
         spin_lock(&arm_smmu_devices_lock);
         list_add(&smmu->list, &arm_smmu_devices);
         spin_unlock(&arm_smmu_devices_lock);
+
+        arm_smmu_device_reset(smmu);
         return 0;
 
 out_free_irqs:
@@ -1966,10 +1967,10 @@ static int __init arm_smmu_init(void)
                 return ret;
 
         /* Oh, for a proper bus abstraction */
-        if (!iommu_present(&platform_bus_type));
+        if (!iommu_present(&platform_bus_type))
                 bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
 
-        if (!iommu_present(&amba_bustype));
+        if (!iommu_present(&amba_bustype))
                 bus_set_iommu(&amba_bustype, &arm_smmu_ops);
 
         return 0;
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 785675a56a10..900946950230 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -88,7 +88,7 @@ static int __init dmar_parse_one_dev_scope(struct acpi_dmar_device_scope *scope,
                         pr_warn("Device scope bus [%d] not found\n", scope->bus);
                         break;
                 }
-                pdev = pci_get_slot(bus, PCI_DEVFN(path->dev, path->fn));
+                pdev = pci_get_slot(bus, PCI_DEVFN(path->device, path->function));
                 if (!pdev) {
                         /* warning will be printed below */
                         break;
@@ -99,7 +99,7 @@ static int __init dmar_parse_one_dev_scope(struct acpi_dmar_device_scope *scope,
         }
         if (!pdev) {
                 pr_warn("Device scope device [%04x:%02x:%02x.%02x] not found\n",
-                        segment, scope->bus, path->dev, path->fn);
+                        segment, scope->bus, path->device, path->function);
                 *dev = NULL;
                 return 0;
         }
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index f71673dbb23d..ab86902fd9ff 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -686,12 +686,12 @@ static void ir_parse_one_hpet_scope(struct acpi_dmar_device_scope *scope,
                  * Access PCI directly due to the PCI
                  * subsystem isn't initialized yet.
                  */
-                bus = read_pci_config_byte(bus, path->dev, path->fn,
+                bus = read_pci_config_byte(bus, path->device, path->function,
                                            PCI_SECONDARY_BUS);
                 path++;
         }
         ir_hpet[ir_hpet_num].bus   = bus;
-        ir_hpet[ir_hpet_num].devfn = PCI_DEVFN(path->dev, path->fn);
+        ir_hpet[ir_hpet_num].devfn = PCI_DEVFN(path->device, path->function);
         ir_hpet[ir_hpet_num].iommu = iommu;
         ir_hpet[ir_hpet_num].id    = scope->enumeration_id;
         ir_hpet_num++;
@@ -714,13 +714,13 @@ static void ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
                  * Access PCI directly due to the PCI
                  * subsystem isn't initialized yet.
                  */
-                bus = read_pci_config_byte(bus, path->dev, path->fn,
+                bus = read_pci_config_byte(bus, path->device, path->function,
                                            PCI_SECONDARY_BUS);
                 path++;
         }
 
         ir_ioapic[ir_ioapic_num].bus   = bus;
-        ir_ioapic[ir_ioapic_num].devfn = PCI_DEVFN(path->dev, path->fn);
+        ir_ioapic[ir_ioapic_num].devfn = PCI_DEVFN(path->device, path->function);
         ir_ioapic[ir_ioapic_num].iommu = iommu;
         ir_ioapic[ir_ioapic_num].id    = scope->enumeration_id;
         ir_ioapic_num++;
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index b39f6f0b45f2..0f12382aa35d 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -498,7 +498,7 @@ struct cached_dev {
          */
         atomic_t                has_dirty;
 
-        struct ratelimit        writeback_rate;
+        struct bch_ratelimit    writeback_rate;
         struct delayed_work     writeback_rate_update;
 
         /*
@@ -507,10 +507,9 @@ struct cached_dev {
          */
         sector_t                last_read;
 
-        /* Number of writeback bios in flight */
-        atomic_t                in_flight;
+        /* Limit number of writeback bios in flight */
+        struct semaphore        in_flight;
         struct closure_with_timer writeback;
-        struct closure_waitlist writeback_wait;
 
         struct keybuf           writeback_keys;
 
diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
index 8010eed06a51..22d1ae72c282 100644
--- a/drivers/md/bcache/bset.c
+++ b/drivers/md/bcache/bset.c
@@ -926,28 +926,45 @@ struct bkey *bch_next_recurse_key(struct btree *b, struct bkey *search)
 
 /* Mergesort */
 
+static void sort_key_next(struct btree_iter *iter,
+                          struct btree_iter_set *i)
+{
+        i->k = bkey_next(i->k);
+
+        if (i->k == i->end)
+                *i = iter->data[--iter->used];
+}
+
 static void btree_sort_fixup(struct btree_iter *iter)
 {
         while (iter->used > 1) {
                 struct btree_iter_set *top = iter->data, *i = top + 1;
-                struct bkey *k;
 
                 if (iter->used > 2 &&
                     btree_iter_cmp(i[0], i[1]))
                         i++;
 
-                for (k = i->k;
-                     k != i->end && bkey_cmp(top->k, &START_KEY(k)) > 0;
-                     k = bkey_next(k))
-                        if (top->k > i->k)
-                                __bch_cut_front(top->k, k);
-                        else if (KEY_SIZE(k))
-                                bch_cut_back(&START_KEY(k), top->k);
-
-                if (top->k < i->k || k == i->k)
+                if (bkey_cmp(top->k, &START_KEY(i->k)) <= 0)
                         break;
 
-                heap_sift(iter, i - top, btree_iter_cmp);
+                if (!KEY_SIZE(i->k)) {
+                        sort_key_next(iter, i);
+                        heap_sift(iter, i - top, btree_iter_cmp);
+                        continue;
+                }
+
+                if (top->k > i->k) {
+                        if (bkey_cmp(top->k, i->k) >= 0)
+                                sort_key_next(iter, i);
+                        else
+                                bch_cut_front(top->k, i->k);
+
+                        heap_sift(iter, i - top, btree_iter_cmp);
+                } else {
+                        /* can't happen because of comparison func */
+                        BUG_ON(!bkey_cmp(&START_KEY(top->k), &START_KEY(i->k)));
+                        bch_cut_back(&START_KEY(i->k), top->k);
+                }
         }
 }
 
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index f9764e61978b..f42fc7ed9cd6 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -255,7 +255,7 @@ void bch_btree_node_read(struct btree *b)
 
         return;
 err:
-        bch_cache_set_error(b->c, "io error reading bucket %lu",
+        bch_cache_set_error(b->c, "io error reading bucket %zu",
                             PTR_BUCKET_NR(b->c, &b->key, 0));
 }
 
@@ -612,7 +612,7 @@ static unsigned long bch_mca_scan(struct shrinker *shrink,
                 return SHRINK_STOP;
 
         /* Return -1 if we can't do anything right now */
-        if (sc->gfp_mask & __GFP_WAIT)
+        if (sc->gfp_mask & __GFP_IO)
                 mutex_lock(&c->bucket_lock);
         else if (!mutex_trylock(&c->bucket_lock))
                 return -1;
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index ba95ab84b2be..8435f81e5d85 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -153,7 +153,8 @@ int bch_journal_read(struct cache_set *c, struct list_head *list,
                 bitmap_zero(bitmap, SB_JOURNAL_BUCKETS);
                 pr_debug("%u journal buckets", ca->sb.njournal_buckets);
 
-                /* Read journal buckets ordered by golden ratio hash to quickly
+                /*
+                 * Read journal buckets ordered by golden ratio hash to quickly
                  * find a sequence of buckets with valid journal entries
                  */
                 for (i = 0; i < ca->sb.njournal_buckets; i++) {
@@ -166,18 +167,20 @@ int bch_journal_read(struct cache_set *c, struct list_head *list,
                                 goto bsearch;
                 }
 
-                /* If that fails, check all the buckets we haven't checked
+                /*
+                 * If that fails, check all the buckets we haven't checked
                  * already
                  */
                 pr_debug("falling back to linear search");
 
-                for (l = 0; l < ca->sb.njournal_buckets; l++) {
-                        if (test_bit(l, bitmap))
-                                continue;
-
+                for (l = find_first_zero_bit(bitmap, ca->sb.njournal_buckets);
+                     l < ca->sb.njournal_buckets;
+                     l = find_next_zero_bit(bitmap, ca->sb.njournal_buckets, l + 1))
                         if (read_bucket(l))
                                 goto bsearch;
-                }
+
+                if (list_empty(list))
+                        continue;
 bsearch:
                 /* Binary search */
                 m = r = find_next_bit(bitmap, ca->sb.njournal_buckets, l + 1);
@@ -197,10 +200,12 @@ bsearch:
                                 r = m;
                 }
 
-                /* Read buckets in reverse order until we stop finding more
+                /*
+                 * Read buckets in reverse order until we stop finding more
                  * journal entries
                  */
-                pr_debug("finishing up");
+                pr_debug("finishing up: m %u njournal_buckets %u",
+                         m, ca->sb.njournal_buckets);
                 l = m;
 
                 while (1) {
@@ -228,9 +233,10 @@ bsearch:
                         }
         }
 
-        c->journal.seq = list_entry(list->prev,
-                                    struct journal_replay,
-                                    list)->j.seq;
+        if (!list_empty(list))
+                c->journal.seq = list_entry(list->prev,
+                                            struct journal_replay,
+                                            list)->j.seq;
 
         return 0;
 #undef read_bucket
@@ -428,7 +434,7 @@ static void do_journal_discard(struct cache *ca)
                 return;
         }
 
-        switch (atomic_read(&ja->discard_in_flight) == DISCARD_IN_FLIGHT) {
+        switch (atomic_read(&ja->discard_in_flight)) {
         case DISCARD_IN_FLIGHT:
                 return;
 
@@ -689,6 +695,7 @@ void bch_journal_meta(struct cache_set *c, struct closure *cl)
                 if (cl)
                         BUG_ON(!closure_wait(&w->wait, cl));
 
+                closure_flush(&c->journal.io);
                 __journal_try_write(c, true);
         }
 }
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 786a1a4f74d8..2a7f0dd6abab 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -996,17 +996,19 @@ static void request_write(struct cached_dev *dc, struct search *s)
                 closure_bio_submit(bio, cl, s->d);
         } else {
                 bch_writeback_add(dc);
+                s->op.cache_bio = bio;
 
-                if (s->op.flush_journal) {
+                if (bio->bi_rw & REQ_FLUSH) {
                         /* Also need to send a flush to the backing device */
-                        s->op.cache_bio = bio_clone_bioset(bio, GFP_NOIO,
-                                                           dc->disk.bio_split);
-
-                        bio->bi_size = 0;
-                        bio->bi_vcnt = 0;
-                        closure_bio_submit(bio, cl, s->d);
-                } else {
-                        s->op.cache_bio = bio;
+                        struct bio *flush = bio_alloc_bioset(GFP_NOIO, 0,
+                                                             dc->disk.bio_split);
+
+                        flush->bi_rw    = WRITE_FLUSH;
+                        flush->bi_bdev  = bio->bi_bdev;
+                        flush->bi_end_io = request_endio;
+                        flush->bi_private = cl;
+
+                        closure_bio_submit(flush, cl, s->d);
                 }
         }
 out:
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 4fe6ab2fbe2e..924dcfdae111 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -223,8 +223,13 @@ STORE(__cached_dev)
         }
 
         if (attr == &sysfs_label) {
-                /* note: endlines are preserved */
-                memcpy(dc->sb.label, buf, SB_LABEL_SIZE);
+                if (size > SB_LABEL_SIZE)
+                        return -EINVAL;
+                memcpy(dc->sb.label, buf, size);
+                if (size < SB_LABEL_SIZE)
+                        dc->sb.label[size] = '\0';
+                if (size && dc->sb.label[size - 1] == '\n')
+                        dc->sb.label[size - 1] = '\0';
                 bch_write_bdev_super(dc, NULL);
                 if (dc->disk.c) {
                         memcpy(dc->disk.c->uuids[dc->disk.id].label,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 98eb81159a22..420dad545c7d 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -190,7 +190,16 @@ void bch_time_stats_update(struct time_stats *stats, uint64_t start_time)
         stats->last = now ?: 1;
 }
 
-unsigned bch_next_delay(struct ratelimit *d, uint64_t done)
+/**
+ * bch_next_delay() - increment @d by the amount of work done, and return how
+ * long to delay until the next time to do some work.
+ *
+ * @d - the struct bch_ratelimit to update
+ * @done - the amount of work done, in arbitrary units
+ *
+ * Returns the amount of time to delay by, in jiffies
+ */
+uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
         uint64_t now = local_clock();
 
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 1ae2a73ad85f..ea345c6896f4 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -450,17 +450,23 @@ read_attribute(name ## _last_ ## frequency_units)
         (ewma) >> factor;                                               \
 })
 
-struct ratelimit {
+struct bch_ratelimit {
+        /* Next time we want to do some work, in nanoseconds */
         uint64_t                next;
+
+        /*
+         * Rate at which we want to do work, in units per nanosecond
+         * The units here correspond to the units passed to bch_next_delay()
+         */
         unsigned                rate;
 };
 
-static inline void ratelimit_reset(struct ratelimit *d)
+static inline void bch_ratelimit_reset(struct bch_ratelimit *d)
 {
         d->next = local_clock();
 }
 
-unsigned bch_next_delay(struct ratelimit *d, uint64_t done);
+uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done);
 
 #define __DIV_SAFE(n, d, zero)                                          \
 ({                                                                      \
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 22cbff551628..ba3ee48320f2 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -94,11 +94,15 @@ static void update_writeback_rate(struct work_struct *work)
 
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
+        uint64_t ret;
+
         if (atomic_read(&dc->disk.detaching) ||
             !dc->writeback_percent)
                 return 0;
 
-        return bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+
+        return min_t(uint64_t, ret, HZ);
 }
 
 /* Background writeback */
@@ -208,7 +212,7 @@ normal_refill:
 
         up_write(&dc->writeback_lock);
 
-        ratelimit_reset(&dc->writeback_rate);
+        bch_ratelimit_reset(&dc->writeback_rate);
 
         /* Punt to workqueue only so we don't recurse and blow the stack */
         continue_at(cl, read_dirty, dirty_wq);
@@ -318,9 +322,7 @@ static void write_dirty_finish(struct closure *cl)
         }
 
         bch_keybuf_del(&dc->writeback_keys, w);
-        atomic_dec_bug(&dc->in_flight);
-
-        closure_wake_up(&dc->writeback_wait);
+        up(&dc->in_flight);
 
         closure_return_with_destructor(cl, dirty_io_destructor);
 }
@@ -349,7 +351,7 @@ static void write_dirty(struct closure *cl)
 
         closure_bio_submit(&io->bio, cl, &io->dc->disk);
 
-        continue_at(cl, write_dirty_finish, dirty_wq);
+        continue_at(cl, write_dirty_finish, system_wq);
 }
 
 static void read_dirty_endio(struct bio *bio, int error)
@@ -369,7 +371,7 @@ static void read_dirty_submit(struct closure *cl)
 
         closure_bio_submit(&io->bio, cl, &io->dc->disk);
 
-        continue_at(cl, write_dirty, dirty_wq);
+        continue_at(cl, write_dirty, system_wq);
 }
 
 static void read_dirty(struct closure *cl)
@@ -394,12 +396,8 @@ static void read_dirty(struct closure *cl)
 
                 if (delay > 0 &&
                     (KEY_START(&w->key) != dc->last_read ||
-                     jiffies_to_msecs(delay) > 50)) {
-                        w->private = NULL;
-
-                        closure_delay(&dc->writeback, delay);
-                        continue_at(cl, read_dirty, dirty_wq);
-                }
+                     jiffies_to_msecs(delay) > 50))
+                        delay = schedule_timeout_uninterruptible(delay);
 
                 dc->last_read   = KEY_OFFSET(&w->key);
 
@@ -424,15 +422,10 @@ static void read_dirty(struct closure *cl)
 
                 trace_bcache_writeback(&w->key);
 
-                closure_call(&io->cl, read_dirty_submit, NULL, &dc->disk.cl);
+                down(&dc->in_flight);
+                closure_call(&io->cl, read_dirty_submit, NULL, cl);
 
                 delay = writeback_delay(dc, KEY_SIZE(&w->key));
-
-                atomic_inc(&dc->in_flight);
-
-                if (!closure_wait_event(&dc->writeback_wait, cl,
-                                        atomic_read(&dc->in_flight) < 64))
-                        continue_at(cl, read_dirty, dirty_wq);
         }
 
         if (0) {
@@ -442,7 +435,11 @@ err:
                 bch_keybuf_del(&dc->writeback_keys, w);
         }
 
-        refill_dirty(cl);
+        /*
+         * Wait for outstanding writeback IOs to finish (and keybuf slots to be
+         * freed) before refilling again
+         */
+        continue_at(cl, refill_dirty, dirty_wq);
 }
 
 /* Init */
@@ -484,6 +481,7 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
 
 void bch_cached_dev_writeback_init(struct cached_dev *dc)
 {
+        sema_init(&dc->in_flight, 64);
         closure_init_unlocked(&dc->writeback);
         init_rwsem(&dc->writeback_lock);
 
@@ -513,7 +511,7 @@ void bch_writeback_exit(void)
 
 int __init bch_writeback_init(void)
 {
-        dirty_wq = create_singlethread_workqueue("bcache_writeback");
+        dirty_wq = create_workqueue("bcache_writeback");
         if (!dirty_wq)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ea49834377c8..2a20986a2fec 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -19,8 +19,6 @@
 #define DM_MSG_PREFIX "io"
 
 #define DM_IO_MAX_REGIONS       BITS_PER_LONG
-#define MIN_IOS         16
-#define MIN_BIOS        16
 
 struct dm_io_client {
         mempool_t *pool;
@@ -50,16 +48,17 @@ static struct kmem_cache *_dm_io_cache;
 struct dm_io_client *dm_io_client_create(void)
 {
         struct dm_io_client *client;
+        unsigned min_ios = dm_get_reserved_bio_based_ios();
 
         client = kmalloc(sizeof(*client), GFP_KERNEL);
         if (!client)
                 return ERR_PTR(-ENOMEM);
 
-        client->pool = mempool_create_slab_pool(MIN_IOS, _dm_io_cache);
+        client->pool = mempool_create_slab_pool(min_ios, _dm_io_cache);
         if (!client->pool)
                 goto bad;
 
-        client->bios = bioset_create(MIN_BIOS, 0);
+        client->bios = bioset_create(min_ios, 0);
         if (!client->bios)
                 goto bad;
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index b759a127f9c3..de570a558764 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -7,6 +7,7 @@
 
 #include <linux/device-mapper.h>
 
+#include "dm.h"
 #include "dm-path-selector.h"
 #include "dm-uevent.h"
 
@@ -116,8 +117,6 @@ struct dm_mpath_io {
 
 typedef int (*action_fn) (struct pgpath *pgpath);
 
-#define MIN_IOS 256     /* Mempool size */
-
 static struct kmem_cache *_mpio_cache;
 
 static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
@@ -190,6 +189,7 @@ static void free_priority_group(struct priority_group *pg,
 static struct multipath *alloc_multipath(struct dm_target *ti)
 {
         struct multipath *m;
+        unsigned min_ios = dm_get_reserved_rq_based_ios();
 
         m = kzalloc(sizeof(*m), GFP_KERNEL);
         if (m) {
@@ -202,7 +202,7 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
                 INIT_WORK(&m->trigger_event, trigger_event);
                 init_waitqueue_head(&m->pg_init_wait);
                 mutex_init(&m->work_mutex);
-                m->mpio_pool = mempool_create_slab_pool(MIN_IOS, _mpio_cache);
+                m->mpio_pool = mempool_create_slab_pool(min_ios, _mpio_cache);
                 if (!m->mpio_pool) {
                         kfree(m);
                         return NULL;
@@ -1268,6 +1268,7 @@ static int noretry_error(int error)
         case -EREMOTEIO:
         case -EILSEQ:
         case -ENODATA:
+        case -ENOSPC:
                 return 1;
         }
 
@@ -1298,8 +1299,17 @@ static int do_end_io(struct multipath *m, struct request *clone,
         if (!error && !clone->errors)
                 return 0;       /* I/O complete */
 
-        if (noretry_error(error))
+        if (noretry_error(error)) {
+                if ((clone->cmd_flags & REQ_WRITE_SAME) &&
+                    !clone->q->limits.max_write_same_sectors) {
+                        struct queue_limits *limits;
+
+                        /* device doesn't really support WRITE SAME, disable it */
+                        limits = dm_get_queue_limits(dm_table_get_md(m->ti->table));
+                        limits->max_write_same_sectors = 0;
+                }
                 return error;
+        }
 
         if (mpio->pgpath)
                 fail_path(mpio->pgpath);
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 3ac415675b6c..2d2b1b7588d7 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -256,7 +256,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
          */
         INIT_WORK_ONSTACK(&req.work, do_metadata);
         queue_work(ps->metadata_wq, &req.work);
-        flush_work(&req.work);
+        flush_workqueue(ps->metadata_wq);
 
         return req.result;
 }
@@ -269,6 +269,14 @@ static chunk_t area_location(struct pstore *ps, chunk_t area)
         return NUM_SNAPSHOT_HDR_CHUNKS + ((ps->exceptions_per_area + 1) * area);
 }
 
+static void skip_metadata(struct pstore *ps)
+{
+        uint32_t stride = ps->exceptions_per_area + 1;
+        chunk_t next_free = ps->next_free;
+        if (sector_div(next_free, stride) == NUM_SNAPSHOT_HDR_CHUNKS)
+                ps->next_free++;
+}
+
 /*
  * Read or write a metadata area.  Remembering to skip the first
  * chunk which holds the header.
@@ -502,6 +510,8 @@ static int read_exceptions(struct pstore *ps,
 
         ps->current_area--;
 
+        skip_metadata(ps);
+
         return 0;
 }
 
@@ -616,8 +626,6 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
                                         struct dm_exception *e)
 {
         struct pstore *ps = get_info(store);
-        uint32_t stride;
-        chunk_t next_free;
         sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
 
         /* Is there enough room ? */
@@ -630,10 +638,8 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
          * Move onto the next free pending, making sure to take
          * into account the location of the metadata chunks.
          */
-        stride = (ps->exceptions_per_area + 1);
-        next_free = ++ps->next_free;
-        if (sector_div(next_free, stride) == 1)
-                ps->next_free++;
+        ps->next_free++;
+        skip_metadata(ps);
 
         atomic_inc(&ps->pending_count);
         return 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index c434e5aab2df..aec57d76db5d 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -725,17 +725,16 @@ static int calc_max_buckets(void)
  */
 static int init_hash_tables(struct dm_snapshot *s)
 {
-        sector_t hash_size, cow_dev_size, origin_dev_size, max_buckets;
+        sector_t hash_size, cow_dev_size, max_buckets;
 
         /*
          * Calculate based on the size of the original volume or
          * the COW volume...
          */
         cow_dev_size = get_dev_size(s->cow->bdev);
-        origin_dev_size = get_dev_size(s->origin->bdev);
         max_buckets = calc_max_buckets();
 
-        hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
+        hash_size = cow_dev_size >> s->store->chunk_shift;
         hash_size = min(hash_size, max_buckets);
 
         if (hash_size < 64)
diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
index 8ae31e8d3d64..3d404c1371ed 100644
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -451,19 +451,26 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry,
         struct dm_stat_percpu *p;
 
         /*
-         * For strict correctness we should use local_irq_disable/enable
+         * For strict correctness we should use local_irq_save/restore
          * instead of preempt_disable/enable.
          *
-         * This is racy if the driver finishes bios from non-interrupt
-         * context as well as from interrupt context or from more different
-         * interrupts.
+         * preempt_disable/enable is racy if the driver finishes bios
+         * from non-interrupt context as well as from interrupt context
+         * or from more different interrupts.
          *
-         * However, the race only results in not counting some events,
-         * so it is acceptable.
+         * On 64-bit architectures the race only results in not counting some
+         * events, so it is acceptable.  On 32-bit architectures the race could
+         * cause the counter going off by 2^32, so we need to do proper locking
+         * there.
          *
          * part_stat_lock()/part_stat_unlock() have this race too.
          */
+#if BITS_PER_LONG == 32
+        unsigned long flags;
+        local_irq_save(flags);
+#else
         preempt_disable();
+#endif
         p = &s->stat_percpu[smp_processor_id()][entry];
 
         if (!end) {
@@ -478,7 +485,11 @@ static void dm_stat_for_entry(struct dm_stat *s, size_t entry,
                 p->ticks[idx] += duration;
         }
 
+#if BITS_PER_LONG == 32
+        local_irq_restore(flags);
+#else
         preempt_enable();
+#endif
 }
 
 static void __dm_stat_bio(struct dm_stat *s, unsigned long bi_rw,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index ed063427d676..2c0cf511ec23 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2095,6 +2095,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
          * them down to the data device.  The thin device's discard
          * processing will cause mappings to be removed from the btree.
          */
+        ti->discard_zeroes_data_unsupported = true;
         if (pf.discard_enabled && pf.discard_passdown) {
                 ti->num_discard_bios = 1;
 
@@ -2104,7 +2105,6 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
                  * thin devices' discard limits consistent).
                  */
                 ti->discards_supported = true;
-                ti->discard_zeroes_data_unsupported = true;
         }
         ti->private = pt;
 
@@ -2689,8 +2689,16 @@ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
          * They get transferred to the live pool in bind_control_target()
          * called from pool_preresume().
          */
-        if (!pt->adjusted_pf.discard_enabled)
+        if (!pt->adjusted_pf.discard_enabled) {
+                /*
+                 * Must explicitly disallow stacking discard limits otherwise the
+                 * block layer will stack them if pool's data device has support.
+                 * QUEUE_FLAG_DISCARD wouldn't be set but there is no way for the
+                 * user to see that, so make sure to set all discard limits to 0.
+                 */
+                limits->discard_granularity = 0;
                 return;
+        }
 
         disable_passdown_if_not_supported(pt);
 
@@ -2826,10 +2834,10 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
         ti->per_bio_data_size = sizeof(struct dm_thin_endio_hook);
 
         /* In case the pool supports discards, pass them on. */
+        ti->discard_zeroes_data_unsupported = true;
         if (tc->pool->pf.discard_enabled) {
                 ti->discards_supported = true;
                 ti->num_discard_bios = 1;
-                ti->discard_zeroes_data_unsupported = true;
                 /* Discard bios must be split on a block boundary */
                 ti->split_discard_bios = true;
         }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6a5e9ed2fcc3..b3e26c7d1417 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -211,10 +211,55 @@ struct dm_md_mempools {
         struct bio_set *bs;
 };
 
-#define MIN_IOS 256
+#define RESERVED_BIO_BASED_IOS          16
+#define RESERVED_REQUEST_BASED_IOS      256
+#define RESERVED_MAX_IOS                1024
 static struct kmem_cache *_io_cache;
 static struct kmem_cache *_rq_tio_cache;
 
+/*
+ * Bio-based DM's mempools' reserved IOs set by the user.
+ */
+static unsigned reserved_bio_based_ios = RESERVED_BIO_BASED_IOS;
+
+/*
+ * Request-based DM's mempools' reserved IOs set by the user.
+ */
+static unsigned reserved_rq_based_ios = RESERVED_REQUEST_BASED_IOS;
+
+static unsigned __dm_get_reserved_ios(unsigned *reserved_ios,
+                                      unsigned def, unsigned max)
+{
+        unsigned ios = ACCESS_ONCE(*reserved_ios);
+        unsigned modified_ios = 0;
+
+        if (!ios)
+                modified_ios = def;
+        else if (ios > max)
+                modified_ios = max;
+
+        if (modified_ios) {
+                (void)cmpxchg(reserved_ios, ios, modified_ios);
+                ios = modified_ios;
+        }
+
+        return ios;
+}
+
+unsigned dm_get_reserved_bio_based_ios(void)
+{
+        return __dm_get_reserved_ios(&reserved_bio_based_ios,
+                                     RESERVED_BIO_BASED_IOS, RESERVED_MAX_IOS);
+}
+EXPORT_SYMBOL_GPL(dm_get_reserved_bio_based_ios);
+
+unsigned dm_get_reserved_rq_based_ios(void)
+{
+        return __dm_get_reserved_ios(&reserved_rq_based_ios,
+                                     RESERVED_REQUEST_BASED_IOS, RESERVED_MAX_IOS);
+}
+EXPORT_SYMBOL_GPL(dm_get_reserved_rq_based_ios);
+
 static int __init local_init(void)
 {
         int r = -ENOMEM;
@@ -2278,6 +2323,17 @@ struct target_type *dm_get_immutable_target_type(struct mapped_device *md)
 }
 
 /*
+ * The queue_limits are only valid as long as you have a reference
+ * count on 'md'.
+ */
+struct queue_limits *dm_get_queue_limits(struct mapped_device *md)
+{
+        BUG_ON(!atomic_read(&md->holders));
+        return &md->queue->limits;
+}
+EXPORT_SYMBOL_GPL(dm_get_queue_limits);
+
+/*
  * Fully initialize a request-based queue (->elevator, ->request_fn, etc).
  */
 static int dm_init_request_based_queue(struct mapped_device *md)
@@ -2862,18 +2918,18 @@ struct dm_md_mempools *dm_alloc_md_mempools(unsigned type, unsigned integrity, u
 
         if (type == DM_TYPE_BIO_BASED) {
                 cachep = _io_cache;
-                pool_size = 16;
+                pool_size = dm_get_reserved_bio_based_ios();
                 front_pad = roundup(per_bio_data_size, __alignof__(struct dm_target_io)) + offsetof(struct dm_target_io, clone);
         } else if (type == DM_TYPE_REQUEST_BASED) {
                 cachep = _rq_tio_cache;
-                pool_size = MIN_IOS;
+                pool_size = dm_get_reserved_rq_based_ios();
                 front_pad = offsetof(struct dm_rq_clone_bio_info, clone);
                 /* per_bio_data_size is not used. See __bind_mempools(). */
                 WARN_ON(per_bio_data_size != 0);
         } else
                 goto out;
 
-        pools->io_pool = mempool_create_slab_pool(MIN_IOS, cachep);
+        pools->io_pool = mempool_create_slab_pool(pool_size, cachep);
         if (!pools->io_pool)
                 goto out;
 
@@ -2924,6 +2980,13 @@ module_exit(dm_exit);
 
 module_param(major, uint, 0);
 MODULE_PARM_DESC(major, "The major number of the device mapper");
+
+module_param(reserved_bio_based_ios, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(reserved_bio_based_ios, "Reserved IOs in bio-based mempools");
+
+module_param(reserved_rq_based_ios, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(reserved_rq_based_ios, "Reserved IOs in request-based mempools");
+
 MODULE_DESCRIPTION(DM_NAME " driver");
 MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 5e604cc7b4aa..1d1ad7b7e527 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -184,6 +184,9 @@ void dm_free_md_mempools(struct dm_md_mempools *pools);
 /*
  * Helpers that are used by DM core
  */
+unsigned dm_get_reserved_bio_based_ios(void);
+unsigned dm_get_reserved_rq_based_ios(void);
+
 static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen)
 {
         return !maxlen || strlen(result) + 1 >= maxlen;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index adf4d7e1d5e1..561a65f82e26 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8111,6 +8111,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
         u64 *p;
         int lo, hi;
         int rv = 1;
+        unsigned long flags;
 
         if (bb->shift < 0)
                 /* badblocks are disabled */
@@ -8125,7 +8126,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
                 sectors = next - s;
         }
 
-        write_seqlock_irq(&bb->lock);
+        write_seqlock_irqsave(&bb->lock, flags);
 
         p = bb->page;
         lo = 0;
@@ -8241,7 +8242,7 @@ static int md_set_badblocks(struct badblocks *bb, sector_t s, int sectors,
         bb->changed = 1;
         if (!acknowledged)
                 bb->unacked_exist = 1;
-        write_sequnlock_irq(&bb->lock);
+        write_sequnlock_irqrestore(&bb->lock, flags);
 
         return rv;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d60412c7f995..aacf6bf352d8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1479,6 +1479,7 @@ static int raid1_spare_active(struct mddev *mddev)
                         }
                 }
                 if (rdev
+                    && rdev->recovery_offset == MaxSector
                     && !test_bit(Faulty, &rdev->flags)
                     && !test_and_set_bit(In_sync, &rdev->flags)) {
                         count++;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index df7b0a06b0ea..73dc8a377522 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1782,6 +1782,7 @@ static int raid10_spare_active(struct mddev *mddev)
                         }
                         sysfs_notify_dirent_safe(tmp->replacement->sysfs_state);
                 } else if (tmp->rdev
+                           && tmp->rdev->recovery_offset == MaxSector
                            && !test_bit(Faulty, &tmp->rdev->flags)
                            && !test_and_set_bit(In_sync, &tmp->rdev->flags)) {
                         count++;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 7ff4f252ca1a..f8b906843926 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -778,6 +778,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                         bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                         bi->bi_io_vec[0].bv_offset = 0;
                         bi->bi_size = STRIPE_SIZE;
+                        /*
+                         * If this is discard request, set bi_vcnt 0. We don't
+                         * want to confuse SCSI because SCSI will replace payload
+                         */
+                        if (rw & REQ_DISCARD)
+                                bi->bi_vcnt = 0;
                         if (rrdev)
                                 set_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags);
 
@@ -816,6 +822,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                         rbi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                         rbi->bi_io_vec[0].bv_offset = 0;
                         rbi->bi_size = STRIPE_SIZE;
+                        /*
+                         * If this is discard request, set bi_vcnt 0. We don't
+                         * want to confuse SCSI because SCSI will replace payload
+                         */
+                        if (rw & REQ_DISCARD)
+                                rbi->bi_vcnt = 0;
                         if (conf->mddev->gendisk)
                                 trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
                                                       rbi, disk_devt(conf->mddev->gendisk),
@@ -2910,6 +2922,14 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                 }
                 /* now that discard is done we can proceed with any sync */
                 clear_bit(STRIPE_DISCARD, &sh->state);
+                /*
+                 * SCSI discard will change some bio fields and the stripe has
+                 * no updated data, so remove it from hash list and the stripe
+                 * will be reinitialized
+                 */
+                spin_lock_irq(&conf->device_lock);
+                remove_hash(sh);
+                spin_unlock_irq(&conf->device_lock);
                 if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
                         set_bit(STRIPE_HANDLE, &sh->state);
 
diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
index 2521f7e23018..e79749cfec81 100644
--- a/drivers/media/dvb-frontends/tda10071.c
+++ b/drivers/media/dvb-frontends/tda10071.c
@@ -912,14 +912,8 @@ static int tda10071_init(struct dvb_frontend *fe)
                 { 0xd5, 0x03, 0x03 },
         };
 
-        /* firmware status */
-        ret = tda10071_rd_reg(priv, 0x51, &tmp);
-        if (ret)
-                goto error;
-
-        if (!tmp) {
+        if (priv->warm) {
                 /* warm state - wake up device from sleep */
-                priv->warm = 1;
 
                 for (i = 0; i < ARRAY_SIZE(tab); i++) {
                         ret = tda10071_wr_reg_mask(priv, tab[i].reg,
@@ -937,7 +931,6 @@ static int tda10071_init(struct dvb_frontend *fe)
                         goto error;
         } else {
                 /* cold state - try to download firmware */
-                priv->warm = 0;
 
                 /* request the firmware, this will block and timeout */
                 ret = request_firmware(&fw, fw_file, priv->i2c->dev.parent);
diff --git a/drivers/media/i2c/ad9389b.c b/drivers/media/i2c/ad9389b.c
index bb0c99d7a4f1..b06a7e54ee0d 100644
--- a/drivers/media/i2c/ad9389b.c
+++ b/drivers/media/i2c/ad9389b.c
@@ -628,16 +628,13 @@ static int ad9389b_s_stream(struct v4l2_subdev *sd, int enable)
 
 static const struct v4l2_dv_timings_cap ad9389b_timings_cap = {
         .type = V4L2_DV_BT_656_1120,
-        .bt = {
-                .max_width = 1920,
-                .max_height = 1200,
-                .min_pixelclock = 25000000,
-                .max_pixelclock = 170000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
+        .reserved = { 0 },
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                         V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
-        },
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+                V4L2_DV_BT_CAP_CUSTOM)
 };
 
 static int ad9389b_s_dv_timings(struct v4l2_subdev *sd,
diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
index 7a576097471f..7c8d971f1f61 100644
--- a/drivers/media/i2c/adv7511.c
+++ b/drivers/media/i2c/adv7511.c
@@ -119,16 +119,14 @@ static int adv7511_s_clock_freq(struct v4l2_subdev *sd, u32 freq);
 
 static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
         .type = V4L2_DV_BT_656_1120,
-        .bt = {
-                .max_width = ADV7511_MAX_WIDTH,
-                .max_height = ADV7511_MAX_HEIGHT,
-                .min_pixelclock = ADV7511_MIN_PIXELCLOCK,
-                .max_pixelclock = ADV7511_MAX_PIXELCLOCK,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
+        .reserved = { 0 },
+        V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT,
+                ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                         V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
-        },
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+                        V4L2_DV_BT_CAP_CUSTOM)
 };
 
 static inline struct adv7511_state *get_adv7511_state(struct v4l2_subdev *sd)
@@ -1126,6 +1124,7 @@ static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *
         state->i2c_edid = i2c_new_dummy(client->adapter, state->i2c_edid_addr >> 1);
         if (state->i2c_edid == NULL) {
                 v4l2_err(sd, "failed to register edid i2c client\n");
+                err = -ENOMEM;
                 goto err_entity;
         }
 
@@ -1133,6 +1132,7 @@ static int adv7511_probe(struct i2c_client *client, const struct i2c_device_id *
         state->work_queue = create_singlethread_workqueue(sd->name);
         if (state->work_queue == NULL) {
                 v4l2_err(sd, "could not create workqueue\n");
+                err = -ENOMEM;
                 goto err_unreg_cec;
         }
 
diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index d1748901337c..22f729d66a96 100644
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -546,30 +546,24 @@ static inline bool is_digital_input(struct v4l2_subdev *sd)
 
 static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = {
         .type = V4L2_DV_BT_656_1120,
-        .bt = {
-                .max_width = 1920,
-                .max_height = 1200,
-                .min_pixelclock = 25000000,
-                .max_pixelclock = 170000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
+        .reserved = { 0 },
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                         V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
-        },
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+                        V4L2_DV_BT_CAP_CUSTOM)
 };
 
 static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = {
         .type = V4L2_DV_BT_656_1120,
-        .bt = {
-                .max_width = 1920,
-                .max_height = 1200,
-                .min_pixelclock = 25000000,
-                .max_pixelclock = 225000000,
-                .standards = V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
+        .reserved = { 0 },
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
+                V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
                         V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE |
-                        V4L2_DV_BT_CAP_REDUCED_BLANKING | V4L2_DV_BT_CAP_CUSTOM,
-        },
+                V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |
+                        V4L2_DV_BT_CAP_CUSTOM)
 };
 
 static inline const struct v4l2_dv_timings_cap *
diff --git a/drivers/media/i2c/ths8200.c b/drivers/media/i2c/ths8200.c
index a58a8f663ffb..d9f65d7e3e58 100644
--- a/drivers/media/i2c/ths8200.c
+++ b/drivers/media/i2c/ths8200.c
@@ -46,14 +46,10 @@ struct ths8200_state {
 
 static const struct v4l2_dv_timings_cap ths8200_timings_cap = {
         .type = V4L2_DV_BT_656_1120,
-        .bt = {
-                .max_width = 1920,
-                .max_height = 1080,
-                .min_pixelclock = 25000000,
-                .max_pixelclock = 148500000,
-                .standards = V4L2_DV_BT_STD_CEA861,
-                .capabilities = V4L2_DV_BT_CAP_PROGRESSIVE,
-        },
+        /* keep this initialization for compatibility with GCC < 4.4.6 */
+        .reserved = { 0 },
+        V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000,
+                V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE)
 };
 
 static inline struct ths8200_state *to_state(struct v4l2_subdev *sd)
diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
index e12bbd8c3f0b..fb60da85bc2c 100644
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1455,6 +1455,7 @@ static int video_release(struct file *file)
 
         /* stop video capture */
         if (res_check(fh, RESOURCE_VIDEO)) {
+                pm_qos_remove_request(&dev->qos_request);
                 videobuf_streamoff(&fh->cap);
                 res_free(dev,fh,RESOURCE_VIDEO);
         }
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 15d23968d1de..9b88a4601007 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1423,6 +1423,7 @@ static int s5p_jpeg_probe(struct platform_device *pdev)
         jpeg->vfd_decoder->release      = video_device_release;
         jpeg->vfd_decoder->lock         = &jpeg->lock;
         jpeg->vfd_decoder->v4l2_dev     = &jpeg->v4l2_dev;
+        jpeg->vfd_decoder->vfl_dir      = VFL_DIR_M2M;
 
         ret = video_register_device(jpeg->vfd_decoder, VFL_TYPE_GRABBER, -1);
         if (ret) {
diff --git a/drivers/media/platform/sh_vou.c b/drivers/media/platform/sh_vou.c
index 7a9c5e9329f2..4f30341dc2ab 100644
--- a/drivers/media/platform/sh_vou.c
+++ b/drivers/media/platform/sh_vou.c
@@ -776,7 +776,7 @@ static int sh_vou_try_fmt_vid_out(struct file *file, void *priv,
         v4l_bound_align_image(&pix->width, 0, VOU_MAX_IMAGE_WIDTH, 1,
                               &pix->height, 0, VOU_MAX_IMAGE_HEIGHT, 1, 0);
 
-        for (i = 0; ARRAY_SIZE(vou_fmt); i++)
+        for (i = 0; i < ARRAY_SIZE(vou_fmt); i++)
                 if (vou_fmt[i].pfmt == pix->pixelformat)
                         return 0;
 
diff --git a/drivers/media/platform/soc_camera/mx3_camera.c b/drivers/media/platform/soc_camera/mx3_camera.c
index 8f9f6211c52e..f975b7008692 100644
--- a/drivers/media/platform/soc_camera/mx3_camera.c
+++ b/drivers/media/platform/soc_camera/mx3_camera.c
@@ -266,7 +266,6 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
         struct idmac_channel *ichan = mx3_cam->idmac_channel[0];
         struct idmac_video_param *video = &ichan->params.video;
         const struct soc_mbus_pixelfmt *host_fmt = icd->current_fmt->host_fmt;
-        unsigned long flags;
         dma_cookie_t cookie;
         size_t new_size;
 
@@ -328,7 +327,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
                 memset(vb2_plane_vaddr(vb, 0), 0xaa, vb2_get_plane_payload(vb, 0));
 #endif
 
-        spin_lock_irqsave(&mx3_cam->lock, flags);
+        spin_lock_irq(&mx3_cam->lock);
         list_add_tail(&buf->queue, &mx3_cam->capture);
 
         if (!mx3_cam->active)
@@ -351,7 +350,7 @@ static void mx3_videobuf_queue(struct vb2_buffer *vb)
         if (mx3_cam->active == buf)
                 mx3_cam->active = NULL;
 
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
 error:
         vb2_buffer_done(vb, VB2_BUF_STATE_ERROR);
 }
diff --git a/drivers/media/tuners/e4000.c b/drivers/media/tuners/e4000.c
index ad9309da4a91..6c96e4898777 100644
--- a/drivers/media/tuners/e4000.c
+++ b/drivers/media/tuners/e4000.c
@@ -19,6 +19,7 @@
  */
 
 #include "e4000_priv.h"
+#include <linux/math64.h>
 
 /* write multiple registers */
 static int e4000_wr_regs(struct e4000_priv *priv, u8 reg, u8 *val, int len)
@@ -233,7 +234,7 @@ static int e4000_set_params(struct dvb_frontend *fe)
          * or more.
          */
         f_vco = c->frequency * e4000_pll_lut[i].mul;
-        sigma_delta = 0x10000UL * (f_vco % priv->cfg->clock) / priv->cfg->clock;
+        sigma_delta = div_u64(0x10000ULL * (f_vco % priv->cfg->clock), priv->cfg->clock);
         buf[0] = f_vco / priv->cfg->clock;
         buf[1] = (sigma_delta >> 0) & 0xff;
         buf[2] = (sigma_delta >> 8) & 0xff;
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
index c43c8d32be40..be77482c3070 100644
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -111,6 +111,13 @@ static const struct dmi_system_id stk_upside_down_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "F3JC")
                 }
         },
+        {
+                .ident = "T12Rg-H",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "HCL Infosystems Limited"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "T12Rg-H")
+                }
+        },
         {}
 };
 
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 81695d48c13e..c3bb2502225b 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -2090,6 +2090,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_PROBE_MINMAX },
+        /* Microsoft Lifecam NX-3000 */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x045e,
+          .idProduct            = 0x0721,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_DEF },
         /* Microsoft Lifecam VX-7000 */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2174,6 +2183,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_PROBE_DEF },
+        /* Dell SP2008WFP Monitor */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x05a9,
+          .idProduct            = 0x2641,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_DEF },
         /* Dell Alienware X51 */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 594c75eab5a5..de0e87f0b2c3 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -353,7 +353,9 @@ static int __verify_length(struct vb2_buffer *vb, const struct v4l2_buffer *b)
 
                         if (b->m.planes[plane].bytesused > length)
                                 return -EINVAL;
-                        if (b->m.planes[plane].data_offset >=
+
+                        if (b->m.planes[plane].data_offset > 0 &&
+                            b->m.planes[plane].data_offset >=
                             b->m.planes[plane].bytesused)
                                 return -EINVAL;
                 }
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index fd56f2563201..646f08f4f504 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -423,6 +423,39 @@ static inline int vma_is_io(struct vm_area_struct *vma)
         return !!(vma->vm_flags & (VM_IO | VM_PFNMAP));
 }
 
+static int vb2_dc_get_user_pfn(unsigned long start, int n_pages,
+        struct vm_area_struct *vma, unsigned long *res)
+{
+        unsigned long pfn, start_pfn, prev_pfn;
+        unsigned int i;
+        int ret;
+
+        if (!vma_is_io(vma))
+                return -EFAULT;
+
+        ret = follow_pfn(vma, start, &pfn);
+        if (ret)
+                return ret;
+
+        start_pfn = pfn;
+        start += PAGE_SIZE;
+
+        for (i = 1; i < n_pages; ++i, start += PAGE_SIZE) {
+                prev_pfn = pfn;
+                ret = follow_pfn(vma, start, &pfn);
+
+                if (ret) {
+                        pr_err("no page for address %lu\n", start);
+                        return ret;
+                }
+                if (pfn != prev_pfn + 1)
+                        return -EINVAL;
+        }
+
+        *res = start_pfn;
+        return 0;
+}
+
 static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
         int n_pages, struct vm_area_struct *vma, int write)
 {
@@ -433,6 +466,9 @@ static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
                         unsigned long pfn;
                         int ret = follow_pfn(vma, start, &pfn);
 
+                        if (!pfn_valid(pfn))
+                                return -EINVAL;
+
                         if (ret) {
                                 pr_err("no page for address %lu\n", start);
                                 return ret;
@@ -468,16 +504,49 @@ static void vb2_dc_put_userptr(void *buf_priv)
         struct vb2_dc_buf *buf = buf_priv;
         struct sg_table *sgt = buf->dma_sgt;
 
-        dma_unmap_sg(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
-        if (!vma_is_io(buf->vma))
-                vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
+        if (sgt) {
+                dma_unmap_sg(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
+                if (!vma_is_io(buf->vma))
+                        vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
 
-        sg_free_table(sgt);
-        kfree(sgt);
+                sg_free_table(sgt);
+                kfree(sgt);
+        }
         vb2_put_vma(buf->vma);
         kfree(buf);
 }
 
+/*
+ * For some kind of reserved memory there might be no struct page available,
+ * so all that can be done to support such 'pages' is to try to convert
+ * pfn to dma address or at the last resort just assume that
+ * dma address == physical address (like it has been assumed in earlier version
+ * of videobuf2-dma-contig
+ */
+
+#ifdef __arch_pfn_to_dma
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__arch_pfn_to_dma(dev, pfn);
+}
+#elif defined(__pfn_to_bus)
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__pfn_to_bus(pfn);
+}
+#elif defined(__pfn_to_phys)
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        return (dma_addr_t)__pfn_to_phys(pfn);
+}
+#else
+static inline dma_addr_t vb2_dc_pfn_to_dma(struct device *dev, unsigned long pfn)
+{
+        /* really, we cannot do anything better at this point */
+        return (dma_addr_t)(pfn) << PAGE_SHIFT;
+}
+#endif
+
 static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         unsigned long size, int write)
 {
@@ -548,6 +617,14 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         /* extract page list from userspace mapping */
         ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, write);
         if (ret) {
+                unsigned long pfn;
+                if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
+                        buf->dma_addr = vb2_dc_pfn_to_dma(buf->dev, pfn);
+                        buf->size = size;
+                        kfree(pages);
+                        return buf;
+                }
+
                 pr_err("failed to get user pages\n");
                 goto fail_vma;
         }
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index d0fdc134068a..f6ff711aa5bb 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -57,6 +57,7 @@ void mei_amthif_reset_params(struct mei_device *dev)
         dev->iamthif_ioctl = false;
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
         dev->iamthif_timer = 0;
+        dev->iamthif_stall_timer = 0;
 }
 
 /**
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 6d0282c08a06..cd2033cd7120 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -297,10 +297,13 @@ int __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
 
         if (cl->reading_state != MEI_READ_COMPLETE &&
             !waitqueue_active(&cl->rx_wait)) {
+
                 mutex_unlock(&dev->device_lock);
 
                 if (wait_event_interruptible(cl->rx_wait,
-                                (MEI_READ_COMPLETE == cl->reading_state))) {
+                                cl->reading_state == MEI_READ_COMPLETE  ||
+                                mei_cl_is_transitioning(cl))) {
+
                         if (signal_pending(current))
                                 return -EINTR;
                         return -ERESTARTSYS;
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 9eb031e92070..892cc4207fa2 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -90,6 +90,12 @@ static inline bool mei_cl_is_connected(struct mei_cl *cl)
                 cl->dev->dev_state == MEI_DEV_ENABLED &&
                 cl->state == MEI_FILE_CONNECTED);
 }
+static inline bool mei_cl_is_transitioning(struct mei_cl *cl)
+{
+        return (MEI_FILE_INITIALIZING == cl->state ||
+                MEI_FILE_DISCONNECTED == cl->state ||
+                MEI_FILE_DISCONNECTING == cl->state);
+}
 
 bool mei_cl_is_other_connecting(struct mei_cl *cl);
 int mei_cl_disconnect(struct mei_cl *cl);
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 6127ab64bb39..0a0448326e9d 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -35,11 +35,15 @@ static void mei_hbm_me_cl_allocate(struct mei_device *dev)
         struct mei_me_client *clients;
         int b;
 
+        dev->me_clients_num = 0;
+        dev->me_client_presentation_num = 0;
+        dev->me_client_index = 0;
+
         /* count how many ME clients we have */
         for_each_set_bit(b, dev->me_clients_map, MEI_CLIENTS_MAX)
                 dev->me_clients_num++;
 
-        if (dev->me_clients_num <= 0)
+        if (dev->me_clients_num == 0)
                 return;
 
         kfree(dev->me_clients);
@@ -221,7 +225,7 @@ static int mei_hbm_prop_req(struct mei_device *dev)
         struct hbm_props_request *prop_req;
         const size_t len = sizeof(struct hbm_props_request);
         unsigned long next_client_index;
-        u8 client_num;
+        unsigned long client_num;
 
 
         client_num = dev->me_client_presentation_num;
@@ -677,8 +681,6 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                 if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
                     dev->hbm_state == MEI_HBM_ENUM_CLIENTS) {
                                 dev->init_clients_timer = 0;
-                                dev->me_client_presentation_num = 0;
-                                dev->me_client_index = 0;
                                 mei_hbm_me_cl_allocate(dev);
                                 dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES;
 
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 92c73118b13c..6197018e2f16 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -175,6 +175,9 @@ void mei_reset(struct mei_device *dev, int interrupts_enabled)
                 memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
         }
 
+        /* we're already in reset, cancel the init timer */
+        dev->init_clients_timer = 0;
+
         dev->me_clients_num = 0;
         dev->rd_msg_hdr = 0;
         dev->wd_pending = false;
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 173ff095be0d..cabeddd66c1f 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -249,19 +249,16 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 mutex_unlock(&dev->device_lock);
 
                 if (wait_event_interruptible(cl->rx_wait,
-                        (MEI_READ_COMPLETE == cl->reading_state ||
-                         MEI_FILE_INITIALIZING == cl->state ||
-                         MEI_FILE_DISCONNECTED == cl->state ||
-                         MEI_FILE_DISCONNECTING == cl->state))) {
+                                MEI_READ_COMPLETE == cl->reading_state ||
+                                mei_cl_is_transitioning(cl))) {
+
                         if (signal_pending(current))
                                 return -EINTR;
                         return -ERESTARTSYS;
                 }
 
                 mutex_lock(&dev->device_lock);
-                if (MEI_FILE_INITIALIZING == cl->state ||
-                    MEI_FILE_DISCONNECTED == cl->state ||
-                    MEI_FILE_DISCONNECTING == cl->state) {
+                if (mei_cl_is_transitioning(cl)) {
                         rets = -EBUSY;
                         goto out;
                 }
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 7b918b2fb894..456b322013e2 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -396,9 +396,9 @@ struct mei_device {
         struct mei_me_client *me_clients; /* Note: memory has to be allocated */
         DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
         DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX);
-        u8 me_clients_num;
-        u8 me_client_presentation_num;
-        u8 me_client_index;
+        unsigned long me_clients_num;
+        unsigned long me_client_presentation_num;
+        unsigned long me_client_index;
 
         struct mei_cl wd_cl;
         enum mei_wd_states wd_state;
diff --git a/drivers/mmc/host/sh_mobile_sdhi.c b/drivers/mmc/host/sh_mobile_sdhi.c
index 87ed3fb5149a..f344659dceac 100644
--- a/drivers/mmc/host/sh_mobile_sdhi.c
+++ b/drivers/mmc/host/sh_mobile_sdhi.c
@@ -113,14 +113,14 @@ static const struct sh_mobile_sdhi_ops sdhi_ops = {
 };
 
 static const struct of_device_id sh_mobile_sdhi_of_match[] = {
-        { .compatible = "renesas,shmobile-sdhi" },
-        { .compatible = "renesas,sh7372-sdhi" },
-        { .compatible = "renesas,sh73a0-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a73a4-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7740-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7778-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7779-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
-        { .compatible = "renesas,r8a7790-sdhi", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-shmobile" },
+        { .compatible = "renesas,sdhi-sh7372" },
+        { .compatible = "renesas,sdhi-sh73a0", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a73a4", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7740", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7778", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7779", .data = &sh_mobile_sdhi_of_cfg[0], },
+        { .compatible = "renesas,sdhi-r8a7790", .data = &sh_mobile_sdhi_of_cfg[0], },
         {},
 };
 MODULE_DEVICE_TABLE(of, sh_mobile_sdhi_of_match);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 26b14f9fcac6..6bc9618af094 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -168,12 +168,25 @@ static inline int write_disable(struct m25p *flash)
  */
 static inline int set_4byte(struct m25p *flash, u32 jedec_id, int enable)
 {
+        int status;
+        bool need_wren = false;
+
         switch (JEDEC_MFR(jedec_id)) {
-        case CFI_MFR_MACRONIX:
         case CFI_MFR_ST: /* Micron, actually */
+                /* Some Micron need WREN command; all will accept it */
+                need_wren = true;
+        case CFI_MFR_MACRONIX:
         case 0xEF /* winbond */:
+                if (need_wren)
+                        write_enable(flash);
+
                 flash->command[0] = enable ? OPCODE_EN4B : OPCODE_EX4B;
-                return spi_write(flash->spi, flash->command, 1);
+                status = spi_write(flash->spi, flash->command, 1);
+
+                if (need_wren)
+                        write_disable(flash);
+
+                return status;
         default:
                 /* Spansion style */
                 flash->command[0] = OPCODE_BRWR;
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 59ab0692f0b9..a9830ff8e3f3 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -349,7 +349,7 @@ static int legacy_set_geometry(struct gpmi_nand_data *this)
 
 int common_nfc_set_geometry(struct gpmi_nand_data *this)
 {
-        return set_geometry_by_ecc_info(this) ? 0 : legacy_set_geometry(this);
+        return legacy_set_geometry(this);
 }
 
 struct dma_chan *get_dma_chan(struct gpmi_nand_data *this)
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 7ed4841327f2..d340b2f198c6 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2869,10 +2869,8 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
 
         len = le16_to_cpu(p->ext_param_page_length) * 16;
         ep = kmalloc(len, GFP_KERNEL);
-        if (!ep) {
-                ret = -ENOMEM;
-                goto ext_out;
-        }
+        if (!ep)
+                return -ENOMEM;
 
         /* Send our own NAND_CMD_PARAM. */
         chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
@@ -2920,7 +2918,7 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
         }
 
         pr_info("ONFI extended param page detected.\n");
-        return 0;
+        ret = 0;
 
 ext_out:
         kfree(ep);
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index dd03dfdfb0d6..c28d4e29af1a 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1320,7 +1320,12 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
         for (cs = 0; cs < pdata->num_cs; cs++) {
                 struct mtd_info *mtd = info->host[cs]->mtd;
 
-                mtd->name = pdev->name;
+                /*
+                 * The mtd name matches the one used in 'mtdparts' kernel
+                 * parameter. This name cannot be changed or otherwise
+                 * user's mtd partitions configuration would get broken.
+                 */
+                mtd->name = "pxa3xx_nand-0";
                 info->cs = cs;
                 ret = pxa3xx_nand_scan(mtd);
                 if (ret) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 55bbb8b8200c..e883bfe2e727 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1724,6 +1724,7 @@ static int __bond_release_one(struct net_device *bond_dev,
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave, *oldcurrent;
         struct sockaddr addr;
+        int old_flags = bond_dev->flags;
         netdev_features_t old_features = bond_dev->features;
 
         /* slave is not a slave or master is not master of this slave */
@@ -1855,12 +1856,18 @@ static int __bond_release_one(struct net_device *bond_dev,
          * bond_change_active_slave(..., NULL)
          */
         if (!USES_PRIMARY(bond->params.mode)) {
-                /* unset promiscuity level from slave */
-                if (bond_dev->flags & IFF_PROMISC)
+                /* unset promiscuity level from slave
+                 * NOTE: The NETDEV_CHANGEADDR call above may change the value
+                 * of the IFF_PROMISC flag in the bond_dev, but we need the
+                 * value of that flag before that change, as that was the value
+                 * when this slave was attached, so we cache at the start of the
+                 * function and use it here. Same goes for ALLMULTI below
+                 */
+                if (old_flags & IFF_PROMISC)
                         dev_set_promiscuity(slave_dev, -1);
 
                 /* unset allmulti level from slave */
-                if (bond_dev->flags & IFF_ALLMULTI)
+                if (old_flags & IFF_ALLMULTI)
                         dev_set_allmulti(slave_dev, -1);
 
                 bond_hw_addr_flush(bond_dev, slave_dev);
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 3b1ff6148702..693d8ffe4653 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -1405,10 +1405,10 @@ static int at91_can_remove(struct platform_device *pdev)
 
 static const struct platform_device_id at91_can_id_table[] = {
         {
-                .name = "at91_can",
+                .name = "at91sam9x5_can",
                 .driver_data = (kernel_ulong_t)&at91_at91sam9x5_data,
         }, {
-                .name = "at91sam9x5_can",
+                .name = "at91_can",
                 .driver_data = (kernel_ulong_t)&at91_at91sam9263_data,
         }, {
                 /* sentinel */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index f9cba4123c66..1870c4731a57 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -705,14 +705,14 @@ static size_t can_get_size(const struct net_device *dev)
         size_t size;
 
         size = nla_total_size(sizeof(u32));   /* IFLA_CAN_STATE */
-        size += sizeof(struct can_ctrlmode);  /* IFLA_CAN_CTRLMODE */
+        size += nla_total_size(sizeof(struct can_ctrlmode));  /* IFLA_CAN_CTRLMODE */
         size += nla_total_size(sizeof(u32));  /* IFLA_CAN_RESTART_MS */
-        size += sizeof(struct can_bittiming); /* IFLA_CAN_BITTIMING */
-        size += sizeof(struct can_clock);     /* IFLA_CAN_CLOCK */
+        size += nla_total_size(sizeof(struct can_bittiming)); /* IFLA_CAN_BITTIMING */
+        size += nla_total_size(sizeof(struct can_clock));     /* IFLA_CAN_CLOCK */
         if (priv->do_get_berr_counter)        /* IFLA_CAN_BERR_COUNTER */
-                size += sizeof(struct can_berr_counter);
+                size += nla_total_size(sizeof(struct can_berr_counter));
         if (priv->bittiming_const)            /* IFLA_CAN_BITTIMING_CONST */
-                size += sizeof(struct can_bittiming_const);
+                size += nla_total_size(sizeof(struct can_bittiming_const));
 
         return size;
 }
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 71c677e651d7..8f5ce747feb5 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -62,7 +62,7 @@
 #define FLEXCAN_MCR_BCC                 BIT(16)
 #define FLEXCAN_MCR_LPRIO_EN            BIT(13)
 #define FLEXCAN_MCR_AEN                 BIT(12)
-#define FLEXCAN_MCR_MAXMB(x)            ((x) & 0xf)
+#define FLEXCAN_MCR_MAXMB(x)            ((x) & 0x1f)
 #define FLEXCAN_MCR_IDAM_A              (0 << 8)
 #define FLEXCAN_MCR_IDAM_B              (1 << 8)
 #define FLEXCAN_MCR_IDAM_C              (2 << 8)
@@ -702,7 +702,6 @@ static int flexcan_chip_start(struct net_device *dev)
 {
         struct flexcan_priv *priv = netdev_priv(dev);
         struct flexcan_regs __iomem *regs = priv->base;
-        unsigned int i;
         int err;
         u32 reg_mcr, reg_ctrl;
 
@@ -736,9 +735,11 @@ static int flexcan_chip_start(struct net_device *dev)
          *
          */
         reg_mcr = flexcan_read(&regs->mcr);
+        reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
         reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_FEN | FLEXCAN_MCR_HALT |
                 FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN |
-                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS;
+                FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_SRX_DIS |
+                FLEXCAN_MCR_MAXMB(FLEXCAN_TX_BUF_ID);
         netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
         flexcan_write(reg_mcr, &regs->mcr);
 
@@ -772,16 +773,9 @@ static int flexcan_chip_start(struct net_device *dev)
         netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
         flexcan_write(reg_ctrl, &regs->ctrl);
 
-        for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
-                flexcan_write(0, &regs->cantxfg[i].can_ctrl);
-                flexcan_write(0, &regs->cantxfg[i].can_id);
-                flexcan_write(0, &regs->cantxfg[i].data[0]);
-                flexcan_write(0, &regs->cantxfg[i].data[1]);
-
-                /* put MB into rx queue */
-                flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
-                        &regs->cantxfg[i].can_ctrl);
-        }
+        /* Abort any pending TX, mark Mailbox as INACTIVE */
+        flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
+                      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
 
         /* acceptance mask/acceptance code (accept everything) */
         flexcan_write(0x0, &regs->rxgmask);
@@ -991,9 +985,9 @@ static void unregister_flexcandev(struct net_device *dev)
 }
 
 static const struct of_device_id flexcan_of_match[] = {
-        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
-        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
         { .compatible = "fsl,imx6q-flexcan", .data = &fsl_imx6q_devtype_data, },
+        { .compatible = "fsl,imx28-flexcan", .data = &fsl_imx28_devtype_data, },
+        { .compatible = "fsl,p1010-flexcan", .data = &fsl_p1010_devtype_data, },
         { /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, flexcan_of_match);
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index 874188ba06f7..25377e547f9b 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -76,6 +76,10 @@ MODULE_PARM_DESC(maxdev, "Maximum number of slcan interfaces");
 /* maximum rx buffer len: extended CAN frame with timestamp */
 #define SLC_MTU (sizeof("T1111222281122334455667788EA5F\r")+1)
 
+#define SLC_CMD_LEN 1
+#define SLC_SFF_ID_LEN 3
+#define SLC_EFF_ID_LEN 8
+
 struct slcan {
         int                     magic;
 
@@ -142,47 +146,63 @@ static void slc_bump(struct slcan *sl)
 {
         struct sk_buff *skb;
         struct can_frame cf;
-        int i, dlc_pos, tmp;
-        unsigned long ultmp;
-        char cmd = sl->rbuff[0];
-
-        if ((cmd != 't') && (cmd != 'T') && (cmd != 'r') && (cmd != 'R'))
+        int i, tmp;
+        u32 tmpid;
+        char *cmd = sl->rbuff;
+
+        cf.can_id = 0;
+
+        switch (*cmd) {
+        case 'r':
+                cf.can_id = CAN_RTR_FLAG;
+                /* fallthrough */
+        case 't':
+                /* store dlc ASCII value and terminate SFF CAN ID string */
+                cf.can_dlc = sl->rbuff[SLC_CMD_LEN + SLC_SFF_ID_LEN];
+                sl->rbuff[SLC_CMD_LEN + SLC_SFF_ID_LEN] = 0;
+                /* point to payload data behind the dlc */
+                cmd += SLC_CMD_LEN + SLC_SFF_ID_LEN + 1;
+                break;
+        case 'R':
+                cf.can_id = CAN_RTR_FLAG;
+                /* fallthrough */
+        case 'T':
+                cf.can_id |= CAN_EFF_FLAG;
+                /* store dlc ASCII value and terminate EFF CAN ID string */
+                cf.can_dlc = sl->rbuff[SLC_CMD_LEN + SLC_EFF_ID_LEN];
+                sl->rbuff[SLC_CMD_LEN + SLC_EFF_ID_LEN] = 0;
+                /* point to payload data behind the dlc */
+                cmd += SLC_CMD_LEN + SLC_EFF_ID_LEN + 1;
+                break;
+        default:
                 return;
+        }
 
-        if (cmd & 0x20) /* tiny chars 'r' 't' => standard frame format */
-                dlc_pos = 4; /* dlc position tiiid */
-        else
-                dlc_pos = 9; /* dlc position Tiiiiiiiid */
-
-        if (!((sl->rbuff[dlc_pos] >= '0') && (sl->rbuff[dlc_pos] < '9')))
+        if (kstrtou32(sl->rbuff + SLC_CMD_LEN, 16, &tmpid))
                 return;
 
-        cf.can_dlc = sl->rbuff[dlc_pos] - '0'; /* get can_dlc from ASCII val */
+        cf.can_id |= tmpid;
 
-        sl->rbuff[dlc_pos] = 0; /* terminate can_id string */
-
-        if (kstrtoul(sl->rbuff+1, 16, &ultmp))
+        /* get can_dlc from sanitized ASCII value */
+        if (cf.can_dlc >= '0' && cf.can_dlc < '9')
+                cf.can_dlc -= '0';
+        else
                 return;
 
-        cf.can_id = ultmp;
-
-        if (!(cmd & 0x20)) /* NO tiny chars => extended frame format */
-                cf.can_id |= CAN_EFF_FLAG;
-
-        if ((cmd | 0x20) == 'r') /* RTR frame */
-                cf.can_id |= CAN_RTR_FLAG;
-
         *(u64 *) (&cf.data) = 0; /* clear payload */
 
-        for (i = 0, dlc_pos++; i < cf.can_dlc; i++) {
-                tmp = hex_to_bin(sl->rbuff[dlc_pos++]);
-                if (tmp < 0)
-                        return;
-                cf.data[i] = (tmp << 4);
-                tmp = hex_to_bin(sl->rbuff[dlc_pos++]);
-                if (tmp < 0)
-                        return;
-                cf.data[i] |= tmp;
+        /* RTR frames may have a dlc > 0 but they never have any data bytes */
+        if (!(cf.can_id & CAN_RTR_FLAG)) {
+                for (i = 0; i < cf.can_dlc; i++) {
+                        tmp = hex_to_bin(*cmd++);
+                        if (tmp < 0)
+                                return;
+                        cf.data[i] = (tmp << 4);
+                        tmp = hex_to_bin(*cmd++);
+                        if (tmp < 0)
+                                return;
+                        cf.data[i] |= tmp;
+                }
         }
 
         skb = dev_alloc_skb(sizeof(struct can_frame) +
@@ -209,7 +229,6 @@ static void slc_bump(struct slcan *sl)
 /* parse tty input stream */
 static void slcan_unesc(struct slcan *sl, unsigned char s)
 {
-
         if ((s == '\r') || (s == '\a')) { /* CR or BEL ends the pdu */
                 if (!test_and_clear_bit(SLF_ERROR, &sl->flags) &&
                     (sl->rcount > 4))  {
@@ -236,27 +255,46 @@ static void slcan_unesc(struct slcan *sl, unsigned char s)
 /* Encapsulate one can_frame and stuff into a TTY queue. */
 static void slc_encaps(struct slcan *sl, struct can_frame *cf)
 {
-        int actual, idx, i;
-        char cmd;
+        int actual, i;
+        unsigned char *pos;
+        unsigned char *endpos;
+        canid_t id = cf->can_id;
+
+        pos = sl->xbuff;
 
         if (cf->can_id & CAN_RTR_FLAG)
-                cmd = 'R'; /* becomes 'r' in standard frame format */
+                *pos = 'R'; /* becomes 'r' in standard frame format (SFF) */
         else
-                cmd = 'T'; /* becomes 't' in standard frame format */
+                *pos = 'T'; /* becomes 't' in standard frame format (SSF) */
 
-        if (cf->can_id & CAN_EFF_FLAG)
-                sprintf(sl->xbuff, "%c%08X%d", cmd,
-                        cf->can_id & CAN_EFF_MASK, cf->can_dlc);
-        else
-                sprintf(sl->xbuff, "%c%03X%d", cmd | 0x20,
-                        cf->can_id & CAN_SFF_MASK, cf->can_dlc);
+        /* determine number of chars for the CAN-identifier */
+        if (cf->can_id & CAN_EFF_FLAG) {
+                id &= CAN_EFF_MASK;
+                endpos = pos + SLC_EFF_ID_LEN;
+        } else {
+                *pos |= 0x20; /* convert R/T to lower case for SFF */
+                id &= CAN_SFF_MASK;
+                endpos = pos + SLC_SFF_ID_LEN;
+        }
 
-        idx = strlen(sl->xbuff);
+        /* build 3 (SFF) or 8 (EFF) digit CAN identifier */
+        pos++;
+        while (endpos >= pos) {
+                *endpos-- = hex_asc_upper[id & 0xf];
+                id >>= 4;
+        }
+
+        pos += (cf->can_id & CAN_EFF_FLAG) ? SLC_EFF_ID_LEN : SLC_SFF_ID_LEN;
 
-        for (i = 0; i < cf->can_dlc; i++)
-                sprintf(&sl->xbuff[idx + 2*i], "%02X", cf->data[i]);
+        *pos++ = cf->can_dlc + '0';
+
+        /* RTR frames may have a dlc > 0 but they never have any data bytes */
+        if (!(cf->can_id & CAN_RTR_FLAG)) {
+                for (i = 0; i < cf->can_dlc; i++)
+                        pos = hex_byte_pack_upper(pos, cf->data[i]);
+        }
 
-        strcat(sl->xbuff, "\r"); /* add terminating character */
+        *pos++ = '\r';
 
         /* Order of next two lines is *very* important.
          * When we are sending a little amount of data,
@@ -267,8 +305,8 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
          *       14 Oct 1994  Dmitry Gorodchanin.
          */
         set_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
-        actual = sl->tty->ops->write(sl->tty, sl->xbuff, strlen(sl->xbuff));
-        sl->xleft = strlen(sl->xbuff) - actual;
+        actual = sl->tty->ops->write(sl->tty, sl->xbuff, pos - sl->xbuff);
+        sl->xleft = (pos - sl->xbuff) - actual;
         sl->xhead = sl->xbuff + actual;
         sl->dev->stats.tx_bytes += cf->can_dlc;
 }
@@ -286,11 +324,13 @@ static void slcan_write_wakeup(struct tty_struct *tty)
         if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
                 return;
 
+        spin_lock(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
                 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                spin_unlock(&sl->lock);
                 netif_wake_queue(sl->dev);
                 return;
         }
@@ -298,6 +338,7 @@ static void slcan_write_wakeup(struct tty_struct *tty)
         actual = tty->ops->write(tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
+        spin_unlock(&sl->lock);
 }
 
 /* Send a can_frame to a TTY queue. */
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index a0f647f92bf5..0b7a4c3b01a2 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -463,7 +463,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
         if (i < PCAN_USB_MAX_TX_URBS) {
                 if (i == 0) {
                         netdev_err(netdev, "couldn't setup any tx URB\n");
-                        return err;
+                        goto err_tx;
                 }
 
                 netdev_warn(netdev, "tx performance may be slow\n");
@@ -472,7 +472,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
         if (dev->adapter->dev_start) {
                 err = dev->adapter->dev_start(dev);
                 if (err)
-                        goto failed;
+                        goto err_adapter;
         }
 
         dev->state |= PCAN_USB_STATE_STARTED;
@@ -481,19 +481,26 @@ static int peak_usb_start(struct peak_usb_device *dev)
         if (dev->adapter->dev_set_bus) {
                 err = dev->adapter->dev_set_bus(dev, 1);
                 if (err)
-                        goto failed;
+                        goto err_adapter;
         }
 
         dev->can.state = CAN_STATE_ERROR_ACTIVE;
 
         return 0;
 
-failed:
+err_adapter:
         if (err == -ENODEV)
                 netif_device_detach(dev->netdev);
 
         netdev_warn(netdev, "couldn't submit control: %d\n", err);
 
+        for (i = 0; i < PCAN_USB_MAX_TX_URBS; i++) {
+                usb_free_urb(dev->tx_contexts[i].urb);
+                dev->tx_contexts[i].urb = NULL;
+        }
+err_tx:
+        usb_kill_anchored_urbs(&dev->rx_submitted);
+
         return err;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 97b3d32a98bd..c5e375ddd6c0 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1197,8 +1197,9 @@ union cdu_context {
 /* TM (timers) host DB constants */
 #define TM_ILT_PAGE_SZ_HW       0
 #define TM_ILT_PAGE_SZ          (4096 << TM_ILT_PAGE_SZ_HW) /* 4K */
-/* #define TM_CONN_NUM          (CNIC_STARTING_CID+CNIC_ISCSI_CXT_MAX) */
-#define TM_CONN_NUM             1024
+#define TM_CONN_NUM             (BNX2X_FIRST_VF_CID + \
+                                 BNX2X_VF_CIDS + \
+                                 CNIC_ISCSI_CID_MAX)
 #define TM_ILT_SZ               (8 * TM_CONN_NUM)
 #define TM_ILT_LINES            DIV_ROUND_UP(TM_ILT_SZ, TM_ILT_PAGE_SZ)
 
@@ -1527,7 +1528,6 @@ struct bnx2x {
 #define PCI_32BIT_FLAG                  (1 << 1)
 #define ONE_PORT_FLAG                   (1 << 2)
 #define NO_WOL_FLAG                     (1 << 3)
-#define USING_DAC_FLAG                  (1 << 4)
 #define USING_MSIX_FLAG                 (1 << 5)
 #define USING_MSI_FLAG                  (1 << 6)
 #define DISABLE_MSI_FLAG                (1 << 7)
@@ -1621,7 +1621,7 @@ struct bnx2x {
         u16                     rx_ticks_int;
         u16                     rx_ticks;
 /* Maximal coalescing timeout in us */
-#define BNX2X_MAX_COALESCE_TOUT         (0xf0*12)
+#define BNX2X_MAX_COALESCE_TOUT         (0xff*BNX2X_BTR)
 
         u32                     lin_cnt;
 
@@ -2072,7 +2072,8 @@ u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
 
 void bnx2x_prep_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
                                u8 src_type, u8 dst_type);
-int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae);
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u32 *comp);
 
 /* FLR related routines */
 u32 bnx2x_flr_clnup_poll_count(struct bnx2x *bp);
@@ -2498,4 +2499,8 @@ enum bnx2x_pci_bus_speed {
 };
 
 void bnx2x_set_local_cmng(struct bnx2x *bp);
+
+#define MCPR_SCRATCH_BASE(bp) \
+        (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 61726af1de6e..4ab4c89c60cd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -681,6 +681,7 @@ static void bnx2x_gro_receive(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                 }
         }
 #endif
+        skb_record_rx_queue(skb, fp->rx_queue);
         napi_gro_receive(&fp->napi, skb);
 }
 
@@ -2481,8 +2482,7 @@ load_error_cnic2:
 load_error_cnic1:
         bnx2x_napi_disable_cnic(bp);
         /* Update the number of queues without the cnic queues */
-        rc = bnx2x_set_real_num_queues(bp, 0);
-        if (rc)
+        if (bnx2x_set_real_num_queues(bp, 0))
                 BNX2X_ERR("Unable to set real_num_queues not including cnic\n");
 load_error_cnic0:
         BNX2X_ERR("CNIC-related load failed\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 324de5f05332..e8efa1c93ffe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -891,17 +891,8 @@ static void bnx2x_get_regs(struct net_device *dev,
          * will re-enable parity attentions right after the dump.
          */
 
-        /* Disable parity on path 0 */
-        bnx2x_pretend_func(bp, 0);
         bnx2x_disable_blocks_parity(bp);
 
-        /* Disable parity on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_disable_blocks_parity(bp);
-
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
-
         dump_hdr.header_size = (sizeof(struct dump_header) / 4) - 1;
         dump_hdr.preset = DUMP_ALL_PRESETS;
         dump_hdr.version = BNX2X_DUMP_VERSION;
@@ -928,18 +919,9 @@ static void bnx2x_get_regs(struct net_device *dev,
         /* Actually read the registers */
         __bnx2x_get_regs(bp, p);
 
-        /* Re-enable parity attentions on path 0 */
-        bnx2x_pretend_func(bp, 0);
+        /* Re-enable parity attentions */
         bnx2x_clear_blocks_parity(bp);
         bnx2x_enable_blocks_parity(bp);
-
-        /* Re-enable parity attentions on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_clear_blocks_parity(bp);
-        bnx2x_enable_blocks_parity(bp);
-
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
 }
 
 static int bnx2x_get_preset_regs_len(struct net_device *dev, u32 preset)
@@ -993,17 +975,8 @@ static int bnx2x_get_dump_data(struct net_device *dev,
          * will re-enable parity attentions right after the dump.
          */
 
-        /* Disable parity on path 0 */
-        bnx2x_pretend_func(bp, 0);
         bnx2x_disable_blocks_parity(bp);
 
-        /* Disable parity on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_disable_blocks_parity(bp);
-
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
-
         dump_hdr.header_size = (sizeof(struct dump_header) / 4) - 1;
         dump_hdr.preset = bp->dump_preset_idx;
         dump_hdr.version = BNX2X_DUMP_VERSION;
@@ -1032,19 +1005,10 @@ static int bnx2x_get_dump_data(struct net_device *dev,
         /* Actually read the registers */
         __bnx2x_get_preset_regs(bp, p, dump_hdr.preset);
 
-        /* Re-enable parity attentions on path 0 */
-        bnx2x_pretend_func(bp, 0);
+        /* Re-enable parity attentions */
         bnx2x_clear_blocks_parity(bp);
         bnx2x_enable_blocks_parity(bp);
 
-        /* Re-enable parity attentions on path 1 */
-        bnx2x_pretend_func(bp, 1);
-        bnx2x_clear_blocks_parity(bp);
-        bnx2x_enable_blocks_parity(bp);
-
-        /* Return to current function */
-        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
-
         return 0;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
index 76df015f486a..c2dfea7968f4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h
@@ -640,23 +640,35 @@ static const struct {
  * [30] MCP Latched ump_tx_parity
  * [31] MCP Latched scpad_parity
  */
-#define MISC_AEU_ENABLE_MCP_PRTY_BITS   \
+#define MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS       \
         (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \
          AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \
-         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY | \
+         AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY)
+
+#define MISC_AEU_ENABLE_MCP_PRTY_BITS   \
+        (MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS | \
          AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY)
 
 /* Below registers control the MCP parity attention output. When
  * MISC_AEU_ENABLE_MCP_PRTY_BITS are set - attentions are
  * enabled, when cleared - disabled.
  */
-static const u32 mcp_attn_ctl_regs[] = {
-        MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0,
-        MISC_REG_AEU_ENABLE4_NIG_0,
-        MISC_REG_AEU_ENABLE4_PXP_0,
-        MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0,
-        MISC_REG_AEU_ENABLE4_NIG_1,
-        MISC_REG_AEU_ENABLE4_PXP_1
+static const struct {
+        u32 addr;
+        u32 bits;
+} mcp_attn_ctl_regs[] = {
+        { MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0,
+                MISC_AEU_ENABLE_MCP_PRTY_BITS },
+        { MISC_REG_AEU_ENABLE4_NIG_0,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_PXP_0,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0,
+                MISC_AEU_ENABLE_MCP_PRTY_BITS },
+        { MISC_REG_AEU_ENABLE4_NIG_1,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS },
+        { MISC_REG_AEU_ENABLE4_PXP_1,
+                MISC_AEU_ENABLE_MCP_PRTY_SUB_BITS }
 };
 
 static inline void bnx2x_set_mcp_parity(struct bnx2x *bp, u8 enable)
@@ -665,14 +677,14 @@ static inline void bnx2x_set_mcp_parity(struct bnx2x *bp, u8 enable)
         u32 reg_val;
 
         for (i = 0; i < ARRAY_SIZE(mcp_attn_ctl_regs); i++) {
-                reg_val = REG_RD(bp, mcp_attn_ctl_regs[i]);
+                reg_val = REG_RD(bp, mcp_attn_ctl_regs[i].addr);
 
                 if (enable)
-                        reg_val |= MISC_AEU_ENABLE_MCP_PRTY_BITS;
+                        reg_val |= mcp_attn_ctl_regs[i].bits;
                 else
-                        reg_val &= ~MISC_AEU_ENABLE_MCP_PRTY_BITS;
+                        reg_val &= ~mcp_attn_ctl_regs[i].bits;
 
-                REG_WR(bp, mcp_attn_ctl_regs[i], reg_val);
+                REG_WR(bp, mcp_attn_ctl_regs[i].addr, reg_val);
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index d60a2ea3da19..51468227bf3b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -175,6 +175,7 @@ typedef int (*read_sfp_module_eeprom_func_p)(struct bnx2x_phy *phy,
 #define EDC_MODE_LINEAR                         0x0022
 #define EDC_MODE_LIMITING                               0x0044
 #define EDC_MODE_PASSIVE_DAC                    0x0055
+#define EDC_MODE_ACTIVE_DAC                     0x0066
 
 /* ETS defines*/
 #define DCBX_INVALID_COS                                        (0xFF)
@@ -3684,6 +3685,41 @@ static void bnx2x_warpcore_enable_AN_KR2(struct bnx2x_phy *phy,
         bnx2x_update_link_attr(params, vars->link_attr_sync);
 }
 
+static void bnx2x_disable_kr2(struct link_params *params,
+                              struct link_vars *vars,
+                              struct bnx2x_phy *phy)
+{
+        struct bnx2x *bp = params->bp;
+        int i;
+        static struct bnx2x_reg_set reg_set[] = {
+                /* Step 1 - Program the TX/RX alignment markers */
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL5, 0x7690},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL7, 0xe647},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL6, 0xc4f0},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL9, 0x7690},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL11, 0xe647},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL10, 0xc4f0},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_USERB0_CTRL, 0x000c},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL1, 0x6000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL3, 0x0000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CODE_FIELD, 0x0002},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI1, 0x0000},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI2, 0x0af7},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI3, 0x0af7},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_BAM_CODE, 0x0002},
+                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_UD_CODE, 0x0000}
+        };
+        DP(NETIF_MSG_LINK, "Disabling 20G-KR2\n");
+
+        for (i = 0; i < ARRAY_SIZE(reg_set); i++)
+                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
+                                 reg_set[i].val);
+        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
+        bnx2x_update_link_attr(params, vars->link_attr_sync);
+
+        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
+}
+
 static void bnx2x_warpcore_set_lpi_passthrough(struct bnx2x_phy *phy,
                                                struct link_params *params)
 {
@@ -3715,7 +3751,6 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                                         struct link_params *params,
                                         struct link_vars *vars) {
         u16 lane, i, cl72_ctrl, an_adv = 0;
-        u16 ucode_ver;
         struct bnx2x *bp = params->bp;
         static struct bnx2x_reg_set reg_set[] = {
                 {MDIO_WC_DEVAD, MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X2, 0x7},
@@ -3806,15 +3841,7 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
 
         /* Advertise pause */
         bnx2x_ext_phy_set_pause(params, phy, vars);
-        /* Set KR Autoneg Work-Around flag for Warpcore version older than D108
-         */
-        bnx2x_cl45_read(bp, phy, MDIO_WC_DEVAD,
-                        MDIO_WC_REG_UC_INFO_B1_VERSION, &ucode_ver);
-        if (ucode_ver < 0xd108) {
-                DP(NETIF_MSG_LINK, "Enable AN KR work-around. WC ver:0x%x\n",
-                               ucode_ver);
-                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
-        }
+        vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
         bnx2x_cl45_read_or_write(bp, phy, MDIO_WC_DEVAD,
                                  MDIO_WC_REG_DIGITAL5_MISC7, 0x100);
 
@@ -3838,6 +3865,8 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                 bnx2x_set_aer_mmd(params, phy);
 
                 bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
+        } else {
+                bnx2x_disable_kr2(params, vars, phy);
         }
 
         /* Enable Autoneg: only on the main lane */
@@ -4347,20 +4376,14 @@ static void bnx2x_warpcore_config_runtime(struct bnx2x_phy *phy,
         struct bnx2x *bp = params->bp;
         u32 serdes_net_if;
         u16 gp_status1 = 0, lnkup = 0, lnkup_kr = 0;
-        u16 lane = bnx2x_get_warpcore_lane(phy, params);
 
         vars->turn_to_run_wc_rt = vars->turn_to_run_wc_rt ? 0 : 1;
 
         if (!vars->turn_to_run_wc_rt)
                 return;
 
-        /* Return if there is no link partner */
-        if (!(bnx2x_warpcore_get_sigdet(phy, params))) {
-                DP(NETIF_MSG_LINK, "bnx2x_warpcore_get_sigdet false\n");
-                return;
-        }
-
         if (vars->rx_tx_asic_rst) {
+                u16 lane = bnx2x_get_warpcore_lane(phy, params);
                 serdes_net_if = (REG_RD(bp, params->shmem_base +
                                 offsetof(struct shmem_region, dev_info.
                                 port_hw_config[params->port].default_cfg)) &
@@ -4375,14 +4398,8 @@ static void bnx2x_warpcore_config_runtime(struct bnx2x_phy *phy,
                                 /*10G KR*/
                         lnkup_kr = (gp_status1 >> (12+lane)) & 0x1;
 
-                        DP(NETIF_MSG_LINK,
-                                "gp_status1 0x%x\n", gp_status1);
-
                         if (lnkup_kr || lnkup) {
-                                        vars->rx_tx_asic_rst = 0;
-                                        DP(NETIF_MSG_LINK,
-                                        "link up, rx_tx_asic_rst 0x%x\n",
-                                        vars->rx_tx_asic_rst);
+                                vars->rx_tx_asic_rst = 0;
                         } else {
                                 /* Reset the lane to see if link comes up.*/
                                 bnx2x_warpcore_reset_lane(bp, phy, 1);
@@ -4507,10 +4524,14 @@ static void bnx2x_warpcore_config_init(struct bnx2x_phy *phy,
                          * enabled transmitter to avoid current leakage in case
                          * no module is connected
                          */
-                        if (bnx2x_is_sfp_module_plugged(phy, params))
-                                bnx2x_sfp_module_detection(phy, params);
-                        else
-                                bnx2x_sfp_e3_set_transmitter(params, phy, 1);
+                        if ((params->loopback_mode == LOOPBACK_NONE) ||
+                            (params->loopback_mode == LOOPBACK_EXT)) {
+                                if (bnx2x_is_sfp_module_plugged(phy, params))
+                                        bnx2x_sfp_module_detection(phy, params);
+                                else
+                                        bnx2x_sfp_e3_set_transmitter(params,
+                                                                     phy, 1);
+                        }
 
                         bnx2x_warpcore_config_sfi(phy, params);
                         break;
@@ -5757,6 +5778,11 @@ static int bnx2x_warpcore_read_status(struct bnx2x_phy *phy,
         rc = bnx2x_get_link_speed_duplex(phy, params, vars, link_up, gp_speed,
                                          duplex);
 
+        /* In case of KR link down, start up the recovering procedure */
+        if ((!link_up) && (phy->media_type == ETH_PHY_KR) &&
+            (!(phy->flags & FLAGS_WC_DUAL_MODE)))
+                vars->rx_tx_asic_rst = MAX_KR_LINK_RETRY;
+
         DP(NETIF_MSG_LINK, "duplex %x  flow_ctrl 0x%x link_status 0x%x\n",
                    vars->duplex, vars->flow_ctrl, vars->link_status);
         return rc;
@@ -6507,6 +6533,11 @@ static int bnx2x_link_initialize(struct link_params *params,
                         params->phy[INT_PHY].config_init(phy, params, vars);
         }
 
+        /* Re-read this value in case it was changed inside config_init due to
+         * limitations of optic module
+         */
+        vars->line_speed = params->phy[INT_PHY].req_line_speed;
+
         /* Init external phy*/
         if (non_ext_phy) {
                 if (params->phy[INT_PHY].supported &
@@ -8080,7 +8111,10 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                 if (copper_module_type &
                     SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_ACTIVE) {
                         DP(NETIF_MSG_LINK, "Active Copper cable detected\n");
-                        check_limiting_mode = 1;
+                        if (phy->type == PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT)
+                                *edc_mode = EDC_MODE_ACTIVE_DAC;
+                        else
+                                check_limiting_mode = 1;
                 } else if (copper_module_type &
                         SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                 DP(NETIF_MSG_LINK,
@@ -8555,6 +8589,7 @@ static void bnx2x_warpcore_set_limiting_mode(struct link_params *params,
                 mode = MDIO_WC_REG_UC_INFO_B1_FIRMWARE_MODE_DEFAULT;
                 break;
         case EDC_MODE_PASSIVE_DAC:
+        case EDC_MODE_ACTIVE_DAC:
                 mode = MDIO_WC_REG_UC_INFO_B1_FIRMWARE_MODE_SFP_DAC;
                 break;
         default:
@@ -9730,32 +9765,41 @@ static int bnx2x_848xx_cmn_config_init(struct bnx2x_phy *phy,
                          MDIO_AN_DEVAD, MDIO_AN_REG_8481_1000T_CTRL,
                          an_1000_val);
 
-        /* set 100 speed advertisement */
-        if ((phy->req_line_speed == SPEED_AUTO_NEG) &&
-             (phy->speed_cap_mask &
-              (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
-               PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF))) {
-                an_10_100_val |= (1<<7);
-                /* Enable autoneg and restart autoneg for legacy speeds */
-                autoneg_val |= (1<<9 | 1<<12);
-
-                if (phy->req_duplex == DUPLEX_FULL)
+        /* Set 10/100 speed advertisement */
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
+                        /* Enable autoneg and restart autoneg for legacy speeds
+                         */
+                        autoneg_val |= (1<<9 | 1<<12);
                         an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
-        }
-        /* set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-             (phy->speed_cap_mask &
-              (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
-               PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)) &&
-             (phy->supported &
-              (SUPPORTED_10baseT_Half |
-               SUPPORTED_10baseT_Full)))) {
-                an_10_100_val |= (1<<5);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
+                }
+
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
+                        /* Enable autoneg and restart autoneg for legacy speeds
+                         */
+                        autoneg_val |= (1<<9 | 1<<12);
+                        an_10_100_val |= (1<<7);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
+                }
+
+                if ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) &&
+                    (phy->supported & SUPPORTED_10baseT_Full)) {
                         an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+
+                if ((phy->speed_cap_mask &
+                     PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) &&
+                    (phy->supported & SUPPORTED_10baseT_Half)) {
+                        an_10_100_val |= (1<<5);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
+                }
         }
 
         /* Only 10/100 are allowed to work in FORCE mode */
@@ -13432,43 +13476,6 @@ static void bnx2x_sfp_tx_fault_detection(struct bnx2x_phy *phy,
                 }
         }
 }
-static void bnx2x_disable_kr2(struct link_params *params,
-                              struct link_vars *vars,
-                              struct bnx2x_phy *phy)
-{
-        struct bnx2x *bp = params->bp;
-        int i;
-        static struct bnx2x_reg_set reg_set[] = {
-                /* Step 1 - Program the TX/RX alignment markers */
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL5, 0x7690},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL7, 0xe647},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL6, 0xc4f0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_TX_CTRL9, 0x7690},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL11, 0xe647},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL82_USERB1_RX_CTRL10, 0xc4f0},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_USERB0_CTRL, 0x000c},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL1, 0x6000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CTRL3, 0x0000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_CL73_BAM_CODE_FIELD, 0x0002},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI1, 0x0000},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI2, 0x0af7},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_OUI3, 0x0af7},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_BAM_CODE, 0x0002},
-                {MDIO_WC_DEVAD, MDIO_WC_REG_ETA_CL73_LD_UD_CODE, 0x0000}
-        };
-        DP(NETIF_MSG_LINK, "Disabling 20G-KR2\n");
-
-        for (i = 0; i < ARRAY_SIZE(reg_set); i++)
-                bnx2x_cl45_write(bp, phy, reg_set[i].devad, reg_set[i].reg,
-                                 reg_set[i].val);
-        vars->link_attr_sync &= ~LINK_ATTR_SYNC_KR2_ENABLE;
-        bnx2x_update_link_attr(params, vars->link_attr_sync);
-
-        vars->check_kr2_recovery_cnt = CHECK_KR2_RECOVERY_CNT;
-        /* Restart AN on leading lane */
-        bnx2x_warpcore_restart_AN_KR(phy, params);
-}
-
 static void bnx2x_kr2_recovery(struct link_params *params,
                                struct link_vars *vars,
                                struct bnx2x_phy *phy)
@@ -13546,6 +13553,8 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
                 /* Disable KR2 on both lanes */
                 DP(NETIF_MSG_LINK, "BP=0x%x, NP=0x%x\n", base_page, next_page);
                 bnx2x_disable_kr2(params, vars, phy);
+                /* Restart AN on leading lane */
+                bnx2x_warpcore_restart_AN_KR(phy, params);
                 return;
         }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index a6704b555042..b42f89ce02ef 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -503,9 +503,9 @@ void bnx2x_prep_dmae_with_comp(struct bnx2x *bp,
 }
 
 /* issue a dmae command over the init-channel and wait for completion */
-int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
+int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae,
+                               u32 *comp)
 {
-        u32 *wb_comp = bnx2x_sp(bp, wb_comp);
         int cnt = CHIP_REV_IS_SLOW(bp) ? (400000) : 4000;
         int rc = 0;
 
@@ -518,14 +518,14 @@ int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
         spin_lock_bh(&bp->dmae_lock);
 
         /* reset completion */
-        *wb_comp = 0;
+        *comp = 0;
 
         /* post the command on the channel used for initializations */
         bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
 
         /* wait for completion */
         udelay(5);
-        while ((*wb_comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
+        while ((*comp & ~DMAE_PCI_ERR_FLAG) != DMAE_COMP_VAL) {
 
                 if (!cnt ||
                     (bp->recovery_state != BNX2X_RECOVERY_DONE &&
@@ -537,7 +537,7 @@ int bnx2x_issue_dmae_with_comp(struct bnx2x *bp, struct dmae_command *dmae)
                 cnt--;
                 udelay(50);
         }
-        if (*wb_comp & DMAE_PCI_ERR_FLAG) {
+        if (*comp & DMAE_PCI_ERR_FLAG) {
                 BNX2X_ERR("DMAE PCI error!\n");
                 rc = DMAE_PCI_ERROR;
         }
@@ -574,7 +574,7 @@ void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
         dmae.len = len32;
 
         /* issue the command and wait for completion */
-        rc = bnx2x_issue_dmae_with_comp(bp, &dmae);
+        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
         if (rc) {
                 BNX2X_ERR("DMAE returned failure %d\n", rc);
                 bnx2x_panic();
@@ -611,7 +611,7 @@ void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
         dmae.len = len32;
 
         /* issue the command and wait for completion */
-        rc = bnx2x_issue_dmae_with_comp(bp, &dmae);
+        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
         if (rc) {
                 BNX2X_ERR("DMAE returned failure %d\n", rc);
                 bnx2x_panic();
@@ -751,6 +751,10 @@ static int bnx2x_mc_assert(struct bnx2x *bp)
         return rc;
 }
 
+#define MCPR_TRACE_BUFFER_SIZE  (0x800)
+#define SCRATCH_BUFFER_SIZE(bp) \
+        (CHIP_IS_E1(bp) ? 0x10000 : (CHIP_IS_E1H(bp) ? 0x20000 : 0x28000))
+
 void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
 {
         u32 addr, val;
@@ -775,7 +779,17 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                 trace_shmem_base = bp->common.shmem_base;
         else
                 trace_shmem_base = SHMEM2_RD(bp, other_shmem_base_addr);
-        addr = trace_shmem_base - 0x800;
+
+        /* sanity */
+        if (trace_shmem_base < MCPR_SCRATCH_BASE(bp) + MCPR_TRACE_BUFFER_SIZE ||
+            trace_shmem_base >= MCPR_SCRATCH_BASE(bp) +
+                                SCRATCH_BUFFER_SIZE(bp)) {
+                BNX2X_ERR("Unable to dump trace buffer (mark %x)\n",
+                          trace_shmem_base);
+                return;
+        }
+
+        addr = trace_shmem_base - MCPR_TRACE_BUFFER_SIZE;
 
         /* validate TRCB signature */
         mark = REG_RD(bp, addr);
@@ -787,14 +801,17 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
         /* read cyclic buffer pointer */
         addr += 4;
         mark = REG_RD(bp, addr);
-        mark = (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
-                        + ((mark + 0x3) & ~0x3) - 0x08000000;
+        mark = MCPR_SCRATCH_BASE(bp) + ((mark + 0x3) & ~0x3) - 0x08000000;
+        if (mark >= trace_shmem_base || mark < addr + 4) {
+                BNX2X_ERR("Mark doesn't fall inside Trace Buffer\n");
+                return;
+        }
         printk("%s" "begin fw dump (mark 0x%x)\n", lvl, mark);
 
         printk("%s", lvl);
 
         /* dump buffer after the mark */
-        for (offset = mark; offset <= trace_shmem_base; offset += 0x8*4) {
+        for (offset = mark; offset < trace_shmem_base; offset += 0x8*4) {
                 for (word = 0; word < 8; word++)
                         data[word] = htonl(REG_RD(bp, offset + 4*word));
                 data[8] = 0x0;
@@ -4280,65 +4297,60 @@ static void _print_next_block(int idx, const char *blk)
         pr_cont("%s%s", idx ? ", " : "", blk);
 }
 
-static int bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+static bool bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
+                                            int *par_num, bool print)
 {
-        int i = 0;
-        u32 cur_bit = 0;
+        u32 cur_bit;
+        bool res;
+        int i;
+
+        res = false;
+
         for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                 if (sig & cur_bit) {
-                        switch (cur_bit) {
-                        case AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "BRB");
+                        res |= true; /* Each bit is real error! */
+
+                        if (print) {
+                                switch (cur_bit) {
+                                case AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "BRB");
                                         _print_parity(bp,
                                                       BRB1_REG_BRB1_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "PARSER");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_PARSER_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "PARSER");
                                         _print_parity(bp, PRS_REG_PRS_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_TSDM_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "TSDM");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_TSDM_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "TSDM");
                                         _print_parity(bp,
                                                       TSDM_REG_TSDM_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++,
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_SEARCHER_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
                                                           "SEARCHER");
                                         _print_parity(bp, SRC_REG_SRC_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "TCM");
-                                        _print_parity(bp,
-                                                      TCM_REG_TCM_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "TSEMI");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "TCM");
+                                        _print_parity(bp, TCM_REG_TCM_PRTY_STS);
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "TSEMI");
                                         _print_parity(bp,
                                                       TSEM_REG_TSEM_PRTY_STS_0);
                                         _print_parity(bp,
                                                       TSEM_REG_TSEM_PRTY_STS_1);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "XPB");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "XPB");
                                         _print_parity(bp, GRCBASE_XPB +
                                                           PB_REG_PB_PRTY_STS);
+                                        break;
                                 }
-                                break;
                         }
 
                         /* Clear the bit */
@@ -4346,53 +4358,59 @@ static int bnx2x_check_blocks_with_parity0(struct bnx2x *bp, u32 sig,
                 }
         }
 
-        return par_num;
+        return res;
 }
 
-static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool *global,
+static bool bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
+                                            int *par_num, bool *global,
                                             bool print)
 {
-        int i = 0;
-        u32 cur_bit = 0;
+        u32 cur_bit;
+        bool res;
+        int i;
+
+        res = false;
+
         for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                 if (sig & cur_bit) {
+                        res |= true; /* Each bit is real error! */
                         switch (cur_bit) {
                         case AEU_INPUTS_ATTN_BITS_PBF_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "PBF");
+                                        _print_next_block((*par_num)++, "PBF");
                                         _print_parity(bp, PBF_REG_PBF_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_QM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "QM");
+                                        _print_next_block((*par_num)++, "QM");
                                         _print_parity(bp, QM_REG_QM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_TIMERS_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "TM");
+                                        _print_next_block((*par_num)++, "TM");
                                         _print_parity(bp, TM_REG_TM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_XSDM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "XSDM");
+                                        _print_next_block((*par_num)++, "XSDM");
                                         _print_parity(bp,
                                                       XSDM_REG_XSDM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_XCM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "XCM");
+                                        _print_next_block((*par_num)++, "XCM");
                                         _print_parity(bp, XCM_REG_XCM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_XSEMI_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "XSEMI");
+                                        _print_next_block((*par_num)++,
+                                                          "XSEMI");
                                         _print_parity(bp,
                                                       XSEM_REG_XSEM_PRTY_STS_0);
                                         _print_parity(bp,
@@ -4401,7 +4419,7 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                 break;
                         case AEU_INPUTS_ATTN_BITS_DOORBELLQ_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                           "DOORBELLQ");
                                         _print_parity(bp,
                                                       DORQ_REG_DORQ_PRTY_STS);
@@ -4409,7 +4427,7 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                 break;
                         case AEU_INPUTS_ATTN_BITS_NIG_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "NIG");
+                                        _print_next_block((*par_num)++, "NIG");
                                         if (CHIP_IS_E1x(bp)) {
                                                 _print_parity(bp,
                                                         NIG_REG_NIG_PRTY_STS);
@@ -4423,32 +4441,34 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                 break;
                         case AEU_INPUTS_ATTN_BITS_VAUX_PCI_CORE_PARITY_ERROR:
                                 if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                           "VAUX PCI CORE");
                                 *global = true;
                                 break;
                         case AEU_INPUTS_ATTN_BITS_DEBUG_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "DEBUG");
+                                        _print_next_block((*par_num)++,
+                                                          "DEBUG");
                                         _print_parity(bp, DBG_REG_DBG_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_USDM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "USDM");
+                                        _print_next_block((*par_num)++, "USDM");
                                         _print_parity(bp,
                                                       USDM_REG_USDM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_UCM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "UCM");
+                                        _print_next_block((*par_num)++, "UCM");
                                         _print_parity(bp, UCM_REG_UCM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_USEMI_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "USEMI");
+                                        _print_next_block((*par_num)++,
+                                                          "USEMI");
                                         _print_parity(bp,
                                                       USEM_REG_USEM_PRTY_STS_0);
                                         _print_parity(bp,
@@ -4457,21 +4477,21 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                                 break;
                         case AEU_INPUTS_ATTN_BITS_UPB_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "UPB");
+                                        _print_next_block((*par_num)++, "UPB");
                                         _print_parity(bp, GRCBASE_UPB +
                                                           PB_REG_PB_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_CSDM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "CSDM");
+                                        _print_next_block((*par_num)++, "CSDM");
                                         _print_parity(bp,
                                                       CSDM_REG_CSDM_PRTY_STS);
                                 }
                                 break;
                         case AEU_INPUTS_ATTN_BITS_CCM_PARITY_ERROR:
                                 if (print) {
-                                        _print_next_block(par_num++, "CCM");
+                                        _print_next_block((*par_num)++, "CCM");
                                         _print_parity(bp, CCM_REG_CCM_PRTY_STS);
                                 }
                                 break;
@@ -4482,80 +4502,73 @@ static int bnx2x_check_blocks_with_parity1(struct bnx2x *bp, u32 sig,
                 }
         }
 
-        return par_num;
+        return res;
 }
 
-static int bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+static bool bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
+                                            int *par_num, bool print)
 {
-        int i = 0;
-        u32 cur_bit = 0;
+        u32 cur_bit;
+        bool res;
+        int i;
+
+        res = false;
+
         for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                 if (sig & cur_bit) {
-                        switch (cur_bit) {
-                        case AEU_INPUTS_ATTN_BITS_CSEMI_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "CSEMI");
+                        res |= true; /* Each bit is real error! */
+                        if (print) {
+                                switch (cur_bit) {
+                                case AEU_INPUTS_ATTN_BITS_CSEMI_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "CSEMI");
                                         _print_parity(bp,
                                                       CSEM_REG_CSEM_PRTY_STS_0);
                                         _print_parity(bp,
                                                       CSEM_REG_CSEM_PRTY_STS_1);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "PXP");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_PXP_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "PXP");
                                         _print_parity(bp, PXP_REG_PXP_PRTY_STS);
                                         _print_parity(bp,
                                                       PXP2_REG_PXP2_PRTY_STS_0);
                                         _print_parity(bp,
                                                       PXP2_REG_PXP2_PRTY_STS_1);
-                                }
-                                break;
-                        case AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR:
-                                if (print)
-                                        _print_next_block(par_num++,
-                                        "PXPPCICLOCKCLIENT");
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_CFC_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "CFC");
+                                        break;
+                                case AEU_IN_ATTN_BITS_PXPPCICLOCKCLIENT_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "PXPPCICLOCKCLIENT");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_CFC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "CFC");
                                         _print_parity(bp,
                                                       CFC_REG_CFC_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_CDU_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "CDU");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_CDU_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "CDU");
                                         _print_parity(bp, CDU_REG_CDU_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_DMAE_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "DMAE");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_DMAE_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "DMAE");
                                         _print_parity(bp,
                                                       DMAE_REG_DMAE_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "IGU");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "IGU");
                                         if (CHIP_IS_E1x(bp))
                                                 _print_parity(bp,
                                                         HC_REG_HC_PRTY_STS);
                                         else
                                                 _print_parity(bp,
                                                         IGU_REG_IGU_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "MISC");
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "MISC");
                                         _print_parity(bp,
                                                       MISC_REG_MISC_PRTY_STS);
+                                        break;
                                 }
-                                break;
                         }
 
                         /* Clear the bit */
@@ -4563,40 +4576,49 @@ static int bnx2x_check_blocks_with_parity2(struct bnx2x *bp, u32 sig,
                 }
         }
 
-        return par_num;
+        return res;
 }
 
-static int bnx2x_check_blocks_with_parity3(u32 sig, int par_num,
-                                           bool *global, bool print)
+static bool bnx2x_check_blocks_with_parity3(struct bnx2x *bp, u32 sig,
+                                            int *par_num, bool *global,
+                                            bool print)
 {
-        int i = 0;
-        u32 cur_bit = 0;
+        bool res = false;
+        u32 cur_bit;
+        int i;
+
         for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                 if (sig & cur_bit) {
                         switch (cur_bit) {
                         case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY:
                                 if (print)
-                                        _print_next_block(par_num++, "MCP ROM");
+                                        _print_next_block((*par_num)++,
+                                                          "MCP ROM");
                                 *global = true;
+                                res |= true;
                                 break;
                         case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY:
                                 if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                           "MCP UMP RX");
                                 *global = true;
+                                res |= true;
                                 break;
                         case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY:
                                 if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                           "MCP UMP TX");
                                 *global = true;
+                                res |= true;
                                 break;
                         case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY:
                                 if (print)
-                                        _print_next_block(par_num++,
+                                        _print_next_block((*par_num)++,
                                                           "MCP SCPAD");
-                                *global = true;
+                                /* clear latched SCPAD PATIRY from MCP */
+                                REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL,
+                                       1UL << 10);
                                 break;
                         }
 
@@ -4605,45 +4627,50 @@ static int bnx2x_check_blocks_with_parity3(u32 sig, int par_num,
                 }
         }
 
-        return par_num;
+        return res;
 }
 
-static int bnx2x_check_blocks_with_parity4(struct bnx2x *bp, u32 sig,
-                                            int par_num, bool print)
+static bool bnx2x_check_blocks_with_parity4(struct bnx2x *bp, u32 sig,
+                                            int *par_num, bool print)
 {
-        int i = 0;
-        u32 cur_bit = 0;
+        u32 cur_bit;
+        bool res;
+        int i;
+
+        res = false;
+
         for (i = 0; sig; i++) {
-                cur_bit = ((u32)0x1 << i);
+                cur_bit = (0x1UL << i);
                 if (sig & cur_bit) {
-                        switch (cur_bit) {
-                        case AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "PGLUE_B");
+                        res |= true; /* Each bit is real error! */
+                        if (print) {
+                                switch (cur_bit) {
+                                case AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR:
+                                        _print_next_block((*par_num)++,
+                                                          "PGLUE_B");
                                         _print_parity(bp,
-                                                PGLUE_B_REG_PGLUE_B_PRTY_STS);
-                                }
-                                break;
-                        case AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR:
-                                if (print) {
-                                        _print_next_block(par_num++, "ATC");
+                                                      PGLUE_B_REG_PGLUE_B_PRTY_STS);
+                                        break;
+                                case AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR:
+                                        _print_next_block((*par_num)++, "ATC");
                                         _print_parity(bp,
                                                       ATC_REG_ATC_PRTY_STS);
+                                        break;
                                 }
-                                break;
                         }
-
                         /* Clear the bit */
                         sig &= ~cur_bit;
                 }
         }
 
-        return par_num;
+        return res;
 }
 
 static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print,
                               u32 *sig)
 {
+        bool res = false;
+
         if ((sig[0] & HW_PRTY_ASSERT_SET_0) ||
             (sig[1] & HW_PRTY_ASSERT_SET_1) ||
             (sig[2] & HW_PRTY_ASSERT_SET_2) ||
@@ -4660,23 +4687,22 @@ static bool bnx2x_parity_attn(struct bnx2x *bp, bool *global, bool print,
                 if (print)
                         netdev_err(bp->dev,
                                    "Parity errors detected in blocks: ");
-                par_num = bnx2x_check_blocks_with_parity0(bp,
-                        sig[0] & HW_PRTY_ASSERT_SET_0, par_num, print);
-                par_num = bnx2x_check_blocks_with_parity1(bp,
-                        sig[1] & HW_PRTY_ASSERT_SET_1, par_num, global, print);
-                par_num = bnx2x_check_blocks_with_parity2(bp,
-                        sig[2] & HW_PRTY_ASSERT_SET_2, par_num, print);
-                par_num = bnx2x_check_blocks_with_parity3(
-                        sig[3] & HW_PRTY_ASSERT_SET_3, par_num, global, print);
-                par_num = bnx2x_check_blocks_with_parity4(bp,
-                        sig[4] & HW_PRTY_ASSERT_SET_4, par_num, print);
+                res |= bnx2x_check_blocks_with_parity0(bp,
+                        sig[0] & HW_PRTY_ASSERT_SET_0, &par_num, print);
+                res |= bnx2x_check_blocks_with_parity1(bp,
+                        sig[1] & HW_PRTY_ASSERT_SET_1, &par_num, global, print);
+                res |= bnx2x_check_blocks_with_parity2(bp,
+                        sig[2] & HW_PRTY_ASSERT_SET_2, &par_num, print);
+                res |= bnx2x_check_blocks_with_parity3(bp,
+                        sig[3] & HW_PRTY_ASSERT_SET_3, &par_num, global, print);
+                res |= bnx2x_check_blocks_with_parity4(bp,
+                        sig[4] & HW_PRTY_ASSERT_SET_4, &par_num, print);
 
                 if (print)
                         pr_cont("\n");
+        }
 
-                return true;
-        } else
-                return false;
+        return res;
 }
 
 /**
@@ -4703,6 +4729,14 @@ bool bnx2x_chk_parity_attn(struct bnx2x *bp, bool *global, bool print)
         attn.sig[3] = REG_RD(bp,
                 MISC_REG_AEU_AFTER_INVERT_4_FUNC_0 +
                              port*4);
+        /* Since MCP attentions can't be disabled inside the block, we need to
+         * read AEU registers to see whether they're currently disabled
+         */
+        attn.sig[3] &= ((REG_RD(bp,
+                                !port ? MISC_REG_AEU_ENABLE4_FUNC_0_OUT_0
+                                      : MISC_REG_AEU_ENABLE4_FUNC_1_OUT_0) &
+                         MISC_AEU_ENABLE_MCP_PRTY_BITS) |
+                        ~MISC_AEU_ENABLE_MCP_PRTY_BITS);
 
         if (!CHIP_IS_E1x(bp))
                 attn.sig[4] = REG_RD(bp,
@@ -5447,26 +5481,24 @@ static void bnx2x_timer(unsigned long data)
         if (IS_PF(bp) &&
             !BP_NOMCP(bp)) {
                 int mb_idx = BP_FW_MB_IDX(bp);
-                u32 drv_pulse;
-                u32 mcp_pulse;
+                u16 drv_pulse;
+                u16 mcp_pulse;
 
                 ++bp->fw_drv_pulse_wr_seq;
                 bp->fw_drv_pulse_wr_seq &= DRV_PULSE_SEQ_MASK;
-                /* TBD - add SYSTEM_TIME */
                 drv_pulse = bp->fw_drv_pulse_wr_seq;
                 bnx2x_drv_pulse(bp);
 
                 mcp_pulse = (SHMEM_RD(bp, func_mb[mb_idx].mcp_pulse_mb) &
                              MCP_PULSE_SEQ_MASK);
                 /* The delta between driver pulse and mcp response
-                 * should be 1 (before mcp response) or 0 (after mcp response)
+                 * should not get too big. If the MFW is more than 5 pulses
+                 * behind, we should worry about it enough to generate an error
+                 * log.
                  */
-                if ((drv_pulse != mcp_pulse) &&
-                    (drv_pulse != ((mcp_pulse + 1) & MCP_PULSE_SEQ_MASK))) {
-                        /* someone lost a heartbeat... */
-                        BNX2X_ERR("drv_pulse (0x%x) != mcp_pulse (0x%x)\n",
+                if (((drv_pulse - mcp_pulse) & MCP_PULSE_SEQ_MASK) > 5)
+                        BNX2X_ERR("MFW seems hanged: drv_pulse (0x%x) != mcp_pulse (0x%x)\n",
                                   drv_pulse, mcp_pulse);
-                }
         }
 
         if (bp->state == BNX2X_STATE_OPEN)
@@ -7120,7 +7152,7 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
         int port = BP_PORT(bp);
         int init_phase = port ? PHASE_PORT1 : PHASE_PORT0;
         u32 low, high;
-        u32 val;
+        u32 val, reg;
 
         DP(NETIF_MSG_HW, "starting port init  port %d\n", port);
 
@@ -7265,6 +7297,17 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
         val |= CHIP_IS_E1(bp) ? 0 : 0x10;
         REG_WR(bp, MISC_REG_AEU_MASK_ATTN_FUNC_0 + port*4, val);
 
+        /* SCPAD_PARITY should NOT trigger close the gates */
+        reg = port ? MISC_REG_AEU_ENABLE4_NIG_1 : MISC_REG_AEU_ENABLE4_NIG_0;
+        REG_WR(bp, reg,
+               REG_RD(bp, reg) &
+               ~AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY);
+
+        reg = port ? MISC_REG_AEU_ENABLE4_PXP_1 : MISC_REG_AEU_ENABLE4_PXP_0;
+        REG_WR(bp, reg,
+               REG_RD(bp, reg) &
+               ~AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY);
+
         bnx2x_init_block(bp, BLOCK_NIG, init_phase);
 
         if (!CHIP_IS_E1x(bp)) {
@@ -11679,9 +11722,6 @@ static int bnx2x_init_bp(struct bnx2x *bp)
 static int bnx2x_open(struct net_device *dev)
 {
         struct bnx2x *bp = netdev_priv(dev);
-        bool global = false;
-        int other_engine = BP_PATH(bp) ? 0 : 1;
-        bool other_load_status, load_status;
         int rc;
 
         bp->stats_init = true;
@@ -11697,6 +11737,10 @@ static int bnx2x_open(struct net_device *dev)
          * Parity recovery is only relevant for PF driver.
          */
         if (IS_PF(bp)) {
+                int other_engine = BP_PATH(bp) ? 0 : 1;
+                bool other_load_status, load_status;
+                bool global = false;
+
                 other_load_status = bnx2x_get_load_status(bp, other_engine);
                 load_status = bnx2x_get_load_status(bp, BP_PATH(bp));
                 if (!bnx2x_reset_is_done(bp, BP_PATH(bp)) ||
@@ -12074,7 +12118,6 @@ static int bnx2x_set_coherency_mask(struct bnx2x *bp)
         struct device *dev = &bp->pdev->dev;
 
         if (dma_set_mask(dev, DMA_BIT_MASK(64)) == 0) {
-                bp->flags |= USING_DAC_FLAG;
                 if (dma_set_coherent_mask(dev, DMA_BIT_MASK(64)) != 0) {
                         dev_err(dev, "dma_set_coherent_mask failed, aborting\n");
                         return -EIO;
@@ -12242,8 +12285,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                 NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_HIGHDMA;
 
         dev->features |= dev->hw_features | NETIF_F_HW_VLAN_CTAG_RX;
-        if (bp->flags & USING_DAC_FLAG)
-                dev->features |= NETIF_F_HIGHDMA;
+        dev->features |= NETIF_F_HIGHDMA;
 
         /* Add Loopback capability to the device */
         dev->hw_features |= NETIF_F_LOOPBACK;
@@ -12606,24 +12648,24 @@ static int set_max_cos_est(int chip_id)
                 return BNX2X_MULTI_TX_COS_E1X;
         case BCM57712:
         case BCM57712_MF:
-        case BCM57712_VF:
                 return BNX2X_MULTI_TX_COS_E2_E3A0;
         case BCM57800:
         case BCM57800_MF:
-        case BCM57800_VF:
         case BCM57810:
         case BCM57810_MF:
         case BCM57840_4_10:
         case BCM57840_2_20:
         case BCM57840_O:
         case BCM57840_MFO:
-        case BCM57810_VF:
         case BCM57840_MF:
-        case BCM57840_VF:
         case BCM57811:
         case BCM57811_MF:
-        case BCM57811_VF:
                 return BNX2X_MULTI_TX_COS_E3B0;
+        case BCM57712_VF:
+        case BCM57800_VF:
+        case BCM57810_VF:
+        case BCM57840_VF:
+        case BCM57811_VF:
                 return 1;
         default:
                 pr_err("Unknown board_type (%d), aborting\n", chip_id);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 2604b6204abe..bf08ad68b405 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -470,10 +470,10 @@ static int bnx2x_vfop_qdtor_cmd(struct bnx2x *bp,
                                  bnx2x_vfop_qdtor, cmd->done);
                 return bnx2x_vfop_transition(bp, vf, bnx2x_vfop_qdtor,
                                              cmd->block);
+        } else {
+                BNX2X_ERR("VF[%d] failed to add a vfop\n", vf->abs_vfid);
+                return -ENOMEM;
         }
-        DP(BNX2X_MSG_IOV, "VF[%d] failed to add a vfop. rc %d\n",
-           vf->abs_vfid, vfop->rc);
-        return -ENOMEM;
 }
 
 static void
@@ -1819,7 +1819,7 @@ bnx2x_get_vf_igu_cam_info(struct bnx2x *bp)
                 fid = GET_FIELD((val), IGU_REG_MAPPING_MEMORY_FID);
                 if (fid & IGU_FID_ENCODE_IS_PF)
                         current_pf = fid & IGU_FID_PF_NUM_MASK;
-                else if (current_pf == BP_ABS_FUNC(bp))
+                else if (current_pf == BP_FUNC(bp))
                         bnx2x_vf_set_igu_info(bp, sb_id,
                                               (fid & IGU_FID_VF_NUM_MASK));
                 DP(BNX2X_MSG_IOV, "%s[%d], igu_sb_id=%d, msix=%d\n",
@@ -3180,6 +3180,7 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                 /* set local queue arrays */
                 vf->vfqs = &bp->vfdb->vfqs[qcount];
                 qcount += vf_sb_count(vf);
+                bnx2x_iov_static_resc(bp, vf);
         }
 
         /* prepare msix vectors in VF configuration space */
@@ -3187,6 +3188,8 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                 bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                 REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
                        num_vf_queues);
+                DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
+                   vf_idx, num_vf_queues);
         }
         bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
 
@@ -3387,14 +3390,16 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
                 rc = bnx2x_del_all_macs(bp, mac_obj, BNX2X_ETH_MAC, true);
                 if (rc) {
                         BNX2X_ERR("failed to delete eth macs\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                 }
 
                 /* remove existing uc list macs */
                 rc = bnx2x_del_all_macs(bp, mac_obj, BNX2X_UC_LIST_MAC, true);
                 if (rc) {
                         BNX2X_ERR("failed to delete uc_list macs\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                 }
 
                 /* configure the new mac to device */
@@ -3402,6 +3407,7 @@ int bnx2x_set_vf_mac(struct net_device *dev, int vfidx, u8 *mac)
                 bnx2x_set_mac_one(bp, (u8 *)&bulletin->mac, mac_obj, true,
                                   BNX2X_ETH_MAC, &ramrod_flags);
 
+out:
                 bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_MAC);
         }
 
@@ -3464,7 +3470,8 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                                           &ramrod_flags);
                 if (rc) {
                         BNX2X_ERR("failed to delete vlans\n");
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto out;
                 }
 
                 /* send queue update ramrod to configure default vlan and silent
@@ -3498,7 +3505,8 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                         rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
                         if (rc) {
                                 BNX2X_ERR("failed to configure vlan\n");
-                                return -EINVAL;
+                                rc =  -EINVAL;
+                                goto out;
                         }
 
                         /* configure default vlan to vf queue and set silent
@@ -3516,18 +3524,18 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
                 rc = bnx2x_queue_state_change(bp, &q_params);
                 if (rc) {
                         BNX2X_ERR("Failed to configure default VLAN\n");
-                        return rc;
+                        goto out;
                 }
 
                 /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured th Vlan before vf was
-                 * and we were called because the VF came up later
+                 * (will only be set if the HV configured the Vlan before vf was
+                 * up and we were called because the VF came up later
                  */
+out:
                 vf->cfg_flags &= ~VF_CFG_VLAN;
-
                 bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
         }
-        return 0;
+        return rc;
 }
 
 /* crc is the first field in the bulletin board. Compute the crc over the
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 86436c77af03..3b75070411aa 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -196,7 +196,7 @@ static void bnx2x_hw_stats_post(struct bnx2x *bp)
 
         } else if (bp->func_stx) {
                 *stats_comp = 0;
-                bnx2x_post_dmae(bp, dmae, INIT_DMAE_C(bp));
+                bnx2x_issue_dmae_with_comp(bp, dmae, stats_comp);
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 6cfb88732452..28757dfacf0d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -980,7 +980,7 @@ static int bnx2x_copy32_vf_dmae(struct bnx2x *bp, u8 from_vf,
         dmae.len = len32;
 
         /* issue the command and wait for completion */
-        return bnx2x_issue_dmae_with_comp(bp, &dmae);
+        return bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
 }
 
 static void bnx2x_vf_mbx_resp(struct bnx2x *bp, struct bnx2x_virtf *vf)
@@ -1765,28 +1765,28 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
                 switch (mbx->first_tlv.tl.type) {
                 case CHANNEL_TLV_ACQUIRE:
                         bnx2x_vf_mbx_acquire(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_INIT:
                         bnx2x_vf_mbx_init_vf(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_SETUP_Q:
                         bnx2x_vf_mbx_setup_q(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_SET_Q_FILTERS:
                         bnx2x_vf_mbx_set_q_filters(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_TEARDOWN_Q:
                         bnx2x_vf_mbx_teardown_q(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_CLOSE:
                         bnx2x_vf_mbx_close_vf(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_RELEASE:
                         bnx2x_vf_mbx_release_vf(bp, vf, mbx);
-                        break;
+                        return;
                 case CHANNEL_TLV_UPDATE_RSS:
                         bnx2x_vf_mbx_update_rss(bp, vf, mbx);
-                        break;
+                        return;
                 }
 
         } else {
@@ -1802,26 +1802,24 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
                 for (i = 0; i < 20; i++)
                         DP_CONT(BNX2X_MSG_IOV, "%x ",
                                 mbx->msg->req.tlv_buf_size.tlv_buffer[i]);
+        }
 
-                /* test whether we can respond to the VF (do we have an address
-                 * for it?)
-                 */
-                if (vf->state == VF_ACQUIRED || vf->state == VF_ENABLED) {
-                        /* mbx_resp uses the op_rc of the VF */
-                        vf->op_rc = PFVF_STATUS_NOT_SUPPORTED;
+        /* can we respond to VF (do we have an address for it?) */
+        if (vf->state == VF_ACQUIRED || vf->state == VF_ENABLED) {
+                /* mbx_resp uses the op_rc of the VF */
+                vf->op_rc = PFVF_STATUS_NOT_SUPPORTED;
 
-                        /* notify the VF that we do not support this request */
-                        bnx2x_vf_mbx_resp(bp, vf);
-                } else {
-                        /* can't send a response since this VF is unknown to us
-                         * just ack the FW to release the mailbox and unlock
-                         * the channel.
-                         */
-                        storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
-                        mmiowb();
-                        bnx2x_unlock_vf_pf_channel(bp, vf,
-                                                   mbx->first_tlv.tl.type);
-                }
+                /* notify the VF that we do not support this request */
+                bnx2x_vf_mbx_resp(bp, vf);
+        } else {
+                /* can't send a response since this VF is unknown to us
+                 * just ack the FW to release the mailbox and unlock
+                 * the channel.
+                 */
+                storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
+                /* Firmware ack should be written before unlocking channel */
+                mmiowb();
+                bnx2x_unlock_vf_pf_channel(bp, vf, mbx->first_tlv.tl.type);
         }
 }
 
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index 78d6d6b970e1..48f52882a22b 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -106,7 +106,6 @@
 #define XGMAC_DMA_HW_FEATURE    0x00000f58      /* Enabled Hardware Features */
 
 #define XGMAC_ADDR_AE           0x80000000
-#define XGMAC_MAX_FILTER_ADDR   31
 
 /* PMT Control and Status */
 #define XGMAC_PMT_POINTER_RESET 0x80000000
@@ -384,6 +383,7 @@ struct xgmac_priv {
         struct device *device;
         struct napi_struct napi;
 
+        int max_macs;
         struct xgmac_extra_stats xstats;
 
         spinlock_t stats_lock;
@@ -1291,14 +1291,12 @@ static void xgmac_set_rx_mode(struct net_device *dev)
         netdev_dbg(priv->dev, "# mcasts %d, # unicast %d\n",
                  netdev_mc_count(dev), netdev_uc_count(dev));
 
-        if (dev->flags & IFF_PROMISC) {
-                writel(XGMAC_FRAME_FILTER_PR, ioaddr + XGMAC_FRAME_FILTER);
-                return;
-        }
+        if (dev->flags & IFF_PROMISC)
+                value |= XGMAC_FRAME_FILTER_PR;
 
         memset(hash_filter, 0, sizeof(hash_filter));
 
-        if (netdev_uc_count(dev) > XGMAC_MAX_FILTER_ADDR) {
+        if (netdev_uc_count(dev) > priv->max_macs) {
                 use_hash = true;
                 value |= XGMAC_FRAME_FILTER_HUC | XGMAC_FRAME_FILTER_HPF;
         }
@@ -1321,7 +1319,7 @@ static void xgmac_set_rx_mode(struct net_device *dev)
                 goto out;
         }
 
-        if ((netdev_mc_count(dev) + reg - 1) > XGMAC_MAX_FILTER_ADDR) {
+        if ((netdev_mc_count(dev) + reg - 1) > priv->max_macs) {
                 use_hash = true;
                 value |= XGMAC_FRAME_FILTER_HMC | XGMAC_FRAME_FILTER_HPF;
         } else {
@@ -1342,8 +1340,8 @@ static void xgmac_set_rx_mode(struct net_device *dev)
         }
 
 out:
-        for (i = reg; i < XGMAC_MAX_FILTER_ADDR; i++)
-                xgmac_set_mac_addr(ioaddr, NULL, reg);
+        for (i = reg; i <= priv->max_macs; i++)
+                xgmac_set_mac_addr(ioaddr, NULL, i);
         for (i = 0; i < XGMAC_NUM_HASH; i++)
                 writel(hash_filter[i], ioaddr + XGMAC_HASH(i));
 
@@ -1761,6 +1759,13 @@ static int xgmac_probe(struct platform_device *pdev)
         uid = readl(priv->base + XGMAC_VERSION);
         netdev_info(ndev, "h/w version is 0x%x\n", uid);
 
+        /* Figure out how many valid mac address filter registers we have */
+        writel(1, priv->base + XGMAC_ADDR_HIGH(31));
+        if (readl(priv->base + XGMAC_ADDR_HIGH(31)) == 1)
+                priv->max_macs = 31;
+        else
+                priv->max_macs = 7;
+
         writel(0, priv->base + XGMAC_DMA_INTR_ENA);
         ndev->irq = platform_get_irq(pdev, 0);
         if (ndev->irq == -ENXIO) {
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 5f5896e522d2..a7a941b1a655 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -158,18 +158,6 @@ static inline board_info_t *to_dm9000_board(struct net_device *dev)
 
 /* DM9000 network board routine ---------------------------- */
 
-static void
-dm9000_reset(board_info_t * db)
-{
-        dev_dbg(db->dev, "resetting device\n");
-
-        /* RESET device */
-        writeb(DM9000_NCR, db->io_addr);
-        udelay(200);
-        writeb(NCR_RST, db->io_data);
-        udelay(200);
-}
-
 /*
  *   Read a byte from I/O port
  */
@@ -191,6 +179,27 @@ iow(board_info_t * db, int reg, int value)
         writeb(value, db->io_data);
 }
 
+static void
+dm9000_reset(board_info_t *db)
+{
+        dev_dbg(db->dev, "resetting device\n");
+
+        /* Reset DM9000, see DM9000 Application Notes V1.22 Jun 11, 2004 page 29
+         * The essential point is that we have to do a double reset, and the
+         * instruction is to set LBK into MAC internal loopback mode.
+         */
+        iow(db, DM9000_NCR, 0x03);
+        udelay(100); /* Application note says at least 20 us */
+        if (ior(db, DM9000_NCR) & 1)
+                dev_err(db->dev, "dm9000 did not respond to first reset\n");
+
+        iow(db, DM9000_NCR, 0);
+        iow(db, DM9000_NCR, 0x03);
+        udelay(100);
+        if (ior(db, DM9000_NCR) & 1)
+                dev_err(db->dev, "dm9000 did not respond to second reset\n");
+}
+
 /* routines for sending block to chip */
 
 static void dm9000_outblk_8bit(void __iomem *reg, void *data, int count)
@@ -744,15 +753,20 @@ static const struct ethtool_ops dm9000_ethtool_ops = {
 static void dm9000_show_carrier(board_info_t *db,
                                 unsigned carrier, unsigned nsr)
 {
+        int lpa;
         struct net_device *ndev = db->ndev;
+        struct mii_if_info *mii = &db->mii;
         unsigned ncr = dm9000_read_locked(db, DM9000_NCR);
 
-        if (carrier)
-                dev_info(db->dev, "%s: link up, %dMbps, %s-duplex, no LPA\n",
+        if (carrier) {
+                lpa = mii->mdio_read(mii->dev, mii->phy_id, MII_LPA);
+                dev_info(db->dev,
+                         "%s: link up, %dMbps, %s-duplex, lpa 0x%04X\n",
                          ndev->name, (nsr & NSR_SPEED) ? 10 : 100,
-                         (ncr & NCR_FDX) ? "full" : "half");
-        else
+                         (ncr & NCR_FDX) ? "full" : "half", lpa);
+        } else {
                 dev_info(db->dev, "%s: link down\n", ndev->name);
+        }
 }
 
 static void
@@ -890,9 +904,15 @@ dm9000_init_dm9000(struct net_device *dev)
                         (dev->features & NETIF_F_RXCSUM) ? RCSR_CSUM : 0);
 
         iow(db, DM9000_GPCR, GPCR_GEP_CNTL);    /* Let GPIO0 output */
+        iow(db, DM9000_GPR, 0);
 
-        dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
-        dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
+        /* If we are dealing with DM9000B, some extra steps are required: a
+         * manual phy reset, and setting init params.
+         */
+        if (db->type == TYPE_DM9000B) {
+                dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET);
+                dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM);
+        }
 
         ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index ace5050dba38..db020230bd0b 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -88,6 +88,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE_MIN_MTU              256
 
 #define BE_NUM_VLANS_SUPPORTED  64
+#define BE_UMC_NUM_VLANS_SUPPORTED      15
 #define BE_MAX_EQD              96u
 #define BE_MAX_TX_FRAG_COUNT    30
 
@@ -333,6 +334,7 @@ enum vf_state {
 
 #define BE_FLAGS_LINK_STATUS_INIT               1
 #define BE_FLAGS_WORKER_SCHEDULED               (1 << 3)
+#define BE_FLAGS_VLAN_PROMISC                   (1 << 4)
 #define BE_FLAGS_NAPI_ENABLED                   (1 << 9)
 #define BE_UC_PMAC_COUNT                30
 #define BE_VF_UC_PMAC_COUNT             2
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 1ab5dab11eff..c08fd32bb8e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -180,6 +180,9 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                         dev_err(&adapter->pdev->dev,
                                 "opcode %d-%d failed:status %d-%d\n",
                                 opcode, subsystem, compl_status, extd_status);
+
+                        if (extd_status == MCC_ADDL_STS_INSUFFICIENT_RESOURCES)
+                                return extd_status;
                 }
         }
 done:
@@ -1195,7 +1198,6 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo)
 
         if (lancer_chip(adapter)) {
                 req->hdr.version = 1;
-                req->if_id = cpu_to_le16(adapter->if_handle);
         } else if (BEx_chip(adapter)) {
                 if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC)
                         req->hdr.version = 2;
@@ -1203,6 +1205,8 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo)
                 req->hdr.version = 2;
         }
 
+        if (req->hdr.version > 0)
+                req->if_id = cpu_to_le16(adapter->if_handle);
         req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
         req->ulp_num = BE_ULP1_NUM;
         req->type = BE_ETH_TX_RING_TYPE_STANDARD;
@@ -1812,6 +1816,12 @@ int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
         } else if (flags & IFF_ALLMULTI) {
                 req->if_flags_mask = req->if_flags =
                                 cpu_to_le32(BE_IF_FLAGS_MCAST_PROMISCUOUS);
+        } else if (flags & BE_FLAGS_VLAN_PROMISC) {
+                req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_VLAN_PROMISCUOUS);
+
+                if (value == ON)
+                        req->if_flags =
+                                cpu_to_le32(BE_IF_FLAGS_VLAN_PROMISCUOUS);
         } else {
                 struct netdev_hw_addr *ha;
                 int i = 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index d026226db88c..108ca8abf0af 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -60,6 +60,8 @@ enum {
         MCC_STATUS_NOT_SUPPORTED = 66
 };
 
+#define MCC_ADDL_STS_INSUFFICIENT_RESOURCES     0x16
+
 #define CQE_STATUS_COMPL_MASK           0xFFFF
 #define CQE_STATUS_COMPL_SHIFT          0       /* bits 0 - 15 */
 #define CQE_STATUS_EXTD_MASK            0xFFFF
@@ -1791,7 +1793,7 @@ struct be_nic_res_desc {
         u8 acpi_params;
         u8 wol_param;
         u16 rsvd7;
-        u32 rsvd8[3];
+        u32 rsvd8[7];
 } __packed;
 
 struct be_cmd_req_get_func_config {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 100b528b9bd0..2c38cc402119 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -855,11 +855,11 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
         unsigned int eth_hdr_len;
         struct iphdr *ip;
 
-        /* Lancer ASIC has a bug wherein packets that are 32 bytes or less
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
          * may cause a transmit stall on that port. So the work-around is to
-         * pad such packets to a 36-byte length.
+         * pad short packets (<= 32 bytes) to a 36-byte length.
          */
-        if (unlikely(lancer_chip(adapter) && skb->len <= 32)) {
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
                 if (skb_padto(skb, 36))
                         goto tx_drop;
                 skb->len = 36;
@@ -1013,18 +1013,40 @@ static int be_vid_config(struct be_adapter *adapter)
         status = be_cmd_vlan_config(adapter, adapter->if_handle,
                                     vids, num, 1, 0);
 
-        /* Set to VLAN promisc mode as setting VLAN filter failed */
         if (status) {
-                dev_info(&adapter->pdev->dev, "Exhausted VLAN HW filters.\n");
-                dev_info(&adapter->pdev->dev, "Disabling HW VLAN filtering.\n");
-                goto set_vlan_promisc;
+                /* Set to VLAN promisc mode as setting VLAN filter failed */
+                if (status == MCC_ADDL_STS_INSUFFICIENT_RESOURCES)
+                        goto set_vlan_promisc;
+                dev_err(&adapter->pdev->dev,
+                        "Setting HW VLAN filtering failed.\n");
+        } else {
+                if (adapter->flags & BE_FLAGS_VLAN_PROMISC) {
+                        /* hw VLAN filtering re-enabled. */
+                        status = be_cmd_rx_filter(adapter,
+                                                  BE_FLAGS_VLAN_PROMISC, OFF);
+                        if (!status) {
+                                dev_info(&adapter->pdev->dev,
+                                         "Disabling VLAN Promiscuous mode.\n");
+                                adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+                                dev_info(&adapter->pdev->dev,
+                                         "Re-Enabling HW VLAN filtering\n");
+                        }
+                }
         }
 
         return status;
 
 set_vlan_promisc:
-        status = be_cmd_vlan_config(adapter, adapter->if_handle,
-                                    NULL, 0, 1, 1);
+        dev_warn(&adapter->pdev->dev, "Exhausted VLAN HW filters.\n");
+
+        status = be_cmd_rx_filter(adapter, BE_FLAGS_VLAN_PROMISC, ON);
+        if (!status) {
+                dev_info(&adapter->pdev->dev, "Enable VLAN Promiscuous mode\n");
+                dev_info(&adapter->pdev->dev, "Disabling HW VLAN filtering\n");
+                adapter->flags |= BE_FLAGS_VLAN_PROMISC;
+        } else
+                dev_err(&adapter->pdev->dev,
+                        "Failed to enable VLAN Promiscuous mode.\n");
         return status;
 }
 
@@ -1033,10 +1055,6 @@ static int be_vlan_add_vid(struct net_device *netdev, __be16 proto, u16 vid)
         struct be_adapter *adapter = netdev_priv(netdev);
         int status = 0;
 
-        if (!lancer_chip(adapter) && !be_physfn(adapter)) {
-                status = -EINVAL;
-                goto ret;
-        }
 
         /* Packets with VID 0 are always received by Lancer by default */
         if (lancer_chip(adapter) && vid == 0)
@@ -1059,11 +1077,6 @@ static int be_vlan_rem_vid(struct net_device *netdev, __be16 proto, u16 vid)
         struct be_adapter *adapter = netdev_priv(netdev);
         int status = 0;
 
-        if (!lancer_chip(adapter) && !be_physfn(adapter)) {
-                status = -EINVAL;
-                goto ret;
-        }
-
         /* Packets with VID 0 are always received by Lancer by default */
         if (lancer_chip(adapter) && vid == 0)
                 goto ret;
@@ -1188,8 +1201,8 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
 
         vi->vf = vf;
         vi->tx_rate = vf_cfg->tx_rate;
-        vi->vlan = vf_cfg->vlan_tag;
-        vi->qos = 0;
+        vi->vlan = vf_cfg->vlan_tag & VLAN_VID_MASK;
+        vi->qos = vf_cfg->vlan_tag >> VLAN_PRIO_SHIFT;
         memcpy(&vi->mac, vf_cfg->mac_addr, ETH_ALEN);
 
         return 0;
@@ -1199,28 +1212,29 @@ static int be_set_vf_vlan(struct net_device *netdev,
                         int vf, u16 vlan, u8 qos)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
         int status = 0;
 
         if (!sriov_enabled(adapter))
                 return -EPERM;
 
-        if (vf >= adapter->num_vfs || vlan > 4095)
+        if (vf >= adapter->num_vfs || vlan > 4095 || qos > 7)
                 return -EINVAL;
 
-        if (vlan) {
-                if (adapter->vf_cfg[vf].vlan_tag != vlan) {
+        if (vlan || qos) {
+                vlan |= qos << VLAN_PRIO_SHIFT;
+                if (vf_cfg->vlan_tag != vlan) {
                         /* If this is new value, program it. Else skip. */
-                        adapter->vf_cfg[vf].vlan_tag = vlan;
-
-                        status = be_cmd_set_hsw_config(adapter, vlan,
-                                vf + 1, adapter->vf_cfg[vf].if_handle, 0);
+                        vf_cfg->vlan_tag = vlan;
+                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
+                                                       vf_cfg->if_handle, 0);
                 }
         } else {
                 /* Reset Transparent Vlan Tagging. */
-                adapter->vf_cfg[vf].vlan_tag = 0;
-                vlan = adapter->vf_cfg[vf].def_vid;
+                vf_cfg->vlan_tag = 0;
+                vlan = vf_cfg->def_vid;
                 status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                        adapter->vf_cfg[vf].if_handle, 0);
+                                               vf_cfg->if_handle, 0);
         }
 
 
@@ -2963,6 +2977,8 @@ static void BEx_get_resources(struct be_adapter *adapter,
 
         if (adapter->function_mode & FLEX10_MODE)
                 res->max_vlans = BE_NUM_VLANS_SUPPORTED/8;
+        else if (adapter->function_mode & UMC_ENABLED)
+                res->max_vlans = BE_UMC_NUM_VLANS_SUPPORTED;
         else
                 res->max_vlans = BE_NUM_VLANS_SUPPORTED;
         res->max_mcast_mac = BE_MAX_MC;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index c4eaadeb572f..9fbe4dda7a0e 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -88,6 +88,7 @@
 
 #include <asm/io.h>
 #include <asm/reg.h>
+#include <asm/mpc85xx.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 #include <linux/module.h>
@@ -939,9 +940,8 @@ static void gfar_init_filer_table(struct gfar_private *priv)
         }
 }
 
-static void gfar_detect_errata(struct gfar_private *priv)
+static void __gfar_detect_errata_83xx(struct gfar_private *priv)
 {
-        struct device *dev = &priv->ofdev->dev;
         unsigned int pvr = mfspr(SPRN_PVR);
         unsigned int svr = mfspr(SPRN_SVR);
         unsigned int mod = (svr >> 16) & 0xfff6; /* w/o E suffix */
@@ -957,15 +957,33 @@ static void gfar_detect_errata(struct gfar_private *priv)
             (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
                 priv->errata |= GFAR_ERRATA_76;
 
-        /* MPC8313 and MPC837x all rev */
-        if ((pvr == 0x80850010 && mod == 0x80b0) ||
-            (pvr == 0x80861010 && (mod & 0xfff9) == 0x80c0))
-                priv->errata |= GFAR_ERRATA_A002;
+        /* MPC8313 Rev < 2.0 */
+        if (pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020)
+                priv->errata |= GFAR_ERRATA_12;
+}
 
-        /* MPC8313 Rev < 2.0, MPC8548 rev 2.0 */
-        if ((pvr == 0x80850010 && mod == 0x80b0 && rev < 0x0020) ||
-            (pvr == 0x80210020 && mod == 0x8030 && rev == 0x0020))
+static void __gfar_detect_errata_85xx(struct gfar_private *priv)
+{
+        unsigned int svr = mfspr(SPRN_SVR);
+
+        if ((SVR_SOC_VER(svr) == SVR_8548) && (SVR_REV(svr) == 0x20))
                 priv->errata |= GFAR_ERRATA_12;
+        if (((SVR_SOC_VER(svr) == SVR_P2020) && (SVR_REV(svr) < 0x20)) ||
+            ((SVR_SOC_VER(svr) == SVR_P2010) && (SVR_REV(svr) < 0x20)))
+                priv->errata |= GFAR_ERRATA_76; /* aka eTSEC 20 */
+}
+
+static void gfar_detect_errata(struct gfar_private *priv)
+{
+        struct device *dev = &priv->ofdev->dev;
+
+        /* no plans to fix */
+        priv->errata |= GFAR_ERRATA_A002;
+
+        if (pvr_version_is(PVR_VER_E500V1) || pvr_version_is(PVR_VER_E500V2))
+                __gfar_detect_errata_85xx(priv);
+        else /* non-mpc85xx parts, i.e. e300 core based */
+                __gfar_detect_errata_83xx(priv);
 
         if (priv->errata)
                 dev_info(dev, "enabled errata workarounds, flags: 0x%x\n",
@@ -1599,7 +1617,7 @@ static int __gfar_is_rx_idle(struct gfar_private *priv)
         /* Normaly TSEC should not hang on GRS commands, so we should
          * actually wait for IEVENT_GRSC flag.
          */
-        if (likely(!gfar_has_errata(priv, GFAR_ERRATA_A002)))
+        if (!gfar_has_errata(priv, GFAR_ERRATA_A002))
                 return 0;
 
         /* Read the eTSEC register at offset 0xD1C. If bits 7-14 are
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index 098f133908ae..e006a09ba899 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -452,7 +452,9 @@ static int gianfar_ptp_probe(struct platform_device *dev)
         err = -ENODEV;
 
         etsects->caps = ptp_gianfar_caps;
-        etsects->cksel = DEFAULT_CKSEL;
+
+        if (get_of_u32(node, "fsl,cksel", &etsects->cksel))
+                etsects->cksel = DEFAULT_CKSEL;
 
         if (get_of_u32(node, "fsl,tclk-period", &etsects->tclk_period) ||
             get_of_u32(node, "fsl,tmr-prsc", &etsects->tmr_prsc) ||
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 0c524fa9f811..cfef7fc32cdd 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -701,8 +701,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
 
         details = I40E_ADMINQ_DETAILS(hw->aq.asq, hw->aq.asq.next_to_use);
         if (cmd_details) {
-                memcpy(details, cmd_details,
-                       sizeof(struct i40e_asq_cmd_details));
+                *details = *cmd_details;
 
                 /* If the cmd_details are defined copy the cookie.  The
                  * cpu_to_le32 is not needed here because the data is ignored
@@ -760,7 +759,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
         desc_on_ring = I40E_ADMINQ_DESC(hw->aq.asq, hw->aq.asq.next_to_use);
 
         /* if the desc is available copy the temp desc to the right place */
-        memcpy(desc_on_ring, desc, sizeof(struct i40e_aq_desc));
+        *desc_on_ring = *desc;
 
         /* if buff is not NULL assume indirect command */
         if (buff != NULL) {
@@ -807,7 +806,7 @@ i40e_status i40e_asq_send_command(struct i40e_hw *hw,
 
         /* if ready, copy the desc back to temp */
         if (i40e_asq_done(hw)) {
-                memcpy(desc, desc_on_ring, sizeof(struct i40e_aq_desc));
+                *desc = *desc_on_ring;
                 if (buff != NULL)
                         memcpy(buff, dma_buff->va, buff_size);
                 retval = le16_to_cpu(desc->retval);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index c21df7bc3b1d..1e4ea134975a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -507,7 +507,7 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw,
 
         /* save link status information */
         if (link)
-                memcpy(link, hw_link_info, sizeof(struct i40e_link_status));
+                *link = *hw_link_info;
 
         /* flag cleared so helper functions don't call AQ again */
         hw->phy.get_link_info = false;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 601d482694ea..221aa4795017 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -101,10 +101,10 @@ int i40e_allocate_dma_mem_d(struct i40e_hw *hw, struct i40e_dma_mem *mem,
         mem->size = ALIGN(size, alignment);
         mem->va = dma_zalloc_coherent(&pf->pdev->dev, mem->size,
                                       &mem->pa, GFP_KERNEL);
-        if (mem->va)
-                return 0;
+        if (!mem->va)
+                return -ENOMEM;
 
-        return -ENOMEM;
+        return 0;
 }
 
 /**
@@ -136,10 +136,10 @@ int i40e_allocate_virt_mem_d(struct i40e_hw *hw, struct i40e_virt_mem *mem,
         mem->size = size;
         mem->va = kzalloc(size, GFP_KERNEL);
 
-        if (mem->va)
-                return 0;
+        if (!mem->va)
+                return -ENOMEM;
 
-        return -ENOMEM;
+        return 0;
 }
 
 /**
@@ -174,8 +174,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
                          u16 needed, u16 id)
 {
         int ret = -ENOMEM;
-        int i = 0;
-        int j = 0;
+        int i, j;
 
         if (!pile || needed == 0 || id >= I40E_PILE_VALID_BIT) {
                 dev_info(&pf->pdev->dev,
@@ -186,7 +185,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
 
         /* start the linear search with an imperfect hint */
         i = pile->search_hint;
-        while (i < pile->num_entries && ret < 0) {
+        while (i < pile->num_entries) {
                 /* skip already allocated entries */
                 if (pile->list[i] & I40E_PILE_VALID_BIT) {
                         i++;
@@ -205,6 +204,7 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
                                 pile->list[i+j] = id | I40E_PILE_VALID_BIT;
                         ret = i;
                         pile->search_hint = i + j;
+                        break;
                 } else {
                         /* not enough, so skip over it and continue looking */
                         i += j;
@@ -1388,7 +1388,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
         bool add_happened = false;
         int filter_list_len = 0;
         u32 changed_flags = 0;
-        i40e_status ret = 0;
+        i40e_status aq_ret = 0;
         struct i40e_pf *pf;
         int num_add = 0;
         int num_del = 0;
@@ -1449,28 +1449,28 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
 
                         /* flush a full buffer */
                         if (num_del == filter_list_len) {
-                                ret = i40e_aq_remove_macvlan(&pf->hw,
+                                aq_ret = i40e_aq_remove_macvlan(&pf->hw,
                                             vsi->seid, del_list, num_del,
                                             NULL);
                                 num_del = 0;
                                 memset(del_list, 0, sizeof(*del_list));
 
-                                if (ret)
+                                if (aq_ret)
                                         dev_info(&pf->pdev->dev,
                                                  "ignoring delete macvlan error, err %d, aq_err %d while flushing a full buffer\n",
-                                                 ret,
+                                                 aq_ret,
                                                  pf->hw.aq.asq_last_status);
                         }
                 }
                 if (num_del) {
-                        ret = i40e_aq_remove_macvlan(&pf->hw, vsi->seid,
+                        aq_ret = i40e_aq_remove_macvlan(&pf->hw, vsi->seid,
                                                      del_list, num_del, NULL);
                         num_del = 0;
 
-                        if (ret)
+                        if (aq_ret)
                                 dev_info(&pf->pdev->dev,
                                          "ignoring delete macvlan error, err %d, aq_err %d\n",
-                                         ret, pf->hw.aq.asq_last_status);
+                                         aq_ret, pf->hw.aq.asq_last_status);
                 }
 
                 kfree(del_list);
@@ -1515,32 +1515,30 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
 
                         /* flush a full buffer */
                         if (num_add == filter_list_len) {
-                                ret = i40e_aq_add_macvlan(&pf->hw,
-                                                          vsi->seid,
-                                                          add_list,
-                                                          num_add,
-                                                          NULL);
+                                aq_ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
+                                                             add_list, num_add,
+                                                             NULL);
                                 num_add = 0;
 
-                                if (ret)
+                                if (aq_ret)
                                         break;
                                 memset(add_list, 0, sizeof(*add_list));
                         }
                 }
                 if (num_add) {
-                        ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
-                                                  add_list, num_add, NULL);
+                        aq_ret = i40e_aq_add_macvlan(&pf->hw, vsi->seid,
+                                                     add_list, num_add, NULL);
                         num_add = 0;
                 }
                 kfree(add_list);
                 add_list = NULL;
 
-                if (add_happened && (!ret)) {
+                if (add_happened && (!aq_ret)) {
                         /* do nothing */;
-                } else if (add_happened && (ret)) {
+                } else if (add_happened && (aq_ret)) {
                         dev_info(&pf->pdev->dev,
                                  "add filter failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
                         if ((pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOSPC) &&
                             !test_bit(__I40E_FILTER_OVERFLOW_PROMISC,
                                       &vsi->state)) {
@@ -1556,28 +1554,27 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
         if (changed_flags & IFF_ALLMULTI) {
                 bool cur_multipromisc;
                 cur_multipromisc = !!(vsi->current_netdev_flags & IFF_ALLMULTI);
-                ret = i40e_aq_set_vsi_multicast_promiscuous(&vsi->back->hw,
-                                                            vsi->seid,
-                                                            cur_multipromisc,
-                                                            NULL);
-                if (ret)
+                aq_ret = i40e_aq_set_vsi_multicast_promiscuous(&vsi->back->hw,
+                                                               vsi->seid,
+                                                               cur_multipromisc,
+                                                               NULL);
+                if (aq_ret)
                         dev_info(&pf->pdev->dev,
                                  "set multi promisc failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
         }
         if ((changed_flags & IFF_PROMISC) || promisc_forced_on) {
                 bool cur_promisc;
                 cur_promisc = (!!(vsi->current_netdev_flags & IFF_PROMISC) ||
                                test_bit(__I40E_FILTER_OVERFLOW_PROMISC,
                                         &vsi->state));
-                ret = i40e_aq_set_vsi_unicast_promiscuous(&vsi->back->hw,
-                                                          vsi->seid,
-                                                          cur_promisc,
-                                                          NULL);
-                if (ret)
+                aq_ret = i40e_aq_set_vsi_unicast_promiscuous(&vsi->back->hw,
+                                                             vsi->seid,
+                                                             cur_promisc, NULL);
+                if (aq_ret)
                         dev_info(&pf->pdev->dev,
                                  "set uni promisc failed, err %d, aq_err %d\n",
-                                 ret, pf->hw.aq.asq_last_status);
+                                 aq_ret, pf->hw.aq.asq_last_status);
         }
 
         clear_bit(__I40E_CONFIG_BUSY, &vsi->state);
@@ -1790,6 +1787,8 @@ int i40e_vsi_add_vlan(struct i40e_vsi *vsi, s16 vid)
  * i40e_vsi_kill_vlan - Remove vsi membership for given vlan
  * @vsi: the vsi being configured
  * @vid: vlan id to be removed (0 = untagged only , -1 = any)
+ *
+ * Return: 0 on success or negative otherwise
  **/
 int i40e_vsi_kill_vlan(struct i40e_vsi *vsi, s16 vid)
 {
@@ -1863,37 +1862,39 @@ int i40e_vsi_kill_vlan(struct i40e_vsi *vsi, s16 vid)
  * i40e_vlan_rx_add_vid - Add a vlan id filter to HW offload
  * @netdev: network interface to be adjusted
  * @vid: vlan id to be added
+ *
+ * net_device_ops implementation for adding vlan ids
  **/
 static int i40e_vlan_rx_add_vid(struct net_device *netdev,
                                 __always_unused __be16 proto, u16 vid)
 {
         struct i40e_netdev_priv *np = netdev_priv(netdev);
         struct i40e_vsi *vsi = np->vsi;
-        int ret;
+        int ret = 0;
 
         if (vid > 4095)
-                return 0;
+                return -EINVAL;
+
+        netdev_info(netdev, "adding %pM vid=%d\n", netdev->dev_addr, vid);
 
-        netdev_info(vsi->netdev, "adding %pM vid=%d\n",
-                    netdev->dev_addr, vid);
         /* If the network stack called us with vid = 0, we should
          * indicate to i40e_vsi_add_vlan() that we want to receive
          * any traffic (i.e. with any vlan tag, or untagged)
          */
         ret = i40e_vsi_add_vlan(vsi, vid ? vid : I40E_VLAN_ANY);
 
-        if (!ret) {
-                if (vid < VLAN_N_VID)
-                        set_bit(vid, vsi->active_vlans);
-        }
+        if (!ret && (vid < VLAN_N_VID))
+                set_bit(vid, vsi->active_vlans);
 
-        return 0;
+        return ret;
 }
 
 /**
  * i40e_vlan_rx_kill_vid - Remove a vlan id filter from HW offload
  * @netdev: network interface to be adjusted
  * @vid: vlan id to be removed
+ *
+ * net_device_ops implementation for adding vlan ids
  **/
 static int i40e_vlan_rx_kill_vid(struct net_device *netdev,
                                  __always_unused __be16 proto, u16 vid)
@@ -1901,15 +1902,16 @@ static int i40e_vlan_rx_kill_vid(struct net_device *netdev,
         struct i40e_netdev_priv *np = netdev_priv(netdev);
         struct i40e_vsi *vsi = np->vsi;
 
-        netdev_info(vsi->netdev, "removing %pM vid=%d\n",
-                    netdev->dev_addr, vid);
+        netdev_info(netdev, "removing %pM vid=%d\n", netdev->dev_addr, vid);
+
         /* return code is ignored as there is nothing a user
          * can do about failure to remove and a log message was
-         * already printed from another function
+         * already printed from the other function
          */
         i40e_vsi_kill_vlan(vsi, vid);
 
         clear_bit(vid, vsi->active_vlans);
+
         return 0;
 }
 
@@ -1936,10 +1938,10 @@ static void i40e_restore_vlan(struct i40e_vsi *vsi)
  * @vsi: the vsi being adjusted
  * @vid: the vlan id to set as a PVID
  **/
-i40e_status i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
+int i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
 {
         struct i40e_vsi_context ctxt;
-        i40e_status ret;
+        i40e_status aq_ret;
 
         vsi->info.valid_sections = cpu_to_le16(I40E_AQ_VSI_PROP_VLAN_VALID);
         vsi->info.pvid = cpu_to_le16(vid);
@@ -1948,14 +1950,15 @@ i40e_status i40e_vsi_add_pvid(struct i40e_vsi *vsi, u16 vid)
 
         ctxt.seid = vsi->seid;
         memcpy(&ctxt.info, &vsi->info, sizeof(vsi->info));
-        ret = i40e_aq_update_vsi_params(&vsi->back->hw, &ctxt, NULL);
-        if (ret) {
+        aq_ret = i40e_aq_update_vsi_params(&vsi->back->hw, &ctxt, NULL);
+        if (aq_ret) {
                 dev_info(&vsi->back->pdev->dev,
                          "%s: update vsi failed, aq_err=%d\n",
                          __func__, vsi->back->hw.aq.asq_last_status);
+                return -ENOENT;
         }
 
-        return ret;
+        return 0;
 }
 
 /**
@@ -3326,7 +3329,8 @@ static void i40e_pf_unquiesce_all_vsi(struct i40e_pf *pf)
  **/
 static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
 {
-        int num_tc = 0, i;
+        u8 num_tc = 0;
+        int i;
 
         /* Scan the ETS Config Priority Table to find
          * traffic class enabled for a given priority
@@ -3341,9 +3345,7 @@ static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
         /* Traffic class index starts from zero so
          * increment to return the actual count
          */
-        num_tc++;
-
-        return num_tc;
+        return num_tc + 1;
 }
 
 /**
@@ -3451,28 +3453,27 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
         struct i40e_aqc_query_vsi_bw_config_resp bw_config = {0};
         struct i40e_pf *pf = vsi->back;
         struct i40e_hw *hw = &pf->hw;
+        i40e_status aq_ret;
         u32 tc_bw_max;
-        int ret;
         int i;
 
         /* Get the VSI level BW configuration */
-        ret = i40e_aq_query_vsi_bw_config(hw, vsi->seid, &bw_config, NULL);
-        if (ret) {
+        aq_ret = i40e_aq_query_vsi_bw_config(hw, vsi->seid, &bw_config, NULL);
+        if (aq_ret) {
                 dev_info(&pf->pdev->dev,
                          "couldn't get pf vsi bw config, err %d, aq_err %d\n",
-                         ret, pf->hw.aq.asq_last_status);
-                return ret;
+                         aq_ret, pf->hw.aq.asq_last_status);
+                return -EINVAL;
         }
 
         /* Get the VSI level BW configuration per TC */
-        ret = i40e_aq_query_vsi_ets_sla_config(hw, vsi->seid,
-                                               &bw_ets_config,
-                                               NULL);
-        if (ret) {
+        aq_ret = i40e_aq_query_vsi_ets_sla_config(hw, vsi->seid, &bw_ets_config,
+                                                  NULL);
+        if (aq_ret) {
                 dev_info(&pf->pdev->dev,
                          "couldn't get pf vsi ets bw config, err %d, aq_err %d\n",
-                         ret, pf->hw.aq.asq_last_status);
-                return ret;
+                         aq_ret, pf->hw.aq.asq_last_status);
+                return -EINVAL;
         }
 
         if (bw_config.tc_valid_bits != bw_ets_config.tc_valid_bits) {
@@ -3494,7 +3495,8 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
                 /* 3 bits out of 4 for each TC */
                 vsi->bw_ets_max_quanta[i] = (u8)((tc_bw_max >> (i*4)) & 0x7);
         }
-        return ret;
+
+        return 0;
 }
 
 /**
@@ -3505,30 +3507,30 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
  *
  * Returns 0 on success, negative value on failure
  **/
-static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi,
-                                       u8 enabled_tc,
+static int i40e_vsi_configure_bw_alloc(struct i40e_vsi *vsi, u8 enabled_tc,
                                        u8 *bw_share)
 {
         struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
-        int i, ret = 0;
+        i40e_status aq_ret;
+        int i;
 
         bw_data.tc_valid_bits = enabled_tc;
         for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                 bw_data.tc_bw_credits[i] = bw_share[i];
 
-        ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid,
-                                       &bw_data, NULL);
-        if (ret) {
+        aq_ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
+                                          NULL);
+        if (aq_ret) {
                 dev_info(&vsi->back->pdev->dev,
                          "%s: AQ command Config VSI BW allocation per TC failed = %d\n",
                          __func__, vsi->back->hw.aq.asq_last_status);
-                return ret;
+                return -EINVAL;
         }
 
         for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
                 vsi->info.qs_handle[i] = bw_data.qs_handles[i];
 
-        return ret;
+        return 0;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 48cbc833b051..151e00cad113 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1607,6 +1607,9 @@ static int igb_integrated_phy_loopback(struct igb_adapter *adapter)
                         igb_write_phy_reg(hw, I347AT4_PAGE_SELECT, 0);
                         igb_write_phy_reg(hw, PHY_CONTROL, 0x4140);
                 }
+        } else if (hw->phy.type == e1000_phy_82580) {
+                /* enable MII loopback */
+                igb_write_phy_reg(hw, I82580_PHY_LBK_CTRL, 0x8041);
         }
 
         /* add small delay to avoid loopback test failure */
@@ -2652,6 +2655,8 @@ static int igb_set_eee(struct net_device *netdev,
             (hw->phy.media_type != e1000_media_type_copper))
                 return -EOPNOTSUPP;
 
+        memset(&eee_curr, 0, sizeof(struct ethtool_eee));
+
         ret_val = igb_get_eee(netdev, &eee_curr);
         if (ret_val)
                 return ret_val;
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 7fb5677451f9..2c210ec35d59 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1131,15 +1131,13 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
         p->rx_discard += rdlp(mp, RX_DISCARD_FRAME_CNT);
         p->rx_overrun += rdlp(mp, RX_OVERRUN_FRAME_CNT);
         spin_unlock_bh(&mp->mib_counters_lock);
-
-        mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
 }
 
 static void mib_counters_timer_wrapper(unsigned long _mp)
 {
         struct mv643xx_eth_private *mp = (void *)_mp;
-
         mib_counters_update(mp);
+        mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
 }
 
 
@@ -2237,6 +2235,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                 mp->int_mask |= INT_TX_END_0 << i;
         }
 
+        add_timer(&mp->mib_counters_timer);
         port_start(mp);
 
         wrlp(mp, INT_MASK_EXT, INT_EXT_LINK_PHY | INT_EXT_TX);
@@ -2534,6 +2533,7 @@ static int mv643xx_eth_shared_of_add_port(struct platform_device *pdev,
         if (!ppdev)
                 return -ENOMEM;
         ppdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+        ppdev->dev.of_node = pnp;
 
         ret = platform_device_add_resources(ppdev, &res, 1);
         if (ret)
@@ -2916,7 +2916,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         mp->mib_counters_timer.data = (unsigned long)mp;
         mp->mib_counters_timer.function = mib_counters_timer_wrapper;
         mp->mib_counters_timer.expires = jiffies + 30 * HZ;
-        add_timer(&mp->mib_counters_timer);
 
         spin_lock_init(&mp->mib_counters_lock);
 
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 1a9c4f6269ea..ecc7f7b696b8 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -3086,13 +3086,16 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                                                PCI_DMA_FROMDEVICE);
                 skge_rx_reuse(e, skge->rx_buf_size);
         } else {
+                struct skge_element ee;
                 struct sk_buff *nskb;
 
                 nskb = netdev_alloc_skb_ip_align(dev, skge->rx_buf_size);
                 if (!nskb)
                         goto resubmit;
 
-                skb = e->skb;
+                ee = *e;
+
+                skb = ee.skb;
                 prefetch(skb->data);
 
                 if (skge_rx_setup(skge, e, nskb, skge->rx_buf_size) < 0) {
@@ -3101,8 +3104,8 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                 }
 
                 pci_unmap_single(skge->hw->pdev,
-                                 dma_unmap_addr(e, mapaddr),
-                                 dma_unmap_len(e, maplen),
+                                 dma_unmap_addr(&ee, mapaddr),
+                                 dma_unmap_len(&ee, maplen),
                                  PCI_DMA_FROMDEVICE);
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index dec455c8f627..afe2efa69c86 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -70,14 +70,15 @@ static int mlx4_alloc_pages(struct mlx4_en_priv *priv,
                 put_page(page);
                 return -ENOMEM;
         }
-        page_alloc->size = PAGE_SIZE << order;
+        page_alloc->page_size = PAGE_SIZE << order;
         page_alloc->page = page;
         page_alloc->dma = dma;
-        page_alloc->offset = frag_info->frag_align;
+        page_alloc->page_offset = frag_info->frag_align;
         /* Not doing get_page() for each frag is a big win
          * on asymetric workloads.
          */
-        atomic_set(&page->_count, page_alloc->size / frag_info->frag_stride);
+        atomic_set(&page->_count,
+                   page_alloc->page_size / frag_info->frag_stride);
         return 0;
 }
 
@@ -96,16 +97,19 @@ static int mlx4_en_alloc_frags(struct mlx4_en_priv *priv,
         for (i = 0; i < priv->num_frags; i++) {
                 frag_info = &priv->frag_info[i];
                 page_alloc[i] = ring_alloc[i];
-                page_alloc[i].offset += frag_info->frag_stride;
-                if (page_alloc[i].offset + frag_info->frag_stride <= ring_alloc[i].size)
+                page_alloc[i].page_offset += frag_info->frag_stride;
+
+                if (page_alloc[i].page_offset + frag_info->frag_stride <=
+                    ring_alloc[i].page_size)
                         continue;
+
                 if (mlx4_alloc_pages(priv, &page_alloc[i], frag_info, gfp))
                         goto out;
         }
 
         for (i = 0; i < priv->num_frags; i++) {
                 frags[i] = ring_alloc[i];
-                dma = ring_alloc[i].dma + ring_alloc[i].offset;
+                dma = ring_alloc[i].dma + ring_alloc[i].page_offset;
                 ring_alloc[i] = page_alloc[i];
                 rx_desc->data[i].addr = cpu_to_be64(dma);
         }
@@ -117,7 +121,7 @@ out:
                 frag_info = &priv->frag_info[i];
                 if (page_alloc[i].page != ring_alloc[i].page) {
                         dma_unmap_page(priv->ddev, page_alloc[i].dma,
-                                page_alloc[i].size, PCI_DMA_FROMDEVICE);
+                                page_alloc[i].page_size, PCI_DMA_FROMDEVICE);
                         page = page_alloc[i].page;
                         atomic_set(&page->_count, 1);
                         put_page(page);
@@ -131,10 +135,12 @@ static void mlx4_en_free_frag(struct mlx4_en_priv *priv,
                               int i)
 {
         const struct mlx4_en_frag_info *frag_info = &priv->frag_info[i];
+        u32 next_frag_end = frags[i].page_offset + 2 * frag_info->frag_stride;
+
 
-        if (frags[i].offset + frag_info->frag_stride > frags[i].size)
-                dma_unmap_page(priv->ddev, frags[i].dma, frags[i].size,
-                                         PCI_DMA_FROMDEVICE);
+        if (next_frag_end > frags[i].page_size)
+                dma_unmap_page(priv->ddev, frags[i].dma, frags[i].page_size,
+                               PCI_DMA_FROMDEVICE);
 
         if (frags[i].page)
                 put_page(frags[i].page);
@@ -161,7 +167,7 @@ out:
 
                 page_alloc = &ring->page_alloc[i];
                 dma_unmap_page(priv->ddev, page_alloc->dma,
-                               page_alloc->size, PCI_DMA_FROMDEVICE);
+                               page_alloc->page_size, PCI_DMA_FROMDEVICE);
                 page = page_alloc->page;
                 atomic_set(&page->_count, 1);
                 put_page(page);
@@ -184,10 +190,11 @@ static void mlx4_en_destroy_allocator(struct mlx4_en_priv *priv,
                        i, page_count(page_alloc->page));
 
                 dma_unmap_page(priv->ddev, page_alloc->dma,
-                                page_alloc->size, PCI_DMA_FROMDEVICE);
-                while (page_alloc->offset + frag_info->frag_stride < page_alloc->size) {
+                                page_alloc->page_size, PCI_DMA_FROMDEVICE);
+                while (page_alloc->page_offset + frag_info->frag_stride <
+                       page_alloc->page_size) {
                         put_page(page_alloc->page);
-                        page_alloc->offset += frag_info->frag_stride;
+                        page_alloc->page_offset += frag_info->frag_stride;
                 }
                 page_alloc->page = NULL;
         }
@@ -478,7 +485,7 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                 /* Save page reference in skb */
                 __skb_frag_set_page(&skb_frags_rx[nr], frags[nr].page);
                 skb_frag_size_set(&skb_frags_rx[nr], frag_info->frag_size);
-                skb_frags_rx[nr].page_offset = frags[nr].offset;
+                skb_frags_rx[nr].page_offset = frags[nr].page_offset;
                 skb->truesize += frag_info->frag_stride;
                 frags[nr].page = NULL;
         }
@@ -517,7 +524,7 @@ static struct sk_buff *mlx4_en_rx_skb(struct mlx4_en_priv *priv,
 
         /* Get pointer to first fragment so we could copy the headers into the
          * (linear part of the) skb */
-        va = page_address(frags[0].page) + frags[0].offset;
+        va = page_address(frags[0].page) + frags[0].page_offset;
 
         if (length <= SMALL_PACKET_SIZE) {
                 /* We are copying all relevant data to the skb - temporarily
@@ -645,7 +652,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                         dma_sync_single_for_cpu(priv->ddev, dma, sizeof(*ethh),
                                                 DMA_FROM_DEVICE);
                         ethh = (struct ethhdr *)(page_address(frags[0].page) +
-                                                 frags[0].offset);
+                                                 frags[0].page_offset);
 
                         if (is_multicast_ether_addr(ethh->h_dest)) {
                                 struct mlx4_mac_entry *entry;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 5e0aa569306a..bf06e3610d27 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -237,8 +237,8 @@ struct mlx4_en_tx_desc {
 struct mlx4_en_rx_alloc {
         struct page     *page;
         dma_addr_t      dma;
-        u32             offset;
-        u32             size;
+        u32             page_offset;
+        u32             page_size;
 };
 
 struct mlx4_en_tx_ring {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5472cbd34028..6ca30739625f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -180,28 +180,32 @@ static int verify_block_sig(struct mlx5_cmd_prot_block *block)
         return 0;
 }
 
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
+                           int csum)
 {
         block->token = token;
-        block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 2);
-        block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+        if (csum) {
+                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
+                                            sizeof(block->data) - 2);
+                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+        }
 }
 
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
 {
         struct mlx5_cmd_mailbox *next = msg->next;
 
         while (next) {
-                calc_block_sig(next->buf, token);
+                calc_block_sig(next->buf, token, csum);
                 next = next->next;
         }
 }
 
-static void set_signature(struct mlx5_cmd_work_ent *ent)
+static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
         ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token);
-        calc_chain_sig(ent->out, ent->token);
+        calc_chain_sig(ent->in, ent->token, csum);
+        calc_chain_sig(ent->out, ent->token, csum);
 }
 
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -539,8 +543,7 @@ static void cmd_work_handler(struct work_struct *work)
         lay->type = MLX5_PCI_CMD_XPORT;
         lay->token = ent->token;
         lay->status_own = CMD_OWNER_HW;
-        if (!cmd->checksum_disabled)
-                set_signature(ent);
+        set_signature(ent, !cmd->checksum_disabled);
         dump_command(dev, ent, 1);
         ktime_get_ts(&ent->ts1);
 
@@ -773,8 +776,6 @@ static int mlx5_copy_from_msg(void *to, struct mlx5_cmd_msg *from, int size)
 
                 copy = min_t(int, size, MLX5_CMD_DATA_BLOCK_SIZE);
                 block = next->buf;
-                if (xor8_buf(block, sizeof(*block)) != 0xff)
-                        return -EINVAL;
 
                 memcpy(to, block->data, copy);
                 to += copy;
@@ -1361,6 +1362,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
                 goto err_map;
         }
 
+        cmd->checksum_disabled = 1;
         cmd->max_reg_cmds = (1 << cmd->log_sz) - 1;
         cmd->bitmask = (1 << cmd->max_reg_cmds) - 1;
 
@@ -1510,7 +1512,7 @@ int mlx5_cmd_status_to_err(struct mlx5_outbox_hdr *hdr)
         case MLX5_CMD_STAT_BAD_SYS_STATE_ERR:           return -EIO;
         case MLX5_CMD_STAT_BAD_RES_ERR:                 return -EINVAL;
         case MLX5_CMD_STAT_RES_BUSY:                    return -EBUSY;
-        case MLX5_CMD_STAT_LIM_ERR:                     return -EINVAL;
+        case MLX5_CMD_STAT_LIM_ERR:                     return -ENOMEM;
         case MLX5_CMD_STAT_BAD_RES_STATE_ERR:           return -EINVAL;
         case MLX5_CMD_STAT_IX_ERR:                      return -EINVAL;
         case MLX5_CMD_STAT_NO_RES_ERR:                  return -EAGAIN;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index 443cc4d7b024..2231d93cc7ad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -366,9 +366,11 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                 goto err_in;
         }
 
+        snprintf(eq->name, MLX5_MAX_EQ_NAME, "%s@pci:%s",
+                 name, pci_name(dev->pdev));
         eq->eqn = out.eq_number;
         err = request_irq(table->msix_arr[vecidx].vector, mlx5_msix_handler, 0,
-                          name, eq);
+                          eq->name, eq);
         if (err)
                 goto err_eq;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index b47739b0b5f6..bc0f5fb66e24 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -165,9 +165,7 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         struct mlx5_cmd_set_hca_cap_mbox_in *set_ctx = NULL;
         struct mlx5_cmd_query_hca_cap_mbox_in query_ctx;
         struct mlx5_cmd_set_hca_cap_mbox_out set_out;
-        struct mlx5_profile *prof = dev->profile;
         u64 flags;
-        int csum = 1;
         int err;
 
         memset(&query_ctx, 0, sizeof(query_ctx));
@@ -197,20 +195,14 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         memcpy(&set_ctx->hca_cap, &query_out->hca_cap,
                sizeof(set_ctx->hca_cap));
 
-        if (prof->mask & MLX5_PROF_MASK_CMDIF_CSUM) {
-                csum = !!prof->cmdif_csum;
-                flags = be64_to_cpu(set_ctx->hca_cap.flags);
-                if (csum)
-                        flags |= MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
-                else
-                        flags &= ~MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
-
-                set_ctx->hca_cap.flags = cpu_to_be64(flags);
-        }
-
         if (dev->profile->mask & MLX5_PROF_MASK_QP_SIZE)
                 set_ctx->hca_cap.log_max_qp = dev->profile->log_max_qp;
 
+        flags = be64_to_cpu(query_out->hca_cap.flags);
+        /* disable checksum */
+        flags &= ~MLX5_DEV_CAP_FLAG_CMDIF_CSUM;
+
+        set_ctx->hca_cap.flags = cpu_to_be64(flags);
         memset(&set_out, 0, sizeof(set_out));
         set_ctx->hca_cap.log_uar_page_sz = cpu_to_be16(PAGE_SHIFT - 12);
         set_ctx->hdr.opcode = cpu_to_be16(MLX5_CMD_OP_SET_HCA_CAP);
@@ -225,9 +217,6 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         if (err)
                 goto query_ex;
 
-        if (!csum)
-                dev->cmd.checksum_disabled = 1;
-
 query_ex:
         kfree(query_out);
         kfree(set_ctx);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 3a2408d44820..7b12acf210f8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -90,6 +90,10 @@ struct mlx5_manage_pages_outbox {
         __be64                  pas[0];
 };
 
+enum {
+        MAX_RECLAIM_TIME_MSECS  = 5000,
+};
+
 static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u16 func_id)
 {
         struct rb_root *root = &dev->priv.page_root;
@@ -279,6 +283,9 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
         int err;
         int i;
 
+        if (nclaimed)
+                *nclaimed = 0;
+
         memset(&in, 0, sizeof(in));
         outlen = sizeof(*out) + npages * sizeof(out->pas[0]);
         out = mlx5_vzalloc(outlen);
@@ -388,20 +395,25 @@ static int optimal_reclaimed_pages(void)
 
 int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev)
 {
-        unsigned long end = jiffies + msecs_to_jiffies(5000);
+        unsigned long end = jiffies + msecs_to_jiffies(MAX_RECLAIM_TIME_MSECS);
         struct fw_page *fwp;
         struct rb_node *p;
+        int nclaimed = 0;
         int err;
 
         do {
                 p = rb_first(&dev->priv.page_root);
                 if (p) {
                         fwp = rb_entry(p, struct fw_page, rb_node);
-                        err = reclaim_pages(dev, fwp->func_id, optimal_reclaimed_pages(), NULL);
+                        err = reclaim_pages(dev, fwp->func_id,
+                                            optimal_reclaimed_pages(),
+                                            &nclaimed);
                         if (err) {
                                 mlx5_core_warn(dev, "failed reclaiming pages (%d)\n", err);
                                 return err;
                         }
+                        if (nclaimed)
+                                end = jiffies + msecs_to_jiffies(MAX_RECLAIM_TIME_MSECS);
                 }
                 if (time_after(jiffies, end)) {
                         mlx5_core_warn(dev, "FW did not return all pages. giving up...\n");
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 83c2091c9c23..ea54d95e5b9f 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -448,7 +448,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
         irq = irq_of_parse_and_map(node, 0);
         if (irq <= 0) {
                 netdev_err(ndev, "irq_of_parse_and_map failed\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto irq_map_fail;
         }
 
         priv = netdev_priv(ndev);
@@ -472,24 +473,32 @@ static int moxart_mac_probe(struct platform_device *pdev)
         priv->tx_desc_base = dma_alloc_coherent(NULL, TX_REG_DESC_SIZE *
                                                 TX_DESC_NUM, &priv->tx_base,
                                                 GFP_DMA | GFP_KERNEL);
-        if (priv->tx_desc_base == NULL)
+        if (priv->tx_desc_base == NULL) {
+                ret = -ENOMEM;
                 goto init_fail;
+        }
 
         priv->rx_desc_base = dma_alloc_coherent(NULL, RX_REG_DESC_SIZE *
                                                 RX_DESC_NUM, &priv->rx_base,
                                                 GFP_DMA | GFP_KERNEL);
-        if (priv->rx_desc_base == NULL)
+        if (priv->rx_desc_base == NULL) {
+                ret = -ENOMEM;
                 goto init_fail;
+        }
 
         priv->tx_buf_base = kmalloc(priv->tx_buf_size * TX_DESC_NUM,
                                     GFP_ATOMIC);
-        if (!priv->tx_buf_base)
+        if (!priv->tx_buf_base) {
+                ret = -ENOMEM;
                 goto init_fail;
+        }
 
         priv->rx_buf_base = kmalloc(priv->rx_buf_size * RX_DESC_NUM,
                                     GFP_ATOMIC);
-        if (!priv->rx_buf_base)
+        if (!priv->rx_buf_base) {
+                ret = -ENOMEM;
                 goto init_fail;
+        }
 
         platform_set_drvdata(pdev, ndev);
 
@@ -522,7 +531,8 @@ static int moxart_mac_probe(struct platform_device *pdev)
 init_fail:
         netdev_err(ndev, "init failed\n");
         moxart_mac_free_memory(ndev);
-
+irq_map_fail:
+        free_netdev(ndev);
         return ret;
 }
 
@@ -543,7 +553,7 @@ static const struct of_device_id moxart_mac_match[] = {
         { }
 };
 
-struct __initdata platform_driver moxart_mac_driver = {
+static struct platform_driver moxart_mac_driver = {
         .probe  = moxart_mac_probe,
         .remove = moxart_remove,
         .driver = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 4d7ad0074d1c..ff83a9fcd4c5 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -665,7 +665,7 @@ static int qlcnic_set_channels(struct net_device *dev,
                         return err;
         }
 
-        if (channel->tx_count) {
+        if (qlcnic_82xx_check(adapter) && channel->tx_count) {
                 err = qlcnic_validate_max_tx_rings(adapter, channel->tx_count);
                 if (err)
                         return err;
@@ -1794,3 +1794,11 @@ const struct ethtool_ops qlcnic_sriov_vf_ethtool_ops = {
         .set_msglevel           = qlcnic_set_msglevel,
         .get_msglevel           = qlcnic_get_msglevel,
 };
+
+const struct ethtool_ops qlcnic_ethtool_failed_ops = {
+        .get_settings           = qlcnic_get_settings,
+        .get_drvinfo            = qlcnic_get_drvinfo,
+        .set_msglevel           = qlcnic_set_msglevel,
+        .get_msglevel           = qlcnic_get_msglevel,
+        .set_dump               = qlcnic_set_dump,
+};
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index c4c5023e1fdf..9e61eb867452 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -431,6 +431,9 @@ static void qlcnic_82xx_cancel_idc_work(struct qlcnic_adapter *adapter)
         while (test_and_set_bit(__QLCNIC_RESETTING, &adapter->state))
                 usleep_range(10000, 11000);
 
+        if (!adapter->fw_work.work.func)
+                return;
+
         cancel_delayed_work_sync(&adapter->fw_work);
 }
 
@@ -2254,7 +2257,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         err = qlcnic_alloc_adapter_resources(adapter);
         if (err)
-                goto err_out_free_netdev;
+                goto err_out_free_wq;
 
         adapter->dev_rst_time = jiffies;
         adapter->ahw->revision_id = pdev->revision;
@@ -2275,8 +2278,9 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->portnum = adapter->ahw->pci_func;
                 err = qlcnic_start_firmware(adapter);
                 if (err) {
-                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n");
-                        goto err_out_free_hw;
+                        dev_err(&pdev->dev, "Loading fw failed.Please Reboot\n"
+                                "\t\tIf reboot doesn't help, try flashing the card\n");
+                        goto err_out_maintenance_mode;
                 }
 
                 qlcnic_get_multiq_capability(adapter);
@@ -2392,6 +2396,9 @@ err_out_disable_msi:
 err_out_free_hw:
         qlcnic_free_adapter_resources(adapter);
 
+err_out_free_wq:
+        destroy_workqueue(adapter->qlcnic_wq);
+
 err_out_free_netdev:
         free_netdev(netdev);
 
@@ -2408,6 +2415,22 @@ err_out_disable_pdev:
         pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
         return err;
+
+err_out_maintenance_mode:
+        netdev->netdev_ops = &qlcnic_netdev_failed_ops;
+        SET_ETHTOOL_OPS(netdev, &qlcnic_ethtool_failed_ops);
+        err = register_netdev(netdev);
+
+        if (err) {
+                dev_err(&pdev->dev, "Failed to register net device\n");
+                qlcnic_clr_all_drv_state(adapter, 0);
+                goto err_out_free_hw;
+        }
+
+        pci_set_drvdata(pdev, adapter);
+        qlcnic_add_sysfs(adapter);
+
+        return 0;
 }
 
 static void qlcnic_remove(struct pci_dev *pdev)
@@ -2518,8 +2541,16 @@ static int qlcnic_resume(struct pci_dev *pdev)
 static int qlcnic_open(struct net_device *netdev)
 {
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
+        u32 state;
         int err;
 
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD) {
+                netdev_err(netdev, "%s: Device is in FAILED state\n", __func__);
+
+                return -EIO;
+        }
+
         netif_carrier_off(netdev);
 
         err = qlcnic_attach(adapter);
@@ -3228,6 +3259,13 @@ void qlcnic_82xx_dev_request_reset(struct qlcnic_adapter *adapter, u32 key)
                 return;
 
         state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD) {
+                netdev_err(adapter->netdev, "%s: Device is in FAILED state\n",
+                           __func__);
+                qlcnic_api_unlock(adapter);
+
+                return;
+        }
 
         if (state == QLCNIC_DEV_READY) {
                 QLC_SHARED_REG_WR32(adapter, QLCNIC_CRB_DEV_STATE,
@@ -3613,11 +3651,6 @@ int qlcnic_validate_max_tx_rings(struct qlcnic_adapter *adapter, u32 txq)
         u8 max_hw = QLCNIC_MAX_TX_RINGS;
         u32 max_allowed;
 
-        if (!qlcnic_82xx_check(adapter)) {
-                netdev_err(netdev, "No Multi TX-Q support\n");
-                return -EINVAL;
-        }
-
         if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
                 netdev_err(netdev, "No Multi TX-Q support in INT-x mode\n");
                 return -EINVAL;
@@ -3657,8 +3690,7 @@ int qlcnic_validate_max_rss(struct qlcnic_adapter *adapter,
         u8 max_hw = adapter->ahw->max_rx_ques;
         u32 max_allowed;
 
-        if (qlcnic_82xx_check(adapter) && !qlcnic_use_msi_x &&
-            !qlcnic_use_msi) {
+        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
                 netdev_err(netdev, "No RSS support in INT-x mode\n");
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 330d9a8774ad..686f460b1502 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -397,6 +397,7 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
 
+        rtnl_lock();
         if (netif_running(netdev))
                 __qlcnic_down(adapter, netdev);
 
@@ -407,12 +408,15 @@ static int qlcnic_pci_sriov_disable(struct qlcnic_adapter *adapter)
         /* After disabling SRIOV re-init the driver in default mode
            configure opmode based on op_mode of function
          */
-        if (qlcnic_83xx_configure_opmode(adapter))
+        if (qlcnic_83xx_configure_opmode(adapter)) {
+                rtnl_unlock();
                 return -EIO;
+        }
 
         if (netif_running(netdev))
                 __qlcnic_up(adapter, netdev);
 
+        rtnl_unlock();
         return 0;
 }
 
@@ -533,6 +537,7 @@ static int qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, int num_vfs)
                 return -EIO;
         }
 
+        rtnl_lock();
         if (netif_running(netdev))
                 __qlcnic_down(adapter, netdev);
 
@@ -555,6 +560,7 @@ static int qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, int num_vfs)
                 __qlcnic_up(adapter, netdev);
 
 error:
+        rtnl_unlock();
         return err;
 }
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index c6165d05cc13..019f4377307f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1272,6 +1272,7 @@ void qlcnic_remove_sysfs_entries(struct qlcnic_adapter *adapter)
 void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 {
         struct device *dev = &adapter->pdev->dev;
+        u32 state;
 
         if (device_create_bin_file(dev, &bin_attr_port_stats))
                 dev_info(dev, "failed to create port stats sysfs entry");
@@ -1285,8 +1286,13 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
         if (device_create_bin_file(dev, &bin_attr_mem))
                 dev_info(dev, "failed to create mem sysfs entry\n");
 
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD)
+                return;
+
         if (device_create_bin_file(dev, &bin_attr_pci_config))
                 dev_info(dev, "failed to create pci config sysfs entry");
+
         if (device_create_file(dev, &dev_attr_beacon))
                 dev_info(dev, "failed to create beacon sysfs entry");
 
@@ -1307,6 +1313,7 @@ void qlcnic_create_diag_entries(struct qlcnic_adapter *adapter)
 void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
 {
         struct device *dev = &adapter->pdev->dev;
+        u32 state;
 
         device_remove_bin_file(dev, &bin_attr_port_stats);
 
@@ -1315,6 +1322,11 @@ void qlcnic_remove_diag_entries(struct qlcnic_adapter *adapter)
         device_remove_file(dev, &dev_attr_diag_mode);
         device_remove_bin_file(dev, &bin_attr_crb);
         device_remove_bin_file(dev, &bin_attr_mem);
+
+        state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
+        if (state == QLCNIC_DEV_FAILED || state == QLCNIC_DEV_BADBAD)
+                return;
+
         device_remove_bin_file(dev, &bin_attr_pci_config);
         device_remove_file(dev, &dev_attr_beacon);
         if (!(adapter->flags & QLCNIC_ESWITCH_ENABLED))
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
index 10093f0c4c0f..6bc5db703920 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
@@ -740,8 +740,8 @@ int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump)
         int i;
 
         if (!mpi_coredump) {
-                netif_err(qdev, drv, qdev->ndev, "No memory available\n");
-                return -ENOMEM;
+                netif_err(qdev, drv, qdev->ndev, "No memory allocated\n");
+                return -EINVAL;
         }
 
         /* Try to get the spinlock, but dont worry if
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c b/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
index ff2bf8a4e247..7ad146080c36 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_mpi.c
@@ -1274,7 +1274,7 @@ void ql_mpi_reset_work(struct work_struct *work)
                 return;
         }
 
-        if (!ql_core_dump(qdev, qdev->mpi_coredump)) {
+        if (qdev->mpi_coredump && !ql_core_dump(qdev, qdev->mpi_coredump)) {
                 netif_err(qdev, drv, qdev->ndev, "Core is dumped!\n");
                 qdev->core_is_dumped = 1;
                 queue_delayed_work(qdev->workqueue,
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5cd831ebfa83..b57c278d3b46 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -688,12 +688,16 @@ static struct sh_eth_cpu_data r8a7740_data = {
         .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
                           EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                           EESR_TDE | EESR_ECI,
+        .fdr_value      = 0x0000070f,
+        .rmcr_value     = 0x00000001,
 
         .apr            = 1,
         .mpr            = 1,
         .tpauser        = 1,
         .bculr          = 1,
         .hw_swap        = 1,
+        .rpadir         = 1,
+        .rpadir_value   = 2 << 16,
         .no_trimd       = 1,
         .no_ade         = 1,
         .tsu            = 1,
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 9f18ae984f9e..21f9ad6392e9 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -444,6 +444,18 @@ static const struct efx_hw_stat_desc efx_ef10_stat_desc[EF10_STAT_COUNT] = {
         EF10_DMA_STAT(rx_align_error, RX_ALIGN_ERROR_PKTS),
         EF10_DMA_STAT(rx_length_error, RX_LENGTH_ERROR_PKTS),
         EF10_DMA_STAT(rx_nodesc_drops, RX_NODESC_DROPS),
+        EF10_DMA_STAT(rx_pm_trunc_bb_overflow, PM_TRUNC_BB_OVERFLOW),
+        EF10_DMA_STAT(rx_pm_discard_bb_overflow, PM_DISCARD_BB_OVERFLOW),
+        EF10_DMA_STAT(rx_pm_trunc_vfifo_full, PM_TRUNC_VFIFO_FULL),
+        EF10_DMA_STAT(rx_pm_discard_vfifo_full, PM_DISCARD_VFIFO_FULL),
+        EF10_DMA_STAT(rx_pm_trunc_qbb, PM_TRUNC_QBB),
+        EF10_DMA_STAT(rx_pm_discard_qbb, PM_DISCARD_QBB),
+        EF10_DMA_STAT(rx_pm_discard_mapping, PM_DISCARD_MAPPING),
+        EF10_DMA_STAT(rx_dp_q_disabled_packets, RXDP_Q_DISABLED_PKTS),
+        EF10_DMA_STAT(rx_dp_di_dropped_packets, RXDP_DI_DROPPED_PKTS),
+        EF10_DMA_STAT(rx_dp_streaming_packets, RXDP_STREAMING_PKTS),
+        EF10_DMA_STAT(rx_dp_emerg_fetch, RXDP_EMERGENCY_FETCH_CONDITIONS),
+        EF10_DMA_STAT(rx_dp_emerg_wait, RXDP_EMERGENCY_WAIT_CONDITIONS),
 };
 
 #define HUNT_COMMON_STAT_MASK ((1ULL << EF10_STAT_tx_bytes) |           \
@@ -498,44 +510,72 @@ static const struct efx_hw_stat_desc efx_ef10_stat_desc[EF10_STAT_COUNT] = {
 #define HUNT_40G_EXTRA_STAT_MASK ((1ULL << EF10_STAT_rx_align_error) |  \
                                   (1ULL << EF10_STAT_rx_length_error))
 
-#if BITS_PER_LONG == 64
-#define STAT_MASK_BITMAP(bits) (bits)
-#else
-#define STAT_MASK_BITMAP(bits) (bits) & 0xffffffff, (bits) >> 32
-#endif
-
-static const unsigned long *efx_ef10_stat_mask(struct efx_nic *efx)
-{
-        static const unsigned long hunt_40g_stat_mask[] = {
-                STAT_MASK_BITMAP(HUNT_COMMON_STAT_MASK |
-                                 HUNT_40G_EXTRA_STAT_MASK)
-        };
-        static const unsigned long hunt_10g_only_stat_mask[] = {
-                STAT_MASK_BITMAP(HUNT_COMMON_STAT_MASK |
-                                 HUNT_10G_ONLY_STAT_MASK)
-        };
+/* These statistics are only provided if the firmware supports the
+ * capability PM_AND_RXDP_COUNTERS.
+ */
+#define HUNT_PM_AND_RXDP_STAT_MASK (                                    \
+        (1ULL << EF10_STAT_rx_pm_trunc_bb_overflow) |                   \
+        (1ULL << EF10_STAT_rx_pm_discard_bb_overflow) |                 \
+        (1ULL << EF10_STAT_rx_pm_trunc_vfifo_full) |                    \
+        (1ULL << EF10_STAT_rx_pm_discard_vfifo_full) |                  \
+        (1ULL << EF10_STAT_rx_pm_trunc_qbb) |                           \
+        (1ULL << EF10_STAT_rx_pm_discard_qbb) |                         \
+        (1ULL << EF10_STAT_rx_pm_discard_mapping) |                     \
+        (1ULL << EF10_STAT_rx_dp_q_disabled_packets) |                  \
+        (1ULL << EF10_STAT_rx_dp_di_dropped_packets) |                  \
+        (1ULL << EF10_STAT_rx_dp_streaming_packets) |                   \
+        (1ULL << EF10_STAT_rx_dp_emerg_fetch) |                         \
+        (1ULL << EF10_STAT_rx_dp_emerg_wait))
+
+static u64 efx_ef10_raw_stat_mask(struct efx_nic *efx)
+{
+        u64 raw_mask = HUNT_COMMON_STAT_MASK;
         u32 port_caps = efx_mcdi_phy_get_caps(efx);
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
 
         if (port_caps & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
-                return hunt_40g_stat_mask;
+                raw_mask |= HUNT_40G_EXTRA_STAT_MASK;
         else
-                return hunt_10g_only_stat_mask;
+                raw_mask |= HUNT_10G_ONLY_STAT_MASK;
+
+        if (nic_data->datapath_caps &
+            (1 << MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_LBN))
+                raw_mask |= HUNT_PM_AND_RXDP_STAT_MASK;
+
+        return raw_mask;
+}
+
+static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
+{
+        u64 raw_mask = efx_ef10_raw_stat_mask(efx);
+
+#if BITS_PER_LONG == 64
+        mask[0] = raw_mask;
+#else
+        mask[0] = raw_mask & 0xffffffff;
+        mask[1] = raw_mask >> 32;
+#endif
 }
 
 static size_t efx_ef10_describe_stats(struct efx_nic *efx, u8 *names)
 {
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
+
+        efx_ef10_get_stat_mask(efx, mask);
         return efx_nic_describe_stats(efx_ef10_stat_desc, EF10_STAT_COUNT,
-                                      efx_ef10_stat_mask(efx), names);
+                                      mask, names);
 }
 
 static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
 {
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
-        const unsigned long *stats_mask = efx_ef10_stat_mask(efx);
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
         __le64 generation_start, generation_end;
         u64 *stats = nic_data->stats;
         __le64 *dma_stats;
 
+        efx_ef10_get_stat_mask(efx, mask);
+
         dma_stats = efx->stats_buffer.addr;
         nic_data = efx->nic_data;
 
@@ -543,8 +583,9 @@ static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
         if (generation_end == EFX_MC_STATS_GENERATION_INVALID)
                 return 0;
         rmb();
-        efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, stats_mask,
+        efx_nic_update_stats(efx_ef10_stat_desc, EF10_STAT_COUNT, mask,
                              stats, efx->stats_buffer.addr, false);
+        rmb();
         generation_start = dma_stats[MC_CMD_MAC_GENERATION_START];
         if (generation_end != generation_start)
                 return -EAGAIN;
@@ -563,12 +604,14 @@ static int efx_ef10_try_update_nic_stats(struct efx_nic *efx)
 static size_t efx_ef10_update_stats(struct efx_nic *efx, u64 *full_stats,
                                     struct rtnl_link_stats64 *core_stats)
 {
-        const unsigned long *mask = efx_ef10_stat_mask(efx);
+        DECLARE_BITMAP(mask, EF10_STAT_COUNT);
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
         u64 *stats = nic_data->stats;
         size_t stats_count = 0, index;
         int retry;
 
+        efx_ef10_get_stat_mask(efx, mask);
+
         /* If we're unlucky enough to read statistics during the DMA, wait
          * up to 10ms for it to finish (typically takes <500us)
          */
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 128d7cdf9eb2..366c8e3e3784 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -27,10 +27,10 @@
 
 /* A reboot/assertion causes the MCDI status word to be set after the
  * command word is set or a REBOOT event is sent. If we notice a reboot
- * via these mechanisms then wait 20ms for the status word to be set.
+ * via these mechanisms then wait 250ms for the status word to be set.
  */
 #define MCDI_STATUS_DELAY_US            100
-#define MCDI_STATUS_DELAY_COUNT         200
+#define MCDI_STATUS_DELAY_COUNT         2500
 #define MCDI_STATUS_SLEEP_MS                                            \
         (MCDI_STATUS_DELAY_US * MCDI_STATUS_DELAY_COUNT / 1000)
 
@@ -800,9 +800,6 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
         } else {
                 int count;
 
-                /* Nobody was waiting for an MCDI request, so trigger a reset */
-                efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
-
                 /* Consume the status word since efx_mcdi_rpc_finish() won't */
                 for (count = 0; count < MCDI_STATUS_DELAY_COUNT; ++count) {
                         if (efx_mcdi_poll_reboot(efx))
@@ -810,6 +807,9 @@ static void efx_mcdi_ev_death(struct efx_nic *efx, int rc)
                         udelay(MCDI_STATUS_DELAY_US);
                 }
                 mcdi->new_epoch = true;
+
+                /* Nobody was waiting for an MCDI request, so trigger a reset */
+                efx_schedule_reset(efx, RESET_TYPE_MC_FAILURE);
         }
 
         spin_unlock(&mcdi->iface_lock);
@@ -963,7 +963,7 @@ static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                                bool *was_attached)
 {
         MCDI_DECLARE_BUF(inbuf, MC_CMD_DRV_ATTACH_IN_LEN);
-        MCDI_DECLARE_BUF(outbuf, MC_CMD_DRV_ATTACH_OUT_LEN);
+        MCDI_DECLARE_BUF(outbuf, MC_CMD_DRV_ATTACH_EXT_OUT_LEN);
         size_t outlen;
         int rc;
 
@@ -981,6 +981,22 @@ static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                 goto fail;
         }
 
+        /* We currently assume we have control of the external link
+         * and are completely trusted by firmware.  Abort probing
+         * if that's not true for this function.
+         */
+        if (driver_operating &&
+            outlen >= MC_CMD_DRV_ATTACH_EXT_OUT_LEN &&
+            (MCDI_DWORD(outbuf, DRV_ATTACH_EXT_OUT_FUNC_FLAGS) &
+             (1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_LINKCTRL |
+              1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_TRUSTED)) !=
+            (1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_LINKCTRL |
+             1 << MC_CMD_DRV_ATTACH_EXT_OUT_FLAG_TRUSTED)) {
+                netif_err(efx, probe, efx->net_dev,
+                          "This driver version only supports one function per port\n");
+                return -ENODEV;
+        }
+
         if (was_attached != NULL)
                 *was_attached = MCDI_DWORD(outbuf, DRV_ATTACH_OUT_OLD_STATE);
         return 0;
diff --git a/drivers/net/ethernet/sfc/mcdi_pcol.h b/drivers/net/ethernet/sfc/mcdi_pcol.h
index b5cf62492f8e..e0a63ddb7a6c 100644
--- a/drivers/net/ethernet/sfc/mcdi_pcol.h
+++ b/drivers/net/ethernet/sfc/mcdi_pcol.h
@@ -2574,8 +2574,58 @@
 #define          MC_CMD_MAC_RX_LANES01_DISP_ERR  0x39 /* enum */
 #define          MC_CMD_MAC_RX_LANES23_DISP_ERR  0x3a /* enum */
 #define          MC_CMD_MAC_RX_MATCH_FAULT  0x3b /* enum */
-#define          MC_CMD_GMAC_DMABUF_START  0x40 /* enum */
-#define          MC_CMD_GMAC_DMABUF_END    0x5f /* enum */
+/* enum: PM trunc_bb_overflow counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_BB_OVERFLOW  0x3c
+/* enum: PM discard_bb_overflow counter. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_BB_OVERFLOW  0x3d
+/* enum: PM trunc_vfifo_full counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_VFIFO_FULL  0x3e
+/* enum: PM discard_vfifo_full counter. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_VFIFO_FULL  0x3f
+/* enum: PM trunc_qbb counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_TRUNC_QBB  0x40
+/* enum: PM discard_qbb counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_QBB  0x41
+/* enum: PM discard_mapping counter. Valid for EF10 with PM_AND_RXDP_COUNTERS
+ * capability only.
+ */
+#define          MC_CMD_MAC_PM_DISCARD_MAPPING  0x42
+/* enum: RXDP counter: Number of packets dropped due to the queue being
+ * disabled. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_Q_DISABLED_PKTS  0x43
+/* enum: RXDP counter: Number of packets dropped by the DICPU. Valid for EF10
+ * with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_DI_DROPPED_PKTS  0x45
+/* enum: RXDP counter: Number of non-host packets. Valid for EF10 with
+ * PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_STREAMING_PKTS  0x46
+/* enum: RXDP counter: Number of times an emergency descriptor fetch was
+ * performed. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_EMERGENCY_FETCH_CONDITIONS  0x47
+/* enum: RXDP counter: Number of times the DPCPU waited for an existing
+ * descriptor fetch. Valid for EF10 with PM_AND_RXDP_COUNTERS capability only.
+ */
+#define          MC_CMD_MAC_RXDP_EMERGENCY_WAIT_CONDITIONS  0x48
+/* enum: Start of GMAC stats buffer space, for Siena only. */
+#define          MC_CMD_GMAC_DMABUF_START  0x40
+/* enum: End of GMAC stats buffer space, for Siena only. */
+#define          MC_CMD_GMAC_DMABUF_END    0x5f
 #define          MC_CMD_MAC_GENERATION_END 0x60 /* enum */
 #define          MC_CMD_MAC_NSTATS  0x61 /* enum */
 
@@ -5065,6 +5115,8 @@
 #define        MC_CMD_GET_CAPABILITIES_OUT_RX_BATCHING_WIDTH 1
 #define        MC_CMD_GET_CAPABILITIES_OUT_MCAST_FILTER_CHAINING_LBN 26
 #define        MC_CMD_GET_CAPABILITIES_OUT_MCAST_FILTER_CHAINING_WIDTH 1
+#define        MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_LBN 27
+#define        MC_CMD_GET_CAPABILITIES_OUT_PM_AND_RXDP_COUNTERS_WIDTH 1
 /* RxDPCPU firmware id. */
 #define       MC_CMD_GET_CAPABILITIES_OUT_RX_DPCPU_FW_ID_OFST 4
 #define       MC_CMD_GET_CAPABILITIES_OUT_RX_DPCPU_FW_ID_LEN 2
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index e7dbd2dd202e..9826594c8a48 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -469,8 +469,7 @@ size_t efx_nic_describe_stats(const struct efx_hw_stat_desc *desc, size_t count,
  * @count: Length of the @desc array
  * @mask: Bitmask of which elements of @desc are enabled
  * @stats: Buffer to update with the converted statistics.  The length
- *      of this array must be at least the number of set bits in the
- *      first @count bits of @mask.
+ *      of this array must be at least @count.
  * @dma_buf: DMA buffer containing hardware statistics
  * @accumulate: If set, the converted values will be added rather than
  *      directly stored to the corresponding elements of @stats
@@ -503,11 +502,9 @@ void efx_nic_update_stats(const struct efx_hw_stat_desc *desc, size_t count,
                         }
 
                         if (accumulate)
-                                *stats += val;
+                                stats[index] += val;
                         else
-                                *stats = val;
+                                stats[index] = val;
                 }
-
-                ++stats;
         }
 }
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index fda29d39032f..890bbbe8320e 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -386,6 +386,18 @@ enum {
         EF10_STAT_rx_align_error,
         EF10_STAT_rx_length_error,
         EF10_STAT_rx_nodesc_drops,
+        EF10_STAT_rx_pm_trunc_bb_overflow,
+        EF10_STAT_rx_pm_discard_bb_overflow,
+        EF10_STAT_rx_pm_trunc_vfifo_full,
+        EF10_STAT_rx_pm_discard_vfifo_full,
+        EF10_STAT_rx_pm_trunc_qbb,
+        EF10_STAT_rx_pm_discard_qbb,
+        EF10_STAT_rx_pm_discard_mapping,
+        EF10_STAT_rx_dp_q_disabled_packets,
+        EF10_STAT_rx_dp_di_dropped_packets,
+        EF10_STAT_rx_dp_streaming_packets,
+        EF10_STAT_rx_dp_emerg_fetch,
+        EF10_STAT_rx_dp_emerg_wait,
         EF10_STAT_COUNT
 };
 
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 5730fe2445a6..98eedb90cdc3 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -1124,8 +1124,7 @@ static const char * chip_ids[ 16 ] =  {
                         void __iomem *__ioaddr = ioaddr;                \
                         if (__len >= 2 && (unsigned long)__ptr & 2) {   \
                                 __len -= 2;                             \
-                                SMC_outw(*(u16 *)__ptr, ioaddr,         \
-                                        DATA_REG(lp));          \
+                                SMC_outsw(ioaddr, DATA_REG(lp), __ptr, 1); \
                                 __ptr += 2;                             \
                         }                                               \
                         if (SMC_CAN_USE_DATACS && lp->datacs)           \
@@ -1133,8 +1132,7 @@ static const char * chip_ids[ 16 ] =  {
                         SMC_outsl(__ioaddr, DATA_REG(lp), __ptr, __len>>2); \
                         if (__len & 2) {                                \
                                 __ptr += (__len & ~3);                  \
-                                SMC_outw(*((u16 *)__ptr), ioaddr,       \
-                                         DATA_REG(lp));         \
+                                SMC_outsw(ioaddr, DATA_REG(lp), __ptr, 1); \
                         }                                               \
                 } else if (SMC_16BIT(lp))                               \
                         SMC_outsw(ioaddr, DATA_REG(lp), p, (l) >> 1);   \
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 79974e31187a..cc3ce557e4aa 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -639,13 +639,6 @@ void cpsw_rx_handler(void *token, int len, int status)
 static irqreturn_t cpsw_interrupt(int irq, void *dev_id)
 {
         struct cpsw_priv *priv = dev_id;
-        u32 rx, tx, rx_thresh;
-
-        rx_thresh = __raw_readl(&priv->wr_regs->rx_thresh_stat);
-        rx = __raw_readl(&priv->wr_regs->rx_stat);
-        tx = __raw_readl(&priv->wr_regs->tx_stat);
-        if (!rx_thresh && !rx && !tx)
-                return IRQ_NONE;
 
         cpsw_intr_disable(priv);
         if (priv->irq_enabled == true) {
@@ -1169,9 +1162,9 @@ static int cpsw_ndo_open(struct net_device *ndev)
                 }
         }
 
+        napi_enable(&priv->napi);
         cpdma_ctlr_start(priv->dma);
         cpsw_intr_enable(priv);
-        napi_enable(&priv->napi);
         cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_RX);
         cpdma_ctlr_eoi(priv->dma, CPDMA_EOI_TX);
 
@@ -1771,8 +1764,8 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
         }
         data->mac_control = prop;
 
-        if (!of_property_read_u32(node, "dual_emac", &prop))
-                data->dual_emac = prop;
+        if (of_property_read_bool(node, "dual_emac"))
+                data->dual_emac = 1;
 
         /*
          * Populate all the child nodes here...
@@ -1782,7 +1775,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
         if (ret)
                 pr_warn("Doesn't have any child node\n");
 
-        for_each_node_by_name(slave_node, "slave") {
+        for_each_child_of_node(node, slave_node) {
                 struct cpsw_slave_data *slave_data = data->slave_data + i;
                 const void *mac_addr = NULL;
                 u32 phyid;
@@ -1791,6 +1784,10 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 struct device_node *mdio_node;
                 struct platform_device *mdio;
 
+                /* This is no slave child node, continue */
+                if (strcmp(slave_node->name, "slave"))
+                        continue;
+
                 parp = of_get_property(slave_node, "phy_id", &lenp);
                 if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         pr_err("Missing slave[%d] phy_id property\n", i);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 67df09ea9d04..6a32ef9d63ae 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -876,8 +876,7 @@ static void emac_dev_mcast_set(struct net_device *ndev)
                     netdev_mc_count(ndev) > EMAC_DEF_MAX_MULTICAST_ADDRESSES) {
                         mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
                         emac_add_mcast(priv, EMAC_ALL_MULTI_SET, NULL);
-                }
-                if (!netdev_mc_empty(ndev)) {
+                } else if (!netdev_mc_empty(ndev)) {
                         struct netdev_hw_addr *ha;
 
                         mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index c8f088ab5fdf..bdf697b184ae 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -32,7 +32,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.5.0"
+#define DRV_VERSION     "1.5.1"
 #define DRV_RELDATE     "2010-10-09"
 
 #include <linux/types.h>
@@ -1704,7 +1704,12 @@ static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
                 cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
 
         if (unlikely(vlan_tx_tag_present(skb))) {
-                rp->tx_ring[entry].tx_status = cpu_to_le32((vlan_tx_tag_get(skb)) << 16);
+                u16 vid_pcp = vlan_tx_tag_get(skb);
+
+                /* drop CFI/DEI bit, register needs VID and PCP */
+                vid_pcp = (vid_pcp & VLAN_VID_MASK) |
+                          ((vid_pcp & VLAN_PRIO_MASK) >> 1);
+                rp->tx_ring[entry].tx_status = cpu_to_le32((vid_pcp) << 16);
                 /* request tagging */
                 rp->tx_ring[entry].desc_length |= cpu_to_le32(0x020000);
         }
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index b88121f240ca..0029148077a9 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -297,6 +297,12 @@ static int temac_dma_bd_init(struct net_device *ndev)
                        lp->rx_bd_p + (sizeof(*lp->rx_bd_v) * (RX_BD_NUM - 1)));
         lp->dma_out(lp, TX_CURDESC_PTR, lp->tx_bd_p);
 
+        /* Init descriptor indexes */
+        lp->tx_bd_ci = 0;
+        lp->tx_bd_next = 0;
+        lp->tx_bd_tail = 0;
+        lp->rx_bd_ci = 0;
+
         return 0;
 
 out:
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 0721e72f9299..5af1c3e5032a 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -975,7 +975,6 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         return -EINVAL;         /* Cannot change this parameter when up */
                 if ((ym = kmalloc(sizeof(struct yamdrv_ioctl_mcs), GFP_KERNEL)) == NULL)
                         return -ENOBUFS;
-                ym->bitrate = 9600;
                 if (copy_from_user(ym, ifr->ifr_data, sizeof(struct yamdrv_ioctl_mcs))) {
                         kfree(ym);
                         return -EFAULT;
diff --git a/drivers/net/ieee802154/mrf24j40.c b/drivers/net/ieee802154/mrf24j40.c
index 42e6deee6db5..0632d34905c7 100644
--- a/drivers/net/ieee802154/mrf24j40.c
+++ b/drivers/net/ieee802154/mrf24j40.c
@@ -82,7 +82,6 @@ struct mrf24j40 {
 
         struct mutex buffer_mutex; /* only used to protect buf */
         struct completion tx_complete;
-        struct work_struct irqwork;
         u8 *buf; /* 3 bytes. Used for SPI single-register transfers. */
 };
 
@@ -344,6 +343,8 @@ static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
         if (ret)
                 goto err;
 
+        INIT_COMPLETION(devrec->tx_complete);
+
         /* Set TXNTRIG bit of TXNCON to send packet */
         ret = read_short_reg(devrec, REG_TXNCON, &val);
         if (ret)
@@ -354,8 +355,6 @@ static int mrf24j40_tx(struct ieee802154_dev *dev, struct sk_buff *skb)
                 val |= 0x4;
         write_short_reg(devrec, REG_TXNCON, val);
 
-        INIT_COMPLETION(devrec->tx_complete);
-
         /* Wait for the device to send the TX complete interrupt. */
         ret = wait_for_completion_interruptible_timeout(
                                                 &devrec->tx_complete,
@@ -590,17 +589,6 @@ static struct ieee802154_ops mrf24j40_ops = {
 static irqreturn_t mrf24j40_isr(int irq, void *data)
 {
         struct mrf24j40 *devrec = data;
-
-        disable_irq_nosync(irq);
-
-        schedule_work(&devrec->irqwork);
-
-        return IRQ_HANDLED;
-}
-
-static void mrf24j40_isrwork(struct work_struct *work)
-{
-        struct mrf24j40 *devrec = container_of(work, struct mrf24j40, irqwork);
         u8 intstat;
         int ret;
 
@@ -618,7 +606,7 @@ static void mrf24j40_isrwork(struct work_struct *work)
                 mrf24j40_handle_rx(devrec);
 
 out:
-        enable_irq(devrec->spi->irq);
+        return IRQ_HANDLED;
 }
 
 static int mrf24j40_probe(struct spi_device *spi)
@@ -642,7 +630,6 @@ static int mrf24j40_probe(struct spi_device *spi)
 
         mutex_init(&devrec->buffer_mutex);
         init_completion(&devrec->tx_complete);
-        INIT_WORK(&devrec->irqwork, mrf24j40_isrwork);
         devrec->spi = spi;
         spi_set_drvdata(spi, devrec);
 
@@ -688,11 +675,12 @@ static int mrf24j40_probe(struct spi_device *spi)
         val &= ~0x3; /* Clear RX mode (normal) */
         write_short_reg(devrec, REG_RXMCR, val);
 
-        ret = request_irq(spi->irq,
-                          mrf24j40_isr,
-                          IRQF_TRIGGER_FALLING,
-                          dev_name(&spi->dev),
-                          devrec);
+        ret = request_threaded_irq(spi->irq,
+                                   NULL,
+                                   mrf24j40_isr,
+                                   IRQF_TRIGGER_LOW|IRQF_ONESHOT,
+                                   dev_name(&spi->dev),
+                                   devrec);
 
         if (ret) {
                 dev_err(printdev(devrec), "Unable to get IRQ");
@@ -721,7 +709,6 @@ static int mrf24j40_remove(struct spi_device *spi)
         dev_dbg(printdev(devrec), "remove\n");
 
         free_irq(spi->irq, devrec);
-        flush_work(&devrec->irqwork); /* TODO: Is this the right call? */
         ieee802154_unregister_device(devrec->dev);
         ieee802154_free_device(devrec->dev);
         /* TODO: Will ieee802154_free_device() wait until ->xmit() is
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index a34d6bf5e43b..cc70ecfc7062 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -429,11 +429,13 @@ static void slip_write_wakeup(struct tty_struct *tty)
         if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
                 return;
 
+        spin_lock(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
                 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                spin_unlock(&sl->lock);
                 sl_unlock(sl);
                 return;
         }
@@ -441,6 +443,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
         actual = tty->ops->write(tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
+        spin_unlock(&sl->lock);
 }
 
 static void sl_tx_timeout(struct net_device *dev)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 807815fc9968..7cb105c103fe 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1293,7 +1293,8 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
         if (unlikely(!noblock))
                 add_wait_queue(&tfile->wq.wait, &wait);
         while (len) {
-                current->state = TASK_INTERRUPTIBLE;
+                if (unlikely(!noblock))
+                        current->state = TASK_INTERRUPTIBLE;
 
                 /* Read frames from the queue */
                 if (!(skb = skb_dequeue(&tfile->socket.sk->sk_receive_queue))) {
@@ -1320,9 +1321,10 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
                 break;
         }
 
-        current->state = TASK_RUNNING;
-        if (unlikely(!noblock))
+        if (unlikely(!noblock)) {
+                current->state = TASK_RUNNING;
                 remove_wait_queue(&tfile->wq.wait, &wait);
+        }
 
         return ret;
 }
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 3569293df872..846cc19c04f2 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -36,8 +36,8 @@
 #define AX_RXHDR_L4_TYPE_TCP                    16
 #define AX_RXHDR_L3CSUM_ERR                     2
 #define AX_RXHDR_L4CSUM_ERR                     1
-#define AX_RXHDR_CRC_ERR                        ((u32)BIT(31))
-#define AX_RXHDR_DROP_ERR                       ((u32)BIT(30))
+#define AX_RXHDR_CRC_ERR                        ((u32)BIT(29))
+#define AX_RXHDR_DROP_ERR                       ((u32)BIT(31))
 #define AX_ACCESS_MAC                           0x01
 #define AX_ACCESS_PHY                           0x02
 #define AX_ACCESS_EEPROM                        0x04
@@ -1406,6 +1406,19 @@ static const struct driver_info sitecom_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info samsung_info = {
+        .description = "Samsung USB Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct usb_device_id products[] = {
 {
         /* ASIX AX88179 10/100/1000 */
@@ -1418,7 +1431,11 @@ static const struct usb_device_id products[] = {
 }, {
         /* Sitecom USB 3.0 to Gigabit Adapter */
         USB_DEVICE(0x0df6, 0x0072),
-        .driver_info = (unsigned long) &sitecom_info,
+        .driver_info = (unsigned long)&sitecom_info,
+}, {
+        /* Samsung USB Ethernet Adapter */
+        USB_DEVICE(0x04e8, 0xa100),
+        .driver_info = (unsigned long)&samsung_info,
 },
         { },
 };
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 2dbb9460349d..c6867f926cff 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -303,7 +303,7 @@ static void dm9601_set_multicast(struct net_device *net)
                 rx_ctl |= 0x02;
         } else if (net->flags & IFF_ALLMULTI ||
                    netdev_mc_count(net) > DM_MAX_MCAST) {
-                rx_ctl |= 0x04;
+                rx_ctl |= 0x08;
         } else if (!netdev_mc_empty(net)) {
                 struct netdev_hw_addr *ha;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6312332afeba..818ce90185b5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -714,7 +714,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
-        {QMI_FIXED_INTF(0x1e2d, 0x12d1, 4)},    /* Cinterion PLxx */
+        {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
+        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 7b331e613e02..90a429b7ebad 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1241,7 +1241,9 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
         if (num_sgs == 1)
                 return 0;
 
-        urb->sg = kmalloc(num_sgs * sizeof(struct scatterlist), GFP_ATOMIC);
+        /* reserve one for zero packet */
+        urb->sg = kmalloc((num_sgs + 1) * sizeof(struct scatterlist),
+                          GFP_ATOMIC);
         if (!urb->sg)
                 return -ENOMEM;
 
@@ -1305,7 +1307,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
                 if (build_dma_sg(skb, urb) < 0)
                         goto drop;
         }
-        entry->length = length = urb->transfer_buffer_length;
+        length = urb->transfer_buffer_length;
 
         /* don't assume the hardware handles USB_ZERO_PACKET
          * NOTE:  strictly conforming cdc-ether devices should expect
@@ -1317,15 +1319,18 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         if (length % dev->maxpacket == 0) {
                 if (!(info->flags & FLAG_SEND_ZLP)) {
                         if (!(info->flags & FLAG_MULTI_PACKET)) {
-                                urb->transfer_buffer_length++;
-                                if (skb_tailroom(skb)) {
+                                length++;
+                                if (skb_tailroom(skb) && !urb->num_sgs) {
                                         skb->data[skb->len] = 0;
                                         __skb_put(skb, 1);
-                                }
+                                } else if (urb->num_sgs)
+                                        sg_set_buf(&urb->sg[urb->num_sgs++],
+                                                        dev->padding_pkt, 1);
                         }
                 } else
                         urb->transfer_flags |= URB_ZERO_PACKET;
         }
+        entry->length = urb->transfer_buffer_length = length;
 
         spin_lock_irqsave(&dev->txq.lock, flags);
         retval = usb_autopm_get_interface_async(dev->intf);
@@ -1509,6 +1514,7 @@ void usbnet_disconnect (struct usb_interface *intf)
 
         usb_kill_urb(dev->interrupt);
         usb_free_urb(dev->interrupt);
+        kfree(dev->padding_pkt);
 
         free_netdev(net);
 }
@@ -1679,9 +1685,18 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
         /* initialize max rx_qlen and tx_qlen */
         usbnet_update_max_qlen(dev);
 
+        if (dev->can_dma_sg && !(info->flags & FLAG_SEND_ZLP) &&
+                !(info->flags & FLAG_MULTI_PACKET)) {
+                dev->padding_pkt = kzalloc(1, GFP_KERNEL);
+                if (!dev->padding_pkt) {
+                        status = -ENOMEM;
+                        goto out4;
+                }
+        }
+
         status = register_netdev (net);
         if (status)
-                goto out4;
+                goto out5;
         netif_info(dev, probe, dev->net,
                    "register '%s' at usb-%s-%s, %s, %pM\n",
                    udev->dev.driver->name,
@@ -1699,6 +1714,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 
         return 0;
 
+out5:
+        kfree(dev->padding_pkt);
 out4:
         usb_free_urb(dev->interrupt);
 out3:
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index defec2b3c5a4..9fbdfcd1e1a0 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -938,7 +938,9 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
                 return -EINVAL;
         } else {
                 vi->curr_queue_pairs = queue_pairs;
-                schedule_delayed_work(&vi->refill, 0);
+                /* virtnet_open() will refill when device is going to up. */
+                if (dev->flags & IFF_UP)
+                        schedule_delayed_work(&vi->refill, 0);
         }
 
         return 0;
@@ -1116,6 +1118,11 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
 {
         struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
 
+        mutex_lock(&vi->config_lock);
+
+        if (!vi->config_enable)
+                goto done;
+
         switch(action & ~CPU_TASKS_FROZEN) {
         case CPU_ONLINE:
         case CPU_DOWN_FAILED:
@@ -1128,6 +1135,9 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
         default:
                 break;
         }
+
+done:
+        mutex_unlock(&vi->config_lock);
         return NOTIFY_OK;
 }
 
@@ -1733,7 +1743,9 @@ static int virtnet_restore(struct virtio_device *vdev)
         vi->config_enable = true;
         mutex_unlock(&vi->config_lock);
 
+        rtnl_lock();
         virtnet_set_queues(vi, vi->curr_queue_pairs);
+        rtnl_unlock();
 
         return 0;
 }
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index d1292fe746bc..2ef5b6219f3f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -952,8 +952,7 @@ void vxlan_sock_release(struct vxlan_sock *vs)
 
         spin_lock(&vn->sock_lock);
         hlist_del_rcu(&vs->hlist);
-        smp_wmb();
-        vs->sock->sk->sk_user_data = NULL;
+        rcu_assign_sk_user_data(vs->sock->sk, NULL);
         vxlan_notify_del_rx_port(sk);
         spin_unlock(&vn->sock_lock);
 
@@ -1048,8 +1047,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 
         port = inet_sk(sk)->inet_sport;
 
-        smp_read_barrier_depends();
-        vs = (struct vxlan_sock *)sk->sk_user_data;
+        vs = rcu_dereference_sk_user_data(sk);
         if (!vs)
                 goto drop;
 
@@ -2302,8 +2300,7 @@ static struct vxlan_sock *vxlan_socket_create(struct net *net, __be16 port,
         atomic_set(&vs->refcnt, 1);
         vs->rcv = rcv;
         vs->data = data;
-        smp_wmb();
-        vs->sock->sk->sk_user_data = vs;
+        rcu_assign_sk_user_data(vs->sock->sk, vs);
 
         spin_lock(&vn->sock_lock);
         hlist_add_head_rcu(&vs->hlist, vs_head(net, port));
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 3f0c4f268751..bcfff0d62de4 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port,
         }
 
         i = port->index;
+        memset(&sync, 0, sizeof(sync));
         sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed);
         /* Lucky card and linux use same encoding here */
         sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==
diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
index 6a24a5a70cc7..4c0a69779b89 100644
--- a/drivers/net/wan/wanxl.c
+++ b/drivers/net/wan/wanxl.c
@@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         ifr->ifr_settings.size = size; /* data size wanted */
                         return -ENOBUFS;
                 }
+                memset(&line, 0, sizeof(line));
                 line.clock_type = get_status(port)->clocking;
                 line.clock_rate = 0;
                 line.loopback = 0;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index e4f65900132d..709301f88dcd 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -208,6 +208,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         unsigned long flags;
+        int i;
 
         if (ath_startrecv(sc) != 0) {
                 ath_err(common, "Unable to restart recv logic\n");
@@ -235,6 +236,15 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                 }
         work:
                 ath_restart_work(sc);
+
+                for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                        if (!ATH_TXQ_SETUP(sc, i))
+                                continue;
+
+                        spin_lock_bh(&sc->tx.txq[i].axq_lock);
+                        ath_txq_schedule(sc, &sc->tx.txq[i]);
+                        spin_unlock_bh(&sc->tx.txq[i].axq_lock);
+                }
         }
 
         ieee80211_wake_queues(sc->hw);
@@ -539,21 +549,10 @@ chip_reset:
 
 static int ath_reset(struct ath_softc *sc)
 {
-        int i, r;
+        int r;
 
         ath9k_ps_wakeup(sc);
-
         r = ath_reset_internal(sc, NULL);
-
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-                if (!ATH_TXQ_SETUP(sc, i))
-                        continue;
-
-                spin_lock_bh(&sc->tx.txq[i].axq_lock);
-                ath_txq_schedule(sc, &sc->tx.txq[i]);
-                spin_unlock_bh(&sc->tx.txq[i].axq_lock);
-        }
-
         ath9k_ps_restore(sc);
 
         return r;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 4ee472a5a4e4..ab9e3a8410bc 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1270,13 +1270,6 @@ static void ath9k_antenna_check(struct ath_softc *sc,
                 return;
 
         /*
-         * All MPDUs in an aggregate will use the same LNA
-         * as the first MPDU.
-         */
-        if (rs->rs_isaggr && !rs->rs_firstaggr)
-                return;
-
-        /*
          * Change the default rx antenna if rx diversity
          * chooses the other antenna 3 times in a row.
          */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 35b515fe3ffa..dd30452df966 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -399,6 +399,7 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
         tbf->bf_buf_addr = bf->bf_buf_addr;
         memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
         tbf->bf_state = bf->bf_state;
+        tbf->bf_state.stale = false;
 
         return tbf;
 }
@@ -1389,11 +1390,15 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                       u16 tid, u16 *ssn)
 {
         struct ath_atx_tid *txtid;
+        struct ath_txq *txq;
         struct ath_node *an;
         u8 density;
 
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
+        txq = txtid->ac->txq;
+
+        ath_txq_lock(sc, txq);
 
         /* update ampdu factor/density, they may have changed. This may happen
          * in HT IBSS when a beacon with HT-info is received after the station
@@ -1417,6 +1422,8 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
         memset(txtid->tx_buf, 0, sizeof(txtid->tx_buf));
         txtid->baw_head = txtid->baw_tail = 0;
 
+        ath_txq_unlock_complete(sc, txq);
+
         return 0;
 }
 
@@ -1555,8 +1562,10 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                         __skb_unlink(bf->bf_mpdu, tid_q);
                         list_add_tail(&bf->list, &bf_q);
                         ath_set_rates(tid->an->vif, tid->an->sta, bf);
-                        ath_tx_addto_baw(sc, tid, bf);
-                        bf->bf_state.bf_type &= ~BUF_AGGR;
+                        if (bf_isampdu(bf)) {
+                                ath_tx_addto_baw(sc, tid, bf);
+                                bf->bf_state.bf_type &= ~BUF_AGGR;
+                        }
                         if (bf_tail)
                                 bf_tail->bf_next = bf;
 
@@ -1950,7 +1959,9 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                         if (bf_is_ampdu_not_probing(bf))
                                 txq->axq_ampdu_depth++;
 
-                        bf = bf->bf_lastbf->bf_next;
+                        bf_last = bf->bf_lastbf;
+                        bf = bf_last->bf_next;
+                        bf_last->bf_next = NULL;
                 }
         }
 }
@@ -1958,15 +1969,18 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
 static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
                                struct ath_atx_tid *tid, struct sk_buff *skb)
 {
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_frame_info *fi = get_frame_info(skb);
         struct list_head bf_head;
-        struct ath_buf *bf;
-
-        bf = fi->bf;
+        struct ath_buf *bf = fi->bf;
 
         INIT_LIST_HEAD(&bf_head);
         list_add_tail(&bf->list, &bf_head);
         bf->bf_state.bf_type = 0;
+        if (tid && (tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
+                bf->bf_state.bf_type = BUF_AMPDU;
+                ath_tx_addto_baw(sc, tid, bf);
+        }
 
         bf->bf_next = NULL;
         bf->bf_lastbf = bf;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 64f4a2bc8dde..c3462b75bd08 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -464,8 +464,6 @@ static struct sdio_driver brcmf_sdmmc_driver = {
 
 static int brcmf_sdio_pd_probe(struct platform_device *pdev)
 {
-        int ret;
-
         brcmf_dbg(SDIO, "Enter\n");
 
         brcmfmac_sdio_pdata = pdev->dev.platform_data;
@@ -473,11 +471,7 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
         if (brcmfmac_sdio_pdata->power_on)
                 brcmfmac_sdio_pdata->power_on();
 
-        ret = sdio_register_driver(&brcmf_sdmmc_driver);
-        if (ret)
-                brcmf_err("sdio_register_driver failed: %d\n", ret);
-
-        return ret;
+        return 0;
 }
 
 static int brcmf_sdio_pd_remove(struct platform_device *pdev)
@@ -500,6 +494,15 @@ static struct platform_driver brcmf_sdio_pd = {
         }
 };
 
+void brcmf_sdio_register(void)
+{
+        int ret;
+
+        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        if (ret)
+                brcmf_err("sdio_register_driver failed: %d\n", ret);
+}
+
 void brcmf_sdio_exit(void)
 {
         brcmf_dbg(SDIO, "Enter\n");
@@ -510,18 +513,13 @@ void brcmf_sdio_exit(void)
                 sdio_unregister_driver(&brcmf_sdmmc_driver);
 }
 
-void brcmf_sdio_init(void)
+void __init brcmf_sdio_init(void)
 {
         int ret;
 
         brcmf_dbg(SDIO, "Enter\n");
 
         ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
-        if (ret == -ENODEV) {
-                brcmf_dbg(SDIO, "No platform data available, registering without.\n");
-                ret = sdio_register_driver(&brcmf_sdmmc_driver);
-        }
-
-        if (ret)
-                brcmf_err("driver registration failed: %d\n", ret);
+        if (ret == -ENODEV)
+                brcmf_dbg(SDIO, "No platform data available.\n");
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index f7c1985844e4..74156f84180c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -156,10 +156,11 @@ extern int brcmf_bus_start(struct device *dev);
 #ifdef CONFIG_BRCMFMAC_SDIO
 extern void brcmf_sdio_exit(void);
 extern void brcmf_sdio_init(void);
+extern void brcmf_sdio_register(void);
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
 extern void brcmf_usb_exit(void);
-extern void brcmf_usb_init(void);
+extern void brcmf_usb_register(void);
 #endif
 
 #endif                          /* _BRCMF_BUS_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index e067aec1fbf1..40e7f854e10f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -1231,21 +1231,23 @@ u32 brcmf_get_chip_info(struct brcmf_if *ifp)
         return bus->chip << 4 | bus->chiprev;
 }
 
-static void brcmf_driver_init(struct work_struct *work)
+static void brcmf_driver_register(struct work_struct *work)
 {
-        brcmf_debugfs_init();
-
 #ifdef CONFIG_BRCMFMAC_SDIO
-        brcmf_sdio_init();
+        brcmf_sdio_register();
 #endif
 #ifdef CONFIG_BRCMFMAC_USB
-        brcmf_usb_init();
+        brcmf_usb_register();
 #endif
 }
-static DECLARE_WORK(brcmf_driver_work, brcmf_driver_init);
+static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register);
 
 static int __init brcmfmac_module_init(void)
 {
+        brcmf_debugfs_init();
+#ifdef CONFIG_BRCMFMAC_SDIO
+        brcmf_sdio_init();
+#endif
         if (!schedule_work(&brcmf_driver_work))
                 return -EBUSY;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 39e01a7c8556..f4aea47e0730 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1539,7 +1539,7 @@ void brcmf_usb_exit(void)
         brcmf_release_fw(&fw_image_list);
 }
 
-void brcmf_usb_init(void)
+void brcmf_usb_register(void)
 {
         brcmf_dbg(USB, "Enter\n");
         INIT_LIST_HEAD(&fw_image_list);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 3a6544710c8a..edc5d105ff98 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -457,6 +457,8 @@ static int brcms_ops_start(struct ieee80211_hw *hw)
         if (err != 0)
                 brcms_err(wl->wlc->hw->d11core, "%s: brcms_up() returned %d\n",
                           __func__, err);
+
+        bcma_core_pci_power_save(wl->wlc->hw->d11core->bus, true);
         return err;
 }
 
@@ -479,6 +481,8 @@ static void brcms_ops_stop(struct ieee80211_hw *hw)
                 return;
         }
 
+        bcma_core_pci_power_save(wl->wlc->hw->d11core->bus, false);
+
         /* put driver in down state */
         spin_lock_bh(&wl->lock);
         brcms_down(wl);
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
index f5e6b489ed32..755a0c8edfe1 100644
--- a/drivers/net/wireless/cw1200/cw1200_spi.c
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -42,7 +42,6 @@ struct hwbus_priv {
         spinlock_t              lock; /* Serialize all bus operations */
         wait_queue_head_t       wq;
         int claimed;
-        int irq_disabled;
 };
 
 #define SDIO_TO_SPI_ADDR(addr) ((addr & 0x1f)>>2)
@@ -238,9 +237,9 @@ static irqreturn_t cw1200_spi_irq_handler(int irq, void *dev_id)
         struct hwbus_priv *self = dev_id;
 
         if (self->core) {
-                disable_irq_nosync(self->func->irq);
-                self->irq_disabled = 1;
+                cw1200_spi_lock(self);
                 cw1200_irq_handler(self->core);
+                cw1200_spi_unlock(self);
                 return IRQ_HANDLED;
         } else {
                 return IRQ_NONE;
@@ -253,9 +252,10 @@ static int cw1200_spi_irq_subscribe(struct hwbus_priv *self)
 
         pr_debug("SW IRQ subscribe\n");
 
-        ret = request_any_context_irq(self->func->irq, cw1200_spi_irq_handler,
-                                      IRQF_TRIGGER_HIGH,
-                                      "cw1200_wlan_irq", self);
+        ret = request_threaded_irq(self->func->irq, NULL,
+                                   cw1200_spi_irq_handler,
+                                   IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+                                   "cw1200_wlan_irq", self);
         if (WARN_ON(ret < 0))
                 goto exit;
 
@@ -273,22 +273,13 @@ exit:
 
 static int cw1200_spi_irq_unsubscribe(struct hwbus_priv *self)
 {
+        int ret = 0;
+
         pr_debug("SW IRQ unsubscribe\n");
         disable_irq_wake(self->func->irq);
         free_irq(self->func->irq, self);
 
-        return 0;
-}
-
-static int cw1200_spi_irq_enable(struct hwbus_priv *self, int enable)
-{
-        /* Disables are handled by the interrupt handler */
-        if (enable && self->irq_disabled) {
-                enable_irq(self->func->irq);
-                self->irq_disabled = 0;
-        }
-
-        return 0;
+        return ret;
 }
 
 static int cw1200_spi_off(const struct cw1200_platform_data_spi *pdata)
@@ -368,7 +359,6 @@ static struct hwbus_ops cw1200_spi_hwbus_ops = {
         .unlock                 = cw1200_spi_unlock,
         .align_size             = cw1200_spi_align_size,
         .power_mgmt             = cw1200_spi_pm,
-        .irq_enable             = cw1200_spi_irq_enable,
 };
 
 /* Probe Function to be called by SPI stack when device is discovered */
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index 0b2061bbc68b..acdff0f7f952 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -485,7 +485,7 @@ int cw1200_load_firmware(struct cw1200_common *priv)
 
         /* Enable interrupt signalling */
         priv->hwbus_ops->lock(priv->hwbus_priv);
-        ret = __cw1200_irq_enable(priv, 2);
+        ret = __cw1200_irq_enable(priv, 1);
         priv->hwbus_ops->unlock(priv->hwbus_priv);
         if (ret < 0)
                 goto unsubscribe;
diff --git a/drivers/net/wireless/cw1200/hwbus.h b/drivers/net/wireless/cw1200/hwbus.h
index 51dfb3a90735..8b2fc831c3de 100644
--- a/drivers/net/wireless/cw1200/hwbus.h
+++ b/drivers/net/wireless/cw1200/hwbus.h
@@ -28,7 +28,6 @@ struct hwbus_ops {
         void (*unlock)(struct hwbus_priv *self);
         size_t (*align_size)(struct hwbus_priv *self, size_t size);
         int (*power_mgmt)(struct hwbus_priv *self, bool suspend);
-        int (*irq_enable)(struct hwbus_priv *self, int enable);
 };
 
 #endif /* CW1200_HWBUS_H */
diff --git a/drivers/net/wireless/cw1200/hwio.c b/drivers/net/wireless/cw1200/hwio.c
index 41bd7615ccaa..ff230b7aeedd 100644
--- a/drivers/net/wireless/cw1200/hwio.c
+++ b/drivers/net/wireless/cw1200/hwio.c
@@ -273,21 +273,6 @@ int __cw1200_irq_enable(struct cw1200_common *priv, int enable)
         u16 val16;
         int ret;
 
-        /* We need to do this hack because the SPI layer can sleep on I/O
-           and the general path involves I/O to the device in interrupt
-           context.
-
-           However, the initial enable call needs to go to the hardware.
-
-           We don't worry about shutdown because we do a full reset which
-           clears the interrupt enabled bits.
-        */
-        if (priv->hwbus_ops->irq_enable) {
-                ret = priv->hwbus_ops->irq_enable(priv->hwbus_priv, enable);
-                if (ret || enable < 2)
-                        return ret;
-        }
-
         if (HIF_8601_SILICON == priv->hw_type) {
                 ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
                 if (ret < 0) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 30d45e2fc193..8ac305be68f4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -240,6 +240,12 @@ const struct iwl_cfg iwl6035_2agn_cfg = {
         .ht_params = &iwl6000_ht_params,
 };
 
+const struct iwl_cfg iwl6035_2agn_sff_cfg = {
+        .name = "Intel(R) Centrino(R) Ultimate-N 6235 AGN",
+        IWL_DEVICE_6035,
+        .ht_params = &iwl6000_ht_params,
+};
+
 const struct iwl_cfg iwl1030_bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 1030 BGN",
         IWL_DEVICE_6030,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index e4d370bff306..b03c25e14903 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -280,6 +280,7 @@ extern const struct iwl_cfg iwl2000_2bgn_cfg;
 extern const struct iwl_cfg iwl2000_2bgn_d_cfg;
 extern const struct iwl_cfg iwl2030_2bgn_cfg;
 extern const struct iwl_cfg iwl6035_2agn_cfg;
+extern const struct iwl_cfg iwl6035_2agn_sff_cfg;
 extern const struct iwl_cfg iwl105_bgn_cfg;
 extern const struct iwl_cfg iwl105_bgn_d_cfg;
 extern const struct iwl_cfg iwl135_bgn_cfg;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index dd57a36ecb10..80b47508647c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -601,8 +601,10 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
 {
         int ret;
 
-        WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
-                  "%s bad state = %d", __func__, trans->state);
+        if (trans->state != IWL_TRANS_FW_ALIVE) {
+                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
+                return -EIO;
+        }
 
         if (!(cmd->flags & CMD_ASYNC))
                 lock_map_acquire_read(&trans->sync_cmd_lockdep_map);
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 21407a353a3b..d58e393324ef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -273,7 +273,10 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                 if (!mvmvif->queue_params[ac].uapsd)
                         continue;
 
-                cmd->flags |= cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+                if (mvm->cur_ucode != IWL_UCODE_WOWLAN)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+
                 cmd->uapsd_ac_flags |= BIT(ac);
 
                 /* QNDP TID - the highest TID with no admission control */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 9a7ab8495300..621fb71f282a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -394,6 +394,11 @@ static bool iwl_mvm_scan_abort_notif(struct iwl_notif_wait_data *notif_wait,
                         return false;
                 }
 
+                /*
+                 * If scan cannot be aborted, it means that we had a
+                 * SCAN_COMPLETE_NOTIFICATION in the pipe and it called
+                 * ieee80211_scan_completed already.
+                 */
                 IWL_DEBUG_SCAN(mvm, "Scan cannot be aborted, exit now: %d\n",
                                *resp);
                 return true;
@@ -417,14 +422,19 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
                                                SCAN_COMPLETE_NOTIFICATION };
         int ret;
 
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return;
+
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
                                    iwl_mvm_scan_abort_notif, NULL);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD,
+                                   CMD_SYNC | CMD_SEND_IN_RFKILL, 0, NULL);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
+                /* mac80211's state will be cleaned in the fw_restart flow */
                 goto out_remove_notif;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index dc02cb9792af..26108a1a29fa 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -139,13 +139,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 6x00 Series */
         {IWL_PCI_DEVICE(0x422B, 0x1101, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1108, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x422B, 0x1121, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422B, 0x1128, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x422C, 0x1301, iwl6000i_2agn_cfg)},
         {IWL_PCI_DEVICE(0x422C, 0x1306, iwl6000i_2abg_cfg)},
         {IWL_PCI_DEVICE(0x422C, 0x1307, iwl6000i_2bg_cfg)},
         {IWL_PCI_DEVICE(0x422C, 0x1321, iwl6000i_2agn_cfg)},
         {IWL_PCI_DEVICE(0x422C, 0x1326, iwl6000i_2abg_cfg)},
         {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4238, 0x1118, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
 
@@ -153,12 +156,16 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6005_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1306, iwl6005_2abg_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1307, iwl6005_2bg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1308, iwl6005_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1321, iwl6005_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1326, iwl6005_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1328, iwl6005_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, 0x1311, iwl6005_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1318, iwl6005_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, 0x1316, iwl6005_2abg_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0xC020, iwl6005_2agn_sff_cfg)},
         {IWL_PCI_DEVICE(0x0085, 0xC220, iwl6005_2agn_sff_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0xC228, iwl6005_2agn_sff_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x4820, iwl6005_2agn_d_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1304, iwl6005_2agn_mow1_cfg)},/* low 5GHz active */
         {IWL_PCI_DEVICE(0x0082, 0x1305, iwl6005_2agn_mow2_cfg)},/* high 5GHz active */
@@ -240,8 +247,11 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 6x35 Series */
         {IWL_PCI_DEVICE(0x088E, 0x4060, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088E, 0x406A, iwl6035_2agn_sff_cfg)},
         {IWL_PCI_DEVICE(0x088F, 0x4260, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088F, 0x426A, iwl6035_2agn_sff_cfg)},
         {IWL_PCI_DEVICE(0x088E, 0x4460, iwl6035_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x088E, 0x446A, iwl6035_2agn_sff_cfg)},
         {IWL_PCI_DEVICE(0x088E, 0x4860, iwl6035_2agn_cfg)},
         {IWL_PCI_DEVICE(0x088F, 0x5260, iwl6035_2agn_cfg)},
 
@@ -260,54 +270,86 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 #if IS_ENABLED(CONFIG_IWLMVM)
 /* 7000 Series */
         {IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4162, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0x4270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4272, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0x4260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x426A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0x4262, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4472, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4460, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x446A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4462, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4870, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x486E, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4A70, iwl7260_2ac_cfg_high_temp)},
         {IWL_PCI_DEVICE(0x08B1, 0x4A6E, iwl7260_2ac_cfg_high_temp)},
         {IWL_PCI_DEVICE(0x08B1, 0x4A6C, iwl7260_2ac_cfg_high_temp)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4570, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4560, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4370, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4360, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x5070, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x402A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4420, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC072, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC170, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC06A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC160, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC062, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC162, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0xC262, iwl7260_n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC472, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC460, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC462, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC570, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC560, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC370, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC360, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC02A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0xC220, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC420, iwl7260_2n_cfg)},
 
 /* 3160 Series */
         {IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0072, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x0170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0172, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x0060, iwl3160_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x0062, iwl3160_n_cfg)},
         {IWL_PCI_DEVICE(0x08B4, 0x0270, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0272, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x0470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0472, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0370, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8072, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8172, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8060, iwl3160_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8062, iwl3160_n_cfg)},
         {IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8570, iwl3160_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index bad95d28d50d..c3f904d422b0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1401,6 +1401,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         spin_lock_init(&trans_pcie->reg_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
+        err = pci_enable_device(pdev);
+        if (err)
+                goto out_no_pci;
+
         if (!cfg->base_params->pcie_l1_allowed) {
                 /*
                  * W/A - seems to solve weird behavior. We need to remove this
@@ -1412,10 +1416,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                                        PCIE_LINK_STATE_CLKPM);
         }
 
-        err = pci_enable_device(pdev);
-        if (err)
-                goto out_no_pci;
-
         pci_set_master(pdev);
 
         err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index f45eb29c2ede..1424335163b9 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1102,6 +1102,8 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
                  * non-AGG queue.
                  */
                 iwl_clear_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+
+                ssn = trans_pcie->txq[txq_id].q.read_ptr;
         }
 
         /* Place first TFD at index corresponding to start sequence number.
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 21c688264708..1214c587fd08 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -150,7 +150,7 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
  */
 int
 mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
-                          struct mwifiex_ra_list_tbl *pra_list, int headroom,
+                          struct mwifiex_ra_list_tbl *pra_list,
                           int ptrindex, unsigned long ra_list_flags)
                           __releases(&priv->wmm.ra_list_spinlock)
 {
@@ -160,6 +160,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
         int pad = 0, ret;
         struct mwifiex_tx_param tx_param;
         struct txpd *ptx_pd = NULL;
+        int headroom = adapter->iface_type == MWIFIEX_USB ? 0 : INTF_HEADER_LEN;
 
         skb_src = skb_peek(&pra_list->skb_head);
         if (!skb_src) {
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.h b/drivers/net/wireless/mwifiex/11n_aggr.h
index 900e1c62a0cc..892098d6a696 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.h
+++ b/drivers/net/wireless/mwifiex/11n_aggr.h
@@ -26,7 +26,7 @@
 int mwifiex_11n_deaggregate_pkt(struct mwifiex_private *priv,
                                 struct sk_buff *skb);
 int mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
-                              struct mwifiex_ra_list_tbl *ptr, int headroom,
+                              struct mwifiex_ra_list_tbl *ptr,
                               int ptr_index, unsigned long flags)
                               __releases(&priv->wmm.ra_list_spinlock);
 
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 2d761477d15e..a6c46f3b6e3a 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1155,7 +1155,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
         uint32_t conditions = le32_to_cpu(phs_cfg->params.hs_config.conditions);
 
         if (phs_cfg->action == cpu_to_le16(HS_ACTIVATE) &&
-            adapter->iface_type == MWIFIEX_SDIO) {
+            adapter->iface_type != MWIFIEX_USB) {
                 mwifiex_hs_activated_event(priv, true);
                 return 0;
         } else {
@@ -1167,8 +1167,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
         }
         if (conditions != HS_CFG_CANCEL) {
                 adapter->is_hs_configured = true;
-                if (adapter->iface_type == MWIFIEX_USB ||
-                    adapter->iface_type == MWIFIEX_PCIE)
+                if (adapter->iface_type == MWIFIEX_USB)
                         mwifiex_hs_activated_event(priv, true);
         } else {
                 adapter->is_hs_configured = false;
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 9d7c0e6c4fc7..37f873bb342f 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1422,13 +1422,19 @@ static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv, u8 *mac)
  */
 int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
 {
+        int ret = 0;
+
         if (!priv->media_connected)
                 return 0;
 
         switch (priv->bss_mode) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
-                return mwifiex_deauthenticate_infra(priv, mac);
+                ret = mwifiex_deauthenticate_infra(priv, mac);
+                if (ret)
+                        cfg80211_disconnected(priv->netdev, 0, NULL, 0,
+                                              GFP_KERNEL);
+                break;
         case NL80211_IFTYPE_ADHOC:
                 return mwifiex_send_cmd_sync(priv,
                                              HostCmd_CMD_802_11_AD_HOC_STOP,
@@ -1440,7 +1446,7 @@ int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
                 break;
         }
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(mwifiex_deauthenticate);
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index fd778337deee..c2b91f566e05 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -358,10 +358,12 @@ process_start:
                 }
         } while (true);
 
-        if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter))
+        spin_lock_irqsave(&adapter->main_proc_lock, flags);
+        if ((adapter->int_status) || IS_CARD_RX_RCVD(adapter)) {
+                spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
                 goto process_start;
+        }
 
-        spin_lock_irqsave(&adapter->main_proc_lock, flags);
         adapter->mwifiex_processing = false;
         spin_unlock_irqrestore(&adapter->main_proc_lock, flags);
 
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 8b057524b252..8c351f71f72f 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -118,7 +118,8 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
         dev_dbg(adapter->dev,
                 "info: successfully disconnected from %pM: reason code %d\n",
                 priv->cfg_bssid, reason_code);
-        if (priv->bss_mode == NL80211_IFTYPE_STATION) {
+        if (priv->bss_mode == NL80211_IFTYPE_STATION ||
+            priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
                 cfg80211_disconnected(priv->netdev, reason_code, NULL, 0,
                                       GFP_KERNEL);
         }
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 2472d4b7f00e..1c70b8d09227 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -447,9 +447,6 @@ static int mwifiex_usb_suspend(struct usb_interface *intf, pm_message_t message)
          */
         adapter->is_suspended = true;
 
-        for (i = 0; i < adapter->priv_num; i++)
-                netif_carrier_off(adapter->priv[i]->netdev);
-
         if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb)
                 usb_kill_urb(card->rx_cmd.urb);
 
@@ -509,10 +506,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                   MWIFIEX_RX_CMD_BUF_SIZE);
         }
 
-        for (i = 0; i < adapter->priv_num; i++)
-                if (adapter->priv[i]->media_connected)
-                        netif_carrier_on(adapter->priv[i]->netdev);
-
         /* Disable Host Sleep */
         if (adapter->hs_activated)
                 mwifiex_cancel_hs(mwifiex_get_priv(adapter,
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 2e8f9cdea54d..95fa3599b407 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -1239,8 +1239,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
                 if (enable_tx_amsdu && mwifiex_is_amsdu_allowed(priv, tid) &&
                     mwifiex_is_11n_aggragation_possible(priv, ptr,
                                                         adapter->tx_buf_size))
-                        mwifiex_11n_aggregate_pkt(priv, ptr, INTF_HEADER_LEN,
-                                                  ptr_index, flags);
+                        mwifiex_11n_aggregate_pkt(priv, ptr, ptr_index, flags);
                         /* ra_list_spinlock has been freed in
                            mwifiex_11n_aggregate_pkt() */
                 else
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index b9deef66cf4b..e328d3058c41 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -83,6 +83,7 @@ static struct usb_device_id p54u_table[] = {
         {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
+        {USB_DEVICE(0x07aa, 0x0020)},   /* Corega WLUSB2GTST USB */
         {USB_DEVICE(0x0803, 0x4310)},   /* Zoom 4410a */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
         {USB_DEVICE(0x083a, 0x4531)},   /* T-Com Sinus 154 data II */
@@ -979,6 +980,7 @@ static int p54u_load_firmware(struct ieee80211_hw *dev,
         if (err) {
                 dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
                                           "(%d)!\n", p54u_fwlist[i].fw, err);
+                usb_put_dev(udev);
         }
 
         return err;
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 76d95deb274b..dc49e525ae5e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -105,13 +105,11 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
                 goto exit_release_regions;
         }
 
-        pci_enable_msi(pci_dev);
-
         hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
         if (!hw) {
                 rt2x00_probe_err("Failed to allocate hardware\n");
                 retval = -ENOMEM;
-                goto exit_disable_msi;
+                goto exit_release_regions;
         }
 
         pci_set_drvdata(pci_dev, hw);
@@ -152,9 +150,6 @@ exit_free_reg:
 exit_free_device:
         ieee80211_free_hw(hw);
 
-exit_disable_msi:
-        pci_disable_msi(pci_dev);
-
 exit_release_regions:
         pci_release_regions(pci_dev);
 
@@ -179,8 +174,6 @@ void rt2x00pci_remove(struct pci_dev *pci_dev)
         rt2x00pci_free_reg(rt2x00dev);
         ieee80211_free_hw(hw);
 
-        pci_disable_msi(pci_dev);
-
         /*
          * Free the PCI device data.
          */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 763cf1defab5..5a060e537fbe 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -343,7 +343,8 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                                         (bool)GET_RX_DESC_PAGGR(pdesc));
         rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
         if (phystatus) {
-                p_drvinfo = (struct rx_fwinfo_92c *)(pdesc + RTL_RX_DESC_SIZE);
+                p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
+                                                     stats->rx_bufshift);
                 rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
                                                  p_drvinfo);
         }
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index cc03e7c87cbe..703258742d28 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2057,7 +2057,7 @@ struct rtl_priv {
            that it points to the data allocated
            beyond  this structure like:
            rtl_pci_priv or rtl_usb_priv */
-        u8 priv[0];
+        u8 priv[0] __aligned(sizeof(void *));
 };
 
 #define rtl_priv(hw)            (((struct rtl_priv *)(hw)->priv))
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index a53782ef1540..1b08d8798372 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -24,6 +24,12 @@
 struct backend_info {
         struct xenbus_device *dev;
         struct xenvif *vif;
+
+        /* This is the state that will be reflected in xenstore when any
+         * active hotplug script completes.
+         */
+        enum xenbus_state state;
+
         enum xenbus_state frontend_state;
         struct xenbus_watch hotplug_status_watch;
         u8 have_hotplug_status_watch:1;
@@ -33,11 +39,15 @@ static int connect_rings(struct backend_info *);
 static void connect(struct backend_info *);
 static void backend_create_xenvif(struct backend_info *be);
 static void unregister_hotplug_status_watch(struct backend_info *be);
+static void set_backend_state(struct backend_info *be,
+                              enum xenbus_state state);
 
 static int netback_remove(struct xenbus_device *dev)
 {
         struct backend_info *be = dev_get_drvdata(&dev->dev);
 
+        set_backend_state(be, XenbusStateClosed);
+
         unregister_hotplug_status_watch(be);
         if (be->vif) {
                 kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
@@ -136,6 +146,8 @@ static int netback_probe(struct xenbus_device *dev,
         if (err)
                 goto fail;
 
+        be->state = XenbusStateInitWait;
+
         /* This kicks hotplug scripts, so do it immediately. */
         backend_create_xenvif(be);
 
@@ -208,24 +220,113 @@ static void backend_create_xenvif(struct backend_info *be)
         kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
 }
 
-
-static void disconnect_backend(struct xenbus_device *dev)
+static void backend_disconnect(struct backend_info *be)
 {
-        struct backend_info *be = dev_get_drvdata(&dev->dev);
-
         if (be->vif)
                 xenvif_disconnect(be->vif);
 }
 
-static void destroy_backend(struct xenbus_device *dev)
+static void backend_connect(struct backend_info *be)
 {
-        struct backend_info *be = dev_get_drvdata(&dev->dev);
+        if (be->vif)
+                connect(be);
+}
 
-        if (be->vif) {
-                kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE);
-                xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status");
-                xenvif_free(be->vif);
-                be->vif = NULL;
+static inline void backend_switch_state(struct backend_info *be,
+                                        enum xenbus_state state)
+{
+        struct xenbus_device *dev = be->dev;
+
+        pr_debug("%s -> %s\n", dev->nodename, xenbus_strstate(state));
+        be->state = state;
+
+        /* If we are waiting for a hotplug script then defer the
+         * actual xenbus state change.
+         */
+        if (!be->have_hotplug_status_watch)
+                xenbus_switch_state(dev, state);
+}
+
+/* Handle backend state transitions:
+ *
+ * The backend state starts in InitWait and the following transitions are
+ * allowed.
+ *
+ * InitWait -> Connected
+ *
+ *    ^    \         |
+ *    |     \        |
+ *    |      \       |
+ *    |       \      |
+ *    |        \     |
+ *    |         \    |
+ *    |          V   V
+ *
+ *  Closed  <-> Closing
+ *
+ * The state argument specifies the eventual state of the backend and the
+ * function transitions to that state via the shortest path.
+ */
+static void set_backend_state(struct backend_info *be,
+                              enum xenbus_state state)
+{
+        while (be->state != state) {
+                switch (be->state) {
+                case XenbusStateClosed:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                                pr_info("%s: prepare for reconnect\n",
+                                        be->dev->nodename);
+                                backend_switch_state(be, XenbusStateInitWait);
+                                break;
+                        case XenbusStateClosing:
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateInitWait:
+                        switch (state) {
+                        case XenbusStateConnected:
+                                backend_connect(be);
+                                backend_switch_state(be, XenbusStateConnected);
+                                break;
+                        case XenbusStateClosing:
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateConnected:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateClosing:
+                        case XenbusStateClosed:
+                                backend_disconnect(be);
+                                backend_switch_state(be, XenbusStateClosing);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                case XenbusStateClosing:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosed);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
+                default:
+                        BUG();
+                }
         }
 }
 
@@ -237,40 +338,33 @@ static void frontend_changed(struct xenbus_device *dev,
 {
         struct backend_info *be = dev_get_drvdata(&dev->dev);
 
-        pr_debug("frontend state %s\n", xenbus_strstate(frontend_state));
+        pr_debug("%s -> %s\n", dev->otherend, xenbus_strstate(frontend_state));
 
         be->frontend_state = frontend_state;
 
         switch (frontend_state) {
         case XenbusStateInitialising:
-                if (dev->state == XenbusStateClosed) {
-                        pr_info("%s: prepare for reconnect\n", dev->nodename);
-                        xenbus_switch_state(dev, XenbusStateInitWait);
-                }
+                set_backend_state(be, XenbusStateInitWait);
                 break;
 
         case XenbusStateInitialised:
                 break;
 
         case XenbusStateConnected:
-                if (dev->state == XenbusStateConnected)
-                        break;
-                if (be->vif)
-                        connect(be);
+                set_backend_state(be, XenbusStateConnected);
                 break;
 
         case XenbusStateClosing:
-                disconnect_backend(dev);
-                xenbus_switch_state(dev, XenbusStateClosing);
+                set_backend_state(be, XenbusStateClosing);
                 break;
 
         case XenbusStateClosed:
-                xenbus_switch_state(dev, XenbusStateClosed);
+                set_backend_state(be, XenbusStateClosed);
                 if (xenbus_dev_is_online(dev))
                         break;
-                destroy_backend(dev);
                 /* fall through if not online */
         case XenbusStateUnknown:
+                set_backend_state(be, XenbusStateClosed);
                 device_unregister(&dev->dev);
                 break;
 
@@ -363,7 +457,9 @@ static void hotplug_status_changed(struct xenbus_watch *watch,
         if (IS_ERR(str))
                 return;
         if (len == sizeof("connected")-1 && !memcmp(str, "connected", len)) {
-                xenbus_switch_state(be->dev, XenbusStateConnected);
+                /* Complete any pending state change */
+                xenbus_switch_state(be->dev, be->state);
+
                 /* Not interested in this watch anymore. */
                 unregister_hotplug_status_watch(be);
         }
@@ -393,12 +489,8 @@ static void connect(struct backend_info *be)
         err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,
                                    hotplug_status_changed,
                                    "%s/%s", dev->nodename, "hotplug-status");
-        if (err) {
-                /* Switch now, since we can't do a watch. */
-                xenbus_switch_state(dev, XenbusStateConnected);
-        } else {
+        if (!err)
                 be->have_hotplug_status_watch = 1;
-        }
 
         netif_wake_queue(be->vif->dev);
 }
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index 9d2009a9004d..78cc76053328 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -74,10 +74,4 @@ config OF_MTD
         depends on MTD
         def_bool y
 
-config OF_RESERVED_MEM
-        depends on OF_FLATTREE && (DMA_CMA || (HAVE_GENERIC_DMA_COHERENT && HAVE_MEMBLOCK))
-        def_bool y
-        help
-          Initialization code for DMA reserved memory
-
 endmenu # OF
diff --git a/drivers/of/Makefile b/drivers/of/Makefile
index ed9660adad77..efd05102c405 100644
--- a/drivers/of/Makefile
+++ b/drivers/of/Makefile
@@ -9,4 +9,3 @@ obj-$(CONFIG_OF_MDIO)	+= of_mdio.o
 obj-$(CONFIG_OF_PCI)    += of_pci.o
 obj-$(CONFIG_OF_PCI_IRQ)  += of_pci_irq.o
 obj-$(CONFIG_OF_MTD)    += of_mtd.o
-obj-$(CONFIG_OF_RESERVED_MEM) += of_reserved_mem.o
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 865d3f66c86b..7d4c70f859e3 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -303,10 +303,8 @@ struct device_node *of_get_cpu_node(int cpu, unsigned int *thread)
         struct device_node *cpun, *cpus;
 
         cpus = of_find_node_by_path("/cpus");
-        if (!cpus) {
-                pr_warn("Missing cpus node, bailing out\n");
+        if (!cpus)
                 return NULL;
-        }
 
         for_each_child_of_node(cpus, cpun) {
                 if (of_node_cmp(cpun->type, "cpu"))
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 229dd9d69e18..a4fa9ad31b8f 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -18,7 +18,6 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
-#include <linux/random.h>
 
 #include <asm/setup.h>  /* for COMMAND_LINE_SIZE */
 #ifdef CONFIG_PPC
@@ -803,14 +802,3 @@ void __init unflatten_device_tree(void)
 }
 
 #endif /* CONFIG_OF_EARLY_FLATTREE */
-
-/* Feed entire flattened device tree into the random pool */
-static int __init add_fdt_randomness(void)
-{
-        if (initial_boot_params)
-                add_device_randomness(initial_boot_params,
-                                be32_to_cpu(initial_boot_params->totalsize));
-
-        return 0;
-}
-core_initcall(add_fdt_randomness);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
deleted file mode 100644
index 0fe40c7d6904..000000000000
--- a/drivers/of/of_reserved_mem.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Device tree based initialization code for reserved memory.
- *
- * Copyright (c) 2013 Samsung Electronics Co., Ltd.
- *              http://www.samsung.com
- * Author: Marek Szyprowski <m.szyprowski@samsung.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License or (at your optional) any later version of the license.
- */
-
-#include <linux/memblock.h>
-#include <linux/err.h>
-#include <linux/of.h>
-#include <linux/of_fdt.h>
-#include <linux/of_platform.h>
-#include <linux/mm.h>
-#include <linux/sizes.h>
-#include <linux/mm_types.h>
-#include <linux/dma-contiguous.h>
-#include <linux/dma-mapping.h>
-#include <linux/of_reserved_mem.h>
-
-#define MAX_RESERVED_REGIONS    16
-struct reserved_mem {
-        phys_addr_t             base;
-        unsigned long           size;
-        struct cma              *cma;
-        char                    name[32];
-};
-static struct reserved_mem reserved_mem[MAX_RESERVED_REGIONS];
-static int reserved_mem_count;
-
-static int __init fdt_scan_reserved_mem(unsigned long node, const char *uname,
-                                        int depth, void *data)
-{
-        struct reserved_mem *rmem = &reserved_mem[reserved_mem_count];
-        phys_addr_t base, size;
-        int is_cma, is_reserved;
-        unsigned long len;
-        const char *status;
-        __be32 *prop;
-
-        is_cma = IS_ENABLED(CONFIG_DMA_CMA) &&
-               of_flat_dt_is_compatible(node, "linux,contiguous-memory-region");
-        is_reserved = of_flat_dt_is_compatible(node, "reserved-memory-region");
-
-        if (!is_reserved && !is_cma) {
-                /* ignore node and scan next one */
-                return 0;
-        }
-
-        status = of_get_flat_dt_prop(node, "status", &len);
-        if (status && strcmp(status, "okay") != 0) {
-                /* ignore disabled node nad scan next one */
-                return 0;
-        }
-
-        prop = of_get_flat_dt_prop(node, "reg", &len);
-        if (!prop || (len < (dt_root_size_cells + dt_root_addr_cells) *
-                             sizeof(__be32))) {
-                pr_err("Reserved mem: node %s, incorrect \"reg\" property\n",
-                       uname);
-                /* ignore node and scan next one */
-                return 0;
-        }
-        base = dt_mem_next_cell(dt_root_addr_cells, &prop);
-        size = dt_mem_next_cell(dt_root_size_cells, &prop);
-
-        if (!size) {
-                /* ignore node and scan next one */
-                return 0;
-        }
-
-        pr_info("Reserved mem: found %s, memory base %lx, size %ld MiB\n",
-                uname, (unsigned long)base, (unsigned long)size / SZ_1M);
-
-        if (reserved_mem_count == ARRAY_SIZE(reserved_mem))
-                return -ENOSPC;
-
-        rmem->base = base;
-        rmem->size = size;
-        strlcpy(rmem->name, uname, sizeof(rmem->name));
-
-        if (is_cma) {
-                struct cma *cma;
-                if (dma_contiguous_reserve_area(size, base, 0, &cma) == 0) {
-                        rmem->cma = cma;
-                        reserved_mem_count++;
-                        if (of_get_flat_dt_prop(node,
-                                                "linux,default-contiguous-region",
-                                                NULL))
-                                dma_contiguous_set_default(cma);
-                }
-        } else if (is_reserved) {
-                if (memblock_remove(base, size) == 0)
-                        reserved_mem_count++;
-                else
-                        pr_err("Failed to reserve memory for %s\n", uname);
-        }
-
-        return 0;
-}
-
-static struct reserved_mem *get_dma_memory_region(struct device *dev)
-{
-        struct device_node *node;
-        const char *name;
-        int i;
-
-        node = of_parse_phandle(dev->of_node, "memory-region", 0);
-        if (!node)
-                return NULL;
-
-        name = kbasename(node->full_name);
-        for (i = 0; i < reserved_mem_count; i++)
-                if (strcmp(name, reserved_mem[i].name) == 0)
-                        return &reserved_mem[i];
-        return NULL;
-}
-
-/**
- * of_reserved_mem_device_init() - assign reserved memory region to given device
- *
- * This function assign memory region pointed by "memory-region" device tree
- * property to the given device.
- */
-void of_reserved_mem_device_init(struct device *dev)
-{
-        struct reserved_mem *region = get_dma_memory_region(dev);
-        if (!region)
-                return;
-
-        if (region->cma) {
-                dev_set_cma_area(dev, region->cma);
-                pr_info("Assigned CMA %s to %s device\n", region->name,
-                        dev_name(dev));
-        } else {
-                if (dma_declare_coherent_memory(dev, region->base, region->base,
-                    region->size, DMA_MEMORY_MAP | DMA_MEMORY_EXCLUSIVE) != 0)
-                        pr_info("Declared reserved memory %s to %s device\n",
-                                region->name, dev_name(dev));
-        }
-}
-
-/**
- * of_reserved_mem_device_release() - release reserved memory device structures
- *
- * This function releases structures allocated for memory region handling for
- * the given device.
- */
-void of_reserved_mem_device_release(struct device *dev)
-{
-        struct reserved_mem *region = get_dma_memory_region(dev);
-        if (!region && !region->cma)
-                dma_release_declared_memory(dev);
-}
-
-/**
- * early_init_dt_scan_reserved_mem() - create reserved memory regions
- *
- * This function grabs memory from early allocator for device exclusive use
- * defined in device tree structures. It should be called by arch specific code
- * once the early allocator (memblock) has been activated and all other
- * subsystems have already allocated/reserved memory.
- */
-void __init early_init_dt_scan_reserved_mem(void)
-{
-        of_scan_flat_dt_by_path("/memory/reserved-memory",
-                                fdt_scan_reserved_mem, NULL);
-}
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 9b439ac63d8e..f6dcde220821 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -21,7 +21,6 @@
 #include <linux/of_device.h>
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
-#include <linux/of_reserved_mem.h>
 #include <linux/platform_device.h>
 
 const struct of_device_id of_default_bus_match_table[] = {
@@ -219,8 +218,6 @@ static struct platform_device *of_platform_device_create_pdata(
         dev->dev.bus = &platform_bus_type;
         dev->dev.platform_data = platform_data;
 
-        of_reserved_mem_device_init(&dev->dev);
-
         /* We do not fill the DMA ops for platform devices by default.
          * This is currently the responsibility of the platform code
          * to do such, possibly using a device notifier
@@ -228,7 +225,6 @@ static struct platform_device *of_platform_device_create_pdata(
 
         if (of_device_add(dev) != 0) {
                 platform_device_put(dev);
-                of_reserved_mem_device_release(&dev->dev);
                 return NULL;
         }
 
diff --git a/drivers/pci/hotplug/acpi_pcihp.c b/drivers/pci/hotplug/acpi_pcihp.c
index 2a47e82821da..5440131cd4ee 100644
--- a/drivers/pci/hotplug/acpi_pcihp.c
+++ b/drivers/pci/hotplug/acpi_pcihp.c
@@ -411,13 +411,10 @@ EXPORT_SYMBOL(acpi_get_hp_hw_control_from_firmware);
 static int pcihp_is_ejectable(acpi_handle handle)
 {
         acpi_status status;
-        acpi_handle tmp;
         unsigned long long removable;
-        status = acpi_get_handle(handle, "_ADR", &tmp);
-        if (ACPI_FAILURE(status))
+        if (!acpi_has_method(handle, "_ADR"))
                 return 0;
-        status = acpi_get_handle(handle, "_EJ0", &tmp);
-        if (ACPI_SUCCESS(status))
+        if (acpi_has_method(handle, "_EJ0"))
                 return 1;
         status = acpi_evaluate_integer(handle, "_RMV", NULL, &removable);
         if (ACPI_SUCCESS(status) && removable)
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 5246ba297470..e98018b43e2a 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -990,14 +990,16 @@ void acpiphp_enumerate_slots(struct pci_bus *bus)
 
                 /*
                  * This bridge should have been registered as a hotplug function
-                 * under its parent, so the context has to be there.  If not, we
-                 * are in deep goo.
+                 * under its parent, so the context should be there, unless the
+                 * parent is going to be handled by pciehp, in which case this
+                 * bridge is not interesting to us either.
                  */
                 mutex_lock(&acpiphp_context_lock);
                 context = acpiphp_get_context(handle);
-                if (WARN_ON(!context)) {
+                if (!context) {
                         mutex_unlock(&acpiphp_context_lock);
                         put_device(&bus->dev);
+                        pci_dev_put(bridge->pci_dev);
                         kfree(bridge);
                         return;
                 }
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index b0299e6d9a3f..dfd1f59de729 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -181,7 +181,6 @@ static bool acpi_pci_power_manageable(struct pci_dev *dev)
 static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
 {
         acpi_handle handle = DEVICE_ACPI_HANDLE(&dev->dev);
-        acpi_handle tmp;
         static const u8 state_conv[] = {
                 [PCI_D0] = ACPI_STATE_D0,
                 [PCI_D1] = ACPI_STATE_D1,
@@ -192,7 +191,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
         int error = -EINVAL;
 
         /* If the ACPI device has _EJ0, ignore the device */
-        if (!handle || ACPI_SUCCESS(acpi_get_handle(handle, "_EJ0", &tmp)))
+        if (!handle || acpi_has_method(handle, "_EJ0"))
                 return -ENODEV;
 
         switch (state) {
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e8ccf6c0f08a..bdd64b1b4817 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1155,8 +1155,14 @@ static void pci_enable_bridge(struct pci_dev *dev)
 
         pci_enable_bridge(dev->bus->self);
 
-        if (pci_is_enabled(dev))
+        if (pci_is_enabled(dev)) {
+                if (!dev->is_busmaster) {
+                        dev_warn(&dev->dev, "driver skip pci_set_master, fix it!\n");
+                        pci_set_master(dev);
+                }
                 return;
+        }
+
         retval = pci_enable_device(dev);
         if (retval)
                 dev_err(&dev->dev, "Error enabling bridge (%d), continuing\n",
diff --git a/drivers/pinctrl/pinconf.c b/drivers/pinctrl/pinconf.c
index a138965c01cb..b8fcc38c0d11 100644
--- a/drivers/pinctrl/pinconf.c
+++ b/drivers/pinctrl/pinconf.c
@@ -490,7 +490,7 @@ exit:
  * <devicename> <state> <pinname> are values that should match the pinctrl-maps
  * <newvalue> reflects the new config and is driver dependant
  */
-static int pinconf_dbg_config_write(struct file *file,
+static ssize_t pinconf_dbg_config_write(struct file *file,
         const char __user *user_buf, size_t count, loff_t *ppos)
 {
         struct pinctrl_maps *maps_node;
@@ -508,7 +508,7 @@ static int pinconf_dbg_config_write(struct file *file,
         int i;
 
         /* Get userspace string and assure termination */
-        buf_size = min(count, (size_t)(sizeof(buf)-1));
+        buf_size = min(count, sizeof(buf) - 1);
         if (copy_from_user(buf, user_buf, buf_size))
                 return -EFAULT;
         buf[buf_size] = 0;
diff --git a/drivers/pinctrl/pinctrl-exynos.c b/drivers/pinctrl/pinctrl-exynos.c
index 2689f8d01a1e..155b1b3a0e7a 100644
--- a/drivers/pinctrl/pinctrl-exynos.c
+++ b/drivers/pinctrl/pinctrl-exynos.c
@@ -663,18 +663,18 @@ static void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata)
 /* pin banks of s5pv210 pin-controller */
 static struct samsung_pin_bank s5pv210_pin_bank[] = {
         EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00),
-        EXYNOS_PIN_BANK_EINTG(6, 0x020, "gpa1", 0x04),
+        EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpa1", 0x04),
         EXYNOS_PIN_BANK_EINTG(8, 0x040, "gpb", 0x08),
         EXYNOS_PIN_BANK_EINTG(5, 0x060, "gpc0", 0x0c),
         EXYNOS_PIN_BANK_EINTG(5, 0x080, "gpc1", 0x10),
         EXYNOS_PIN_BANK_EINTG(4, 0x0a0, "gpd0", 0x14),
-        EXYNOS_PIN_BANK_EINTG(4, 0x0c0, "gpd1", 0x18),
-        EXYNOS_PIN_BANK_EINTG(5, 0x0e0, "gpe0", 0x1c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x100, "gpe1", 0x20),
-        EXYNOS_PIN_BANK_EINTG(6, 0x120, "gpf0", 0x24),
+        EXYNOS_PIN_BANK_EINTG(6, 0x0c0, "gpd1", 0x18),
+        EXYNOS_PIN_BANK_EINTG(8, 0x0e0, "gpe0", 0x1c),
+        EXYNOS_PIN_BANK_EINTG(5, 0x100, "gpe1", 0x20),
+        EXYNOS_PIN_BANK_EINTG(8, 0x120, "gpf0", 0x24),
         EXYNOS_PIN_BANK_EINTG(8, 0x140, "gpf1", 0x28),
         EXYNOS_PIN_BANK_EINTG(8, 0x160, "gpf2", 0x2c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x180, "gpf3", 0x30),
+        EXYNOS_PIN_BANK_EINTG(6, 0x180, "gpf3", 0x30),
         EXYNOS_PIN_BANK_EINTG(7, 0x1a0, "gpg0", 0x34),
         EXYNOS_PIN_BANK_EINTG(7, 0x1c0, "gpg1", 0x38),
         EXYNOS_PIN_BANK_EINTG(7, 0x1e0, "gpg2", 0x3c),
diff --git a/drivers/pinctrl/pinctrl-palmas.c b/drivers/pinctrl/pinctrl-palmas.c
index 82638fac3cfa..30c4d356cb33 100644
--- a/drivers/pinctrl/pinctrl-palmas.c
+++ b/drivers/pinctrl/pinctrl-palmas.c
@@ -891,9 +891,10 @@ static int palmas_pinconf_set(struct pinctrl_dev *pctldev,
                 param = pinconf_to_config_param(configs[i]);
                 param_val = pinconf_to_config_argument(configs[i]);
 
+                if (param == PIN_CONFIG_BIAS_PULL_PIN_DEFAULT)
+                        continue;
+
                 switch (param) {
-                case PIN_CONFIG_BIAS_PULL_PIN_DEFAULT:
-                        return 0;
                 case PIN_CONFIG_BIAS_DISABLE:
                 case PIN_CONFIG_BIAS_PULL_UP:
                 case PIN_CONFIG_BIAS_PULL_DOWN:
diff --git a/drivers/pinctrl/pinctrl-tegra114.c b/drivers/pinctrl/pinctrl-tegra114.c
index 622c4854977e..93c9e3899d5e 100644
--- a/drivers/pinctrl/pinctrl-tegra114.c
+++ b/drivers/pinctrl/pinctrl-tegra114.c
@@ -3,7 +3,7 @@
  *
  * Copyright (c) 2012-2013, NVIDIA CORPORATION.  All rights reserved.
  *
- * Arthur:  Pritesh Raithatha <praithatha@nvidia.com>
+ * Author:  Pritesh Raithatha <praithatha@nvidia.com>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -2763,7 +2763,6 @@ static struct platform_driver tegra114_pinctrl_driver = {
 };
 module_platform_driver(tegra114_pinctrl_driver);
 
-MODULE_ALIAS("platform:tegra114-pinctrl");
 MODULE_AUTHOR("Pritesh Raithatha <praithatha@nvidia.com>");
-MODULE_DESCRIPTION("NVIDIA Tegra114 pincontrol driver");
+MODULE_DESCRIPTION("NVIDIA Tegra114 pinctrl driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 96d6b2eef4f2..b51a7460cc49 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -504,6 +504,7 @@ config ASUS_WMI
         depends on BACKLIGHT_CLASS_DEVICE
         depends on RFKILL || RFKILL = n
         depends on HOTPLUG_PCI
+        depends on ACPI_VIDEO || ACPI_VIDEO = n
         select INPUT_SPARSEKMAP
         select LEDS_CLASS
         select NEW_LEDS
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index a6afd4108beb..aefcc32e5634 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -190,16 +190,10 @@ struct eeepc_laptop {
  */
 static int write_acpi_int(acpi_handle handle, const char *method, int val)
 {
-        struct acpi_object_list params;
-        union acpi_object in_obj;
         acpi_status status;
 
-        params.count = 1;
-        params.pointer = &in_obj;
-        in_obj.type = ACPI_TYPE_INTEGER;
-        in_obj.integer.value = val;
+        status = acpi_execute_simple_method(handle, (char *)method, val);
 
-        status = acpi_evaluate_object(handle, (char *)method, &params, NULL);
         return (status == AE_OK ? 0 : -1);
 }
 
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 52b8a97efde1..9d30d69aa78f 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -219,8 +219,7 @@ static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
         { .type = ACPI_TYPE_INTEGER }
         };
         struct acpi_object_list arg_list = { 4, &params[0] };
-        struct acpi_buffer output;
-        union acpi_object out_obj;
+        unsigned long long value;
         acpi_handle handle = NULL;
 
         status = acpi_get_handle(fujitsu_hotkey->acpi_handle, "FUNC", &handle);
@@ -235,10 +234,7 @@ static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
         params[2].integer.value = arg1;
         params[3].integer.value = arg2;
 
-        output.length = sizeof(out_obj);
-        output.pointer = &out_obj;
-
-        status = acpi_evaluate_object(handle, NULL, &arg_list, &output);
+        status = acpi_evaluate_integer(handle, NULL, &arg_list, &value);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_WARN,
                         "FUNC 0x%x (args 0x%x, 0x%x, 0x%x) call failed\n",
@@ -246,18 +242,10 @@ static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
                 return -ENODEV;
         }
 
-        if (out_obj.type != ACPI_TYPE_INTEGER) {
-                vdbg_printk(FUJLAPTOP_DBG_WARN,
-                        "FUNC 0x%x (args 0x%x, 0x%x, 0x%x) did not "
-                        "return an integer\n",
-                        cmd, arg0, arg1, arg2);
-                return -ENODEV;
-        }
-
         vdbg_printk(FUJLAPTOP_DBG_TRACE,
                 "FUNC 0x%x (args 0x%x, 0x%x, 0x%x) returned 0x%x\n",
-                        cmd, arg0, arg1, arg2, (int)out_obj.integer.value);
-        return out_obj.integer.value;
+                        cmd, arg0, arg1, arg2, (int)value);
+        return value;
 }
 
 #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE)
@@ -317,8 +305,6 @@ static enum led_brightness kblamps_get(struct led_classdev *cdev)
 static int set_lcd_level(int level)
 {
         acpi_status status = AE_OK;
-        union acpi_object arg0 = { ACPI_TYPE_INTEGER };
-        struct acpi_object_list arg_list = { 1, &arg0 };
         acpi_handle handle = NULL;
 
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "set lcd level via SBLL [%d]\n",
@@ -333,9 +319,8 @@ static int set_lcd_level(int level)
                 return -ENODEV;
         }
 
-        arg0.integer.value = level;
 
-        status = acpi_evaluate_object(handle, NULL, &arg_list, NULL);
+        status = acpi_execute_simple_method(handle, NULL, level);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -345,8 +330,6 @@ static int set_lcd_level(int level)
 static int set_lcd_level_alt(int level)
 {
         acpi_status status = AE_OK;
-        union acpi_object arg0 = { ACPI_TYPE_INTEGER };
-        struct acpi_object_list arg_list = { 1, &arg0 };
         acpi_handle handle = NULL;
 
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "set lcd level via SBL2 [%d]\n",
@@ -361,9 +344,7 @@ static int set_lcd_level_alt(int level)
                 return -ENODEV;
         }
 
-        arg0.integer.value = level;
-
-        status = acpi_evaluate_object(handle, NULL, &arg_list, NULL);
+        status = acpi_execute_simple_method(handle, NULL, level);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -586,11 +567,10 @@ static struct platform_driver fujitsupf_driver = {
 
 static void dmi_check_cb_common(const struct dmi_system_id *id)
 {
-        acpi_handle handle;
         pr_info("Identified laptop model '%s'\n", id->ident);
         if (use_alt_lcd_levels == -1) {
-                if (ACPI_SUCCESS(acpi_get_handle(NULL,
-                                "\\_SB.PCI0.LPCB.FJEX.SBL2", &handle)))
+                if (acpi_has_method(NULL,
+                                "\\_SB.PCI0.LPCB.FJEX.SBL2"))
                         use_alt_lcd_levels = 1;
                 else
                         use_alt_lcd_levels = 0;
@@ -653,7 +633,6 @@ static struct dmi_system_id fujitsu_dmi_table[] = {
 
 static int acpi_fujitsu_add(struct acpi_device *device)
 {
-        acpi_handle handle;
         int result = 0;
         int state = 0;
         struct input_dev *input;
@@ -702,8 +681,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
 
         fujitsu->dev = device;
 
-        if (ACPI_SUCCESS
-            (acpi_get_handle(device->handle, METHOD_NAME__INI, &handle))) {
+        if (acpi_has_method(device->handle, METHOD_NAME__INI)) {
                 vdbg_printk(FUJLAPTOP_DBG_INFO, "Invoking _INI\n");
                 if (ACPI_FAILURE
                     (acpi_evaluate_object
@@ -803,7 +781,6 @@ static void acpi_fujitsu_notify(struct acpi_device *device, u32 event)
 
 static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
 {
-        acpi_handle handle;
         int result = 0;
         int state = 0;
         struct input_dev *input;
@@ -866,8 +843,7 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
 
         fujitsu_hotkey->dev = device;
 
-        if (ACPI_SUCCESS
-            (acpi_get_handle(device->handle, METHOD_NAME__INI, &handle))) {
+        if (acpi_has_method(device->handle, METHOD_NAME__INI)) {
                 vdbg_printk(FUJLAPTOP_DBG_INFO, "Invoking _INI\n");
                 if (ACPI_FAILURE
                     (acpi_evaluate_object
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 89c4519d48ac..6788acc22ab9 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -72,8 +72,15 @@ enum {
         VPCCMD_W_BL_POWER = 0x33,
 };
 
+struct ideapad_rfk_priv {
+        int dev;
+        struct ideapad_private *priv;
+};
+
 struct ideapad_private {
+        struct acpi_device *adev;
         struct rfkill *rfk[IDEAPAD_RFKILL_DEV_NUM];
+        struct ideapad_rfk_priv rfk_priv[IDEAPAD_RFKILL_DEV_NUM];
         struct platform_device *platform_device;
         struct input_dev *inputdev;
         struct backlight_device *blightdev;
@@ -81,8 +88,6 @@ struct ideapad_private {
         unsigned long cfg;
 };
 
-static acpi_handle ideapad_handle;
-static struct ideapad_private *ideapad_priv;
 static bool no_bt_rfkill;
 module_param(no_bt_rfkill, bool, 0444);
 MODULE_PARM_DESC(no_bt_rfkill, "No rfkill for bluetooth.");
@@ -200,34 +205,38 @@ static int write_ec_cmd(acpi_handle handle, int cmd, unsigned long data)
  */
 static int debugfs_status_show(struct seq_file *s, void *data)
 {
+        struct ideapad_private *priv = s->private;
         unsigned long value;
 
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_BL_MAX, &value))
+        if (!priv)
+                return -EINVAL;
+
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_BL_MAX, &value))
                 seq_printf(s, "Backlight max:\t%lu\n", value);
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_BL, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_BL, &value))
                 seq_printf(s, "Backlight now:\t%lu\n", value);
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_BL_POWER, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_BL_POWER, &value))
                 seq_printf(s, "BL power value:\t%s\n", value ? "On" : "Off");
         seq_printf(s, "=====================\n");
 
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_RF, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_RF, &value))
                 seq_printf(s, "Radio status:\t%s(%lu)\n",
                            value ? "On" : "Off", value);
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_WIFI, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_WIFI, &value))
                 seq_printf(s, "Wifi status:\t%s(%lu)\n",
                            value ? "On" : "Off", value);
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_BT, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_BT, &value))
                 seq_printf(s, "BT status:\t%s(%lu)\n",
                            value ? "On" : "Off", value);
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_3G, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_3G, &value))
                 seq_printf(s, "3G status:\t%s(%lu)\n",
                            value ? "On" : "Off", value);
         seq_printf(s, "=====================\n");
 
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_TOUCHPAD, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &value))
                 seq_printf(s, "Touchpad status:%s(%lu)\n",
                            value ? "On" : "Off", value);
-        if (!read_ec_data(ideapad_handle, VPCCMD_R_CAMERA, &value))
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_CAMERA, &value))
                 seq_printf(s, "Camera status:\t%s(%lu)\n",
                            value ? "On" : "Off", value);
 
@@ -236,7 +245,7 @@ static int debugfs_status_show(struct seq_file *s, void *data)
 
 static int debugfs_status_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, debugfs_status_show, NULL);
+        return single_open(file, debugfs_status_show, inode->i_private);
 }
 
 static const struct file_operations debugfs_status_fops = {
@@ -249,21 +258,23 @@ static const struct file_operations debugfs_status_fops = {
 
 static int debugfs_cfg_show(struct seq_file *s, void *data)
 {
-        if (!ideapad_priv) {
+        struct ideapad_private *priv = s->private;
+
+        if (!priv) {
                 seq_printf(s, "cfg: N/A\n");
         } else {
                 seq_printf(s, "cfg: 0x%.8lX\n\nCapability: ",
-                           ideapad_priv->cfg);
-                if (test_bit(CFG_BT_BIT, &ideapad_priv->cfg))
+                           priv->cfg);
+                if (test_bit(CFG_BT_BIT, &priv->cfg))
                         seq_printf(s, "Bluetooth ");
-                if (test_bit(CFG_3G_BIT, &ideapad_priv->cfg))
+                if (test_bit(CFG_3G_BIT, &priv->cfg))
                         seq_printf(s, "3G ");
-                if (test_bit(CFG_WIFI_BIT, &ideapad_priv->cfg))
+                if (test_bit(CFG_WIFI_BIT, &priv->cfg))
                         seq_printf(s, "Wireless ");
-                if (test_bit(CFG_CAMERA_BIT, &ideapad_priv->cfg))
+                if (test_bit(CFG_CAMERA_BIT, &priv->cfg))
                         seq_printf(s, "Camera ");
                 seq_printf(s, "\nGraphic: ");
-                switch ((ideapad_priv->cfg)&0x700) {
+                switch ((priv->cfg)&0x700) {
                 case 0x100:
                         seq_printf(s, "Intel");
                         break;
@@ -287,7 +298,7 @@ static int debugfs_cfg_show(struct seq_file *s, void *data)
 
 static int debugfs_cfg_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, debugfs_cfg_show, NULL);
+        return single_open(file, debugfs_cfg_show, inode->i_private);
 }
 
 static const struct file_operations debugfs_cfg_fops = {
@@ -308,14 +319,14 @@ static int ideapad_debugfs_init(struct ideapad_private *priv)
                 goto errout;
         }
 
-        node = debugfs_create_file("cfg", S_IRUGO, priv->debug, NULL,
+        node = debugfs_create_file("cfg", S_IRUGO, priv->debug, priv,
                                    &debugfs_cfg_fops);
         if (!node) {
                 pr_err("failed to create cfg in debugfs");
                 goto errout;
         }
 
-        node = debugfs_create_file("status", S_IRUGO, priv->debug, NULL,
+        node = debugfs_create_file("status", S_IRUGO, priv->debug, priv,
                                    &debugfs_status_fops);
         if (!node) {
                 pr_err("failed to create status in debugfs");
@@ -342,8 +353,9 @@ static ssize_t show_ideapad_cam(struct device *dev,
                                 char *buf)
 {
         unsigned long result;
+        struct ideapad_private *priv = dev_get_drvdata(dev);
 
-        if (read_ec_data(ideapad_handle, VPCCMD_R_CAMERA, &result))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_CAMERA, &result))
                 return sprintf(buf, "-1\n");
         return sprintf(buf, "%lu\n", result);
 }
@@ -353,12 +365,13 @@ static ssize_t store_ideapad_cam(struct device *dev,
                                  const char *buf, size_t count)
 {
         int ret, state;
+        struct ideapad_private *priv = dev_get_drvdata(dev);
 
         if (!count)
                 return 0;
         if (sscanf(buf, "%i", &state) != 1)
                 return -EINVAL;
-        ret = write_ec_cmd(ideapad_handle, VPCCMD_W_CAMERA, state);
+        ret = write_ec_cmd(priv->adev->handle, VPCCMD_W_CAMERA, state);
         if (ret < 0)
                 return -EIO;
         return count;
@@ -371,8 +384,9 @@ static ssize_t show_ideapad_fan(struct device *dev,
                                 char *buf)
 {
         unsigned long result;
+        struct ideapad_private *priv = dev_get_drvdata(dev);
 
-        if (read_ec_data(ideapad_handle, VPCCMD_R_FAN, &result))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_FAN, &result))
                 return sprintf(buf, "-1\n");
         return sprintf(buf, "%lu\n", result);
 }
@@ -382,6 +396,7 @@ static ssize_t store_ideapad_fan(struct device *dev,
                                  const char *buf, size_t count)
 {
         int ret, state;
+        struct ideapad_private *priv = dev_get_drvdata(dev);
 
         if (!count)
                 return 0;
@@ -389,7 +404,7 @@ static ssize_t store_ideapad_fan(struct device *dev,
                 return -EINVAL;
         if (state < 0 || state > 4 || state == 3)
                 return -EINVAL;
-        ret = write_ec_cmd(ideapad_handle, VPCCMD_W_FAN, state);
+        ret = write_ec_cmd(priv->adev->handle, VPCCMD_W_FAN, state);
         if (ret < 0)
                 return -EIO;
         return count;
@@ -415,7 +430,8 @@ static umode_t ideapad_is_visible(struct kobject *kobj,
                 supported = test_bit(CFG_CAMERA_BIT, &(priv->cfg));
         else if (attr == &dev_attr_fan_mode.attr) {
                 unsigned long value;
-                supported = !read_ec_data(ideapad_handle, VPCCMD_R_FAN, &value);
+                supported = !read_ec_data(priv->adev->handle, VPCCMD_R_FAN,
+                                          &value);
         } else
                 supported = true;
 
@@ -445,9 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
 
 static int ideapad_rfk_set(void *data, bool blocked)
 {
-        unsigned long opcode = (unsigned long)data;
+        struct ideapad_rfk_priv *priv = data;
 
-        return write_ec_cmd(ideapad_handle, opcode, !blocked);
+        return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
 }
 
 static struct rfkill_ops ideapad_rfk_ops = {
@@ -459,7 +475,7 @@ static void ideapad_sync_rfk_state(struct ideapad_private *priv)
         unsigned long hw_blocked;
         int i;
 
-        if (read_ec_data(ideapad_handle, VPCCMD_R_RF, &hw_blocked))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_RF, &hw_blocked))
                 return;
         hw_blocked = !hw_blocked;
 
@@ -468,27 +484,30 @@ static void ideapad_sync_rfk_state(struct ideapad_private *priv)
                         rfkill_set_hw_state(priv->rfk[i], hw_blocked);
 }
 
-static int ideapad_register_rfkill(struct acpi_device *adevice, int dev)
+static int ideapad_register_rfkill(struct ideapad_private *priv, int dev)
 {
-        struct ideapad_private *priv = dev_get_drvdata(&adevice->dev);
         int ret;
         unsigned long sw_blocked;
 
         if (no_bt_rfkill &&
             (ideapad_rfk_data[dev].type == RFKILL_TYPE_BLUETOOTH)) {
                 /* Force to enable bluetooth when no_bt_rfkill=1 */
-                write_ec_cmd(ideapad_handle,
+                write_ec_cmd(priv->adev->handle,
                              ideapad_rfk_data[dev].opcode, 1);
                 return 0;
         }
-
-        priv->rfk[dev] = rfkill_alloc(ideapad_rfk_data[dev].name, &adevice->dev,
-                                      ideapad_rfk_data[dev].type, &ideapad_rfk_ops,
-                                      (void *)(long)dev);
+        priv->rfk_priv[dev].dev = dev;
+        priv->rfk_priv[dev].priv = priv;
+
+        priv->rfk[dev] = rfkill_alloc(ideapad_rfk_data[dev].name,
+                                      &priv->platform_device->dev,
+                                      ideapad_rfk_data[dev].type,
+                                      &ideapad_rfk_ops,
+                                      &priv->rfk_priv[dev]);
         if (!priv->rfk[dev])
                 return -ENOMEM;
 
-        if (read_ec_data(ideapad_handle, ideapad_rfk_data[dev].opcode-1,
+        if (read_ec_data(priv->adev->handle, ideapad_rfk_data[dev].opcode-1,
                          &sw_blocked)) {
                 rfkill_init_sw_state(priv->rfk[dev], 0);
         } else {
@@ -504,10 +523,8 @@ static int ideapad_register_rfkill(struct acpi_device *adevice, int dev)
         return 0;
 }
 
-static void ideapad_unregister_rfkill(struct acpi_device *adevice, int dev)
+static void ideapad_unregister_rfkill(struct ideapad_private *priv, int dev)
 {
-        struct ideapad_private *priv = dev_get_drvdata(&adevice->dev);
-
         if (!priv->rfk[dev])
                 return;
 
@@ -518,37 +535,16 @@ static void ideapad_unregister_rfkill(struct acpi_device *adevice, int dev)
 /*
  * Platform device
  */
-static int ideapad_platform_init(struct ideapad_private *priv)
+static int ideapad_sysfs_init(struct ideapad_private *priv)
 {
-        int result;
-
-        priv->platform_device = platform_device_alloc("ideapad", -1);
-        if (!priv->platform_device)
-                return -ENOMEM;
-        platform_set_drvdata(priv->platform_device, priv);
-
-        result = platform_device_add(priv->platform_device);
-        if (result)
-                goto fail_platform_device;
-
-        result = sysfs_create_group(&priv->platform_device->dev.kobj,
+        return sysfs_create_group(&priv->platform_device->dev.kobj,
                                     &ideapad_attribute_group);
-        if (result)
-                goto fail_sysfs;
-        return 0;
-
-fail_sysfs:
-        platform_device_del(priv->platform_device);
-fail_platform_device:
-        platform_device_put(priv->platform_device);
-        return result;
 }
 
-static void ideapad_platform_exit(struct ideapad_private *priv)
+static void ideapad_sysfs_exit(struct ideapad_private *priv)
 {
         sysfs_remove_group(&priv->platform_device->dev.kobj,
                            &ideapad_attribute_group);
-        platform_device_unregister(priv->platform_device);
 }
 
 /*
@@ -623,7 +619,7 @@ static void ideapad_input_novokey(struct ideapad_private *priv)
 {
         unsigned long long_pressed;
 
-        if (read_ec_data(ideapad_handle, VPCCMD_R_NOVO, &long_pressed))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_NOVO, &long_pressed))
                 return;
         if (long_pressed)
                 ideapad_input_report(priv, 17);
@@ -635,7 +631,7 @@ static void ideapad_check_special_buttons(struct ideapad_private *priv)
 {
         unsigned long bit, value;
 
-        read_ec_data(ideapad_handle, VPCCMD_R_SPECIAL_BUTTONS, &value);
+        read_ec_data(priv->adev->handle, VPCCMD_R_SPECIAL_BUTTONS, &value);
 
         for (bit = 0; bit < 16; bit++) {
                 if (test_bit(bit, &value)) {
@@ -662,19 +658,28 @@ static void ideapad_check_special_buttons(struct ideapad_private *priv)
  */
 static int ideapad_backlight_get_brightness(struct backlight_device *blightdev)
 {
+        struct ideapad_private *priv = bl_get_data(blightdev);
         unsigned long now;
 
-        if (read_ec_data(ideapad_handle, VPCCMD_R_BL, &now))
+        if (!priv)
+                return -EINVAL;
+
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_BL, &now))
                 return -EIO;
         return now;
 }
 
 static int ideapad_backlight_update_status(struct backlight_device *blightdev)
 {
-        if (write_ec_cmd(ideapad_handle, VPCCMD_W_BL,
+        struct ideapad_private *priv = bl_get_data(blightdev);
+
+        if (!priv)
+                return -EINVAL;
+
+        if (write_ec_cmd(priv->adev->handle, VPCCMD_W_BL,
                          blightdev->props.brightness))
                 return -EIO;
-        if (write_ec_cmd(ideapad_handle, VPCCMD_W_BL_POWER,
+        if (write_ec_cmd(priv->adev->handle, VPCCMD_W_BL_POWER,
                          blightdev->props.power == FB_BLANK_POWERDOWN ? 0 : 1))
                 return -EIO;
 
@@ -692,11 +697,11 @@ static int ideapad_backlight_init(struct ideapad_private *priv)
         struct backlight_properties props;
         unsigned long max, now, power;
 
-        if (read_ec_data(ideapad_handle, VPCCMD_R_BL_MAX, &max))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_BL_MAX, &max))
                 return -EIO;
-        if (read_ec_data(ideapad_handle, VPCCMD_R_BL, &now))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_BL, &now))
                 return -EIO;
-        if (read_ec_data(ideapad_handle, VPCCMD_R_BL_POWER, &power))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_BL_POWER, &power))
                 return -EIO;
 
         memset(&props, 0, sizeof(struct backlight_properties));
@@ -734,7 +739,7 @@ static void ideapad_backlight_notify_power(struct ideapad_private *priv)
 
         if (!blightdev)
                 return;
-        if (read_ec_data(ideapad_handle, VPCCMD_R_BL_POWER, &power))
+        if (read_ec_data(priv->adev->handle, VPCCMD_R_BL_POWER, &power))
                 return;
         blightdev->props.power = power ? FB_BLANK_UNBLANK : FB_BLANK_POWERDOWN;
 }
@@ -745,7 +750,7 @@ static void ideapad_backlight_notify_brightness(struct ideapad_private *priv)
 
         /* if we control brightness via acpi video driver */
         if (priv->blightdev == NULL) {
-                read_ec_data(ideapad_handle, VPCCMD_R_BL, &now);
+                read_ec_data(priv->adev->handle, VPCCMD_R_BL, &now);
                 return;
         }
 
@@ -755,19 +760,12 @@ static void ideapad_backlight_notify_brightness(struct ideapad_private *priv)
 /*
  * module init/exit
  */
-static const struct acpi_device_id ideapad_device_ids[] = {
-        { "VPC2004", 0},
-        { "", 0},
-};
-MODULE_DEVICE_TABLE(acpi, ideapad_device_ids);
-
-static void ideapad_sync_touchpad_state(struct acpi_device *adevice)
+static void ideapad_sync_touchpad_state(struct ideapad_private *priv)
 {
-        struct ideapad_private *priv = dev_get_drvdata(&adevice->dev);
         unsigned long value;
 
         /* Without reading from EC touchpad LED doesn't switch state */
-        if (!read_ec_data(adevice->handle, VPCCMD_R_TOUCHPAD, &value)) {
+        if (!read_ec_data(priv->adev->handle, VPCCMD_R_TOUCHPAD, &value)) {
                 /* Some IdeaPads don't really turn off touchpad - they only
                  * switch the LED state. We (de)activate KBC AUX port to turn
                  * touchpad off and on. We send KEY_TOUCHPAD_OFF and
@@ -779,26 +777,77 @@ static void ideapad_sync_touchpad_state(struct acpi_device *adevice)
         }
 }
 
-static int ideapad_acpi_add(struct acpi_device *adevice)
+static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
+{
+        struct ideapad_private *priv = data;
+        unsigned long vpc1, vpc2, vpc_bit;
+
+        if (read_ec_data(handle, VPCCMD_R_VPC1, &vpc1))
+                return;
+        if (read_ec_data(handle, VPCCMD_R_VPC2, &vpc2))
+                return;
+
+        vpc1 = (vpc2 << 8) | vpc1;
+        for (vpc_bit = 0; vpc_bit < 16; vpc_bit++) {
+                if (test_bit(vpc_bit, &vpc1)) {
+                        switch (vpc_bit) {
+                        case 9:
+                                ideapad_sync_rfk_state(priv);
+                                break;
+                        case 13:
+                        case 11:
+                        case 7:
+                        case 6:
+                                ideapad_input_report(priv, vpc_bit);
+                                break;
+                        case 5:
+                                ideapad_sync_touchpad_state(priv);
+                                break;
+                        case 4:
+                                ideapad_backlight_notify_brightness(priv);
+                                break;
+                        case 3:
+                                ideapad_input_novokey(priv);
+                                break;
+                        case 2:
+                                ideapad_backlight_notify_power(priv);
+                                break;
+                        case 0:
+                                ideapad_check_special_buttons(priv);
+                                break;
+                        default:
+                                pr_info("Unknown event: %lu\n", vpc_bit);
+                        }
+                }
+        }
+}
+
+static int ideapad_acpi_add(struct platform_device *pdev)
 {
         int ret, i;
         int cfg;
         struct ideapad_private *priv;
+        struct acpi_device *adev;
+
+        ret = acpi_bus_get_device(ACPI_HANDLE(&pdev->dev), &adev);
+        if (ret)
+                return -ENODEV;
 
-        if (read_method_int(adevice->handle, "_CFG", &cfg))
+        if (read_method_int(adev->handle, "_CFG", &cfg))
                 return -ENODEV;
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
-        dev_set_drvdata(&adevice->dev, priv);
-        ideapad_priv = priv;
-        ideapad_handle = adevice->handle;
+
+        dev_set_drvdata(&pdev->dev, priv);
         priv->cfg = cfg;
+        priv->adev = adev;
+        priv->platform_device = pdev;
 
-        ret = ideapad_platform_init(priv);
+        ret = ideapad_sysfs_init(priv);
         if (ret)
-                goto platform_failed;
+                goto sysfs_failed;
 
         ret = ideapad_debugfs_init(priv);
         if (ret)
@@ -810,117 +859,92 @@ static int ideapad_acpi_add(struct acpi_device *adevice)
 
         for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++) {
                 if (test_bit(ideapad_rfk_data[i].cfgbit, &priv->cfg))
-                        ideapad_register_rfkill(adevice, i);
+                        ideapad_register_rfkill(priv, i);
                 else
                         priv->rfk[i] = NULL;
         }
         ideapad_sync_rfk_state(priv);
-        ideapad_sync_touchpad_state(adevice);
+        ideapad_sync_touchpad_state(priv);
 
         if (!acpi_video_backlight_support()) {
                 ret = ideapad_backlight_init(priv);
                 if (ret && ret != -ENODEV)
                         goto backlight_failed;
         }
+        ret = acpi_install_notify_handler(adev->handle,
+                ACPI_DEVICE_NOTIFY, ideapad_acpi_notify, priv);
+        if (ret)
+                goto notification_failed;
 
         return 0;
-
+notification_failed:
+        ideapad_backlight_exit(priv);
 backlight_failed:
         for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++)
-                ideapad_unregister_rfkill(adevice, i);
+                ideapad_unregister_rfkill(priv, i);
         ideapad_input_exit(priv);
 input_failed:
         ideapad_debugfs_exit(priv);
 debugfs_failed:
-        ideapad_platform_exit(priv);
-platform_failed:
+        ideapad_sysfs_exit(priv);
+sysfs_failed:
         kfree(priv);
         return ret;
 }
 
-static int ideapad_acpi_remove(struct acpi_device *adevice)
+static int ideapad_acpi_remove(struct platform_device *pdev)
 {
-        struct ideapad_private *priv = dev_get_drvdata(&adevice->dev);
+        struct ideapad_private *priv = dev_get_drvdata(&pdev->dev);
         int i;
 
+        acpi_remove_notify_handler(priv->adev->handle,
+                ACPI_DEVICE_NOTIFY, ideapad_acpi_notify);
         ideapad_backlight_exit(priv);
         for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++)
-                ideapad_unregister_rfkill(adevice, i);
+                ideapad_unregister_rfkill(priv, i);
         ideapad_input_exit(priv);
         ideapad_debugfs_exit(priv);
-        ideapad_platform_exit(priv);
-        dev_set_drvdata(&adevice->dev, NULL);
+        ideapad_sysfs_exit(priv);
+        dev_set_drvdata(&pdev->dev, NULL);
         kfree(priv);
 
         return 0;
 }
 
-static void ideapad_acpi_notify(struct acpi_device *adevice, u32 event)
+#ifdef CONFIG_PM_SLEEP
+static int ideapad_acpi_resume(struct device *device)
 {
-        struct ideapad_private *priv = dev_get_drvdata(&adevice->dev);
-        acpi_handle handle = adevice->handle;
-        unsigned long vpc1, vpc2, vpc_bit;
-
-        if (read_ec_data(handle, VPCCMD_R_VPC1, &vpc1))
-                return;
-        if (read_ec_data(handle, VPCCMD_R_VPC2, &vpc2))
-                return;
+        struct ideapad_private *priv;
 
-        vpc1 = (vpc2 << 8) | vpc1;
-        for (vpc_bit = 0; vpc_bit < 16; vpc_bit++) {
-                if (test_bit(vpc_bit, &vpc1)) {
-                        switch (vpc_bit) {
-                        case 9:
-                                ideapad_sync_rfk_state(priv);
-                                break;
-                        case 13:
-                        case 11:
-                        case 7:
-                        case 6:
-                                ideapad_input_report(priv, vpc_bit);
-                                break;
-                        case 5:
-                                ideapad_sync_touchpad_state(adevice);
-                                break;
-                        case 4:
-                                ideapad_backlight_notify_brightness(priv);
-                                break;
-                        case 3:
-                                ideapad_input_novokey(priv);
-                                break;
-                        case 2:
-                                ideapad_backlight_notify_power(priv);
-                                break;
-                        case 0:
-                                ideapad_check_special_buttons(priv);
-                                break;
-                        default:
-                                pr_info("Unknown event: %lu\n", vpc_bit);
-                        }
-                }
-        }
-}
+        if (!device)
+                return -EINVAL;
+        priv = dev_get_drvdata(device);
 
-static int ideapad_acpi_resume(struct device *device)
-{
-        ideapad_sync_rfk_state(ideapad_priv);
-        ideapad_sync_touchpad_state(to_acpi_device(device));
+        ideapad_sync_rfk_state(priv);
+        ideapad_sync_touchpad_state(priv);
         return 0;
 }
-
+#endif
 static SIMPLE_DEV_PM_OPS(ideapad_pm, NULL, ideapad_acpi_resume);
 
-static struct acpi_driver ideapad_acpi_driver = {
-        .name = "ideapad_acpi",
-        .class = "IdeaPad",
-        .ids = ideapad_device_ids,
-        .ops.add = ideapad_acpi_add,
-        .ops.remove = ideapad_acpi_remove,
-        .ops.notify = ideapad_acpi_notify,
-        .drv.pm = &ideapad_pm,
-        .owner = THIS_MODULE,
+static const struct acpi_device_id ideapad_device_ids[] = {
+        { "VPC2004", 0},
+        { "", 0},
 };
-module_acpi_driver(ideapad_acpi_driver);
+MODULE_DEVICE_TABLE(acpi, ideapad_device_ids);
+
+static struct platform_driver ideapad_acpi_driver = {
+        .probe = ideapad_acpi_add,
+        .remove = ideapad_acpi_remove,
+        .driver = {
+                .name   = "ideapad_acpi",
+                .owner  = THIS_MODULE,
+                .pm     = &ideapad_pm,
+                .acpi_match_table = ACPI_PTR(ideapad_device_ids),
+        },
+};
+
+module_platform_driver(ideapad_acpi_driver);
 
 MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
 MODULE_DESCRIPTION("IdeaPad ACPI Extras");
diff --git a/drivers/platform/x86/intel-rst.c b/drivers/platform/x86/intel-rst.c
index 41b740cb28bc..a2083a9e5662 100644
--- a/drivers/platform/x86/intel-rst.c
+++ b/drivers/platform/x86/intel-rst.c
@@ -29,24 +29,16 @@ static ssize_t irst_show_wakeup_events(struct device *dev,
                                        char *buf)
 {
         struct acpi_device *acpi;
-        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
-        union acpi_object *result;
+        unsigned long long value;
         acpi_status status;
 
         acpi = to_acpi_device(dev);
 
-        status = acpi_evaluate_object(acpi->handle, "GFFS", NULL, &output);
+        status = acpi_evaluate_integer(acpi->handle, "GFFS", NULL, &value);
         if (!ACPI_SUCCESS(status))
                 return -EINVAL;
 
-        result = output.pointer;
-
-        if (result->type != ACPI_TYPE_INTEGER) {
-                kfree(result);
-                return -EINVAL;
-        }
-
-        return sprintf(buf, "%lld\n", result->integer.value);
+        return sprintf(buf, "%lld\n", value);
 }
 
 static ssize_t irst_store_wakeup_events(struct device *dev,
@@ -54,8 +46,6 @@ static ssize_t irst_store_wakeup_events(struct device *dev,
                                         const char *buf, size_t count)
 {
         struct acpi_device *acpi;
-        struct acpi_object_list input;
-        union acpi_object param;
         acpi_status status;
         unsigned long value;
         int error;
@@ -67,13 +57,7 @@ static ssize_t irst_store_wakeup_events(struct device *dev,
         if (error)
                 return error;
 
-        param.type = ACPI_TYPE_INTEGER;
-        param.integer.value = value;
-
-        input.count = 1;
-        input.pointer = &param;
-
-        status = acpi_evaluate_object(acpi->handle, "SFFS", &input, NULL);
+        status = acpi_execute_simple_method(acpi->handle, "SFFS", value);
 
         if (!ACPI_SUCCESS(status))
                 return -EINVAL;
@@ -91,24 +75,16 @@ static ssize_t irst_show_wakeup_time(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
         struct acpi_device *acpi;
-        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
-        union acpi_object *result;
+        unsigned long long value;
         acpi_status status;
 
         acpi = to_acpi_device(dev);
 
-        status = acpi_evaluate_object(acpi->handle, "GFTV", NULL, &output);
+        status = acpi_evaluate_integer(acpi->handle, "GFTV", NULL, &value);
         if (!ACPI_SUCCESS(status))
                 return -EINVAL;
 
-        result = output.pointer;
-
-        if (result->type != ACPI_TYPE_INTEGER) {
-                kfree(result);
-                return -EINVAL;
-        }
-
-        return sprintf(buf, "%lld\n", result->integer.value);
+        return sprintf(buf, "%lld\n", value);
 }
 
 static ssize_t irst_store_wakeup_time(struct device *dev,
@@ -116,8 +92,6 @@ static ssize_t irst_store_wakeup_time(struct device *dev,
                                       const char *buf, size_t count)
 {
         struct acpi_device *acpi;
-        struct acpi_object_list input;
-        union acpi_object param;
         acpi_status status;
         unsigned long value;
         int error;
@@ -129,13 +103,7 @@ static ssize_t irst_store_wakeup_time(struct device *dev,
         if (error)
                 return error;
 
-        param.type = ACPI_TYPE_INTEGER;
-        param.integer.value = value;
-
-        input.count = 1;
-        input.pointer = &param;
-
-        status = acpi_evaluate_object(acpi->handle, "SFTV", &input, NULL);
+        status = acpi_execute_simple_method(acpi->handle, "SFTV", value);
 
         if (!ACPI_SUCCESS(status))
                 return -EINVAL;
diff --git a/drivers/platform/x86/intel-smartconnect.c b/drivers/platform/x86/intel-smartconnect.c
index 52259dcabecb..1838400dc036 100644
--- a/drivers/platform/x86/intel-smartconnect.c
+++ b/drivers/platform/x86/intel-smartconnect.c
@@ -25,37 +25,18 @@ MODULE_LICENSE("GPL");
 
 static int smartconnect_acpi_init(struct acpi_device *acpi)
 {
-        struct acpi_object_list input;
-        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
-        union acpi_object *result;
-        union acpi_object param;
+        unsigned long long value;
         acpi_status status;
 
-        status = acpi_evaluate_object(acpi->handle, "GAOS", NULL, &output);
+        status = acpi_evaluate_integer(acpi->handle, "GAOS", NULL, &value);
         if (!ACPI_SUCCESS(status))
                 return -EINVAL;
 
-        result = output.pointer;
-
-        if (result->type != ACPI_TYPE_INTEGER) {
-                kfree(result);
-                return -EINVAL;
-        }
-
-        if (result->integer.value & 0x1) {
-                param.type = ACPI_TYPE_INTEGER;
-                param.integer.value = 0;
-
-                input.count = 1;
-                input.pointer = &param;
-
+        if (value & 0x1) {
                 dev_info(&acpi->dev, "Disabling Intel Smart Connect\n");
-                status = acpi_evaluate_object(acpi->handle, "SAOS", &input,
-                                              NULL);
+                status = acpi_execute_simple_method(acpi->handle, "SAOS", 0);
         }
 
-        kfree(result);
-
         return 0;
 }
 
diff --git a/drivers/platform/x86/intel_menlow.c b/drivers/platform/x86/intel_menlow.c
index d6cfc1558c2f..11244f8703c4 100644
--- a/drivers/platform/x86/intel_menlow.c
+++ b/drivers/platform/x86/intel_menlow.c
@@ -156,19 +156,15 @@ static struct thermal_cooling_device_ops memory_cooling_ops = {
 static int intel_menlow_memory_add(struct acpi_device *device)
 {
         int result = -ENODEV;
-        acpi_status status = AE_OK;
-        acpi_handle dummy;
         struct thermal_cooling_device *cdev;
 
         if (!device)
                 return -EINVAL;
 
-        status = acpi_get_handle(device->handle, MEMORY_GET_BANDWIDTH, &dummy);
-        if (ACPI_FAILURE(status))
+        if (!acpi_has_method(device->handle, MEMORY_GET_BANDWIDTH))
                 goto end;
 
-        status = acpi_get_handle(device->handle, MEMORY_SET_BANDWIDTH, &dummy);
-        if (ACPI_FAILURE(status))
+        if (!acpi_has_method(device->handle, MEMORY_SET_BANDWIDTH))
                 goto end;
 
         cdev = thermal_cooling_device_register("Memory controller", device,
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index d3fd52036fd6..47caab0ea7a1 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -127,18 +127,17 @@ MODULE_PARM_DESC(minor,
                  "default is -1 (automatic)");
 #endif
 
-static int kbd_backlight = 1;
+static int kbd_backlight = -1;
 module_param(kbd_backlight, int, 0444);
 MODULE_PARM_DESC(kbd_backlight,
                  "set this to 0 to disable keyboard backlight, "
-                 "1 to enable it (default: 0)");
+                 "1 to enable it (default: no change from current value)");
 
-static int kbd_backlight_timeout;       /* = 0 */
+static int kbd_backlight_timeout = -1;
 module_param(kbd_backlight_timeout, int, 0444);
 MODULE_PARM_DESC(kbd_backlight_timeout,
-                 "set this to 0 to set the default 10 seconds timeout, "
-                 "1 for 30 seconds, 2 for 60 seconds and 3 to disable timeout "
-                 "(default: 0)");
+                 "meaningful values vary from 0 to 3 and their meaning depends "
+                 "on the model (default: no change from current value)");
 
 #ifdef CONFIG_PM_SLEEP
 static void sony_nc_kbd_backlight_resume(void);
@@ -1509,7 +1508,6 @@ static void sony_nc_function_resume(void)
 static int sony_nc_resume(struct device *dev)
 {
         struct sony_nc_value *item;
-        acpi_handle handle;
 
         for (item = sony_nc_values; item->name; item++) {
                 int ret;
@@ -1524,15 +1522,13 @@ static int sony_nc_resume(struct device *dev)
                 }
         }
 
-        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "ECON",
-                                         &handle))) {
+        if (acpi_has_method(sony_nc_acpi_handle, "ECON")) {
                 int arg = 1;
                 if (sony_nc_int_call(sony_nc_acpi_handle, "ECON", &arg, NULL))
                         dprintk("ECON Method failed\n");
         }
 
-        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "SN00",
-                                         &handle)))
+        if (acpi_has_method(sony_nc_acpi_handle, "SN00"))
                 sony_nc_function_resume();
 
         return 0;
@@ -1844,6 +1840,8 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
         if (!kbdbl_ctl)
                 return -ENOMEM;
 
+        kbdbl_ctl->mode = kbd_backlight;
+        kbdbl_ctl->timeout = kbd_backlight_timeout;
         kbdbl_ctl->handle = handle;
         if (handle == 0x0137)
                 kbdbl_ctl->base = 0x0C00;
@@ -1870,8 +1868,8 @@ static int sony_nc_kbd_backlight_setup(struct platform_device *pd,
         if (ret)
                 goto outmode;
 
-        __sony_nc_kbd_backlight_mode_set(kbd_backlight);
-        __sony_nc_kbd_backlight_timeout_set(kbd_backlight_timeout);
+        __sony_nc_kbd_backlight_mode_set(kbdbl_ctl->mode);
+        __sony_nc_kbd_backlight_timeout_set(kbdbl_ctl->timeout);
 
         return 0;
 
@@ -1886,17 +1884,8 @@ outkzalloc:
 static void sony_nc_kbd_backlight_cleanup(struct platform_device *pd)
 {
         if (kbdbl_ctl) {
-                int result;
-
                 device_remove_file(&pd->dev, &kbdbl_ctl->mode_attr);
                 device_remove_file(&pd->dev, &kbdbl_ctl->timeout_attr);
-
-                /* restore the default hw behaviour */
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                kbdbl_ctl->base | 0x10000, &result);
-                sony_call_snc_handle(kbdbl_ctl->handle,
-                                kbdbl_ctl->base + 0x200, &result);
-
                 kfree(kbdbl_ctl);
                 kbdbl_ctl = NULL;
         }
@@ -2690,7 +2679,6 @@ static void sony_nc_backlight_ng_read_limits(int handle,
 
 static void sony_nc_backlight_setup(void)
 {
-        acpi_handle unused;
         int max_brightness = 0;
         const struct backlight_ops *ops = NULL;
         struct backlight_properties props;
@@ -2725,8 +2713,7 @@ static void sony_nc_backlight_setup(void)
                 sony_nc_backlight_ng_read_limits(0x14c, &sony_bl_props);
                 max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
 
-        } else if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "GBRT",
-                                                &unused))) {
+        } else if (acpi_has_method(sony_nc_acpi_handle, "GBRT")) {
                 ops = &sony_backlight_ops;
                 max_brightness = SONY_MAX_BRIGHTNESS - 1;
 
@@ -2758,7 +2745,6 @@ static int sony_nc_add(struct acpi_device *device)
 {
         acpi_status status;
         int result = 0;
-        acpi_handle handle;
         struct sony_nc_value *item;
 
         pr_info("%s v%s\n", SONY_NC_DRIVER_NAME, SONY_LAPTOP_DRIVER_VERSION);
@@ -2798,15 +2784,13 @@ static int sony_nc_add(struct acpi_device *device)
                 goto outplatform;
         }
 
-        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "ECON",
-                                         &handle))) {
+        if (acpi_has_method(sony_nc_acpi_handle, "ECON")) {
                 int arg = 1;
                 if (sony_nc_int_call(sony_nc_acpi_handle, "ECON", &arg, NULL))
                         dprintk("ECON Method failed\n");
         }
 
-        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "SN00",
-                                         &handle))) {
+        if (acpi_has_method(sony_nc_acpi_handle, "SN00")) {
                 dprintk("Doing SNC setup\n");
                 /* retrieve the available handles */
                 result = sony_nc_handles_setup(sony_pf_device);
@@ -2829,9 +2813,8 @@ static int sony_nc_add(struct acpi_device *device)
 
                 /* find the available acpiget as described in the DSDT */
                 for (; item->acpiget && *item->acpiget; ++item->acpiget) {
-                        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle,
-                                                         *item->acpiget,
-                                                         &handle))) {
+                        if (acpi_has_method(sony_nc_acpi_handle,
+                                                        *item->acpiget)) {
                                 dprintk("Found %s getter: %s\n",
                                                 item->name, *item->acpiget);
                                 item->devattr.attr.mode |= S_IRUGO;
@@ -2841,9 +2824,8 @@ static int sony_nc_add(struct acpi_device *device)
 
                 /* find the available acpiset as described in the DSDT */
                 for (; item->acpiset && *item->acpiset; ++item->acpiset) {
-                        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle,
-                                                         *item->acpiset,
-                                                         &handle))) {
+                        if (acpi_has_method(sony_nc_acpi_handle,
+                                                        *item->acpiset)) {
                                 dprintk("Found %s setter: %s\n",
                                                 item->name, *item->acpiset);
                                 item->devattr.attr.mode |= S_IWUSR;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 03ca6c139f1a..170f2788ee67 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -700,6 +700,14 @@ static void __init drv_acpi_handle_init(const char *name,
 static acpi_status __init tpacpi_acpi_handle_locate_callback(acpi_handle handle,
                         u32 level, void *context, void **return_value)
 {
+        struct acpi_device *dev;
+        if (!strcmp(context, "video")) {
+                if (acpi_bus_get_device(handle, &dev))
+                        return AE_OK;
+                if (strcmp(ACPI_VIDEO_HID, acpi_device_hid(dev)))
+                        return AE_OK;
+        }
+
         *(acpi_handle *)return_value = handle;
 
         return AE_CTRL_TERMINATE;
@@ -712,10 +720,10 @@ static void __init tpacpi_acpi_handle_locate(const char *name,
         acpi_status status;
         acpi_handle device_found;
 
-        BUG_ON(!name || !hid || !handle);
+        BUG_ON(!name || !handle);
         vdbg_printk(TPACPI_DBG_INIT,
                         "trying to locate ACPI handle for %s, using HID %s\n",
-                        name, hid);
+                        name, hid ? hid : "NULL");
 
         memset(&device_found, 0, sizeof(device_found));
         status = acpi_get_devices(hid, tpacpi_acpi_handle_locate_callback,
@@ -6090,19 +6098,28 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
+        struct acpi_device *device, *child;
         int rc;
 
-        if (ACPI_SUCCESS(acpi_evaluate_object(handle, "_BCL", NULL, &buffer))) {
+        if (acpi_bus_get_device(handle, &device))
+                return 0;
+
+        rc = 0;
+        list_for_each_entry(child, &device->children, node) {
+                acpi_status status = acpi_evaluate_object(child->handle, "_BCL",
+                                                          NULL, &buffer);
+                if (ACPI_FAILURE(status))
+                        continue;
+
                 obj = (union acpi_object *)buffer.pointer;
                 if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {
                         pr_err("Unknown _BCL data, please report this to %s\n",
-                               TPACPI_MAIL);
+                                TPACPI_MAIL);
                         rc = 0;
                 } else {
                         rc = obj->package.count;
                 }
-        } else {
-                return 0;
+                break;
         }
 
         kfree(buffer.pointer);
@@ -6118,7 +6135,7 @@ static unsigned int __init tpacpi_check_std_acpi_brightness_support(void)
         acpi_handle video_device;
         int bcl_levels = 0;
 
-        tpacpi_acpi_handle_locate("video", ACPI_VIDEO_HID, &video_device);
+        tpacpi_acpi_handle_locate("video", NULL, &video_device);
         if (video_device)
                 bcl_levels = tpacpi_query_bcl_levels(video_device);
 
diff --git a/drivers/platform/x86/topstar-laptop.c b/drivers/platform/x86/topstar-laptop.c
index 4ab618c63b45..67897c8740ba 100644
--- a/drivers/platform/x86/topstar-laptop.c
+++ b/drivers/platform/x86/topstar-laptop.c
@@ -80,13 +80,9 @@ static void acpi_topstar_notify(struct acpi_device *device, u32 event)
 static int acpi_topstar_fncx_switch(struct acpi_device *device, bool state)
 {
         acpi_status status;
-        union acpi_object fncx_params[1] = {
-                { .type = ACPI_TYPE_INTEGER }
-        };
-        struct acpi_object_list fncx_arg_list = { 1, &fncx_params[0] };
 
-        fncx_params[0].integer.value = state ? 0x86 : 0x87;
-        status = acpi_evaluate_object(device->handle, "FNCX", &fncx_arg_list, NULL);
+        status = acpi_execute_simple_method(device->handle, "FNCX",
+                                                state ? 0x86 : 0x87);
         if (ACPI_FAILURE(status)) {
                 pr_err("Unable to switch FNCX notifications\n");
                 return -ENODEV;
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index eb3467ea6d86..0cfadb65f7c6 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -191,16 +191,9 @@ static __inline__ void _set_bit(u32 * word, u32 mask, int value)
 
 static int write_acpi_int(const char *methodName, int val)
 {
-        struct acpi_object_list params;
-        union acpi_object in_objs[1];
         acpi_status status;
 
-        params.count = ARRAY_SIZE(in_objs);
-        params.pointer = in_objs;
-        in_objs[0].type = ACPI_TYPE_INTEGER;
-        in_objs[0].integer.value = val;
-
-        status = acpi_evaluate_object(NULL, (char *)methodName, &params, NULL);
+        status = acpi_execute_simple_method(NULL, (char *)methodName, val);
         return (status == AE_OK) ? 0 : -EIO;
 }
 
@@ -947,21 +940,17 @@ static void toshiba_acpi_hotkey_work(struct work_struct *work)
  */
 static int toshiba_acpi_query_hotkey(struct toshiba_acpi_dev *dev)
 {
-        struct acpi_buffer buf;
-        union acpi_object out_obj;
+        unsigned long long value;
         acpi_status status;
 
-        buf.pointer = &out_obj;
-        buf.length = sizeof(out_obj);
-
-        status = acpi_evaluate_object(dev->acpi_dev->handle, "INFO",
-                                      NULL, &buf);
-        if (ACPI_FAILURE(status) || out_obj.type != ACPI_TYPE_INTEGER) {
+        status = acpi_evaluate_integer(dev->acpi_dev->handle, "INFO",
+                                      NULL, &value);
+        if (ACPI_FAILURE(status)) {
                 pr_err("ACPI INFO method execution failed\n");
                 return -EIO;
         }
 
-        return out_obj.integer.value;
+        return value;
 }
 
 static void toshiba_acpi_report_hotkey(struct toshiba_acpi_dev *dev,
@@ -981,7 +970,7 @@ static void toshiba_acpi_report_hotkey(struct toshiba_acpi_dev *dev,
 static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
 {
         acpi_status status;
-        acpi_handle ec_handle, handle;
+        acpi_handle ec_handle;
         int error;
         u32 hci_result;
 
@@ -1008,10 +997,7 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
          */
         status = AE_ERROR;
         ec_handle = ec_get_handle();
-        if (ec_handle)
-                status = acpi_get_handle(ec_handle, "NTFY", &handle);
-
-        if (ACPI_SUCCESS(status)) {
+        if (ec_handle && acpi_has_method(ec_handle, "NTFY")) {
                 INIT_WORK(&dev->hotkey_work, toshiba_acpi_hotkey_work);
 
                 error = i8042_install_filter(toshiba_acpi_i8042_filter);
@@ -1027,10 +1013,9 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
          * Determine hotkey query interface. Prefer using the INFO
          * method when it is available.
          */
-        status = acpi_get_handle(dev->acpi_dev->handle, "INFO", &handle);
-        if (ACPI_SUCCESS(status)) {
+        if (acpi_has_method(dev->acpi_dev->handle, "INFO"))
                 dev->info_supported = 1;
-        } else {
+        else {
                 hci_write1(dev, HCI_SYSTEM_EVENT, 1, &hci_result);
                 if (hci_result == HCI_SUCCESS)
                         dev->system_event_supported = 1;
@@ -1155,15 +1140,10 @@ static int toshiba_acpi_remove(struct acpi_device *acpi_dev)
 
 static const char *find_hci_method(acpi_handle handle)
 {
-        acpi_status status;
-        acpi_handle hci_handle;
-
-        status = acpi_get_handle(handle, "GHCI", &hci_handle);
-        if (ACPI_SUCCESS(status))
+        if (acpi_has_method(handle, "GHCI"))
                 return "GHCI";
 
-        status = acpi_get_handle(handle, "SPFC", &hci_handle);
-        if (ACPI_SUCCESS(status))
+        if (acpi_has_method(handle, "SPFC"))
                 return "SPFC";
 
         return NULL;
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 601ea9512242..62e8c221d01e 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -252,8 +252,6 @@ static acpi_status wmi_method_enable(struct wmi_block *wblock, int enable)
 {
         struct guid_block *block = NULL;
         char method[5];
-        struct acpi_object_list input;
-        union acpi_object params[1];
         acpi_status status;
         acpi_handle handle;
 
@@ -263,13 +261,9 @@ static acpi_status wmi_method_enable(struct wmi_block *wblock, int enable)
         if (!block)
                 return AE_NOT_EXIST;
 
-        input.count = 1;
-        input.pointer = params;
-        params[0].type = ACPI_TYPE_INTEGER;
-        params[0].integer.value = enable;
 
         snprintf(method, 5, "WE%02X", block->notify_id);
-        status = acpi_evaluate_object(handle, method, &input, NULL);
+        status = acpi_execute_simple_method(handle, method, enable);
 
         if (status != AE_OK && status != AE_NOT_FOUND)
                 return status;
@@ -353,10 +347,10 @@ struct acpi_buffer *out)
 {
         struct guid_block *block = NULL;
         struct wmi_block *wblock = NULL;
-        acpi_handle handle, wc_handle;
+        acpi_handle handle;
         acpi_status status, wc_status = AE_ERROR;
-        struct acpi_object_list input, wc_input;
-        union acpi_object wc_params[1], wq_params[1];
+        struct acpi_object_list input;
+        union acpi_object wq_params[1];
         char method[5];
         char wc_method[5] = "WC";
 
@@ -386,11 +380,6 @@ struct acpi_buffer *out)
          * enable collection.
          */
         if (block->flags & ACPI_WMI_EXPENSIVE) {
-                wc_input.count = 1;
-                wc_input.pointer = wc_params;
-                wc_params[0].type = ACPI_TYPE_INTEGER;
-                wc_params[0].integer.value = 1;
-
                 strncat(wc_method, block->object_id, 2);
 
                 /*
@@ -398,10 +387,9 @@ struct acpi_buffer *out)
                  * expensive, but have no corresponding WCxx method. So we
                  * should not fail if this happens.
                  */
-                wc_status = acpi_get_handle(handle, wc_method, &wc_handle);
-                if (ACPI_SUCCESS(wc_status))
-                        wc_status = acpi_evaluate_object(handle, wc_method,
-                                &wc_input, NULL);
+                if (acpi_has_method(handle, wc_method))
+                        wc_status = acpi_execute_simple_method(handle,
+                                                                wc_method, 1);
         }
 
         strcpy(method, "WQ");
@@ -414,9 +402,7 @@ struct acpi_buffer *out)
          * the WQxx method failed - we should disable collection anyway.
          */
         if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) {
-                wc_params[0].integer.value = 0;
-                status = acpi_evaluate_object(handle,
-                wc_method, &wc_input, NULL);
+                status = acpi_execute_simple_method(handle, wc_method, 0);
         }
 
         return status;
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 34049b0b4c73..747826d99059 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -239,8 +239,6 @@ static char *__init pnpacpi_get_id(struct acpi_device *device)
 
 static int __init pnpacpi_add_device(struct acpi_device *device)
 {
-        acpi_handle temp = NULL;
-        acpi_status status;
         struct pnp_dev *dev;
         char *pnpid;
         struct acpi_hardware_id *id;
@@ -253,8 +251,7 @@ static int __init pnpacpi_add_device(struct acpi_device *device)
          * If a PnPacpi device is not present , the device
          * driver should not be loaded.
          */
-        status = acpi_get_handle(device->handle, "_CRS", &temp);
-        if (ACPI_FAILURE(status))
+        if (!acpi_has_method(device->handle, "_CRS"))
                 return 0;
 
         pnpid = pnpacpi_get_id(device);
@@ -271,16 +268,14 @@ static int __init pnpacpi_add_device(struct acpi_device *device)
         dev->data = device;
         /* .enabled means the device can decode the resources */
         dev->active = device->status.enabled;
-        status = acpi_get_handle(device->handle, "_SRS", &temp);
-        if (ACPI_SUCCESS(status))
+        if (acpi_has_method(device->handle, "_SRS"))
                 dev->capabilities |= PNP_CONFIGURABLE;
         dev->capabilities |= PNP_READ;
         if (device->flags.dynamic_status && (dev->capabilities & PNP_CONFIGURABLE))
                 dev->capabilities |= PNP_WRITE;
         if (device->flags.removable)
                 dev->capabilities |= PNP_REMOVABLE;
-        status = acpi_get_handle(device->handle, "_DIS", &temp);
-        if (ACPI_SUCCESS(status))
+        if (acpi_has_method(device->handle, "_DIS"))
                 dev->capabilities |= PNP_DISABLE;
 
         if (strlen(acpi_device_name(device)))
diff --git a/drivers/powercap/Kconfig b/drivers/powercap/Kconfig
new file mode 100644
index 000000000000..a7c81b53d88a
--- /dev/null
+++ b/drivers/powercap/Kconfig
@@ -0,0 +1,32 @@
+#
+# Generic power capping sysfs interface configuration
+#
+
+menuconfig POWERCAP
+        bool "Generic powercap sysfs driver"
+        help
+          The power capping sysfs interface allows kernel subsystems to expose power
+          capping settings to user space in a consistent way.  Usually, it consists
+          of multiple control types that determine which settings may be exposed and
+          power zones representing parts of the system that can be subject to power
+          capping.
+
+          If you want this code to be compiled in, say Y here.
+
+if POWERCAP
+# Client driver configurations go here.
+config INTEL_RAPL
+        tristate "Intel RAPL Support"
+        depends on X86
+        default n
+        ---help---
+          This enables support for the Intel Running Average Power Limit (RAPL)
+          technology which allows power limits to be enforced and monitored on
+          modern Intel processors (Sandy Bridge and later).
+
+          In RAPL, the platform level settings are divided into domains for
+          fine grained control. These domains include processor package, DRAM
+          controller, CPU core (Power Plance 0), graphics uncore (Power Plane
+          1), etc.
+
+endif
diff --git a/drivers/powercap/Makefile b/drivers/powercap/Makefile
new file mode 100644
index 000000000000..0a21ef31372b
--- /dev/null
+++ b/drivers/powercap/Makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_POWERCAP)  += powercap_sys.o
+obj-$(CONFIG_INTEL_RAPL) += intel_rapl.o
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
new file mode 100644
index 000000000000..2a786c504460
--- /dev/null
+++ b/drivers/powercap/intel_rapl.c
@@ -0,0 +1,1395 @@
+/*
+ * Intel Running Average Power Limit (RAPL) Driver
+ * Copyright (c) 2013, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.
+ *
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/log2.h>
+#include <linux/bitmap.h>
+#include <linux/delay.h>
+#include <linux/sysfs.h>
+#include <linux/cpu.h>
+#include <linux/powercap.h>
+
+#include <asm/processor.h>
+#include <asm/cpu_device_id.h>
+
+/* bitmasks for RAPL MSRs, used by primitive access functions */
+#define ENERGY_STATUS_MASK      0xffffffff
+
+#define POWER_LIMIT1_MASK       0x7FFF
+#define POWER_LIMIT1_ENABLE     BIT(15)
+#define POWER_LIMIT1_CLAMP      BIT(16)
+
+#define POWER_LIMIT2_MASK       (0x7FFFULL<<32)
+#define POWER_LIMIT2_ENABLE     BIT_ULL(47)
+#define POWER_LIMIT2_CLAMP      BIT_ULL(48)
+#define POWER_PACKAGE_LOCK      BIT_ULL(63)
+#define POWER_PP_LOCK           BIT(31)
+
+#define TIME_WINDOW1_MASK       (0x7FULL<<17)
+#define TIME_WINDOW2_MASK       (0x7FULL<<49)
+
+#define POWER_UNIT_OFFSET       0
+#define POWER_UNIT_MASK         0x0F
+
+#define ENERGY_UNIT_OFFSET      0x08
+#define ENERGY_UNIT_MASK        0x1F00
+
+#define TIME_UNIT_OFFSET        0x10
+#define TIME_UNIT_MASK          0xF0000
+
+#define POWER_INFO_MAX_MASK     (0x7fffULL<<32)
+#define POWER_INFO_MIN_MASK     (0x7fffULL<<16)
+#define POWER_INFO_MAX_TIME_WIN_MASK     (0x3fULL<<48)
+#define POWER_INFO_THERMAL_SPEC_MASK     0x7fff
+
+#define PERF_STATUS_THROTTLE_TIME_MASK 0xffffffff
+#define PP_POLICY_MASK         0x1F
+
+/* Non HW constants */
+#define RAPL_PRIMITIVE_DERIVED       BIT(1) /* not from raw data */
+#define RAPL_PRIMITIVE_DUMMY         BIT(2)
+
+/* scale RAPL units to avoid floating point math inside kernel */
+#define POWER_UNIT_SCALE     (1000000)
+#define ENERGY_UNIT_SCALE    (1000000)
+#define TIME_UNIT_SCALE      (1000000)
+
+#define TIME_WINDOW_MAX_MSEC 40000
+#define TIME_WINDOW_MIN_MSEC 250
+
+enum unit_type {
+        ARBITRARY_UNIT, /* no translation */
+        POWER_UNIT,
+        ENERGY_UNIT,
+        TIME_UNIT,
+};
+
+enum rapl_domain_type {
+        RAPL_DOMAIN_PACKAGE, /* entire package/socket */
+        RAPL_DOMAIN_PP0, /* core power plane */
+        RAPL_DOMAIN_PP1, /* graphics uncore */
+        RAPL_DOMAIN_DRAM,/* DRAM control_type */
+        RAPL_DOMAIN_MAX,
+};
+
+enum rapl_domain_msr_id {
+        RAPL_DOMAIN_MSR_LIMIT,
+        RAPL_DOMAIN_MSR_STATUS,
+        RAPL_DOMAIN_MSR_PERF,
+        RAPL_DOMAIN_MSR_POLICY,
+        RAPL_DOMAIN_MSR_INFO,
+        RAPL_DOMAIN_MSR_MAX,
+};
+
+/* per domain data, some are optional */
+enum rapl_primitives {
+        ENERGY_COUNTER,
+        POWER_LIMIT1,
+        POWER_LIMIT2,
+        FW_LOCK,
+
+        PL1_ENABLE,  /* power limit 1, aka long term */
+        PL1_CLAMP,   /* allow frequency to go below OS request */
+        PL2_ENABLE,  /* power limit 2, aka short term, instantaneous */
+        PL2_CLAMP,
+
+        TIME_WINDOW1, /* long term */
+        TIME_WINDOW2, /* short term */
+        THERMAL_SPEC_POWER,
+        MAX_POWER,
+
+        MIN_POWER,
+        MAX_TIME_WINDOW,
+        THROTTLED_TIME,
+        PRIORITY_LEVEL,
+
+        /* below are not raw primitive data */
+        AVERAGE_POWER,
+        NR_RAPL_PRIMITIVES,
+};
+
+#define NR_RAW_PRIMITIVES (NR_RAPL_PRIMITIVES - 2)
+
+/* Can be expanded to include events, etc.*/
+struct rapl_domain_data {
+        u64 primitives[NR_RAPL_PRIMITIVES];
+        unsigned long timestamp;
+};
+
+
+#define DOMAIN_STATE_INACTIVE           BIT(0)
+#define DOMAIN_STATE_POWER_LIMIT_SET    BIT(1)
+#define DOMAIN_STATE_BIOS_LOCKED        BIT(2)
+
+#define NR_POWER_LIMITS (2)
+struct rapl_power_limit {
+        struct powercap_zone_constraint *constraint;
+        int prim_id; /* primitive ID used to enable */
+        struct rapl_domain *domain;
+        const char *name;
+};
+
+static const char pl1_name[] = "long_term";
+static const char pl2_name[] = "short_term";
+
+struct rapl_domain {
+        const char *name;
+        enum rapl_domain_type id;
+        int msrs[RAPL_DOMAIN_MSR_MAX];
+        struct powercap_zone power_zone;
+        struct rapl_domain_data rdd;
+        struct rapl_power_limit rpl[NR_POWER_LIMITS];
+        u64 attr_map; /* track capabilities */
+        unsigned int state;
+        int package_id;
+};
+#define power_zone_to_rapl_domain(_zone) \
+        container_of(_zone, struct rapl_domain, power_zone)
+
+
+/* Each physical package contains multiple domains, these are the common
+ * data across RAPL domains within a package.
+ */
+struct rapl_package {
+        unsigned int id; /* physical package/socket id */
+        unsigned int nr_domains;
+        unsigned long domain_map; /* bit map of active domains */
+        unsigned int power_unit_divisor;
+        unsigned int energy_unit_divisor;
+        unsigned int time_unit_divisor;
+        struct rapl_domain *domains; /* array of domains, sized at runtime */
+        struct powercap_zone *power_zone; /* keep track of parent zone */
+        int nr_cpus; /* active cpus on the package, topology info is lost during
+                      * cpu hotplug. so we have to track ourselves.
+                      */
+        unsigned long power_limit_irq; /* keep track of package power limit
+                                        * notify interrupt enable status.
+                                        */
+        struct list_head plist;
+};
+#define PACKAGE_PLN_INT_SAVED   BIT(0)
+#define MAX_PRIM_NAME (32)
+
+/* per domain data. used to describe individual knobs such that access function
+ * can be consolidated into one instead of many inline functions.
+ */
+struct rapl_primitive_info {
+        const char *name;
+        u64 mask;
+        int shift;
+        enum rapl_domain_msr_id id;
+        enum unit_type unit;
+        u32 flag;
+};
+
+#define PRIMITIVE_INFO_INIT(p, m, s, i, u, f) { \
+                .name = #p,                     \
+                .mask = m,                      \
+                .shift = s,                     \
+                .id = i,                        \
+                .unit = u,                      \
+                .flag = f                       \
+        }
+
+static void rapl_init_domains(struct rapl_package *rp);
+static int rapl_read_data_raw(struct rapl_domain *rd,
+                        enum rapl_primitives prim,
+                        bool xlate, u64 *data);
+static int rapl_write_data_raw(struct rapl_domain *rd,
+                        enum rapl_primitives prim,
+                        unsigned long long value);
+static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+                        int to_raw);
+static void package_power_limit_irq_save(int package_id);
+
+static LIST_HEAD(rapl_packages); /* guarded by CPU hotplug lock */
+
+static const char * const rapl_domain_names[] = {
+        "package",
+        "core",
+        "uncore",
+        "dram",
+};
+
+static struct powercap_control_type *control_type; /* PowerCap Controller */
+
+/* caller to ensure CPU hotplug lock is held */
+static struct rapl_package *find_package_by_id(int id)
+{
+        struct rapl_package *rp;
+
+        list_for_each_entry(rp, &rapl_packages, plist) {
+                if (rp->id == id)
+                        return rp;
+        }
+
+        return NULL;
+}
+
+/* caller to ensure CPU hotplug lock is held */
+static int find_active_cpu_on_package(int package_id)
+{
+        int i;
+
+        for_each_online_cpu(i) {
+                if (topology_physical_package_id(i) == package_id)
+                        return i;
+        }
+        /* all CPUs on this package are offline */
+
+        return -ENODEV;
+}
+
+/* caller must hold cpu hotplug lock */
+static void rapl_cleanup_data(void)
+{
+        struct rapl_package *p, *tmp;
+
+        list_for_each_entry_safe(p, tmp, &rapl_packages, plist) {
+                kfree(p->domains);
+                list_del(&p->plist);
+                kfree(p);
+        }
+}
+
+static int get_energy_counter(struct powercap_zone *power_zone, u64 *energy_raw)
+{
+        struct rapl_domain *rd;
+        u64 energy_now;
+
+        /* prevent CPU hotplug, make sure the RAPL domain does not go
+         * away while reading the counter.
+         */
+        get_online_cpus();
+        rd = power_zone_to_rapl_domain(power_zone);
+
+        if (!rapl_read_data_raw(rd, ENERGY_COUNTER, true, &energy_now)) {
+                *energy_raw = energy_now;
+                put_online_cpus();
+
+                return 0;
+        }
+        put_online_cpus();
+
+        return -EIO;
+}
+
+static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
+{
+        *energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+        return 0;
+}
+
+static int release_zone(struct powercap_zone *power_zone)
+{
+        struct rapl_domain *rd = power_zone_to_rapl_domain(power_zone);
+        struct rapl_package *rp;
+
+        /* package zone is the last zone of a package, we can free
+         * memory here since all children has been unregistered.
+         */
+        if (rd->id == RAPL_DOMAIN_PACKAGE) {
+                rp = find_package_by_id(rd->package_id);
+                if (!rp) {
+                        dev_warn(&power_zone->dev, "no package id %s\n",
+                                rd->name);
+                        return -ENODEV;
+                }
+                kfree(rd);
+                rp->domains = NULL;
+        }
+
+        return 0;
+
+}
+
+static int find_nr_power_limit(struct rapl_domain *rd)
+{
+        int i;
+
+        for (i = 0; i < NR_POWER_LIMITS; i++) {
+                if (rd->rpl[i].name == NULL)
+                        break;
+        }
+
+        return i;
+}
+
+static int set_domain_enable(struct powercap_zone *power_zone, bool mode)
+{
+        struct rapl_domain *rd = power_zone_to_rapl_domain(power_zone);
+        int nr_powerlimit;
+
+        if (rd->state & DOMAIN_STATE_BIOS_LOCKED)
+                return -EACCES;
+        get_online_cpus();
+        nr_powerlimit = find_nr_power_limit(rd);
+        /* here we activate/deactivate the hardware for power limiting */
+        rapl_write_data_raw(rd, PL1_ENABLE, mode);
+        /* always enable clamp such that p-state can go below OS requested
+         * range. power capping priority over guranteed frequency.
+         */
+        rapl_write_data_raw(rd, PL1_CLAMP, mode);
+        /* some domains have pl2 */
+        if (nr_powerlimit > 1) {
+                rapl_write_data_raw(rd, PL2_ENABLE, mode);
+                rapl_write_data_raw(rd, PL2_CLAMP, mode);
+        }
+        put_online_cpus();
+
+        return 0;
+}
+
+static int get_domain_enable(struct powercap_zone *power_zone, bool *mode)
+{
+        struct rapl_domain *rd = power_zone_to_rapl_domain(power_zone);
+        u64 val;
+
+        if (rd->state & DOMAIN_STATE_BIOS_LOCKED) {
+                *mode = false;
+                return 0;
+        }
+        get_online_cpus();
+        if (rapl_read_data_raw(rd, PL1_ENABLE, true, &val)) {
+                put_online_cpus();
+                return -EIO;
+        }
+        *mode = val;
+        put_online_cpus();
+
+        return 0;
+}
+
+/* per RAPL domain ops, in the order of rapl_domain_type */
+static struct powercap_zone_ops zone_ops[] = {
+        /* RAPL_DOMAIN_PACKAGE */
+        {
+                .get_energy_uj = get_energy_counter,
+                .get_max_energy_range_uj = get_max_energy_counter,
+                .release = release_zone,
+                .set_enable = set_domain_enable,
+                .get_enable = get_domain_enable,
+        },
+        /* RAPL_DOMAIN_PP0 */
+        {
+                .get_energy_uj = get_energy_counter,
+                .get_max_energy_range_uj = get_max_energy_counter,
+                .release = release_zone,
+                .set_enable = set_domain_enable,
+                .get_enable = get_domain_enable,
+        },
+        /* RAPL_DOMAIN_PP1 */
+        {
+                .get_energy_uj = get_energy_counter,
+                .get_max_energy_range_uj = get_max_energy_counter,
+                .release = release_zone,
+                .set_enable = set_domain_enable,
+                .get_enable = get_domain_enable,
+        },
+        /* RAPL_DOMAIN_DRAM */
+        {
+                .get_energy_uj = get_energy_counter,
+                .get_max_energy_range_uj = get_max_energy_counter,
+                .release = release_zone,
+                .set_enable = set_domain_enable,
+                .get_enable = get_domain_enable,
+        },
+};
+
+static int set_power_limit(struct powercap_zone *power_zone, int id,
+                        u64 power_limit)
+{
+        struct rapl_domain *rd;
+        struct rapl_package *rp;
+        int ret = 0;
+
+        get_online_cpus();
+        rd = power_zone_to_rapl_domain(power_zone);
+        rp = find_package_by_id(rd->package_id);
+        if (!rp) {
+                ret = -ENODEV;
+                goto set_exit;
+        }
+
+        if (rd->state & DOMAIN_STATE_BIOS_LOCKED) {
+                dev_warn(&power_zone->dev, "%s locked by BIOS, monitoring only\n",
+                        rd->name);
+                ret = -EACCES;
+                goto set_exit;
+        }
+
+        switch (rd->rpl[id].prim_id) {
+        case PL1_ENABLE:
+                rapl_write_data_raw(rd, POWER_LIMIT1, power_limit);
+                break;
+        case PL2_ENABLE:
+                rapl_write_data_raw(rd, POWER_LIMIT2, power_limit);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+        if (!ret)
+                package_power_limit_irq_save(rd->package_id);
+set_exit:
+        put_online_cpus();
+        return ret;
+}
+
+static int get_current_power_limit(struct powercap_zone *power_zone, int id,
+                                        u64 *data)
+{
+        struct rapl_domain *rd;
+        u64 val;
+        int prim;
+        int ret = 0;
+
+        get_online_cpus();
+        rd = power_zone_to_rapl_domain(power_zone);
+        switch (rd->rpl[id].prim_id) {
+        case PL1_ENABLE:
+                prim = POWER_LIMIT1;
+                break;
+        case PL2_ENABLE:
+                prim = POWER_LIMIT2;
+                break;
+        default:
+                put_online_cpus();
+                return -EINVAL;
+        }
+        if (rapl_read_data_raw(rd, prim, true, &val))
+                ret = -EIO;
+        else
+                *data = val;
+
+        put_online_cpus();
+
+        return ret;
+}
+
+static int set_time_window(struct powercap_zone *power_zone, int id,
+                                                                u64 window)
+{
+        struct rapl_domain *rd;
+        int ret = 0;
+
+        get_online_cpus();
+        rd = power_zone_to_rapl_domain(power_zone);
+        switch (rd->rpl[id].prim_id) {
+        case PL1_ENABLE:
+                rapl_write_data_raw(rd, TIME_WINDOW1, window);
+                break;
+        case PL2_ENABLE:
+                rapl_write_data_raw(rd, TIME_WINDOW2, window);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+        put_online_cpus();
+        return ret;
+}
+
+static int get_time_window(struct powercap_zone *power_zone, int id, u64 *data)
+{
+        struct rapl_domain *rd;
+        u64 val;
+        int ret = 0;
+
+        get_online_cpus();
+        rd = power_zone_to_rapl_domain(power_zone);
+        switch (rd->rpl[id].prim_id) {
+        case PL1_ENABLE:
+                ret = rapl_read_data_raw(rd, TIME_WINDOW1, true, &val);
+                break;
+        case PL2_ENABLE:
+                ret = rapl_read_data_raw(rd, TIME_WINDOW2, true, &val);
+                break;
+        default:
+                put_online_cpus();
+                return -EINVAL;
+        }
+        if (!ret)
+                *data = val;
+        put_online_cpus();
+
+        return ret;
+}
+
+static const char *get_constraint_name(struct powercap_zone *power_zone, int id)
+{
+        struct rapl_power_limit *rpl;
+        struct rapl_domain *rd;
+
+        rd = power_zone_to_rapl_domain(power_zone);
+        rpl = (struct rapl_power_limit *) &rd->rpl[id];
+
+        return rpl->name;
+}
+
+
+static int get_max_power(struct powercap_zone *power_zone, int id,
+                                        u64 *data)
+{
+        struct rapl_domain *rd;
+        u64 val;
+        int prim;
+        int ret = 0;
+
+        get_online_cpus();
+        rd = power_zone_to_rapl_domain(power_zone);
+        switch (rd->rpl[id].prim_id) {
+        case PL1_ENABLE:
+                prim = THERMAL_SPEC_POWER;
+                break;
+        case PL2_ENABLE:
+                prim = MAX_POWER;
+                break;
+        default:
+                put_online_cpus();
+                return -EINVAL;
+        }
+        if (rapl_read_data_raw(rd, prim, true, &val))
+                ret = -EIO;
+        else
+                *data = val;
+
+        put_online_cpus();
+
+        return ret;
+}
+
+static struct powercap_zone_constraint_ops constraint_ops = {
+        .set_power_limit_uw = set_power_limit,
+        .get_power_limit_uw = get_current_power_limit,
+        .set_time_window_us = set_time_window,
+        .get_time_window_us = get_time_window,
+        .get_max_power_uw = get_max_power,
+        .get_name = get_constraint_name,
+};
+
+/* called after domain detection and package level data are set */
+static void rapl_init_domains(struct rapl_package *rp)
+{
+        int i;
+        struct rapl_domain *rd = rp->domains;
+
+        for (i = 0; i < RAPL_DOMAIN_MAX; i++) {
+                unsigned int mask = rp->domain_map & (1 << i);
+                switch (mask) {
+                case BIT(RAPL_DOMAIN_PACKAGE):
+                        rd->name = rapl_domain_names[RAPL_DOMAIN_PACKAGE];
+                        rd->id = RAPL_DOMAIN_PACKAGE;
+                        rd->msrs[0] = MSR_PKG_POWER_LIMIT;
+                        rd->msrs[1] = MSR_PKG_ENERGY_STATUS;
+                        rd->msrs[2] = MSR_PKG_PERF_STATUS;
+                        rd->msrs[3] = 0;
+                        rd->msrs[4] = MSR_PKG_POWER_INFO;
+                        rd->rpl[0].prim_id = PL1_ENABLE;
+                        rd->rpl[0].name = pl1_name;
+                        rd->rpl[1].prim_id = PL2_ENABLE;
+                        rd->rpl[1].name = pl2_name;
+                        break;
+                case BIT(RAPL_DOMAIN_PP0):
+                        rd->name = rapl_domain_names[RAPL_DOMAIN_PP0];
+                        rd->id = RAPL_DOMAIN_PP0;
+                        rd->msrs[0] = MSR_PP0_POWER_LIMIT;
+                        rd->msrs[1] = MSR_PP0_ENERGY_STATUS;
+                        rd->msrs[2] = 0;
+                        rd->msrs[3] = MSR_PP0_POLICY;
+                        rd->msrs[4] = 0;
+                        rd->rpl[0].prim_id = PL1_ENABLE;
+                        rd->rpl[0].name = pl1_name;
+                        break;
+                case BIT(RAPL_DOMAIN_PP1):
+                        rd->name = rapl_domain_names[RAPL_DOMAIN_PP1];
+                        rd->id = RAPL_DOMAIN_PP1;
+                        rd->msrs[0] = MSR_PP1_POWER_LIMIT;
+                        rd->msrs[1] = MSR_PP1_ENERGY_STATUS;
+                        rd->msrs[2] = 0;
+                        rd->msrs[3] = MSR_PP1_POLICY;
+                        rd->msrs[4] = 0;
+                        rd->rpl[0].prim_id = PL1_ENABLE;
+                        rd->rpl[0].name = pl1_name;
+                        break;
+                case BIT(RAPL_DOMAIN_DRAM):
+                        rd->name = rapl_domain_names[RAPL_DOMAIN_DRAM];
+                        rd->id = RAPL_DOMAIN_DRAM;
+                        rd->msrs[0] = MSR_DRAM_POWER_LIMIT;
+                        rd->msrs[1] = MSR_DRAM_ENERGY_STATUS;
+                        rd->msrs[2] = MSR_DRAM_PERF_STATUS;
+                        rd->msrs[3] = 0;
+                        rd->msrs[4] = MSR_DRAM_POWER_INFO;
+                        rd->rpl[0].prim_id = PL1_ENABLE;
+                        rd->rpl[0].name = pl1_name;
+                        break;
+                }
+                if (mask) {
+                        rd->package_id = rp->id;
+                        rd++;
+                }
+        }
+}
+
+static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+                        int to_raw)
+{
+        u64 divisor = 1;
+        int scale = 1; /* scale to user friendly data without floating point */
+        u64 f, y; /* fraction and exp. used for time unit */
+        struct rapl_package *rp;
+
+        rp = find_package_by_id(package);
+        if (!rp)
+                return value;
+
+        switch (type) {
+        case POWER_UNIT:
+                divisor = rp->power_unit_divisor;
+                scale = POWER_UNIT_SCALE;
+                break;
+        case ENERGY_UNIT:
+                scale = ENERGY_UNIT_SCALE;
+                divisor = rp->energy_unit_divisor;
+                break;
+        case TIME_UNIT:
+                divisor = rp->time_unit_divisor;
+                scale = TIME_UNIT_SCALE;
+                /* special processing based on 2^Y*(1+F)/4 = val/divisor, refer
+                 * to Intel Software Developer's manual Vol. 3a, CH 14.7.4.
+                 */
+                if (!to_raw) {
+                        f = (value & 0x60) >> 5;
+                        y = value & 0x1f;
+                        value = (1 << y) * (4 + f) * scale / 4;
+                        return div64_u64(value, divisor);
+                } else {
+                        do_div(value, scale);
+                        value *= divisor;
+                        y = ilog2(value);
+                        f = div64_u64(4 * (value - (1 << y)), 1 << y);
+                        value = (y & 0x1f) | ((f & 0x3) << 5);
+                        return value;
+                }
+                break;
+        case ARBITRARY_UNIT:
+        default:
+                return value;
+        };
+
+        if (to_raw)
+                return div64_u64(value * divisor, scale);
+        else
+                return div64_u64(value * scale, divisor);
+}
+
+/* in the order of enum rapl_primitives */
+static struct rapl_primitive_info rpi[] = {
+        /* name, mask, shift, msr index, unit divisor */
+        PRIMITIVE_INFO_INIT(ENERGY_COUNTER, ENERGY_STATUS_MASK, 0,
+                                RAPL_DOMAIN_MSR_STATUS, ENERGY_UNIT, 0),
+        PRIMITIVE_INFO_INIT(POWER_LIMIT1, POWER_LIMIT1_MASK, 0,
+                                RAPL_DOMAIN_MSR_LIMIT, POWER_UNIT, 0),
+        PRIMITIVE_INFO_INIT(POWER_LIMIT2, POWER_LIMIT2_MASK, 32,
+                                RAPL_DOMAIN_MSR_LIMIT, POWER_UNIT, 0),
+        PRIMITIVE_INFO_INIT(FW_LOCK, POWER_PP_LOCK, 31,
+                                RAPL_DOMAIN_MSR_LIMIT, ARBITRARY_UNIT, 0),
+        PRIMITIVE_INFO_INIT(PL1_ENABLE, POWER_LIMIT1_ENABLE, 15,
+                                RAPL_DOMAIN_MSR_LIMIT, ARBITRARY_UNIT, 0),
+        PRIMITIVE_INFO_INIT(PL1_CLAMP, POWER_LIMIT1_CLAMP, 16,
+                                RAPL_DOMAIN_MSR_LIMIT, ARBITRARY_UNIT, 0),
+        PRIMITIVE_INFO_INIT(PL2_ENABLE, POWER_LIMIT2_ENABLE, 47,
+                                RAPL_DOMAIN_MSR_LIMIT, ARBITRARY_UNIT, 0),
+        PRIMITIVE_INFO_INIT(PL2_CLAMP, POWER_LIMIT2_CLAMP, 48,
+                                RAPL_DOMAIN_MSR_LIMIT, ARBITRARY_UNIT, 0),
+        PRIMITIVE_INFO_INIT(TIME_WINDOW1, TIME_WINDOW1_MASK, 17,
+                                RAPL_DOMAIN_MSR_LIMIT, TIME_UNIT, 0),
+        PRIMITIVE_INFO_INIT(TIME_WINDOW2, TIME_WINDOW2_MASK, 49,
+                                RAPL_DOMAIN_MSR_LIMIT, TIME_UNIT, 0),
+        PRIMITIVE_INFO_INIT(THERMAL_SPEC_POWER, POWER_INFO_THERMAL_SPEC_MASK,
+                                0, RAPL_DOMAIN_MSR_INFO, POWER_UNIT, 0),
+        PRIMITIVE_INFO_INIT(MAX_POWER, POWER_INFO_MAX_MASK, 32,
+                                RAPL_DOMAIN_MSR_INFO, POWER_UNIT, 0),
+        PRIMITIVE_INFO_INIT(MIN_POWER, POWER_INFO_MIN_MASK, 16,
+                                RAPL_DOMAIN_MSR_INFO, POWER_UNIT, 0),
+        PRIMITIVE_INFO_INIT(MAX_TIME_WINDOW, POWER_INFO_MAX_TIME_WIN_MASK, 48,
+                                RAPL_DOMAIN_MSR_INFO, TIME_UNIT, 0),
+        PRIMITIVE_INFO_INIT(THROTTLED_TIME, PERF_STATUS_THROTTLE_TIME_MASK, 0,
+                                RAPL_DOMAIN_MSR_PERF, TIME_UNIT, 0),
+        PRIMITIVE_INFO_INIT(PRIORITY_LEVEL, PP_POLICY_MASK, 0,
+                                RAPL_DOMAIN_MSR_POLICY, ARBITRARY_UNIT, 0),
+        /* non-hardware */
+        PRIMITIVE_INFO_INIT(AVERAGE_POWER, 0, 0, 0, POWER_UNIT,
+                                RAPL_PRIMITIVE_DERIVED),
+        {NULL, 0, 0, 0},
+};
+
+/* Read primitive data based on its related struct rapl_primitive_info.
+ * if xlate flag is set, return translated data based on data units, i.e.
+ * time, energy, and power.
+ * RAPL MSRs are non-architectual and are laid out not consistently across
+ * domains. Here we use primitive info to allow writing consolidated access
+ * functions.
+ * For a given primitive, it is processed by MSR mask and shift. Unit conversion
+ * is pre-assigned based on RAPL unit MSRs read at init time.
+ * 63-------------------------- 31--------------------------- 0
+ * |                           xxxxx (mask)                   |
+ * |                                |<- shift ----------------|
+ * 63-------------------------- 31--------------------------- 0
+ */
+static int rapl_read_data_raw(struct rapl_domain *rd,
+                        enum rapl_primitives prim,
+                        bool xlate, u64 *data)
+{
+        u64 value, final;
+        u32 msr;
+        struct rapl_primitive_info *rp = &rpi[prim];
+        int cpu;
+
+        if (!rp->name || rp->flag & RAPL_PRIMITIVE_DUMMY)
+                return -EINVAL;
+
+        msr = rd->msrs[rp->id];
+        if (!msr)
+                return -EINVAL;
+        /* use physical package id to look up active cpus */
+        cpu = find_active_cpu_on_package(rd->package_id);
+        if (cpu < 0)
+                return cpu;
+
+        /* special-case package domain, which uses a different bit*/
+        if (prim == FW_LOCK && rd->id == RAPL_DOMAIN_PACKAGE) {
+                rp->mask = POWER_PACKAGE_LOCK;
+                rp->shift = 63;
+        }
+        /* non-hardware data are collected by the polling thread */
+        if (rp->flag & RAPL_PRIMITIVE_DERIVED) {
+                *data = rd->rdd.primitives[prim];
+                return 0;
+        }
+
+        if (rdmsrl_safe_on_cpu(cpu, msr, &value)) {
+                pr_debug("failed to read msr 0x%x on cpu %d\n", msr, cpu);
+                return -EIO;
+        }
+
+        final = value & rp->mask;
+        final = final >> rp->shift;
+        if (xlate)
+                *data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
+        else
+                *data = final;
+
+        return 0;
+}
+
+/* Similar use of primitive info in the read counterpart */
+static int rapl_write_data_raw(struct rapl_domain *rd,
+                        enum rapl_primitives prim,
+                        unsigned long long value)
+{
+        u64 msr_val;
+        u32 msr;
+        struct rapl_primitive_info *rp = &rpi[prim];
+        int cpu;
+
+        cpu = find_active_cpu_on_package(rd->package_id);
+        if (cpu < 0)
+                return cpu;
+        msr = rd->msrs[rp->id];
+        if (rdmsrl_safe_on_cpu(cpu, msr, &msr_val)) {
+                dev_dbg(&rd->power_zone.dev,
+                        "failed to read msr 0x%x on cpu %d\n", msr, cpu);
+                return -EIO;
+        }
+        value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
+        msr_val &= ~rp->mask;
+        msr_val |= value << rp->shift;
+        if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
+                dev_dbg(&rd->power_zone.dev,
+                        "failed to write msr 0x%x on cpu %d\n", msr, cpu);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static int rapl_check_unit(struct rapl_package *rp, int cpu)
+{
+        u64 msr_val;
+        u32 value;
+
+        if (rdmsrl_safe_on_cpu(cpu, MSR_RAPL_POWER_UNIT, &msr_val)) {
+                pr_err("Failed to read power unit MSR 0x%x on CPU %d, exit.\n",
+                        MSR_RAPL_POWER_UNIT, cpu);
+                return -ENODEV;
+        }
+
+        /* Raw RAPL data stored in MSRs are in certain scales. We need to
+         * convert them into standard units based on the divisors reported in
+         * the RAPL unit MSRs.
+         * i.e.
+         * energy unit: 1/enery_unit_divisor Joules
+         * power unit: 1/power_unit_divisor Watts
+         * time unit: 1/time_unit_divisor Seconds
+         */
+        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+        rp->energy_unit_divisor = 1 << value;
+
+
+        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+        rp->power_unit_divisor = 1 << value;
+
+        value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+        rp->time_unit_divisor = 1 << value;
+
+        pr_debug("Physical package %d units: energy=%d, time=%d, power=%d\n",
+                rp->id,
+                rp->energy_unit_divisor,
+                rp->time_unit_divisor,
+                rp->power_unit_divisor);
+
+        return 0;
+}
+
+/* REVISIT:
+ * When package power limit is set artificially low by RAPL, LVT
+ * thermal interrupt for package power limit should be ignored
+ * since we are not really exceeding the real limit. The intention
+ * is to avoid excessive interrupts while we are trying to save power.
+ * A useful feature might be routing the package_power_limit interrupt
+ * to userspace via eventfd. once we have a usecase, this is simple
+ * to do by adding an atomic notifier.
+ */
+
+static void package_power_limit_irq_save(int package_id)
+{
+        u32 l, h = 0;
+        int cpu;
+        struct rapl_package *rp;
+
+        rp = find_package_by_id(package_id);
+        if (!rp)
+                return;
+
+        if (!boot_cpu_has(X86_FEATURE_PTS) || !boot_cpu_has(X86_FEATURE_PLN))
+                return;
+
+        cpu = find_active_cpu_on_package(package_id);
+        if (cpu < 0)
+                return;
+        /* save the state of PLN irq mask bit before disabling it */
+        rdmsr_safe_on_cpu(cpu, MSR_IA32_PACKAGE_THERM_INTERRUPT, &l, &h);
+        if (!(rp->power_limit_irq & PACKAGE_PLN_INT_SAVED)) {
+                rp->power_limit_irq = l & PACKAGE_THERM_INT_PLN_ENABLE;
+                rp->power_limit_irq |= PACKAGE_PLN_INT_SAVED;
+        }
+        l &= ~PACKAGE_THERM_INT_PLN_ENABLE;
+        wrmsr_on_cpu(cpu, MSR_IA32_PACKAGE_THERM_INTERRUPT, l, h);
+}
+
+/* restore per package power limit interrupt enable state */
+static void package_power_limit_irq_restore(int package_id)
+{
+        u32 l, h;
+        int cpu;
+        struct rapl_package *rp;
+
+        rp = find_package_by_id(package_id);
+        if (!rp)
+                return;
+
+        if (!boot_cpu_has(X86_FEATURE_PTS) || !boot_cpu_has(X86_FEATURE_PLN))
+                return;
+
+        cpu = find_active_cpu_on_package(package_id);
+        if (cpu < 0)
+                return;
+
+        /* irq enable state not saved, nothing to restore */
+        if (!(rp->power_limit_irq & PACKAGE_PLN_INT_SAVED))
+                return;
+        rdmsr_safe_on_cpu(cpu, MSR_IA32_PACKAGE_THERM_INTERRUPT, &l, &h);
+
+        if (rp->power_limit_irq & PACKAGE_THERM_INT_PLN_ENABLE)
+                l |= PACKAGE_THERM_INT_PLN_ENABLE;
+        else
+                l &= ~PACKAGE_THERM_INT_PLN_ENABLE;
+
+        wrmsr_on_cpu(cpu, MSR_IA32_PACKAGE_THERM_INTERRUPT, l, h);
+}
+
+static const struct x86_cpu_id rapl_ids[] = {
+        { X86_VENDOR_INTEL, 6, 0x2a},/* SNB */
+        { X86_VENDOR_INTEL, 6, 0x2d},/* SNB EP */
+        { X86_VENDOR_INTEL, 6, 0x3a},/* IVB */
+        { X86_VENDOR_INTEL, 6, 0x45},/* HSW */
+        /* TODO: Add more CPU IDs after testing */
+        {}
+};
+MODULE_DEVICE_TABLE(x86cpu, rapl_ids);
+
+/* read once for all raw primitive data for all packages, domains */
+static void rapl_update_domain_data(void)
+{
+        int dmn, prim;
+        u64 val;
+        struct rapl_package *rp;
+
+        list_for_each_entry(rp, &rapl_packages, plist) {
+                for (dmn = 0; dmn < rp->nr_domains; dmn++) {
+                        pr_debug("update package %d domain %s data\n", rp->id,
+                                rp->domains[dmn].name);
+                        /* exclude non-raw primitives */
+                        for (prim = 0; prim < NR_RAW_PRIMITIVES; prim++)
+                                if (!rapl_read_data_raw(&rp->domains[dmn], prim,
+                                                                rpi[prim].unit,
+                                                                &val))
+                                        rp->domains[dmn].rdd.primitives[prim] =
+                                                                        val;
+                }
+        }
+
+}
+
+static int rapl_unregister_powercap(void)
+{
+        struct rapl_package *rp;
+        struct rapl_domain *rd, *rd_package = NULL;
+
+        /* unregister all active rapl packages from the powercap layer,
+         * hotplug lock held
+         */
+        list_for_each_entry(rp, &rapl_packages, plist) {
+                package_power_limit_irq_restore(rp->id);
+
+                for (rd = rp->domains; rd < rp->domains + rp->nr_domains;
+                     rd++) {
+                        pr_debug("remove package, undo power limit on %d: %s\n",
+                                rp->id, rd->name);
+                        rapl_write_data_raw(rd, PL1_ENABLE, 0);
+                        rapl_write_data_raw(rd, PL2_ENABLE, 0);
+                        rapl_write_data_raw(rd, PL1_CLAMP, 0);
+                        rapl_write_data_raw(rd, PL2_CLAMP, 0);
+                        if (rd->id == RAPL_DOMAIN_PACKAGE) {
+                                rd_package = rd;
+                                continue;
+                        }
+                        powercap_unregister_zone(control_type, &rd->power_zone);
+                }
+                /* do the package zone last */
+                if (rd_package)
+                        powercap_unregister_zone(control_type,
+                                                &rd_package->power_zone);
+        }
+        powercap_unregister_control_type(control_type);
+
+        return 0;
+}
+
+static int rapl_package_register_powercap(struct rapl_package *rp)
+{
+        struct rapl_domain *rd;
+        int ret = 0;
+        char dev_name[17]; /* max domain name = 7 + 1 + 8 for int + 1 for null*/
+        struct powercap_zone *power_zone = NULL;
+        int nr_pl;
+
+        /* first we register package domain as the parent zone*/
+        for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
+                if (rd->id == RAPL_DOMAIN_PACKAGE) {
+                        nr_pl = find_nr_power_limit(rd);
+                        pr_debug("register socket %d package domain %s\n",
+                                rp->id, rd->name);
+                        memset(dev_name, 0, sizeof(dev_name));
+                        snprintf(dev_name, sizeof(dev_name), "%s-%d",
+                                rd->name, rp->id);
+                        power_zone = powercap_register_zone(&rd->power_zone,
+                                                        control_type,
+                                                        dev_name, NULL,
+                                                        &zone_ops[rd->id],
+                                                        nr_pl,
+                                                        &constraint_ops);
+                        if (IS_ERR(power_zone)) {
+                                pr_debug("failed to register package, %d\n",
+                                        rp->id);
+                                ret = PTR_ERR(power_zone);
+                                goto exit_package;
+                        }
+                        /* track parent zone in per package/socket data */
+                        rp->power_zone = power_zone;
+                        /* done, only one package domain per socket */
+                        break;
+                }
+        }
+        if (!power_zone) {
+                pr_err("no package domain found, unknown topology!\n");
+                ret = -ENODEV;
+                goto exit_package;
+        }
+        /* now register domains as children of the socket/package*/
+        for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
+                if (rd->id == RAPL_DOMAIN_PACKAGE)
+                        continue;
+                /* number of power limits per domain varies */
+                nr_pl = find_nr_power_limit(rd);
+                power_zone = powercap_register_zone(&rd->power_zone,
+                                                control_type, rd->name,
+                                                rp->power_zone,
+                                                &zone_ops[rd->id], nr_pl,
+                                                &constraint_ops);
+
+                if (IS_ERR(power_zone)) {
+                        pr_debug("failed to register power_zone, %d:%s:%s\n",
+                                rp->id, rd->name, dev_name);
+                        ret = PTR_ERR(power_zone);
+                        goto err_cleanup;
+                }
+        }
+
+exit_package:
+        return ret;
+err_cleanup:
+        /* clean up previously initialized domains within the package if we
+         * failed after the first domain setup.
+         */
+        while (--rd >= rp->domains) {
+                pr_debug("unregister package %d domain %s\n", rp->id, rd->name);
+                powercap_unregister_zone(control_type, &rd->power_zone);
+        }
+
+        return ret;
+}
+
+static int rapl_register_powercap(void)
+{
+        struct rapl_domain *rd;
+        struct rapl_package *rp;
+        int ret = 0;
+
+        control_type = powercap_register_control_type(NULL, "intel-rapl", NULL);
+        if (IS_ERR(control_type)) {
+                pr_debug("failed to register powercap control_type.\n");
+                return PTR_ERR(control_type);
+        }
+        /* read the initial data */
+        rapl_update_domain_data();
+        list_for_each_entry(rp, &rapl_packages, plist)
+                if (rapl_package_register_powercap(rp))
+                        goto err_cleanup_package;
+        return ret;
+
+err_cleanup_package:
+        /* clean up previously initialized packages */
+        list_for_each_entry_continue_reverse(rp, &rapl_packages, plist) {
+                for (rd = rp->domains; rd < rp->domains + rp->nr_domains;
+                     rd++) {
+                        pr_debug("unregister zone/package %d, %s domain\n",
+                                rp->id, rd->name);
+                        powercap_unregister_zone(control_type, &rd->power_zone);
+                }
+        }
+
+        return ret;
+}
+
+static int rapl_check_domain(int cpu, int domain)
+{
+        unsigned msr;
+        u64 val1, val2 = 0;
+        int retry = 0;
+
+        switch (domain) {
+        case RAPL_DOMAIN_PACKAGE:
+                msr = MSR_PKG_ENERGY_STATUS;
+                break;
+        case RAPL_DOMAIN_PP0:
+                msr = MSR_PP0_ENERGY_STATUS;
+                break;
+        case RAPL_DOMAIN_PP1:
+                msr = MSR_PP1_ENERGY_STATUS;
+                break;
+        case RAPL_DOMAIN_DRAM:
+                msr = MSR_DRAM_ENERGY_STATUS;
+                break;
+        default:
+                pr_err("invalid domain id %d\n", domain);
+                return -EINVAL;
+        }
+        if (rdmsrl_safe_on_cpu(cpu, msr, &val1))
+                return -ENODEV;
+
+        /* energy counters roll slowly on some domains */
+        while (++retry < 10) {
+                usleep_range(10000, 15000);
+                rdmsrl_safe_on_cpu(cpu, msr, &val2);
+                if ((val1 & ENERGY_STATUS_MASK) != (val2 & ENERGY_STATUS_MASK))
+                        return 0;
+        }
+        /* if energy counter does not change, report as bad domain */
+        pr_info("domain %s energy ctr %llu:%llu not working, skip\n",
+                rapl_domain_names[domain], val1, val2);
+
+        return -ENODEV;
+}
+
+/* Detect active and valid domains for the given CPU, caller must
+ * ensure the CPU belongs to the targeted package and CPU hotlug is disabled.
+ */
+static int rapl_detect_domains(struct rapl_package *rp, int cpu)
+{
+        int i;
+        int ret = 0;
+        struct rapl_domain *rd;
+        u64 locked;
+
+        for (i = 0; i < RAPL_DOMAIN_MAX; i++) {
+                /* use physical package id to read counters */
+                if (!rapl_check_domain(cpu, i))
+                        rp->domain_map |= 1 << i;
+        }
+        rp->nr_domains = bitmap_weight(&rp->domain_map, RAPL_DOMAIN_MAX);
+        if (!rp->nr_domains) {
+                pr_err("no valid rapl domains found in package %d\n", rp->id);
+                ret = -ENODEV;
+                goto done;
+        }
+        pr_debug("found %d domains on package %d\n", rp->nr_domains, rp->id);
+
+        rp->domains = kcalloc(rp->nr_domains + 1, sizeof(struct rapl_domain),
+                        GFP_KERNEL);
+        if (!rp->domains) {
+                ret = -ENOMEM;
+                goto done;
+        }
+        rapl_init_domains(rp);
+
+        for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
+                /* check if the domain is locked by BIOS */
+                if (rapl_read_data_raw(rd, FW_LOCK, false, &locked)) {
+                        pr_info("RAPL package %d domain %s locked by BIOS\n",
+                                rp->id, rd->name);
+                                rd->state |= DOMAIN_STATE_BIOS_LOCKED;
+                }
+        }
+
+
+done:
+        return ret;
+}
+
+static bool is_package_new(int package)
+{
+        struct rapl_package *rp;
+
+        /* caller prevents cpu hotplug, there will be no new packages added
+         * or deleted while traversing the package list, no need for locking.
+         */
+        list_for_each_entry(rp, &rapl_packages, plist)
+                if (package == rp->id)
+                        return false;
+
+        return true;
+}
+
+/* RAPL interface can be made of a two-level hierarchy: package level and domain
+ * level. We first detect the number of packages then domains of each package.
+ * We have to consider the possiblity of CPU online/offline due to hotplug and
+ * other scenarios.
+ */
+static int rapl_detect_topology(void)
+{
+        int i;
+        int phy_package_id;
+        struct rapl_package *new_package, *rp;
+
+        for_each_online_cpu(i) {
+                phy_package_id = topology_physical_package_id(i);
+                if (is_package_new(phy_package_id)) {
+                        new_package = kzalloc(sizeof(*rp), GFP_KERNEL);
+                        if (!new_package) {
+                                rapl_cleanup_data();
+                                return -ENOMEM;
+                        }
+                        /* add the new package to the list */
+                        new_package->id = phy_package_id;
+                        new_package->nr_cpus = 1;
+
+                        /* check if the package contains valid domains */
+                        if (rapl_detect_domains(new_package, i) ||
+                                rapl_check_unit(new_package, i)) {
+                                kfree(new_package->domains);
+                                kfree(new_package);
+                                /* free up the packages already initialized */
+                                rapl_cleanup_data();
+                                return -ENODEV;
+                        }
+                        INIT_LIST_HEAD(&new_package->plist);
+                        list_add(&new_package->plist, &rapl_packages);
+                } else {
+                        rp = find_package_by_id(phy_package_id);
+                        if (rp)
+                                ++rp->nr_cpus;
+                }
+        }
+
+        return 0;
+}
+
+/* called from CPU hotplug notifier, hotplug lock held */
+static void rapl_remove_package(struct rapl_package *rp)
+{
+        struct rapl_domain *rd, *rd_package = NULL;
+
+        for (rd = rp->domains; rd < rp->domains + rp->nr_domains; rd++) {
+                if (rd->id == RAPL_DOMAIN_PACKAGE) {
+                        rd_package = rd;
+                        continue;
+                }
+                pr_debug("remove package %d, %s domain\n", rp->id, rd->name);
+                powercap_unregister_zone(control_type, &rd->power_zone);
+        }
+        /* do parent zone last */
+        powercap_unregister_zone(control_type, &rd_package->power_zone);
+        list_del(&rp->plist);
+        kfree(rp);
+}
+
+/* called from CPU hotplug notifier, hotplug lock held */
+static int rapl_add_package(int cpu)
+{
+        int ret = 0;
+        int phy_package_id;
+        struct rapl_package *rp;
+
+        phy_package_id = topology_physical_package_id(cpu);
+        rp = kzalloc(sizeof(struct rapl_package), GFP_KERNEL);
+        if (!rp)
+                return -ENOMEM;
+
+        /* add the new package to the list */
+        rp->id = phy_package_id;
+        rp->nr_cpus = 1;
+        /* check if the package contains valid domains */
+        if (rapl_detect_domains(rp, cpu) ||
+                rapl_check_unit(rp, cpu)) {
+                ret = -ENODEV;
+                goto err_free_package;
+        }
+        if (!rapl_package_register_powercap(rp)) {
+                INIT_LIST_HEAD(&rp->plist);
+                list_add(&rp->plist, &rapl_packages);
+                return ret;
+        }
+
+err_free_package:
+        kfree(rp->domains);
+        kfree(rp);
+
+        return ret;
+}
+
+/* Handles CPU hotplug on multi-socket systems.
+ * If a CPU goes online as the first CPU of the physical package
+ * we add the RAPL package to the system. Similarly, when the last
+ * CPU of the package is removed, we remove the RAPL package and its
+ * associated domains. Cooling devices are handled accordingly at
+ * per-domain level.
+ */
+static int rapl_cpu_callback(struct notifier_block *nfb,
+                                unsigned long action, void *hcpu)
+{
+        unsigned long cpu = (unsigned long)hcpu;
+        int phy_package_id;
+        struct rapl_package *rp;
+
+        phy_package_id = topology_physical_package_id(cpu);
+        switch (action) {
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+        case CPU_DOWN_FAILED:
+        case CPU_DOWN_FAILED_FROZEN:
+                rp = find_package_by_id(phy_package_id);
+                if (rp)
+                        ++rp->nr_cpus;
+                else
+                        rapl_add_package(cpu);
+                break;
+        case CPU_DOWN_PREPARE:
+        case CPU_DOWN_PREPARE_FROZEN:
+                rp = find_package_by_id(phy_package_id);
+                if (!rp)
+                        break;
+                if (--rp->nr_cpus == 0)
+                        rapl_remove_package(rp);
+        }
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block rapl_cpu_notifier = {
+        .notifier_call = rapl_cpu_callback,
+};
+
+static int __init rapl_init(void)
+{
+        int ret = 0;
+
+        if (!x86_match_cpu(rapl_ids)) {
+                pr_err("driver does not support CPU family %d model %d\n",
+                        boot_cpu_data.x86, boot_cpu_data.x86_model);
+
+                return -ENODEV;
+        }
+        /* prevent CPU hotplug during detection */
+        get_online_cpus();
+        ret = rapl_detect_topology();
+        if (ret)
+                goto done;
+
+        if (rapl_register_powercap()) {
+                rapl_cleanup_data();
+                ret = -ENODEV;
+                goto done;
+        }
+        register_hotcpu_notifier(&rapl_cpu_notifier);
+done:
+        put_online_cpus();
+
+        return ret;
+}
+
+static void __exit rapl_exit(void)
+{
+        get_online_cpus();
+        unregister_hotcpu_notifier(&rapl_cpu_notifier);
+        rapl_unregister_powercap();
+        rapl_cleanup_data();
+        put_online_cpus();
+}
+
+module_init(rapl_init);
+module_exit(rapl_exit);
+
+MODULE_DESCRIPTION("Driver for Intel RAPL (Running Average Power Limit)");
+MODULE_AUTHOR("Jacob Pan <jacob.jun.pan@intel.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
new file mode 100644
index 000000000000..8d0fe431dbdd
--- /dev/null
+++ b/drivers/powercap/powercap_sys.c
@@ -0,0 +1,685 @@
+/*
+ * Power capping class
+ * Copyright (c) 2013, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/powercap.h>
+
+#define to_powercap_zone(n) container_of(n, struct powercap_zone, dev)
+#define to_powercap_control_type(n) \
+                        container_of(n, struct powercap_control_type, dev)
+
+/* Power zone show function */
+#define define_power_zone_show(_attr)           \
+static ssize_t _attr##_show(struct device *dev, \
+                                        struct device_attribute *dev_attr,\
+                                        char *buf) \
+{ \
+        u64 value; \
+        ssize_t len = -EINVAL; \
+        struct powercap_zone *power_zone = to_powercap_zone(dev); \
+        \
+        if (power_zone->ops->get_##_attr) { \
+                if (!power_zone->ops->get_##_attr(power_zone, &value)) \
+                        len = sprintf(buf, "%lld\n", value); \
+        } \
+        \
+        return len; \
+}
+
+/* The only meaningful input is 0 (reset), others are silently ignored */
+#define define_power_zone_store(_attr)          \
+static ssize_t _attr##_store(struct device *dev,\
+                                struct device_attribute *dev_attr, \
+                                const char *buf, size_t count) \
+{ \
+        int err; \
+        struct powercap_zone *power_zone = to_powercap_zone(dev); \
+        u64 value; \
+        \
+        err = kstrtoull(buf, 10, &value); \
+        if (err) \
+                return -EINVAL; \
+        if (value) \
+                return count; \
+        if (power_zone->ops->reset_##_attr) { \
+                if (!power_zone->ops->reset_##_attr(power_zone)) \
+                        return count; \
+        } \
+        \
+        return -EINVAL; \
+}
+
+/* Power zone constraint show function */
+#define define_power_zone_constraint_show(_attr) \
+static ssize_t show_constraint_##_attr(struct device *dev, \
+                                struct device_attribute *dev_attr,\
+                                char *buf) \
+{ \
+        u64 value; \
+        ssize_t len = -ENODATA; \
+        struct powercap_zone *power_zone = to_powercap_zone(dev); \
+        int id; \
+        struct powercap_zone_constraint *pconst;\
+        \
+        if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id)) \
+                return -EINVAL; \
+        if (id >= power_zone->const_id_cnt)     \
+                return -EINVAL; \
+        pconst = &power_zone->constraints[id]; \
+        if (pconst && pconst->ops && pconst->ops->get_##_attr) { \
+                if (!pconst->ops->get_##_attr(power_zone, id, &value)) \
+                        len = sprintf(buf, "%lld\n", value); \
+        } \
+        \
+        return len; \
+}
+
+/* Power zone constraint store function */
+#define define_power_zone_constraint_store(_attr) \
+static ssize_t store_constraint_##_attr(struct device *dev,\
+                                struct device_attribute *dev_attr, \
+                                const char *buf, size_t count) \
+{ \
+        int err; \
+        u64 value; \
+        struct powercap_zone *power_zone = to_powercap_zone(dev); \
+        int id; \
+        struct powercap_zone_constraint *pconst;\
+        \
+        if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id)) \
+                return -EINVAL; \
+        if (id >= power_zone->const_id_cnt)     \
+                return -EINVAL; \
+        pconst = &power_zone->constraints[id]; \
+        err = kstrtoull(buf, 10, &value); \
+        if (err) \
+                return -EINVAL; \
+        if (pconst && pconst->ops && pconst->ops->set_##_attr) { \
+                if (!pconst->ops->set_##_attr(power_zone, id, value)) \
+                        return count; \
+        } \
+        \
+        return -ENODATA; \
+}
+
+/* Power zone information callbacks */
+define_power_zone_show(power_uw);
+define_power_zone_show(max_power_range_uw);
+define_power_zone_show(energy_uj);
+define_power_zone_store(energy_uj);
+define_power_zone_show(max_energy_range_uj);
+
+/* Power zone attributes */
+static DEVICE_ATTR_RO(max_power_range_uw);
+static DEVICE_ATTR_RO(power_uw);
+static DEVICE_ATTR_RO(max_energy_range_uj);
+static DEVICE_ATTR_RW(energy_uj);
+
+/* Power zone constraint attributes callbacks */
+define_power_zone_constraint_show(power_limit_uw);
+define_power_zone_constraint_store(power_limit_uw);
+define_power_zone_constraint_show(time_window_us);
+define_power_zone_constraint_store(time_window_us);
+define_power_zone_constraint_show(max_power_uw);
+define_power_zone_constraint_show(min_power_uw);
+define_power_zone_constraint_show(max_time_window_us);
+define_power_zone_constraint_show(min_time_window_us);
+
+/* For one time seeding of constraint device attributes */
+struct powercap_constraint_attr {
+        struct device_attribute power_limit_attr;
+        struct device_attribute time_window_attr;
+        struct device_attribute max_power_attr;
+        struct device_attribute min_power_attr;
+        struct device_attribute max_time_window_attr;
+        struct device_attribute min_time_window_attr;
+        struct device_attribute name_attr;
+};
+
+static struct powercap_constraint_attr
+                                constraint_attrs[MAX_CONSTRAINTS_PER_ZONE];
+
+/* A list of powercap control_types */
+static LIST_HEAD(powercap_cntrl_list);
+/* Mutex to protect list of powercap control_types */
+static DEFINE_MUTEX(powercap_cntrl_list_lock);
+
+#define POWERCAP_CONSTRAINT_NAME_LEN    30 /* Some limit to avoid overflow */
+static ssize_t show_constraint_name(struct device *dev,
+                                struct device_attribute *dev_attr,
+                                char *buf)
+{
+        const char *name;
+        struct powercap_zone *power_zone = to_powercap_zone(dev);
+        int id;
+        ssize_t len = -ENODATA;
+        struct powercap_zone_constraint *pconst;
+
+        if (!sscanf(dev_attr->attr.name, "constraint_%d_", &id))
+                return -EINVAL;
+        if (id >= power_zone->const_id_cnt)
+                return -EINVAL;
+        pconst = &power_zone->constraints[id];
+
+        if (pconst && pconst->ops && pconst->ops->get_name) {
+                name = pconst->ops->get_name(power_zone, id);
+                if (name) {
+                        snprintf(buf, POWERCAP_CONSTRAINT_NAME_LEN,
+                                                                "%s\n", name);
+                        buf[POWERCAP_CONSTRAINT_NAME_LEN] = '\0';
+                        len = strlen(buf);
+                }
+        }
+
+        return len;
+}
+
+static int create_constraint_attribute(int id, const char *name,
+                                int mode,
+                                struct device_attribute *dev_attr,
+                                ssize_t (*show)(struct device *,
+                                        struct device_attribute *, char *),
+                                ssize_t (*store)(struct device *,
+                                        struct device_attribute *,
+                                const char *, size_t)
+                                )
+{
+
+        dev_attr->attr.name = kasprintf(GFP_KERNEL, "constraint_%d_%s",
+                                                                id, name);
+        if (!dev_attr->attr.name)
+                return -ENOMEM;
+        dev_attr->attr.mode = mode;
+        dev_attr->show = show;
+        dev_attr->store = store;
+
+        return 0;
+}
+
+static void free_constraint_attributes(void)
+{
+        int i;
+
+        for (i = 0; i < MAX_CONSTRAINTS_PER_ZONE; ++i) {
+                kfree(constraint_attrs[i].power_limit_attr.attr.name);
+                kfree(constraint_attrs[i].time_window_attr.attr.name);
+                kfree(constraint_attrs[i].name_attr.attr.name);
+                kfree(constraint_attrs[i].max_power_attr.attr.name);
+                kfree(constraint_attrs[i].min_power_attr.attr.name);
+                kfree(constraint_attrs[i].max_time_window_attr.attr.name);
+                kfree(constraint_attrs[i].min_time_window_attr.attr.name);
+        }
+}
+
+static int seed_constraint_attributes(void)
+{
+        int i;
+        int ret;
+
+        for (i = 0; i < MAX_CONSTRAINTS_PER_ZONE; ++i) {
+                ret = create_constraint_attribute(i, "power_limit_uw",
+                                        S_IWUSR | S_IRUGO,
+                                        &constraint_attrs[i].power_limit_attr,
+                                        show_constraint_power_limit_uw,
+                                        store_constraint_power_limit_uw);
+                if (ret)
+                        goto err_alloc;
+                ret = create_constraint_attribute(i, "time_window_us",
+                                        S_IWUSR | S_IRUGO,
+                                        &constraint_attrs[i].time_window_attr,
+                                        show_constraint_time_window_us,
+                                        store_constraint_time_window_us);
+                if (ret)
+                        goto err_alloc;
+                ret = create_constraint_attribute(i, "name", S_IRUGO,
+                                &constraint_attrs[i].name_attr,
+                                show_constraint_name,
+                                NULL);
+                if (ret)
+                        goto err_alloc;
+                ret = create_constraint_attribute(i, "max_power_uw", S_IRUGO,
+                                &constraint_attrs[i].max_power_attr,
+                                show_constraint_max_power_uw,
+                                NULL);
+                if (ret)
+                        goto err_alloc;
+                ret = create_constraint_attribute(i, "min_power_uw", S_IRUGO,
+                                &constraint_attrs[i].min_power_attr,
+                                show_constraint_min_power_uw,
+                                NULL);
+                if (ret)
+                        goto err_alloc;
+                ret = create_constraint_attribute(i, "max_time_window_us",
+                                S_IRUGO,
+                                &constraint_attrs[i].max_time_window_attr,
+                                show_constraint_max_time_window_us,
+                                NULL);
+                if (ret)
+                        goto err_alloc;
+                ret = create_constraint_attribute(i, "min_time_window_us",
+                                S_IRUGO,
+                                &constraint_attrs[i].min_time_window_attr,
+                                show_constraint_min_time_window_us,
+                                NULL);
+                if (ret)
+                        goto err_alloc;
+
+        }
+
+        return 0;
+
+err_alloc:
+        free_constraint_attributes();
+
+        return ret;
+}
+
+static int create_constraints(struct powercap_zone *power_zone,
+                                int nr_constraints,
+                                struct powercap_zone_constraint_ops *const_ops)
+{
+        int i;
+        int ret = 0;
+        int count;
+        struct powercap_zone_constraint *pconst;
+
+        if (!power_zone || !const_ops || !const_ops->get_power_limit_uw ||
+                                        !const_ops->set_power_limit_uw ||
+                                        !const_ops->get_time_window_us ||
+                                        !const_ops->set_time_window_us)
+                return -EINVAL;
+
+        count = power_zone->zone_attr_count;
+        for (i = 0; i < nr_constraints; ++i) {
+                pconst = &power_zone->constraints[i];
+                pconst->ops = const_ops;
+                pconst->id = power_zone->const_id_cnt;
+                power_zone->const_id_cnt++;
+                power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].power_limit_attr.attr;
+                power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].time_window_attr.attr;
+                if (pconst->ops->get_name)
+                        power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].name_attr.attr;
+                if (pconst->ops->get_max_power_uw)
+                        power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].max_power_attr.attr;
+                if (pconst->ops->get_min_power_uw)
+                        power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].min_power_attr.attr;
+                if (pconst->ops->get_max_time_window_us)
+                        power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].max_time_window_attr.attr;
+                if (pconst->ops->get_min_time_window_us)
+                        power_zone->zone_dev_attrs[count++] =
+                                &constraint_attrs[i].min_time_window_attr.attr;
+        }
+        power_zone->zone_attr_count = count;
+
+        return ret;
+}
+
+static bool control_type_valid(void *control_type)
+{
+        struct powercap_control_type *pos = NULL;
+        bool found = false;
+
+        mutex_lock(&powercap_cntrl_list_lock);
+
+        list_for_each_entry(pos, &powercap_cntrl_list, node) {
+                if (pos == control_type) {
+                        found = true;
+                        break;
+                }
+        }
+        mutex_unlock(&powercap_cntrl_list_lock);
+
+        return found;
+}
+
+static ssize_t name_show(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct powercap_zone *power_zone = to_powercap_zone(dev);
+
+        return sprintf(buf, "%s\n", power_zone->name);
+}
+
+static DEVICE_ATTR_RO(name);
+
+/* Create zone and attributes in sysfs */
+static void create_power_zone_common_attributes(
+                                        struct powercap_zone *power_zone)
+{
+        int count = 0;
+
+        power_zone->zone_dev_attrs[count++] = &dev_attr_name.attr;
+        if (power_zone->ops->get_max_energy_range_uj)
+                power_zone->zone_dev_attrs[count++] =
+                                        &dev_attr_max_energy_range_uj.attr;
+        if (power_zone->ops->get_energy_uj)
+                power_zone->zone_dev_attrs[count++] =
+                                        &dev_attr_energy_uj.attr;
+        if (power_zone->ops->get_power_uw)
+                power_zone->zone_dev_attrs[count++] =
+                                        &dev_attr_power_uw.attr;
+        if (power_zone->ops->get_max_power_range_uw)
+                power_zone->zone_dev_attrs[count++] =
+                                        &dev_attr_max_power_range_uw.attr;
+        power_zone->zone_dev_attrs[count] = NULL;
+        power_zone->zone_attr_count = count;
+}
+
+static void powercap_release(struct device *dev)
+{
+        bool allocated;
+
+        if (dev->parent) {
+                struct powercap_zone *power_zone = to_powercap_zone(dev);
+
+                /* Store flag as the release() may free memory */
+                allocated = power_zone->allocated;
+                /* Remove id from parent idr struct */
+                idr_remove(power_zone->parent_idr, power_zone->id);
+                /* Destroy idrs allocated for this zone */
+                idr_destroy(&power_zone->idr);
+                kfree(power_zone->name);
+                kfree(power_zone->zone_dev_attrs);
+                kfree(power_zone->constraints);
+                if (power_zone->ops->release)
+                        power_zone->ops->release(power_zone);
+                if (allocated)
+                        kfree(power_zone);
+        } else {
+                struct powercap_control_type *control_type =
+                                                to_powercap_control_type(dev);
+
+                /* Store flag as the release() may free memory */
+                allocated = control_type->allocated;
+                idr_destroy(&control_type->idr);
+                mutex_destroy(&control_type->lock);
+                if (control_type->ops && control_type->ops->release)
+                        control_type->ops->release(control_type);
+                if (allocated)
+                        kfree(control_type);
+        }
+}
+
+static ssize_t enabled_show(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        bool mode = true;
+
+        /* Default is enabled */
+        if (dev->parent) {
+                struct powercap_zone *power_zone = to_powercap_zone(dev);
+                if (power_zone->ops->get_enable)
+                        if (power_zone->ops->get_enable(power_zone, &mode))
+                                mode = false;
+        } else {
+                struct powercap_control_type *control_type =
+                                                to_powercap_control_type(dev);
+                if (control_type->ops && control_type->ops->get_enable)
+                        if (control_type->ops->get_enable(control_type, &mode))
+                                mode = false;
+        }
+
+        return sprintf(buf, "%d\n", mode);
+}
+
+static ssize_t enabled_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf,  size_t len)
+{
+        bool mode;
+
+        if (strtobool(buf, &mode))
+                return -EINVAL;
+        if (dev->parent) {
+                struct powercap_zone *power_zone = to_powercap_zone(dev);
+                if (power_zone->ops->set_enable)
+                        if (!power_zone->ops->set_enable(power_zone, mode))
+                                return len;
+        } else {
+                struct powercap_control_type *control_type =
+                                                to_powercap_control_type(dev);
+                if (control_type->ops && control_type->ops->set_enable)
+                        if (!control_type->ops->set_enable(control_type, mode))
+                                return len;
+        }
+
+        return -ENOSYS;
+}
+
+static DEVICE_ATTR_RW(enabled);
+
+static struct attribute *powercap_attrs[] = {
+        &dev_attr_enabled.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(powercap);
+
+static struct class powercap_class = {
+        .name = "powercap",
+        .dev_release = powercap_release,
+        .dev_groups = powercap_groups,
+};
+
+struct powercap_zone *powercap_register_zone(
+                                struct powercap_zone *power_zone,
+                                struct powercap_control_type *control_type,
+                                const char *name,
+                                struct powercap_zone *parent,
+                                const struct powercap_zone_ops *ops,
+                                int nr_constraints,
+                                struct powercap_zone_constraint_ops *const_ops)
+{
+        int result;
+        int nr_attrs;
+
+        if (!name || !control_type || !ops ||
+                        nr_constraints > MAX_CONSTRAINTS_PER_ZONE ||
+                        (!ops->get_energy_uj && !ops->get_power_uw) ||
+                        !control_type_valid(control_type))
+                return ERR_PTR(-EINVAL);
+
+        if (power_zone) {
+                if (!ops->release)
+                        return ERR_PTR(-EINVAL);
+                memset(power_zone, 0, sizeof(*power_zone));
+        } else {
+                power_zone = kzalloc(sizeof(*power_zone), GFP_KERNEL);
+                if (!power_zone)
+                        return ERR_PTR(-ENOMEM);
+                power_zone->allocated = true;
+        }
+        power_zone->ops = ops;
+        power_zone->control_type_inst = control_type;
+        if (!parent) {
+                power_zone->dev.parent = &control_type->dev;
+                power_zone->parent_idr = &control_type->idr;
+        } else {
+                power_zone->dev.parent = &parent->dev;
+                power_zone->parent_idr = &parent->idr;
+        }
+        power_zone->dev.class = &powercap_class;
+
+        mutex_lock(&control_type->lock);
+        /* Using idr to get the unique id */
+        result = idr_alloc(power_zone->parent_idr, NULL, 0, 0, GFP_KERNEL);
+        if (result < 0)
+                goto err_idr_alloc;
+
+        power_zone->id = result;
+        idr_init(&power_zone->idr);
+        power_zone->name = kstrdup(name, GFP_KERNEL);
+        if (!power_zone->name)
+                goto err_name_alloc;
+        dev_set_name(&power_zone->dev, "%s:%x",
+                                        dev_name(power_zone->dev.parent),
+                                        power_zone->id);
+        power_zone->constraints = kzalloc(sizeof(*power_zone->constraints) *
+                                         nr_constraints, GFP_KERNEL);
+        if (!power_zone->constraints)
+                goto err_const_alloc;
+
+        nr_attrs = nr_constraints * POWERCAP_CONSTRAINTS_ATTRS +
+                                                POWERCAP_ZONE_MAX_ATTRS + 1;
+        power_zone->zone_dev_attrs = kzalloc(sizeof(void *) *
+                                                nr_attrs, GFP_KERNEL);
+        if (!power_zone->zone_dev_attrs)
+                goto err_attr_alloc;
+        create_power_zone_common_attributes(power_zone);
+        result = create_constraints(power_zone, nr_constraints, const_ops);
+        if (result)
+                goto err_dev_ret;
+
+        power_zone->zone_dev_attrs[power_zone->zone_attr_count] = NULL;
+        power_zone->dev_zone_attr_group.attrs = power_zone->zone_dev_attrs;
+        power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group;
+        power_zone->dev_attr_groups[1] = NULL;
+        power_zone->dev.groups = power_zone->dev_attr_groups;
+        result = device_register(&power_zone->dev);
+        if (result)
+                goto err_dev_ret;
+
+        control_type->nr_zones++;
+        mutex_unlock(&control_type->lock);
+
+        return power_zone;
+
+err_dev_ret:
+        kfree(power_zone->zone_dev_attrs);
+err_attr_alloc:
+        kfree(power_zone->constraints);
+err_const_alloc:
+        kfree(power_zone->name);
+err_name_alloc:
+        idr_remove(power_zone->parent_idr, power_zone->id);
+err_idr_alloc:
+        if (power_zone->allocated)
+                kfree(power_zone);
+        mutex_unlock(&control_type->lock);
+
+        return ERR_PTR(result);
+}
+EXPORT_SYMBOL_GPL(powercap_register_zone);
+
+int powercap_unregister_zone(struct powercap_control_type *control_type,
+                                struct powercap_zone *power_zone)
+{
+        if (!power_zone || !control_type)
+                return -EINVAL;
+
+        mutex_lock(&control_type->lock);
+        control_type->nr_zones--;
+        mutex_unlock(&control_type->lock);
+
+        device_unregister(&power_zone->dev);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(powercap_unregister_zone);
+
+struct powercap_control_type *powercap_register_control_type(
+                                struct powercap_control_type *control_type,
+                                const char *name,
+                                const struct powercap_control_type_ops *ops)
+{
+        int result;
+
+        if (!name)
+                return ERR_PTR(-EINVAL);
+        if (control_type) {
+                if (!ops || !ops->release)
+                        return ERR_PTR(-EINVAL);
+                memset(control_type, 0, sizeof(*control_type));
+        } else {
+                control_type = kzalloc(sizeof(*control_type), GFP_KERNEL);
+                if (!control_type)
+                        return ERR_PTR(-ENOMEM);
+                control_type->allocated = true;
+        }
+        mutex_init(&control_type->lock);
+        control_type->ops = ops;
+        INIT_LIST_HEAD(&control_type->node);
+        control_type->dev.class = &powercap_class;
+        dev_set_name(&control_type->dev, "%s", name);
+        result = device_register(&control_type->dev);
+        if (result) {
+                if (control_type->allocated)
+                        kfree(control_type);
+                return ERR_PTR(result);
+        }
+        idr_init(&control_type->idr);
+
+        mutex_lock(&powercap_cntrl_list_lock);
+        list_add_tail(&control_type->node, &powercap_cntrl_list);
+        mutex_unlock(&powercap_cntrl_list_lock);
+
+        return control_type;
+}
+EXPORT_SYMBOL_GPL(powercap_register_control_type);
+
+int powercap_unregister_control_type(struct powercap_control_type *control_type)
+{
+        struct powercap_control_type *pos = NULL;
+
+        if (control_type->nr_zones) {
+                dev_err(&control_type->dev, "Zones of this type still not freed\n");
+                return -EINVAL;
+        }
+        mutex_lock(&powercap_cntrl_list_lock);
+        list_for_each_entry(pos, &powercap_cntrl_list, node) {
+                if (pos == control_type) {
+                        list_del(&control_type->node);
+                        mutex_unlock(&powercap_cntrl_list_lock);
+                        device_unregister(&control_type->dev);
+                        return 0;
+                }
+        }
+        mutex_unlock(&powercap_cntrl_list_lock);
+
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(powercap_unregister_control_type);
+
+static int __init powercap_init(void)
+{
+        int result = 0;
+
+        result = seed_constraint_attributes();
+        if (result)
+                return result;
+
+        result = class_register(&powercap_class);
+
+        return result;
+}
+
+device_initcall(powercap_init);
+
+MODULE_DESCRIPTION("PowerCap sysfs Driver");
+MODULE_AUTHOR("Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index 1a7816390773..b9f2653e4ef9 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -709,7 +709,7 @@ static struct da9063_regulators_pdata *da9063_parse_regulators_dt(
                 struct of_regulator_match **da9063_reg_matches)
 {
         da9063_reg_matches = NULL;
-        return PTR_ERR(-ENODEV);
+        return ERR_PTR(-ENODEV);
 }
 #endif
 
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 488dfe7ce9a6..7e2b165972e6 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -201,13 +201,7 @@ static unsigned int palmas_smps_ramp_delay[4] = {0, 10000, 5000, 2500};
 #define SMPS_CTRL_MODE_ECO              0x02
 #define SMPS_CTRL_MODE_PWM              0x03
 
-/* These values are derived from the data sheet. And are the number of steps
- * where there is a voltage change, the ranges at beginning and end of register
- * max/min values where there are no change are ommitted.
- *
- * So they are basically (maxV-minV)/stepV
- */
-#define PALMAS_SMPS_NUM_VOLTAGES        117
+#define PALMAS_SMPS_NUM_VOLTAGES        122
 #define PALMAS_SMPS10_NUM_VOLTAGES      2
 #define PALMAS_LDO_NUM_VOLTAGES         50
 
@@ -979,6 +973,7 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                         pmic->desc[id].min_uV = 900000;
                         pmic->desc[id].uV_step = 50000;
                         pmic->desc[id].linear_min_sel = 1;
+                        pmic->desc[id].enable_time = 500;
                         pmic->desc[id].vsel_reg =
                                         PALMAS_BASE_TO_REG(PALMAS_LDO_BASE,
                                                 palmas_regs_info[id].vsel_addr);
@@ -997,6 +992,11 @@ static int palmas_regulators_probe(struct platform_device *pdev)
                                 pmic->desc[id].min_uV = 450000;
                                 pmic->desc[id].uV_step = 25000;
                         }
+
+                        /* LOD6 in vibrator mode will have enable time 2000us */
+                        if (pdata && pdata->ldo6_vibrator &&
+                                (id == PALMAS_REG_LDO6))
+                                pmic->desc[id].enable_time = 2000;
                 } else {
                         pmic->desc[id].n_voltages = 1;
                         pmic->desc[id].ops = &palmas_ops_extreg;
diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index d8e3e1262bc2..20c271d49dcb 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -279,8 +279,12 @@ static int ti_abb_set_opp(struct regulator_dev *rdev, struct ti_abb *abb,
         ti_abb_rmw(regs->opp_sel_mask, info->opp_sel, regs->control_reg,
                    abb->base);
 
-        /* program LDO VBB vset override if needed */
-        if (abb->ldo_base)
+        /*
+         * program LDO VBB vset override if needed for !bypass mode
+         * XXX: Do not switch sequence - for !bypass, LDO override reset *must*
+         * be performed *before* switch to bias mode else VBB glitches.
+         */
+        if (abb->ldo_base && info->opp_sel != TI_ABB_NOMINAL_OPP)
                 ti_abb_program_ldovbb(dev, abb, info);
 
         /* Initiate ABB ldo change */
@@ -295,6 +299,14 @@ static int ti_abb_set_opp(struct regulator_dev *rdev, struct ti_abb *abb,
         if (ret)
                 goto out;
 
+        /*
+         * Reset LDO VBB vset override bypass mode
+         * XXX: Do not switch sequence - for bypass, LDO override reset *must*
+         * be performed *after* switch to bypass else VBB glitches.
+         */
+        if (abb->ldo_base && info->opp_sel == TI_ABB_NOMINAL_OPP)
+                ti_abb_program_ldovbb(dev, abb, info);
+
 out:
         return ret;
 }
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index 1432b26ef2e9..2205fbc2c37b 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -63,7 +63,7 @@ static irqreturn_t wm831x_ldo_uv_irq(int irq, void *data)
  */
 
 static const struct regulator_linear_range wm831x_gp_ldo_ranges[] = {
-        { .min_uV =  900000, .max_uV = 1650000, .min_sel =  0, .max_sel = 14,
+        { .min_uV =  900000, .max_uV = 1600000, .min_sel =  0, .max_sel = 14,
           .uV_step =  50000 },
         { .min_uV = 1700000, .max_uV = 3300000, .min_sel = 15, .max_sel = 31,
           .uV_step = 100000 },
@@ -332,7 +332,7 @@ static struct platform_driver wm831x_gp_ldo_driver = {
  */
 
 static const struct regulator_linear_range wm831x_aldo_ranges[] = {
-        { .min_uV = 1000000, .max_uV = 1650000, .min_sel =  0, .max_sel = 12,
+        { .min_uV = 1000000, .max_uV = 1600000, .min_sel =  0, .max_sel = 12,
           .uV_step =  50000 },
         { .min_uV = 1700000, .max_uV = 3500000, .min_sel = 13, .max_sel = 31,
           .uV_step = 100000 },
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 835b5f0f344e..61ca9292a429 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -543,7 +543,7 @@ static int wm8350_dcdc_set_suspend_mode(struct regulator_dev *rdev,
 }
 
 static const struct regulator_linear_range wm8350_ldo_ranges[] = {
-        { .min_uV =  900000, .max_uV = 1750000, .min_sel =  0, .max_sel = 15,
+        { .min_uV =  900000, .max_uV = 1650000, .min_sel =  0, .max_sel = 15,
           .uV_step =  50000 },
         { .min_uV = 1800000, .max_uV = 3300000, .min_sel = 16, .max_sel = 31,
           .uV_step = 100000 },
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 5adb2042e824..cee7e2708a1f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2077,6 +2077,7 @@ dasd_eckd_build_format(struct dasd_device *base,
         int intensity = 0;
         int r0_perm;
         int nr_tracks;
+        int use_prefix;
 
         startdev = dasd_alias_get_start_dev(base);
         if (!startdev)
@@ -2106,28 +2107,46 @@ dasd_eckd_build_format(struct dasd_device *base,
                 intensity = fdata->intensity;
         }
 
+        use_prefix = base_priv->features.feature[8] & 0x01;
+
         switch (intensity) {
         case 0x00:      /* Normal format */
         case 0x08:      /* Normal format, use cdl. */
                 cplength = 2 + (rpt*nr_tracks);
-                datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct LO_eckd_data) +
-                        rpt * nr_tracks * sizeof(struct eckd_count);
+                if (use_prefix)
+                        datasize = sizeof(struct PFX_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
                 break;
         case 0x01:      /* Write record zero and format track. */
         case 0x09:      /* Write record zero and format track, use cdl. */
                 cplength = 2 + rpt * nr_tracks;
-                datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct LO_eckd_data) +
-                        sizeof(struct eckd_count) +
-                        rpt * nr_tracks * sizeof(struct eckd_count);
+                if (use_prefix)
+                        datasize = sizeof(struct PFX_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count) +
+                                rpt * nr_tracks * sizeof(struct eckd_count);
                 break;
         case 0x04:      /* Invalidate track. */
         case 0x0c:      /* Invalidate track, use cdl. */
                 cplength = 3;
-                datasize = sizeof(struct PFX_eckd_data) +
-                        sizeof(struct LO_eckd_data) +
-                        sizeof(struct eckd_count);
+                if (use_prefix)
+                        datasize = sizeof(struct PFX_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count);
+                else
+                        datasize = sizeof(struct DE_eckd_data) +
+                                sizeof(struct LO_eckd_data) +
+                                sizeof(struct eckd_count);
                 break;
         default:
                 dev_warn(&startdev->cdev->dev,
@@ -2147,14 +2166,25 @@ dasd_eckd_build_format(struct dasd_device *base,
 
         switch (intensity & ~0x08) {
         case 0x00: /* Normal format. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
-                       fdata->start_unit, fdata->stop_unit,
-                       DASD_ECKD_CCW_WRITE_CKD, base, startdev);
-                /* grant subsystem permission to format R0 */
-                if (r0_perm)
-                        ((struct PFX_eckd_data *)data)
-                                ->define_extent.ga_extended |= 0x04;
-                data += sizeof(struct PFX_eckd_data);
+                if (use_prefix) {
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                        /* grant subsystem permission to format R0 */
+                        if (r0_perm)
+                                ((struct PFX_eckd_data *)data)
+                                        ->define_extent.ga_extended |= 0x04;
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                                      fdata->start_unit, fdata->stop_unit,
+                                      DASD_ECKD_CCW_WRITE_CKD, startdev);
+                        /* grant subsystem permission to format R0 */
+                        if (r0_perm)
+                                ((struct DE_eckd_data *) data)
+                                        ->ga_extended |= 0x04;
+                        data += sizeof(struct DE_eckd_data);
+                }
                 ccw[-1].flags |= CCW_FLAG_CC;
                 locate_record(ccw++, (struct LO_eckd_data *) data,
                               fdata->start_unit, 0, rpt*nr_tracks,
@@ -2163,11 +2193,18 @@ dasd_eckd_build_format(struct dasd_device *base,
                 data += sizeof(struct LO_eckd_data);
                 break;
         case 0x01: /* Write record zero + format track. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
-                       fdata->start_unit, fdata->stop_unit,
-                       DASD_ECKD_CCW_WRITE_RECORD_ZERO,
-                       base, startdev);
-                data += sizeof(struct PFX_eckd_data);
+                if (use_prefix) {
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_RECORD_ZERO,
+                               base, startdev);
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_RECORD_ZERO, startdev);
+                        data += sizeof(struct DE_eckd_data);
+                }
                 ccw[-1].flags |= CCW_FLAG_CC;
                 locate_record(ccw++, (struct LO_eckd_data *) data,
                               fdata->start_unit, 0, rpt * nr_tracks + 1,
@@ -2176,10 +2213,17 @@ dasd_eckd_build_format(struct dasd_device *base,
                 data += sizeof(struct LO_eckd_data);
                 break;
         case 0x04: /* Invalidate track. */
-                prefix(ccw++, (struct PFX_eckd_data *) data,
-                       fdata->start_unit, fdata->stop_unit,
-                       DASD_ECKD_CCW_WRITE_CKD, base, startdev);
-                data += sizeof(struct PFX_eckd_data);
+                if (use_prefix) {
+                        prefix(ccw++, (struct PFX_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_CKD, base, startdev);
+                        data += sizeof(struct PFX_eckd_data);
+                } else {
+                        define_extent(ccw++, (struct DE_eckd_data *) data,
+                               fdata->start_unit, fdata->stop_unit,
+                               DASD_ECKD_CCW_WRITE_CKD, startdev);
+                        data += sizeof(struct DE_eckd_data);
+                }
                 ccw[-1].flags |= CCW_FLAG_CC;
                 locate_record(ccw++, (struct LO_eckd_data *) data,
                               fdata->start_unit, 0, 1,
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index a3aa374799dc..1fe264379e0d 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -486,7 +486,7 @@ sclp_sync_wait(void)
         timeout = 0;
         if (timer_pending(&sclp_request_timer)) {
                 /* Get timeout TOD value */
-                timeout = get_tod_clock() +
+                timeout = get_tod_clock_fast() +
                           sclp_tod_from_jiffies(sclp_request_timer.expires -
                                                 jiffies);
         }
@@ -508,7 +508,7 @@ sclp_sync_wait(void)
         while (sclp_running_state != sclp_running_state_idle) {
                 /* Check for expired request timer */
                 if (timer_pending(&sclp_request_timer) &&
-                    get_tod_clock() > timeout &&
+                    get_tod_clock_fast() > timeout &&
                     del_timer(&sclp_request_timer))
                         sclp_request_timer.function(sclp_request_timer.data);
                 cpu_relax();
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 8cd34bf644b3..77df9cb00688 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -145,9 +145,11 @@ bool __init sclp_has_linemode(void)
 
         if (sccb->header.response_code != 0x20)
                 return 0;
-        if (sccb->sclp_send_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK))
-                return 1;
-        return 0;
+        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        return 1;
 }
 
 bool __init sclp_has_vt220(void)
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index a0f47c83fd62..3f4ca4e09a4c 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -810,7 +810,7 @@ static void tty3270_resize_work(struct work_struct *work)
         struct winsize ws;
 
         screen = tty3270_alloc_screen(tp->n_rows, tp->n_cols);
-        if (!screen)
+        if (IS_ERR(screen))
                 return;
         /* Switch to new output size */
         spin_lock_bh(&tp->view.lock);
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index 9b3a24e8d3a0..cf31d3321dab 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -313,7 +313,7 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
         int ret;
 
         dev_num = iminor(inode);
-        if (dev_num > MAXMINOR)
+        if (dev_num >= MAXMINOR)
                 return -ENODEV;
         logptr = &sys_ser[dev_num];
 
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index d7da67a31c77..88e35d85d205 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -878,9 +878,9 @@ static void css_reset(void)
                         atomic_inc(&chpid_reset_count);
         }
         /* Wait for machine check for all channel paths. */
-        timeout = get_tod_clock() + (RCHP_TIMEOUT << 12);
+        timeout = get_tod_clock_fast() + (RCHP_TIMEOUT << 12);
         while (atomic_read(&chpid_reset_count) != 0) {
-                if (get_tod_clock() > timeout)
+                if (get_tod_clock_fast() > timeout)
                         break;
                 cpu_relax();
         }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 8ed52aa49122..bbd3e511c771 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -338,10 +338,10 @@ again:
                 retries++;
 
                 if (!start_time) {
-                        start_time = get_tod_clock();
+                        start_time = get_tod_clock_fast();
                         goto again;
                 }
-                if ((get_tod_clock() - start_time) < QDIO_BUSY_BIT_PATIENCE)
+                if (get_tod_clock_fast() - start_time < QDIO_BUSY_BIT_PATIENCE)
                         goto again;
         }
         if (retries) {
@@ -504,7 +504,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
         int count, stop;
         unsigned char state = 0;
 
-        q->timestamp = get_tod_clock();
+        q->timestamp = get_tod_clock_fast();
 
         /*
          * Don't check 128 buffers, as otherwise qdio_inbound_q_moved
@@ -595,7 +595,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
          * At this point we know, that inbound first_to_check
          * has (probably) not moved (see qdio_inbound_processing).
          */
-        if (get_tod_clock() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
+        if (get_tod_clock_fast() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "in done:%02x",
                               q->first_to_check);
                 return 1;
@@ -728,7 +728,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
         int count, stop;
         unsigned char state = 0;
 
-        q->timestamp = get_tod_clock();
+        q->timestamp = get_tod_clock_fast();
 
         if (need_siga_sync(q))
                 if (((queue_type(q) != QDIO_IQDIO_QFMT) &&
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index feab3a5e50b5..757eb0716d45 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -696,7 +696,7 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
         while ((pci_device = pci_get_device(PCI_VENDOR_ID_BUSLOGIC,
                                         PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER,
                                         pci_device)) != NULL) {
-                struct blogic_adapter *adapter = adapter;
+                struct blogic_adapter *host_adapter = adapter;
                 struct blogic_adapter_info adapter_info;
                 enum blogic_isa_ioport mod_ioaddr_req;
                 unsigned char bus;
@@ -744,9 +744,9 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                    known and enabled, note that the particular Standard ISA I/O
                    Address should not be probed.
                  */
-                adapter->io_addr = io_addr;
-                blogic_intreset(adapter);
-                if (blogic_cmd(adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
+                host_adapter->io_addr = io_addr;
+                blogic_intreset(host_adapter);
+                if (blogic_cmd(host_adapter, BLOGIC_INQ_PCI_INFO, NULL, 0,
                                 &adapter_info, sizeof(adapter_info)) ==
                                 sizeof(adapter_info)) {
                         if (adapter_info.isa_port < 6)
@@ -762,7 +762,7 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
                    I/O Address assigned at system initialization.
                  */
                 mod_ioaddr_req = BLOGIC_IO_DISABLE;
-                blogic_cmd(adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
+                blogic_cmd(host_adapter, BLOGIC_MOD_IOADDR, &mod_ioaddr_req,
                                 sizeof(mod_ioaddr_req), NULL, 0);
                 /*
                    For the first MultiMaster Host Adapter enumerated,
@@ -779,12 +779,12 @@ static int __init blogic_init_mm_probeinfo(struct blogic_adapter *adapter)
 
                         fetch_localram.offset = BLOGIC_AUTOSCSI_BASE + 45;
                         fetch_localram.count = sizeof(autoscsi_byte45);
-                        blogic_cmd(adapter, BLOGIC_FETCH_LOCALRAM,
+                        blogic_cmd(host_adapter, BLOGIC_FETCH_LOCALRAM,
                                         &fetch_localram, sizeof(fetch_localram),
                                         &autoscsi_byte45,
                                         sizeof(autoscsi_byte45));
-                        blogic_cmd(adapter, BLOGIC_GET_BOARD_ID, NULL, 0, &id,
-                                        sizeof(id));
+                        blogic_cmd(host_adapter, BLOGIC_GET_BOARD_ID, NULL, 0,
+                                        &id, sizeof(id));
                         if (id.fw_ver_digit1 == '5')
                                 force_scan_order =
                                         autoscsi_byte45.force_scan_order;
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 2ef497ebadc0..ee5c1833eb73 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -20,7 +20,7 @@
  * | Device Discovery             |       0x2095       | 0x2020-0x2022, |
  * |                              |                    | 0x2011-0x2012, |
  * |                              |                    | 0x2016         |
- * | Queue Command and IO tracing |       0x3058       | 0x3006-0x300b  |
+ * | Queue Command and IO tracing |       0x3059       | 0x3006-0x300b  |
  * |                              |                    | 0x3027-0x3028  |
  * |                              |                    | 0x303d-0x3041  |
  * |                              |                    | 0x302d,0x3033  |
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index df1b30ba938c..ff9c86b1a0d8 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1957,6 +1957,15 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
         que = MSW(sts->handle);
         req = ha->req_q_map[que];
 
+        /* Check for invalid queue pointer */
+        if (req == NULL ||
+            que >= find_first_zero_bit(ha->req_qid_map, ha->max_req_queues)) {
+                ql_dbg(ql_dbg_io, vha, 0x3059,
+                    "Invalid status handle (0x%x): Bad req pointer. req=%p, "
+                    "que=%u.\n", sts->handle, req, que);
+                return;
+        }
+
         /* Validate handle. */
         if (handle < req->num_outstanding_cmds)
                 sp = req->outstanding_cmds[handle];
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index e62d17d41d4e..5693f6d7eddb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2854,6 +2854,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
                 gd->events |= DISK_EVENT_MEDIA_CHANGE;
         }
 
+        blk_pm_runtime_init(sdp->request_queue, dev);
         add_disk(gd);
         if (sdkp->capacity)
                 sd_dif_config_host(sdkp);
@@ -2862,7 +2863,6 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
 
         sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
                   sdp->removable ? "removable " : "");
-        blk_pm_runtime_init(sdp->request_queue, dev);
         scsi_autopm_put_device(sdp);
         put_device(&sdkp->dev);
 }
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index fd7cc566095a..d4ac60b4a56e 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1583,7 +1583,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
         /* Initialize the hardware */
         ret = clk_prepare_enable(clk);
         if (ret)
-                goto out_unmap_regs;
+                goto out_free_irq;
         spi_writel(as, CR, SPI_BIT(SWRST));
         spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
         if (as->caps.has_wdrbt) {
@@ -1614,6 +1614,7 @@ out_free_dma:
         spi_writel(as, CR, SPI_BIT(SWRST));
         spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
         clk_disable_unprepare(clk);
+out_free_irq:
         free_irq(irq, master);
 out_unmap_regs:
         iounmap(as->regs);
diff --git a/drivers/spi/spi-clps711x.c b/drivers/spi/spi-clps711x.c
index 5655acf55bfe..6416798828e7 100644
--- a/drivers/spi/spi-clps711x.c
+++ b/drivers/spi/spi-clps711x.c
@@ -226,7 +226,6 @@ static int spi_clps711x_probe(struct platform_device *pdev)
                                dev_name(&pdev->dev), hw);
         if (ret) {
                 dev_err(&pdev->dev, "Can't request IRQ\n");
-                clk_put(hw->spi_clk);
                 goto clk_out;
         }
 
@@ -247,7 +246,6 @@ err_out:
                         gpio_free(hw->chipselect[i]);
 
         spi_master_put(master);
-        kfree(master);
 
         return ret;
 }
@@ -263,7 +261,6 @@ static int spi_clps711x_remove(struct platform_device *pdev)
                         gpio_free(hw->chipselect[i]);
 
         spi_unregister_master(master);
-        kfree(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 6cd07d13ecab..4e44575bd87a 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -476,15 +476,9 @@ static int dspi_probe(struct platform_device *pdev)
         master->bus_num = bus_num;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                dev_err(&pdev->dev, "can't get platform resource\n");
-                ret = -EINVAL;
-                goto out_master_put;
-        }
-
         dspi->base = devm_ioremap_resource(&pdev->dev, res);
-        if (!dspi->base) {
-                ret = -EINVAL;
+        if (IS_ERR(dspi->base)) {
+                ret = PTR_ERR(dspi->base);
                 goto out_master_put;
         }
 
diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
index dbc5e999a1f5..6adf4e35816d 100644
--- a/drivers/spi/spi-mpc512x-psc.c
+++ b/drivers/spi/spi-mpc512x-psc.c
@@ -522,8 +522,10 @@ static int mpc512x_psc_spi_do_probe(struct device *dev, u32 regaddr,
         psc_num = master->bus_num;
         snprintf(clk_name, sizeof(clk_name), "psc%d_mclk", psc_num);
         clk = devm_clk_get(dev, clk_name);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                ret = PTR_ERR(clk);
                 goto free_irq;
+        }
         ret = clk_prepare_enable(clk);
         if (ret)
                 goto free_irq;
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index 2eb06ee0b326..c1a50674c1e3 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -546,8 +546,17 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
         if (pm_runtime_suspended(&drv_data->pdev->dev))
                 return IRQ_NONE;
 
-        sccr1_reg = read_SSCR1(reg);
+        /*
+         * If the device is not yet in RPM suspended state and we get an
+         * interrupt that is meant for another device, check if status bits
+         * are all set to one. That means that the device is already
+         * powered off.
+         */
         status = read_SSSR(reg);
+        if (status == ~0)
+                return IRQ_NONE;
+
+        sccr1_reg = read_SSCR1(reg);
 
         /* Ignore possible writes if we don't need to write */
         if (!(sccr1_reg & SSCR1_TIE))
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 512b8893893b..a80376dc3a10 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -1428,6 +1428,8 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
                S3C64XX_SPI_INT_TX_OVERRUN_EN | S3C64XX_SPI_INT_TX_UNDERRUN_EN,
                sdd->regs + S3C64XX_SPI_INT_EN);
 
+        pm_runtime_enable(&pdev->dev);
+
         if (spi_register_master(master)) {
                 dev_err(&pdev->dev, "cannot register SPI master\n");
                 ret = -EBUSY;
@@ -1440,8 +1442,6 @@ static int s3c64xx_spi_probe(struct platform_device *pdev)
                                         mem_res,
                                         sdd->rx_dma.dmach, sdd->tx_dma.dmach);
 
-        pm_runtime_enable(&pdev->dev);
-
         return 0;
 
 err3:
diff --git a/drivers/spi/spi-sh-hspi.c b/drivers/spi/spi-sh-hspi.c
index 0b68cb592fa4..e488a90a98b8 100644
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -296,6 +296,8 @@ static int hspi_probe(struct platform_device *pdev)
                 goto error1;
         }
 
+        pm_runtime_enable(&pdev->dev);
+
         master->num_chipselect  = 1;
         master->bus_num         = pdev->id;
         master->setup           = hspi_setup;
@@ -309,8 +311,6 @@ static int hspi_probe(struct platform_device *pdev)
                 goto error1;
         }
 
-        pm_runtime_enable(&pdev->dev);
-
         return 0;
 
  error1:
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 9e039c60c068..740f9ddda227 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -240,15 +240,27 @@ EXPORT_SYMBOL_GPL(spi_bus_type);
 static int spi_drv_probe(struct device *dev)
 {
         const struct spi_driver         *sdrv = to_spi_driver(dev->driver);
+        struct spi_device               *spi = to_spi_device(dev);
+        int ret;
+
+        acpi_dev_pm_attach(&spi->dev, true);
+        ret = sdrv->probe(spi);
+        if (ret)
+                acpi_dev_pm_detach(&spi->dev, true);
 
-        return sdrv->probe(to_spi_device(dev));
+        return ret;
 }
 
 static int spi_drv_remove(struct device *dev)
 {
         const struct spi_driver         *sdrv = to_spi_driver(dev->driver);
+        struct spi_device               *spi = to_spi_device(dev);
+        int ret;
+
+        ret = sdrv->remove(spi);
+        acpi_dev_pm_detach(&spi->dev, true);
 
-        return sdrv->remove(to_spi_device(dev));
+        return ret;
 }
 
 static void spi_drv_shutdown(struct device *dev)
@@ -1025,8 +1037,10 @@ static acpi_status acpi_spi_add_device(acpi_handle handle, u32 level,
                 return AE_OK;
         }
 
+        adev->power.flags.ignore_parent = true;
         strlcpy(spi->modalias, dev_name(&adev->dev), sizeof(spi->modalias));
         if (spi_add_device(spi)) {
+                adev->power.flags.ignore_parent = false;
                 dev_err(&master->dev, "failed to add SPI device %s from ACPI\n",
                         dev_name(&adev->dev));
                 spi_dev_put(spi);
diff --git a/drivers/staging/comedi/drivers/ni_65xx.c b/drivers/staging/comedi/drivers/ni_65xx.c
index 3ba4c5712dff..853f62b2b1a9 100644
--- a/drivers/staging/comedi/drivers/ni_65xx.c
+++ b/drivers/staging/comedi/drivers/ni_65xx.c
@@ -369,28 +369,23 @@ static int ni_65xx_dio_insn_bits(struct comedi_device *dev,
 {
         const struct ni_65xx_board *board = comedi_board(dev);
         struct ni_65xx_private *devpriv = dev->private;
-        unsigned base_bitfield_channel;
-        const unsigned max_ports_per_bitfield = 5;
+        int base_bitfield_channel;
         unsigned read_bits = 0;
-        unsigned j;
+        int last_port_offset = ni_65xx_port_by_channel(s->n_chan - 1);
+        int port_offset;
 
         base_bitfield_channel = CR_CHAN(insn->chanspec);
-        for (j = 0; j < max_ports_per_bitfield; ++j) {
-                const unsigned port_offset =
-                        ni_65xx_port_by_channel(base_bitfield_channel) + j;
-                const unsigned port =
-                        sprivate(s)->base_port + port_offset;
-                unsigned base_port_channel;
+        for (port_offset = ni_65xx_port_by_channel(base_bitfield_channel);
+             port_offset <= last_port_offset; port_offset++) {
+                unsigned port = sprivate(s)->base_port + port_offset;
+                int base_port_channel = port_offset * ni_65xx_channels_per_port;
                 unsigned port_mask, port_data, port_read_bits;
-                int bitshift;
-                if (port >= ni_65xx_total_num_ports(board))
+                int bitshift = base_port_channel - base_bitfield_channel;
+
+                if (bitshift >= 32)
                         break;
-                base_port_channel = port_offset * ni_65xx_channels_per_port;
                 port_mask = data[0];
                 port_data = data[1];
-                bitshift = base_port_channel - base_bitfield_channel;
-                if (bitshift >= 32 || bitshift <= -32)
-                        break;
                 if (bitshift > 0) {
                         port_mask >>= bitshift;
                         port_data >>= bitshift;
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index 47c5888461ff..a2e52a0c53c9 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -41,7 +41,6 @@ struct imx_drm_device {
         struct list_head                        encoder_list;
         struct list_head                        connector_list;
         struct mutex                            mutex;
-        int                                     references;
         int                                     pipes;
         struct drm_fbdev_cma                    *fbhelper;
 };
@@ -241,8 +240,6 @@ struct drm_device *imx_drm_device_get(void)
                 }
         }
 
-        imxdrm->references++;
-
         return imxdrm->drm;
 
 unwind_crtc:
@@ -280,8 +277,6 @@ void imx_drm_device_put(void)
         list_for_each_entry(enc, &imxdrm->encoder_list, list)
                 module_put(enc->owner);
 
-        imxdrm->references--;
-
         mutex_unlock(&imxdrm->mutex);
 }
 EXPORT_SYMBOL_GPL(imx_drm_device_put);
@@ -485,7 +480,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
 
         mutex_lock(&imxdrm->mutex);
 
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                 ret = -EBUSY;
                 goto err_busy;
         }
@@ -564,7 +559,7 @@ int imx_drm_add_encoder(struct drm_encoder *encoder,
 
         mutex_lock(&imxdrm->mutex);
 
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                 ret = -EBUSY;
                 goto err_busy;
         }
@@ -709,7 +704,7 @@ int imx_drm_add_connector(struct drm_connector *connector,
 
         mutex_lock(&imxdrm->mutex);
 
-        if (imxdrm->references) {
+        if (imxdrm->drm->open_count) {
                 ret = -EBUSY;
                 goto err_busy;
         }
diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
index 2644edf438c1..c8b43442dc74 100644
--- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
+++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
@@ -1387,7 +1387,7 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
         if (nob > ulsm_nob)
                 return (-EINVAL);
 
-        if (copy_to_user (ulsm, lsm, sizeof(ulsm)))
+        if (copy_to_user (ulsm, lsm, sizeof(*ulsm)))
                 return (-EFAULT);
 
         for (i = 0; i < lsm->lsm_stripe_count; i++) {
diff --git a/drivers/staging/media/msi3101/Kconfig b/drivers/staging/media/msi3101/Kconfig
index b94a95a597d6..76d5bbd4d93c 100644
--- a/drivers/staging/media/msi3101/Kconfig
+++ b/drivers/staging/media/msi3101/Kconfig
@@ -1,3 +1,4 @@
 config USB_MSI3101
         tristate "Mirics MSi3101 SDR Dongle"
         depends on USB && VIDEO_DEV && VIDEO_V4L2
+        select VIDEOBUF2_VMALLOC
diff --git a/drivers/staging/media/msi3101/sdr-msi3101.c b/drivers/staging/media/msi3101/sdr-msi3101.c
index 24c7b70a6cbf..4c3bf776bb20 100644
--- a/drivers/staging/media/msi3101/sdr-msi3101.c
+++ b/drivers/staging/media/msi3101/sdr-msi3101.c
@@ -1131,7 +1131,13 @@ static int msi3101_queue_setup(struct vb2_queue *vq,
         /* Absolute min and max number of buffers available for mmap() */
         *nbuffers = 32;
         *nplanes = 1;
-        sizes[0] = PAGE_ALIGN(3 * 3072); /* 3 * 768 * 4 */
+        /*
+         *   3, wMaxPacketSize 3x 1024 bytes
+         * 504, max IQ sample pairs per 1024 frame
+         *   2, two samples, I and Q
+         *   4, 32-bit float
+         */
+        sizes[0] = PAGE_ALIGN(3 * 504 * 2 * 4); /* = 12096 */
         dev_dbg(&s->udev->dev, "%s: nbuffers=%d sizes[0]=%d\n",
                         __func__, *nbuffers, sizes[0]);
         return 0;
@@ -1657,7 +1663,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
                         f->frequency * 625UL / 10UL);
 }
 
-const struct v4l2_ioctl_ops msi3101_ioctl_ops = {
+static const struct v4l2_ioctl_ops msi3101_ioctl_ops = {
         .vidioc_querycap          = msi3101_querycap,
 
         .vidioc_enum_input        = msi3101_enum_input,
diff --git a/drivers/staging/octeon-usb/cvmx-usb.c b/drivers/staging/octeon-usb/cvmx-usb.c
index d7b3c82b5ead..45dfe94199ae 100644
--- a/drivers/staging/octeon-usb/cvmx-usb.c
+++ b/drivers/staging/octeon-usb/cvmx-usb.c
@@ -604,7 +604,7 @@ int cvmx_usb_initialize(struct cvmx_usb_state *state, int usb_port_number,
                         }
         }
 
-        memset(usb, 0, sizeof(usb));
+        memset(usb, 0, sizeof(*usb));
         usb->init_flags = flags;
 
         /* Initialize the USB state structure */
diff --git a/drivers/staging/rtl8188eu/core/rtw_mp.c b/drivers/staging/rtl8188eu/core/rtw_mp.c
index c7ff2e4d1f23..9832dcbbd07f 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mp.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mp.c
@@ -907,7 +907,7 @@ u32 mp_query_psd(struct adapter *pAdapter, u8 *data)
                 sscanf(data, "pts =%d, start =%d, stop =%d", &psd_pts, &psd_start, &psd_stop);
         }
 
-        _rtw_memset(data, '\0', sizeof(data));
+        _rtw_memset(data, '\0', sizeof(*data));
 
         i = psd_start;
         while (i < psd_stop) {
diff --git a/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c b/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
index 9c2e7a20c09e..ec0028d4e61a 100644
--- a/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
+++ b/drivers/staging/rtl8188eu/hal/rtl8188e_dm.c
@@ -57,7 +57,7 @@ static void Init_ODM_ComInfo_88E(struct adapter *Adapter)
         u8 cut_ver, fab_ver;
 
         /*  Init Value */
-        _rtw_memset(dm_odm, 0, sizeof(dm_odm));
+        _rtw_memset(dm_odm, 0, sizeof(*dm_odm));
 
         dm_odm->Adapter = Adapter;
 
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index cd4100fb3645..95953ebc0279 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -6973,7 +6973,7 @@ static int rtw_mp_ctx(struct net_device *dev,
         stop = strncmp(extra, "stop", 4);
         sscanf(extra, "count =%d, pkt", &count);
 
-        _rtw_memset(extra, '\0', sizeof(extra));
+        _rtw_memset(extra, '\0', sizeof(*extra));
 
         if (stop == 0) {
                 bStartTest = 0; /*  To set Stop */
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index d3078d200e50..9ca3180ebaa0 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -54,6 +54,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         /*=== Customer ID ===*/
         /****** 8188EUS ********/
         {USB_DEVICE(0x8179, 0x07B8)}, /* Abocom - Abocom */
+        {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.c b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
index 5bc361b16d4c..56144014b7c9 100644
--- a/drivers/staging/rtl8192u/r819xU_cmdpkt.c
+++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
@@ -37,6 +37,8 @@ rt_status SendTxCommandPacket(struct net_device *dev, void *pData, u32 DataLen)
         /* Get TCB and local buffer from common pool.
            (It is shared by CmdQ, MgntQ, and USB coalesce DataQ) */
         skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
+        if (!skb)
+                return RT_STATUS_FAILURE;
         memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
         tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
         tcb_desc->queue_index = TXCMD_QUEUE;
diff --git a/drivers/staging/vt6656/iwctl.c b/drivers/staging/vt6656/iwctl.c
index d0cf7d8a20e5..8872e0f84f40 100644
--- a/drivers/staging/vt6656/iwctl.c
+++ b/drivers/staging/vt6656/iwctl.c
@@ -1634,6 +1634,9 @@ int iwctl_siwencodeext(struct net_device *dev, struct iw_request_info *info,
         if (pMgmt == NULL)
                 return -EFAULT;
 
+        if (!(pDevice->flags & DEVICE_FLAGS_OPENED))
+                return -ENODEV;
+
         buf = kzalloc(sizeof(struct viawget_wpa_param), GFP_KERNEL);
         if (buf == NULL)
                 return -ENOMEM;
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index 536971786ae8..6f9d28182445 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -1098,6 +1098,8 @@ static int device_close(struct net_device *dev)
     memset(pMgmt->abyCurrBSSID, 0, 6);
     pMgmt->eCurrState = WMAC_STATE_IDLE;
 
+        pDevice->flags &= ~DEVICE_FLAGS_OPENED;
+
     device_free_tx_bufs(pDevice);
     device_free_rx_bufs(pDevice);
     device_free_int_bufs(pDevice);
@@ -1109,7 +1111,6 @@ static int device_close(struct net_device *dev)
     usb_free_urb(pDevice->pInterruptURB);
 
     BSSvClearNodeDBTable(pDevice, 0);
-    pDevice->flags &=(~DEVICE_FLAGS_OPENED);
 
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "device_close2 \n");
 
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index fb743a8811bb..14f3e852215d 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -148,6 +148,8 @@ static void *s_vGetFreeContext(struct vnt_private *pDevice)
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"GetFreeContext()\n");
 
     for (ii = 0; ii < pDevice->cbTD; ii++) {
+        if (!pDevice->apTD[ii])
+                return NULL;
         pContext = pDevice->apTD[ii];
         if (pContext->bBoolInUse == false) {
             pContext->bBoolInUse = true;
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 35b61f7d6c63..38e44b9abf0f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -753,7 +753,8 @@ static void iscsit_unmap_iovec(struct iscsi_cmd *cmd)
 
 static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
 {
-        struct iscsi_cmd *cmd;
+        LIST_HEAD(ack_list);
+        struct iscsi_cmd *cmd, *cmd_p;
 
         conn->exp_statsn = exp_statsn;
 
@@ -761,19 +762,23 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
                 return;
 
         spin_lock_bh(&conn->cmd_lock);
-        list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
+        list_for_each_entry_safe(cmd, cmd_p, &conn->conn_cmd_list, i_conn_node) {
                 spin_lock(&cmd->istate_lock);
                 if ((cmd->i_state == ISTATE_SENT_STATUS) &&
                     iscsi_sna_lt(cmd->stat_sn, exp_statsn)) {
                         cmd->i_state = ISTATE_REMOVE;
                         spin_unlock(&cmd->istate_lock);
-                        iscsit_add_cmd_to_immediate_queue(cmd, conn,
-                                                cmd->i_state);
+                        list_move_tail(&cmd->i_conn_node, &ack_list);
                         continue;
                 }
                 spin_unlock(&cmd->istate_lock);
         }
         spin_unlock_bh(&conn->cmd_lock);
+
+        list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
+                list_del(&cmd->i_conn_node);
+                iscsit_free_cmd(cmd, false);
+        }
 }
 
 static int iscsit_allocate_iovecs(struct iscsi_cmd *cmd)
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 14d1aed5af1d..ef6d836a4d09 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1192,7 +1192,7 @@ get_target:
          */
 alloc_tags:
         tag_num = max_t(u32, ISCSIT_MIN_TAGS, queue_depth);
-        tag_num += ISCSIT_EXTRA_TAGS;
+        tag_num += (tag_num / 2) + ISCSIT_EXTRA_TAGS;
         tag_size = sizeof(struct iscsi_cmd) + conn->conn_transport->priv_size;
 
         ret = transport_alloc_session_tags(sess->se_sess, tag_num, tag_size);
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index f2de28e178fd..b0cac0c342e1 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -736,7 +736,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
                  * Fallthrough
                  */
         case ISCSI_OP_SCSI_TMFUNC:
-                rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
                 if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
                         __iscsit_free_cmd(cmd, true, shutdown);
                         target_put_sess_cmd(se_cmd->se_sess, se_cmd);
@@ -752,7 +752,7 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
                         se_cmd = &cmd->se_cmd;
                         __iscsit_free_cmd(cmd, true, shutdown);
 
-                        rc = transport_generic_free_cmd(&cmd->se_cmd, 1);
+                        rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
                         if (!rc && shutdown && se_cmd->se_sess) {
                                 __iscsit_free_cmd(cmd, true, shutdown);
                                 target_put_sess_cmd(se_cmd->se_sess, se_cmd);
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 551c96ca60ac..0f199f6a0738 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -134,10 +134,10 @@ static int pscsi_pmode_enable_hba(struct se_hba *hba, unsigned long mode_flag)
          * pSCSI Host ID and enable for phba mode
          */
         sh = scsi_host_lookup(phv->phv_host_id);
-        if (IS_ERR(sh)) {
+        if (!sh) {
                 pr_err("pSCSI: Unable to locate SCSI Host for"
                         " phv_host_id: %d\n", phv->phv_host_id);
-                return PTR_ERR(sh);
+                return -EINVAL;
         }
 
         phv->phv_lld_host = sh;
@@ -515,10 +515,10 @@ static int pscsi_configure_device(struct se_device *dev)
                         sh = phv->phv_lld_host;
                 } else {
                         sh = scsi_host_lookup(pdv->pdv_host_id);
-                        if (IS_ERR(sh)) {
+                        if (!sh) {
                                 pr_err("pSCSI: Unable to locate"
                                         " pdv_host_id: %d\n", pdv->pdv_host_id);
-                                return PTR_ERR(sh);
+                                return -EINVAL;
                         }
                 }
         } else {
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 6c17295e8d7c..d9b92b2c524d 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -263,6 +263,11 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
                         sectors, cmd->se_dev->dev_attrib.max_write_same_len);
                 return TCM_INVALID_CDB_FIELD;
         }
+        /* We always have ANC_SUP == 0 so setting ANCHOR is always an error */
+        if (flags[0] & 0x10) {
+                pr_warn("WRITE SAME with ANCHOR not supported\n");
+                return TCM_INVALID_CDB_FIELD;
+        }
         /*
          * Special case for WRITE_SAME w/ UNMAP=1 that ends up getting
          * translated into block discard requests within backend code.
@@ -349,7 +354,16 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
 
-        cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+        /*
+         * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
+         * within target_complete_ok_work() if the command was successfully
+         * sent to the backend driver.
+         */
+        spin_lock_irq(&cmd->t_state_lock);
+        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
+                cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+        spin_unlock_irq(&cmd->t_state_lock);
+
         /*
          * Unlock ->caw_sem originally obtained during sbc_compare_and_write()
          * before the original READ I/O submission.
@@ -363,7 +377,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
         struct scatterlist *write_sg = NULL, *sg;
-        unsigned char *buf, *addr;
+        unsigned char *buf = NULL, *addr;
         struct sg_mapping_iter m;
         unsigned int offset = 0, len;
         unsigned int nlbas = cmd->t_task_nolb;
@@ -378,6 +392,15 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd)
          */
         if (!cmd->t_data_sg || !cmd->t_bidi_data_sg)
                 return TCM_NO_SENSE;
+        /*
+         * Immediately exit + release dev->caw_sem if command has already
+         * been failed with a non-zero SCSI status.
+         */
+        if (cmd->scsi_status) {
+                pr_err("compare_and_write_callback: non zero scsi_status:"
+                        " 0x%02x\n", cmd->scsi_status);
+                goto out;
+        }
 
         buf = kzalloc(cmd->data_length, GFP_KERNEL);
         if (!buf) {
@@ -508,6 +531,12 @@ sbc_compare_and_write(struct se_cmd *cmd)
                 cmd->transport_complete_callback = NULL;
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
         }
+        /*
+         * Reset cmd->data_length to individual block_size in order to not
+         * confuse backend drivers that depend on this value matching the
+         * size of the I/O being submitted.
+         */
+        cmd->data_length = cmd->t_task_nolb * dev->dev_attrib.block_size;
 
         ret = cmd->execute_rw(cmd, cmd->t_bidi_data_sg, cmd->t_bidi_data_nents,
                               DMA_FROM_DEVICE);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 84747cc1aac0..81e945eefbbd 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -236,17 +236,24 @@ int transport_alloc_session_tags(struct se_session *se_sess,
 {
         int rc;
 
-        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size, GFP_KERNEL);
+        se_sess->sess_cmd_map = kzalloc(tag_num * tag_size,
+                                        GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
         if (!se_sess->sess_cmd_map) {
-                pr_err("Unable to allocate se_sess->sess_cmd_map\n");
-                return -ENOMEM;
+                se_sess->sess_cmd_map = vzalloc(tag_num * tag_size);
+                if (!se_sess->sess_cmd_map) {
+                        pr_err("Unable to allocate se_sess->sess_cmd_map\n");
+                        return -ENOMEM;
+                }
         }
 
         rc = percpu_ida_init(&se_sess->sess_tag_pool, tag_num);
         if (rc < 0) {
                 pr_err("Unable to init se_sess->sess_tag_pool,"
                         " tag_num: %u\n", tag_num);
-                kfree(se_sess->sess_cmd_map);
+                if (is_vmalloc_addr(se_sess->sess_cmd_map))
+                        vfree(se_sess->sess_cmd_map);
+                else
+                        kfree(se_sess->sess_cmd_map);
                 se_sess->sess_cmd_map = NULL;
                 return -ENOMEM;
         }
@@ -412,7 +419,10 @@ void transport_free_session(struct se_session *se_sess)
 {
         if (se_sess->sess_cmd_map) {
                 percpu_ida_destroy(&se_sess->sess_tag_pool);
-                kfree(se_sess->sess_cmd_map);
+                if (is_vmalloc_addr(se_sess->sess_cmd_map))
+                        vfree(se_sess->sess_cmd_map);
+                else
+                        kfree(se_sess->sess_cmd_map);
         }
         kmem_cache_free(se_sess_cache, se_sess);
 }
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 4d22e7d2adca..474cd44fac14 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -82,6 +82,9 @@ static int target_xcopy_locate_se_dev_e4(struct se_cmd *se_cmd, struct xcopy_op
         mutex_lock(&g_device_mutex);
         list_for_each_entry(se_dev, &g_device_list, g_dev_node) {
 
+                if (!se_dev->dev_attrib.emulate_3pc)
+                        continue;
+
                 memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN);
                 target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]);
 
@@ -298,8 +301,8 @@ static int target_xcopy_parse_segdesc_02(struct se_cmd *se_cmd, struct xcopy_op
                 (unsigned long long)xop->dst_lba);
 
         if (dc != 0) {
-                xop->dbl = (desc[29] << 16) & 0xff;
-                xop->dbl |= (desc[30] << 8) & 0xff;
+                xop->dbl = (desc[29] & 0xff) << 16;
+                xop->dbl |= (desc[30] & 0xff) << 8;
                 xop->dbl |= desc[31] & 0xff;
 
                 pr_debug("XCOPY seg desc 0x02: DC=1 w/ dbl: %u\n", xop->dbl);
@@ -357,6 +360,7 @@ struct xcopy_pt_cmd {
         struct se_cmd se_cmd;
         struct xcopy_op *xcopy_op;
         struct completion xpt_passthrough_sem;
+        unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
 };
 
 static struct se_port xcopy_pt_port;
@@ -675,7 +679,8 @@ static int target_xcopy_issue_pt_cmd(struct xcopy_pt_cmd *xpt_cmd)
 
         pr_debug("target_xcopy_issue_pt_cmd(): SCSI status: 0x%02x\n",
                         se_cmd->scsi_status);
-        return 0;
+
+        return (se_cmd->scsi_status) ? -EINVAL : 0;
 }
 
 static int target_xcopy_read_source(
@@ -708,7 +713,7 @@ static int target_xcopy_read_source(
                 (unsigned long long)src_lba, src_sectors, length);
 
         transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
-                                DMA_FROM_DEVICE, 0, NULL);
+                              DMA_FROM_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
         xop->src_pt_cmd = xpt_cmd;
 
         rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0],
@@ -768,7 +773,7 @@ static int target_xcopy_write_destination(
                 (unsigned long long)dst_lba, dst_sectors, length);
 
         transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
-                                DMA_TO_DEVICE, 0, NULL);
+                              DMA_TO_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
         xop->dst_pt_cmd = xpt_cmd;
 
         rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, dst_dev, &cdb[0],
@@ -884,30 +889,42 @@ out:
 
 sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
 {
+        struct se_device *dev = se_cmd->se_dev;
         struct xcopy_op *xop = NULL;
         unsigned char *p = NULL, *seg_desc;
         unsigned int list_id, list_id_usage, sdll, inline_dl, sa;
+        sense_reason_t ret = TCM_INVALID_PARAMETER_LIST;
         int rc;
         unsigned short tdll;
 
+        if (!dev->dev_attrib.emulate_3pc) {
+                pr_err("EXTENDED_COPY operation explicitly disabled\n");
+                return TCM_UNSUPPORTED_SCSI_OPCODE;
+        }
+
         sa = se_cmd->t_task_cdb[1] & 0x1f;
         if (sa != 0x00) {
                 pr_err("EXTENDED_COPY(LID4) not supported\n");
                 return TCM_UNSUPPORTED_SCSI_OPCODE;
         }
 
+        xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
+        if (!xop) {
+                pr_err("Unable to allocate xcopy_op\n");
+                return TCM_OUT_OF_RESOURCES;
+        }
+        xop->xop_se_cmd = se_cmd;
+
         p = transport_kmap_data_sg(se_cmd);
         if (!p) {
                 pr_err("transport_kmap_data_sg() failed in target_do_xcopy\n");
+                kfree(xop);
                 return TCM_OUT_OF_RESOURCES;
         }
 
         list_id = p[0];
-        if (list_id != 0x00) {
-                pr_err("XCOPY with non zero list_id: 0x%02x\n", list_id);
-                goto out;
-        }
-        list_id_usage = (p[1] & 0x18);
+        list_id_usage = (p[1] & 0x18) >> 3;
+
         /*
          * Determine TARGET DESCRIPTOR LIST LENGTH + SEGMENT DESCRIPTOR LIST LENGTH
          */
@@ -920,13 +937,6 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
                 goto out;
         }
 
-        xop = kzalloc(sizeof(struct xcopy_op), GFP_KERNEL);
-        if (!xop) {
-                pr_err("Unable to allocate xcopy_op\n");
-                goto out;
-        }
-        xop->xop_se_cmd = se_cmd;
-
         pr_debug("Processing XCOPY with list_id: 0x%02x list_id_usage: 0x%02x"
                 " tdll: %hu sdll: %u inline_dl: %u\n", list_id, list_id_usage,
                 tdll, sdll, inline_dl);
@@ -935,6 +945,17 @@ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
         if (rc <= 0)
                 goto out;
 
+        if (xop->src_dev->dev_attrib.block_size !=
+            xop->dst_dev->dev_attrib.block_size) {
+                pr_err("XCOPY: Non matching src_dev block_size: %u + dst_dev"
+                       " block_size: %u currently unsupported\n",
+                        xop->src_dev->dev_attrib.block_size,
+                        xop->dst_dev->dev_attrib.block_size);
+                xcopy_pt_undepend_remotedev(xop);
+                ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+                goto out;
+        }
+
         pr_debug("XCOPY: Processed %d target descriptors, length: %u\n", rc,
                                 rc * XCOPY_TARGET_DESC_LEN);
         seg_desc = &p[16];
@@ -957,7 +978,7 @@ out:
         if (p)
                 transport_kunmap_data_sg(se_cmd);
         kfree(xop);
-        return TCM_INVALID_CDB_FIELD;
+        return ret;
 }
 
 static sense_reason_t target_rcr_operating_parameters(struct se_cmd *se_cmd)
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index dbfc390330ac..5ef596765060 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -78,7 +78,6 @@ config THERMAL_GOV_USER_SPACE
 config CPU_THERMAL
         bool "generic cpu cooling support"
         depends on CPU_FREQ
-        select CPU_FREQ_TABLE
         help
           This implements the generic cpu cooling mechanism through frequency
           reduction. An ACPI version of this already exists
diff --git a/drivers/thermal/samsung/exynos_thermal_common.c b/drivers/thermal/samsung/exynos_thermal_common.c
index f10a6ad37c06..c2301da08ac7 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.c
+++ b/drivers/thermal/samsung/exynos_thermal_common.c
@@ -310,8 +310,6 @@ void exynos_report_trigger(struct thermal_sensor_conf *conf)
         }
 
         th_zone = conf->pzone_data;
-        if (th_zone->therm_dev)
-                return;
 
         if (th_zone->bind == false) {
                 for (i = 0; i < th_zone->cool_dev_size; i++) {
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index b43afda8acd1..32f38b90c4f6 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -317,6 +317,9 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
 
         con = readl(data->base + reg->tmu_ctrl);
 
+        if (pdata->test_mux)
+                con |= (pdata->test_mux << reg->test_mux_addr_shift);
+
         if (pdata->reference_voltage) {
                 con &= ~(reg->buf_vref_sel_mask << reg->buf_vref_sel_shift);
                 con |= pdata->reference_voltage << reg->buf_vref_sel_shift;
@@ -488,7 +491,7 @@ static const struct of_device_id exynos_tmu_match[] = {
         },
         {
                 .compatible = "samsung,exynos4412-tmu",
-                .data = (void *)EXYNOS5250_TMU_DRV_DATA,
+                .data = (void *)EXYNOS4412_TMU_DRV_DATA,
         },
         {
                 .compatible = "samsung,exynos5250-tmu",
@@ -629,9 +632,10 @@ static int exynos_tmu_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        if (pdata->type == SOC_ARCH_EXYNOS ||
-                pdata->type == SOC_ARCH_EXYNOS4210 ||
-                                pdata->type == SOC_ARCH_EXYNOS5440)
+        if (pdata->type == SOC_ARCH_EXYNOS4210 ||
+            pdata->type == SOC_ARCH_EXYNOS4412 ||
+            pdata->type == SOC_ARCH_EXYNOS5250 ||
+            pdata->type == SOC_ARCH_EXYNOS5440)
                 data->soc = pdata->type;
         else {
                 ret = -EINVAL;
diff --git a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
index b364c9eee701..3fb65547e64c 100644
--- a/drivers/thermal/samsung/exynos_tmu.h
+++ b/drivers/thermal/samsung/exynos_tmu.h
@@ -41,7 +41,8 @@ enum calibration_mode {
 
 enum soc_type {
         SOC_ARCH_EXYNOS4210 = 1,
-        SOC_ARCH_EXYNOS,
+        SOC_ARCH_EXYNOS4412,
+        SOC_ARCH_EXYNOS5250,
         SOC_ARCH_EXYNOS5440,
 };
 
@@ -84,6 +85,7 @@ enum soc_type {
  * @triminfo_reload_shift: shift of triminfo reload enable bit in triminfo_ctrl
         reg.
  * @tmu_ctrl: TMU main controller register.
+ * @test_mux_addr_shift: shift bits of test mux address.
  * @buf_vref_sel_shift: shift bits of reference voltage in tmu_ctrl register.
  * @buf_vref_sel_mask: mask bits of reference voltage in tmu_ctrl register.
  * @therm_trip_mode_shift: shift bits of tripping mode in tmu_ctrl register.
@@ -150,6 +152,7 @@ struct exynos_tmu_registers {
         u32     triminfo_reload_shift;
 
         u32     tmu_ctrl;
+        u32     test_mux_addr_shift;
         u32     buf_vref_sel_shift;
         u32     buf_vref_sel_mask;
         u32     therm_trip_mode_shift;
@@ -257,6 +260,7 @@ struct exynos_tmu_registers {
  * @first_point_trim: temp value of the first point trimming
  * @second_point_trim: temp value of the second point trimming
  * @default_temp_offset: default temperature offset in case of no trimming
+ * @test_mux; information if SoC supports test MUX
  * @cal_type: calibration type for temperature
  * @cal_mode: calibration mode for temperature
  * @freq_clip_table: Table representing frequency reduction percentage.
@@ -286,6 +290,7 @@ struct exynos_tmu_platform_data {
         u8 first_point_trim;
         u8 second_point_trim;
         u8 default_temp_offset;
+        u8 test_mux;
 
         enum calibration_type cal_type;
         enum calibration_mode cal_mode;
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index 9002499c1f69..073c292baa53 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -90,14 +90,15 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
 };
 #endif
 
-#if defined(CONFIG_SOC_EXYNOS5250) || defined(CONFIG_SOC_EXYNOS4412)
-static const struct exynos_tmu_registers exynos5250_tmu_registers = {
+#if defined(CONFIG_SOC_EXYNOS4412) || defined(CONFIG_SOC_EXYNOS5250)
+static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
         .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
         .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .triminfo_ctrl = EXYNOS_TMU_TRIMINFO_CON,
         .triminfo_reload_shift = EXYNOS_TRIMINFO_RELOAD_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
+        .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
         .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
         .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
@@ -128,7 +129,7 @@ static const struct exynos_tmu_registers exynos5250_tmu_registers = {
         .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
-#define EXYNOS5250_TMU_DATA \
+#define EXYNOS4412_TMU_DATA \
         .threshold_falling = 10, \
         .trigger_levels[0] = 85, \
         .trigger_levels[1] = 103, \
@@ -162,15 +163,32 @@ static const struct exynos_tmu_registers exynos5250_tmu_registers = {
                 .temp_level = 103, \
         }, \
         .freq_tab_count = 2, \
-        .type = SOC_ARCH_EXYNOS, \
-        .registers = &exynos5250_tmu_registers, \
+        .registers = &exynos4412_tmu_registers, \
         .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
                         TMU_SUPPORT_EMUL_TIME)
+#endif
 
+#if defined(CONFIG_SOC_EXYNOS4412)
+struct exynos_tmu_init_data const exynos4412_default_tmu_data = {
+        .tmu_data = {
+                {
+                        EXYNOS4412_TMU_DATA,
+                        .type = SOC_ARCH_EXYNOS4412,
+                        .test_mux = EXYNOS4412_MUX_ADDR_VALUE,
+                },
+        },
+        .tmu_count = 1,
+};
+#endif
+
+#if defined(CONFIG_SOC_EXYNOS5250)
 struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
         .tmu_data = {
-                { EXYNOS5250_TMU_DATA },
+                {
+                        EXYNOS4412_TMU_DATA,
+                        .type = SOC_ARCH_EXYNOS5250,
+                },
         },
         .tmu_count = 1,
 };
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index dc7feb51099b..a1ea19d9e0a6 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -95,6 +95,10 @@
 
 #define EXYNOS_MAX_TRIGGER_PER_REG      4
 
+/* Exynos4412 specific */
+#define EXYNOS4412_MUX_ADDR_VALUE          6
+#define EXYNOS4412_MUX_ADDR_SHIFT          20
+
 /*exynos5440 specific registers*/
 #define EXYNOS5440_TMU_S0_7_TRIM                0x000
 #define EXYNOS5440_TMU_S0_7_CTRL                0x020
@@ -138,7 +142,14 @@ extern struct exynos_tmu_init_data const exynos4210_default_tmu_data;
 #define EXYNOS4210_TMU_DRV_DATA (NULL)
 #endif
 
-#if (defined(CONFIG_SOC_EXYNOS5250) || defined(CONFIG_SOC_EXYNOS4412))
+#if defined(CONFIG_SOC_EXYNOS4412)
+extern struct exynos_tmu_init_data const exynos4412_default_tmu_data;
+#define EXYNOS4412_TMU_DRV_DATA (&exynos4412_default_tmu_data)
+#else
+#define EXYNOS4412_TMU_DRV_DATA (NULL)
+#endif
+
+#if defined(CONFIG_SOC_EXYNOS5250)
 extern struct exynos_tmu_init_data const exynos5250_default_tmu_data;
 #define EXYNOS5250_TMU_DRV_DATA (&exynos5250_default_tmu_data)
 #else
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index eeef0e2498ca..fdb07199d9c2 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -159,7 +159,7 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
 
         INIT_LIST_HEAD(&hwmon->tz_list);
         strlcpy(hwmon->type, tz->type, THERMAL_NAME_LENGTH);
-        hwmon->device = hwmon_device_register(&tz->device);
+        hwmon->device = hwmon_device_register(NULL);
         if (IS_ERR(hwmon->device)) {
                 result = PTR_ERR(hwmon->device);
                 goto free_mem;
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 4f8b9af54a5a..5a47cc8c8f85 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -110,6 +110,7 @@ static inline int ti_thermal_get_temp(struct thermal_zone_device *thermal,
                 } else {
                         dev_err(bgp->dev,
                                 "Failed to read PCB state. Using defaults\n");
+                        ret = 0;
                 }
         }
         *temp = ti_thermal_hotspot_temperature(tmp, slope, constant);
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index f36950e4134f..7722cb9d5a80 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -316,18 +316,19 @@ static void pkg_temp_thermal_threshold_work_fn(struct work_struct *work)
         int phy_id = topology_physical_package_id(cpu);
         struct phy_dev_entry *phdev = pkg_temp_thermal_get_phy_entry(cpu);
         bool notify = false;
+        unsigned long flags;
 
         if (!phdev)
                 return;
 
-        spin_lock(&pkg_work_lock);
+        spin_lock_irqsave(&pkg_work_lock, flags);
         ++pkg_work_cnt;
         if (unlikely(phy_id > max_phy_id)) {
-                spin_unlock(&pkg_work_lock);
+                spin_unlock_irqrestore(&pkg_work_lock, flags);
                 return;
         }
         pkg_work_scheduled[phy_id] = 0;
-        spin_unlock(&pkg_work_lock);
+        spin_unlock_irqrestore(&pkg_work_lock, flags);
 
         enable_pkg_thres_interrupt();
         rdmsrl(MSR_IA32_PACKAGE_THERM_STATUS, msr_val);
@@ -397,6 +398,7 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
         int thres_count;
         u32 eax, ebx, ecx, edx;
         u8 *temp;
+        unsigned long flags;
 
         cpuid(6, &eax, &ebx, &ecx, &edx);
         thres_count = ebx & 0x07;
@@ -420,19 +422,19 @@ static int pkg_temp_thermal_device_add(unsigned int cpu)
                 goto err_ret_unlock;
         }
 
-        spin_lock(&pkg_work_lock);
+        spin_lock_irqsave(&pkg_work_lock, flags);
         if (topology_physical_package_id(cpu) > max_phy_id)
                 max_phy_id = topology_physical_package_id(cpu);
         temp = krealloc(pkg_work_scheduled,
                         (max_phy_id+1) * sizeof(u8), GFP_ATOMIC);
         if (!temp) {
-                spin_unlock(&pkg_work_lock);
+                spin_unlock_irqrestore(&pkg_work_lock, flags);
                 err = -ENOMEM;
                 goto err_ret_free;
         }
         pkg_work_scheduled = temp;
         pkg_work_scheduled[topology_physical_package_id(cpu)] = 0;
-        spin_unlock(&pkg_work_lock);
+        spin_unlock_irqrestore(&pkg_work_lock, flags);
 
         phy_dev_entry->phys_proc_id = topology_physical_package_id(cpu);
         phy_dev_entry->first_cpu = cpu;
diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index e61c36cbb866..c193af6a628f 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -636,6 +636,7 @@ struct console xenboot_console = {
         .name           = "xenboot",
         .write          = xenboot_write_console,
         .flags          = CON_PRINTBUFFER | CON_BOOT | CON_ANYTIME,
+        .index          = -1,
 };
 #endif  /* CONFIG_EARLY_PRINTK */
 
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c9a9ddd1d0bc..7a744b69c3d1 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1758,8 +1758,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
                 canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
         if (canon_change) {
                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
-                ldata->line_start = 0;
-                ldata->canon_head = ldata->read_tail;
+                ldata->line_start = ldata->canon_head = ldata->read_tail;
                 ldata->erasing = 0;
                 ldata->lnext = 0;
         }
@@ -2184,28 +2183,34 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 
                 if (!input_available_p(tty, 0)) {
                         if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
-                                retval = -EIO;
-                                break;
-                        }
-                        if (tty_hung_up_p(file))
-                                break;
-                        if (!timeout)
-                                break;
-                        if (file->f_flags & O_NONBLOCK) {
-                                retval = -EAGAIN;
-                                break;
-                        }
-                        if (signal_pending(current)) {
-                                retval = -ERESTARTSYS;
-                                break;
-                        }
-                        n_tty_set_room(tty);
-                        up_read(&tty->termios_rwsem);
+                                up_read(&tty->termios_rwsem);
+                                tty_flush_to_ldisc(tty);
+                                down_read(&tty->termios_rwsem);
+                                if (!input_available_p(tty, 0)) {
+                                        retval = -EIO;
+                                        break;
+                                }
+                        } else {
+                                if (tty_hung_up_p(file))
+                                        break;
+                                if (!timeout)
+                                        break;
+                                if (file->f_flags & O_NONBLOCK) {
+                                        retval = -EAGAIN;
+                                        break;
+                                }
+                                if (signal_pending(current)) {
+                                        retval = -ERESTARTSYS;
+                                        break;
+                                }
+                                n_tty_set_room(tty);
+                                up_read(&tty->termios_rwsem);
 
-                        timeout = schedule_timeout(timeout);
+                                timeout = schedule_timeout(timeout);
 
-                        down_read(&tty->termios_rwsem);
-                        continue;
+                                down_read(&tty->termios_rwsem);
+                                continue;
+                        }
                 }
                 __set_current_state(TASK_RUNNING);
 
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index a0ebbc9ce5cd..042aa077b5b3 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1912,9 +1912,6 @@ static int serial_imx_probe_dt(struct imx_port *sport,
 
         sport->devdata = of_id->data;
 
-        if (of_device_is_stdout_path(np))
-                add_preferred_console(imx_reg.cons->name, sport->port.line, 0);
-
         return 0;
 }
 #else
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 52379e56a31e..44077c0b7670 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -667,30 +667,21 @@ static int pop_tx_x(struct eg20t_port *priv, unsigned char *buf)
 
 static int dma_push_rx(struct eg20t_port *priv, int size)
 {
-        struct tty_struct *tty;
         int room;
         struct uart_port *port = &priv->port;
         struct tty_port *tport = &port->state->port;
 
-        port = &priv->port;
-        tty = tty_port_tty_get(tport);
-        if (!tty) {
-                dev_dbg(priv->port.dev, "%s:tty is busy now", __func__);
-                return 0;
-        }
-
         room = tty_buffer_request_room(tport, size);
 
         if (room < size)
                 dev_warn(port->dev, "Rx overrun: dropping %u bytes\n",
                          size - room);
         if (!room)
-                return room;
+                return 0;
 
         tty_insert_flip_string(tport, sg_virt(&priv->sg_rx), size);
 
         port->icount.rx += room;
-        tty_kref_put(tty);
 
         return room;
 }
@@ -1098,6 +1089,8 @@ static void pch_uart_err_ir(struct eg20t_port *priv, unsigned int lsr)
         if (tty == NULL) {
                 for (i = 0; error_msg[i] != NULL; i++)
                         dev_err(&priv->pdev->dev, error_msg[i]);
+        } else {
+                tty_kref_put(tty);
         }
 }
 
diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index d0d972f7e43e..0489a2bdcdf9 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -732,7 +732,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data)
 static void tegra_uart_stop_rx(struct uart_port *u)
 {
         struct tegra_uart_port *tup = to_tegra_uport(u);
-        struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port);
+        struct tty_struct *tty;
         struct tty_port *port = &u->state->port;
         struct dma_tx_state state;
         unsigned long ier;
@@ -744,6 +744,8 @@ static void tegra_uart_stop_rx(struct uart_port *u)
         if (!tup->rx_in_progress)
                 return;
 
+        tty = tty_port_tty_get(&tup->uport.state->port);
+
         tegra_uart_wait_sym_time(tup, 1); /* wait a character interval */
 
         ier = tup->ier_shadow;
diff --git a/drivers/tty/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c
index 93b697a0de65..15ad6fcda88b 100644
--- a/drivers/tty/serial/vt8500_serial.c
+++ b/drivers/tty/serial/vt8500_serial.c
@@ -561,12 +561,13 @@ static int vt8500_serial_probe(struct platform_device *pdev)
         if (!mmres || !irqres)
                 return -ENODEV;
 
-        if (np)
+        if (np) {
                 port = of_alias_get_id(np, "serial");
                 if (port >= VT8500_MAX_PORTS)
                         port = -1;
-        else
+        } else {
                 port = -1;
+        }
 
         if (port < 0) {
                 /* calculate the port id */
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 03ba081c5772..6fd60fece6b4 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -1201,6 +1201,9 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                 }
                 return 0;
         case TCFLSH:
+                retval = tty_check_change(tty);
+                if (retval)
+                        return retval;
                 return __tty_perform_flush(tty, arg);
         default:
                 /* Try the mode commands */
diff --git a/drivers/usb/chipidea/Kconfig b/drivers/usb/chipidea/Kconfig
index 4a851e15e58c..77b47d82c9a6 100644
--- a/drivers/usb/chipidea/Kconfig
+++ b/drivers/usb/chipidea/Kconfig
@@ -1,6 +1,6 @@
 config USB_CHIPIDEA
         tristate "ChipIdea Highspeed Dual Role Controller"
-        depends on (USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)
+        depends on ((USB_EHCI_HCD && USB_GADGET) || (USB_EHCI_HCD && !USB_GADGET) || (!USB_EHCI_HCD && USB_GADGET)) && HAS_DMA
         help
           Say Y here if your system has a dual role high speed USB
           controller based on ChipIdea silicon IP. Currently, only the
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 74d998d9b45b..be822a2c1776 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -131,7 +131,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                 if (ret) {
                         dev_err(&pdev->dev, "usbmisc init failed, ret=%d\n",
                                         ret);
-                        goto err_clk;
+                        goto err_phy;
                 }
         }
 
@@ -143,7 +143,7 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev,
                         "Can't register ci_hdrc platform device, err=%d\n",
                         ret);
-                goto err_clk;
+                goto err_phy;
         }
 
         if (data->usbmisc_data) {
@@ -164,6 +164,9 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 
 disable_device:
         ci_hdrc_remove_device(data->ci_pdev);
+err_phy:
+        if (data->phy)
+                usb_phy_shutdown(data->phy);
 err_clk:
         clk_disable_unprepare(data->clk);
         return ret;
diff --git a/drivers/usb/chipidea/ci_hdrc_pci.c b/drivers/usb/chipidea/ci_hdrc_pci.c
index 042320a6c6c7..d514332ac081 100644
--- a/drivers/usb/chipidea/ci_hdrc_pci.c
+++ b/drivers/usb/chipidea/ci_hdrc_pci.c
@@ -129,7 +129,12 @@ static DEFINE_PCI_DEVICE_TABLE(ci_hdrc_pci_id_table) = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0829),
                 .driver_data = (kernel_ulong_t)&penwell_pci_platdata,
         },
-        { 0, 0, 0, 0, 0, 0, 0 /* end: all zeroes */ }
+        {
+                /* Intel Clovertrail */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe006),
+                .driver_data = (kernel_ulong_t)&penwell_pci_platdata,
+        },
+        { 0 } /* end: all zeroes */
 };
 MODULE_DEVICE_TABLE(pci, ci_hdrc_pci_id_table);
 
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 94626409559a..23763dcec069 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -605,6 +605,7 @@ static int ci_hdrc_remove(struct platform_device *pdev)
         dbg_remove_files(ci);
         free_irq(ci->irq, ci);
         ci_role_destroy(ci);
+        kfree(ci->hw_bank.regmap);
 
         return 0;
 }
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 6f96795dd20c..64d7a6d9a1ad 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -100,8 +100,10 @@ static void host_stop(struct ci_hdrc *ci)
 {
         struct usb_hcd *hcd = ci->hcd;
 
-        usb_remove_hcd(hcd);
-        usb_put_hcd(hcd);
+        if (hcd) {
+                usb_remove_hcd(hcd);
+                usb_put_hcd(hcd);
+        }
         if (ci->platdata->reg_vbus)
                 regulator_disable(ci->platdata->reg_vbus);
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 6b4c2f2eb946..9333083dd111 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1600,6 +1600,8 @@ static void destroy_eps(struct ci_hdrc *ci)
         for (i = 0; i < ci->hw_ep_max; i++) {
                 struct ci_hw_ep *hwep = &ci->ci_hw_ep[i];
 
+                if (hwep->pending_td)
+                        free_pending_td(hwep);
                 dma_pool_free(ci->qh_pool, hwep->qh.ptr, hwep->qh.dma);
         }
 }
@@ -1667,13 +1669,13 @@ static int ci_udc_stop(struct usb_gadget *gadget,
                 if (ci->platdata->notify_event)
                         ci->platdata->notify_event(ci,
                         CI_HDRC_CONTROLLER_STOPPED_EVENT);
-                ci->driver = NULL;
                 spin_unlock_irqrestore(&ci->lock, flags);
                 _gadget_stop_activity(&ci->gadget);
                 spin_lock_irqsave(&ci->lock, flags);
                 pm_runtime_put(&ci->gadget.dev);
         }
 
+        ci->driver = NULL;
         spin_unlock_irqrestore(&ci->lock, flags);
 
         return 0;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 737e3c19967b..71dc5d768fa5 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -742,6 +742,22 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
                 if ((index & ~USB_DIR_IN) == 0)
                         return 0;
                 ret = findintfep(ps->dev, index);
+                if (ret < 0) {
+                        /*
+                         * Some not fully compliant Win apps seem to get
+                         * index wrong and have the endpoint number here
+                         * rather than the endpoint address (with the
+                         * correct direction). Win does let this through,
+                         * so we'll not reject it here but leave it to
+                         * the device to not break KVM. But we warn.
+                         */
+                        ret = findintfep(ps->dev, index ^ 0x80);
+                        if (ret >= 0)
+                                dev_info(&ps->dev->dev,
+                                        "%s: process %i (%s) requesting ep %02x but needs %02x\n",
+                                        __func__, task_pid_nr(current),
+                                        current->comm, index, index ^ 0x80);
+                }
                 if (ret >= 0)
                         ret = checkintf(ps, ret);
                 break;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index dde4c83516a1..e6b682c6c236 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3426,6 +3426,9 @@ static int usb_req_set_sel(struct usb_device *udev, enum usb3_link_state state)
         unsigned long long u2_pel;
         int ret;
 
+        if (udev->state != USB_STATE_CONFIGURED)
+                return 0;
+
         /* Convert SEL and PEL stored in ns to us */
         u1_sel = DIV_ROUND_UP(udev->u1_params.sel, 1000);
         u1_pel = DIV_ROUND_UP(udev->u1_params.pel, 1000);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5b44cd47da5b..01fe36273f3b 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -97,6 +97,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Alcor Micro Corp. Hub */
         { USB_DEVICE(0x058f, 0x9254), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* MicroTouch Systems touchscreen */
+        { USB_DEVICE(0x0596, 0x051e), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* appletouch */
         { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 
@@ -130,6 +133,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Broadcom BCM92035DGROM BT dongle */
         { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* MAYA44USB sound device */
+        { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Action Semiconductor flash disk */
         { USB_DEVICE(0x10d6, 0x2200), .driver_info =
                         USB_QUIRK_STRING_FETCH_255 },
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 997ebe420bc9..2e252aae51ca 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -29,6 +29,7 @@
 #define PCI_VENDOR_ID_SYNOPSYS          0x16c3
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
 #define PCI_DEVICE_ID_INTEL_BYT         0x0f37
+#define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
 
 struct dwc3_pci {
         struct device           *dev;
@@ -189,6 +190,7 @@ static DEFINE_PCI_DEVICE_TABLE(dwc3_pci_id_table) = {
                                 PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
         },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
         {  }    /* Terminating Entry */
 };
 MODULE_DEVICE_TABLE(pci, dwc3_pci_id_table);
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 1a66c5baa0d1..44cf775a8627 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1034,37 +1034,19 @@ struct ffs_sb_fill_data {
         struct ffs_file_perms perms;
         umode_t root_mode;
         const char *dev_name;
-        union {
-                /* set by ffs_fs_mount(), read by ffs_sb_fill() */
-                void *private_data;
-                /* set by ffs_sb_fill(), read by ffs_fs_mount */
-                struct ffs_data *ffs_data;
-        };
+        struct ffs_data *ffs_data;
 };
 
 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
 {
         struct ffs_sb_fill_data *data = _data;
         struct inode    *inode;
-        struct ffs_data *ffs;
+        struct ffs_data *ffs = data->ffs_data;
 
         ENTER();
 
-        /* Initialise data */
-        ffs = ffs_data_new();
-        if (unlikely(!ffs))
-                goto Enomem;
-
         ffs->sb              = sb;
-        ffs->dev_name        = kstrdup(data->dev_name, GFP_KERNEL);
-        if (unlikely(!ffs->dev_name))
-                goto Enomem;
-        ffs->file_perms      = data->perms;
-        ffs->private_data    = data->private_data;
-
-        /* used by the caller of this function */
-        data->ffs_data       = ffs;
-
+        data->ffs_data       = NULL;
         sb->s_fs_info        = ffs;
         sb->s_blocksize      = PAGE_CACHE_SIZE;
         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
@@ -1080,17 +1062,14 @@ static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
                                   &data->perms);
         sb->s_root = d_make_root(inode);
         if (unlikely(!sb->s_root))
-                goto Enomem;
+                return -ENOMEM;
 
         /* EP0 file */
         if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
                                          &ffs_ep0_operations, NULL)))
-                goto Enomem;
+                return -ENOMEM;
 
         return 0;
-
-Enomem:
-        return -ENOMEM;
 }
 
 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
@@ -1193,6 +1172,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
         struct dentry *rv;
         int ret;
         void *ffs_dev;
+        struct ffs_data *ffs;
 
         ENTER();
 
@@ -1200,18 +1180,30 @@ ffs_fs_mount(struct file_system_type *t, int flags,
         if (unlikely(ret < 0))
                 return ERR_PTR(ret);
 
+        ffs = ffs_data_new();
+        if (unlikely(!ffs))
+                return ERR_PTR(-ENOMEM);
+        ffs->file_perms = data.perms;
+
+        ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
+        if (unlikely(!ffs->dev_name)) {
+                ffs_data_put(ffs);
+                return ERR_PTR(-ENOMEM);
+        }
+
         ffs_dev = functionfs_acquire_dev_callback(dev_name);
-        if (IS_ERR(ffs_dev))
-                return ffs_dev;
+        if (IS_ERR(ffs_dev)) {
+                ffs_data_put(ffs);
+                return ERR_CAST(ffs_dev);
+        }
+        ffs->private_data = ffs_dev;
+        data.ffs_data = ffs;
 
-        data.dev_name = dev_name;
-        data.private_data = ffs_dev;
         rv = mount_nodev(t, flags, &data, ffs_sb_fill);
-
-        /* data.ffs_data is set by ffs_sb_fill */
-        if (IS_ERR(rv))
+        if (IS_ERR(rv) && data.ffs_data) {
                 functionfs_release_dev_callback(data.ffs_data);
-
+                ffs_data_put(data.ffs_data);
+        }
         return rv;
 }
 
@@ -2264,6 +2256,8 @@ static int ffs_func_bind(struct usb_configuration *c,
                                    data->raw_descs + ret,
                                    (sizeof data->raw_descs) - ret,
                                    __ffs_func_bind_do_descs, func);
+                if (unlikely(ret < 0))
+                        goto error;
         }
 
         /*
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index cc9207473dbc..0ac6064aa3b8 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -2054,7 +2054,7 @@ static struct pxa25x_udc memory = {
 /*
  *      probe - binds to the platform device
  */
-static int __init pxa25x_udc_probe(struct platform_device *pdev)
+static int pxa25x_udc_probe(struct platform_device *pdev)
 {
         struct pxa25x_udc *dev = &memory;
         int retval, irq;
@@ -2203,7 +2203,7 @@ static void pxa25x_udc_shutdown(struct platform_device *_dev)
         pullup_off();
 }
 
-static int __exit pxa25x_udc_remove(struct platform_device *pdev)
+static int pxa25x_udc_remove(struct platform_device *pdev)
 {
         struct pxa25x_udc *dev = platform_get_drvdata(pdev);
 
@@ -2294,7 +2294,8 @@ static int pxa25x_udc_resume(struct platform_device *dev)
 
 static struct platform_driver udc_driver = {
         .shutdown       = pxa25x_udc_shutdown,
-        .remove         = __exit_p(pxa25x_udc_remove),
+        .probe          = pxa25x_udc_probe,
+        .remove         = pxa25x_udc_remove,
         .suspend        = pxa25x_udc_suspend,
         .resume         = pxa25x_udc_resume,
         .driver         = {
@@ -2303,7 +2304,7 @@ static struct platform_driver udc_driver = {
         },
 };
 
-module_platform_driver_probe(udc_driver, pxa25x_udc_probe);
+module_platform_driver(udc_driver);
 
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Frank Becker, Robert Schwebel, David Brownell");
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 6bddf1aa2347..a8a99e4748d5 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -543,7 +543,7 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
          * FIFO, requests of >512 cause the endpoint to get stuck with a
          * fragment of the end of the transfer in it.
          */
-        if (can_write > 512)
+        if (can_write > 512 && !periodic)
                 can_write = 512;
 
         /*
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 4449f565d6c6..f2407b2e8a99 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -130,7 +130,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
         }
 
         /* Enable USB controller, 83xx or 8536 */
-        if (pdata->have_sysif_regs)
+        if (pdata->have_sysif_regs && pdata->controller_ver < FSL_USB_VER_1_6)
                 setbits32(hcd->regs + FSL_SOC_USB_CTRL, 0x4);
 
         /* Don't need to set host mode here. It will be done by tdi_reset() */
@@ -232,15 +232,9 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
         case FSL_USB2_PHY_ULPI:
                 if (pdata->have_sysif_regs && pdata->controller_ver) {
                         /* controller version 1.6 or above */
+                        clrbits32(non_ehci + FSL_SOC_USB_CTRL, UTMI_PHY_EN);
                         setbits32(non_ehci + FSL_SOC_USB_CTRL,
-                                        ULPI_PHY_CLK_SEL);
-                        /*
-                         * Due to controller issue of PHY_CLK_VALID in ULPI
-                         * mode, we set USB_CTRL_USB_EN before checking
-                         * PHY_CLK_VALID, otherwise PHY_CLK_VALID doesn't work.
-                         */
-                        clrsetbits_be32(non_ehci + FSL_SOC_USB_CTRL,
-                                        UTMI_PHY_EN, USB_CTRL_USB_EN);
+                                ULPI_PHY_CLK_SEL | USB_CTRL_USB_EN);
                 }
                 portsc |= PORT_PTS_ULPI;
                 break;
@@ -270,8 +264,9 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
         if (pdata->have_sysif_regs && pdata->controller_ver &&
             (phy_mode == FSL_USB2_PHY_ULPI)) {
                 /* check PHY_CLK_VALID to get phy clk valid */
-                if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
-                                PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0)) {
+                if (!(spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
+                                PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0) ||
+                                in_be32(non_ehci + FSL_SOC_USB_PRICTRL))) {
                         printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
                         return -EINVAL;
                 }
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 6bd299e61f58..854c2ec7b699 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -361,7 +361,7 @@ static struct pci_driver ehci_pci_driver = {
         .remove =       usb_hcd_pci_remove,
         .shutdown =     usb_hcd_pci_shutdown,
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
         .driver =       {
                 .pm =   &usb_hcd_pci_pm_ops
         },
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index 60a5de505ca1..adb01d950a16 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -824,13 +824,13 @@ static int imx21_hc_urb_enqueue_isoc(struct usb_hcd *hcd,
                         i = DIV_ROUND_UP(wrap_frame(
                                         cur_frame - urb->start_frame),
                                         urb->interval);
-                        if (urb->transfer_flags & URB_ISO_ASAP) {
+
+                        /* Treat underruns as if URB_ISO_ASAP was set */
+                        if ((urb->transfer_flags & URB_ISO_ASAP) ||
+                                        i >= urb->number_of_packets) {
                                 urb->start_frame = wrap_frame(urb->start_frame
                                                 + i * urb->interval);
                                 i = 0;
-                        } else if (i >= urb->number_of_packets) {
-                                ret = -EXDEV;
-                                goto alloc_dmem_failed;
                         }
                 }
         }
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 8f6b695af6a4..604cad1bcf9c 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -216,31 +216,26 @@ static int ohci_urb_enqueue (
                         frame &= ~(ed->interval - 1);
                         frame |= ed->branch;
                         urb->start_frame = frame;
+                        ed->last_iso = frame + ed->interval * (size - 1);
                 }
         } else if (ed->type == PIPE_ISOCHRONOUS) {
                 u16     next = ohci_frame_no(ohci) + 1;
                 u16     frame = ed->last_iso + ed->interval;
+                u16     length = ed->interval * (size - 1);
 
                 /* Behind the scheduling threshold? */
                 if (unlikely(tick_before(frame, next))) {
 
-                        /* USB_ISO_ASAP: Round up to the first available slot */
+                        /* URB_ISO_ASAP: Round up to the first available slot */
                         if (urb->transfer_flags & URB_ISO_ASAP) {
                                 frame += (next - frame + ed->interval - 1) &
                                                 -ed->interval;
 
                         /*
-                         * Not ASAP: Use the next slot in the stream.  If
-                         * the entire URB falls before the threshold, fail.
+                         * Not ASAP: Use the next slot in the stream,
+                         * no matter what.
                          */
                         } else {
-                                if (tick_before(frame + ed->interval *
-                                        (urb->number_of_packets - 1), next)) {
-                                        retval = -EXDEV;
-                                        usb_hcd_unlink_urb_from_ep(hcd, urb);
-                                        goto fail;
-                                }
-
                                 /*
                                  * Some OHCI hardware doesn't handle late TDs
                                  * correctly.  After retiring them it proceeds
@@ -251,9 +246,16 @@ static int ohci_urb_enqueue (
                                 urb_priv->td_cnt = DIV_ROUND_UP(
                                                 (u16) (next - frame),
                                                 ed->interval);
+                                if (urb_priv->td_cnt >= urb_priv->length) {
+                                        ++urb_priv->td_cnt;     /* Mark it */
+                                        ohci_dbg(ohci, "iso underrun %p (%u+%u < %u)\n",
+                                                        urb, frame, length,
+                                                        next);
+                                }
                         }
                 }
                 urb->start_frame = frame;
+                ed->last_iso = frame + length;
         }
 
         /* fill the TDs and link them to the ed; and
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index df4a6707322d..e7f577e63624 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -41,9 +41,13 @@ finish_urb(struct ohci_hcd *ohci, struct urb *urb, int status)
 __releases(ohci->lock)
 __acquires(ohci->lock)
 {
-         struct device *dev = ohci_to_hcd(ohci)->self.controller;
+        struct device *dev = ohci_to_hcd(ohci)->self.controller;
+        struct usb_host_endpoint *ep = urb->ep;
+        struct urb_priv *urb_priv;
+
         // ASSERT (urb->hcpriv != 0);
 
+ restart:
         urb_free_priv (ohci, urb->hcpriv);
         urb->hcpriv = NULL;
         if (likely(status == -EINPROGRESS))
@@ -80,6 +84,21 @@ __acquires(ohci->lock)
                 ohci->hc_control &= ~(OHCI_CTRL_PLE|OHCI_CTRL_IE);
                 ohci_writel (ohci, ohci->hc_control, &ohci->regs->control);
         }
+
+        /*
+         * An isochronous URB that is sumitted too late won't have any TDs
+         * (marked by the fact that the td_cnt value is larger than the
+         * actual number of TDs).  If the next URB on this endpoint is like
+         * that, give it back now.
+         */
+        if (!list_empty(&ep->urb_list)) {
+                urb = list_first_entry(&ep->urb_list, struct urb, urb_list);
+                urb_priv = urb->hcpriv;
+                if (urb_priv->td_cnt > urb_priv->length) {
+                        status = 0;
+                        goto restart;
+                }
+        }
 }
 
 
@@ -546,7 +565,6 @@ td_fill (struct ohci_hcd *ohci, u32 info,
                 td->hwCBP = cpu_to_hc32 (ohci, data & 0xFFFFF000);
                 *ohci_hwPSWp(ohci, td, 0) = cpu_to_hc16 (ohci,
                                                 (data & 0x0FFF) | 0xE000);
-                td->ed->last_iso = info & 0xffff;
         } else {
                 td->hwCBP = cpu_to_hc32 (ohci, data);
         }
@@ -996,7 +1014,7 @@ rescan_this:
                         urb_priv->td_cnt++;
 
                         /* if URB is done, clean up */
-                        if (urb_priv->td_cnt == urb_priv->length) {
+                        if (urb_priv->td_cnt >= urb_priv->length) {
                                 modified = completed = 1;
                                 finish_urb(ohci, urb, 0);
                         }
@@ -1086,7 +1104,7 @@ static void takeback_td(struct ohci_hcd *ohci, struct td *td)
         urb_priv->td_cnt++;
 
         /* If all this urb's TDs are done, call complete() */
-        if (urb_priv->td_cnt == urb_priv->length)
+        if (urb_priv->td_cnt >= urb_priv->length)
                 finish_urb(ohci, urb, status);
 
         /* clean schedule:  unlink EDs that are no longer busy */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 2c76ef1320ea..08ef2829a7e2 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -799,7 +799,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
          * switchable ports.
          */
         pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
-                        cpu_to_le32(ports_available));
+                        ports_available);
 
         pci_read_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
                         &ports_available);
@@ -821,7 +821,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
          * host.
          */
         pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
-                        cpu_to_le32(ports_available));
+                        ports_available);
 
         pci_read_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
                         &ports_available);
diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c
index c300bd2f7d1c..0f228c46eeda 100644
--- a/drivers/usb/host/uhci-pci.c
+++ b/drivers/usb/host/uhci-pci.c
@@ -293,7 +293,7 @@ static struct pci_driver uhci_pci_driver = {
         .remove =       usb_hcd_pci_remove,
         .shutdown =     uhci_shutdown,
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
         .driver =       {
                 .pm =   &usb_hcd_pci_pm_ops
         },
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 041c6ddb695c..da6f56d996ce 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -1303,7 +1303,7 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                 }
 
                 /* Fell behind? */
-                if (uhci_frame_before_eq(frame, next)) {
+                if (!uhci_frame_before_eq(next, frame)) {
 
                         /* USB_ISO_ASAP: Round up to the first available slot */
                         if (urb->transfer_flags & URB_ISO_ASAP)
@@ -1311,13 +1311,17 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
                                                 -qh->period;
 
                         /*
-                         * Not ASAP: Use the next slot in the stream.  If
-                         * the entire URB falls before the threshold, fail.
+                         * Not ASAP: Use the next slot in the stream,
+                         * no matter what.
                          */
                         else if (!uhci_frame_before_eq(next,
                                         frame + (urb->number_of_packets - 1) *
                                                 qh->period))
-                                return -EXDEV;
+                                dev_dbg(uhci_dev(uhci), "iso underrun %p (%u+%u < %u)\n",
+                                                urb, frame,
+                                                (urb->number_of_packets - 1) *
+                                                        qh->period,
+                                                next);
                 }
         }
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index fae697ed0b70..e8b4c56dcf62 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -287,7 +287,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
                 if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue)
                         xhci_queue_stop_endpoint(xhci, slot_id, i, suspend);
         }
-        cmd->command_trb = xhci->cmd_ring->enqueue;
+        cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
         list_add_tail(&cmd->cmd_list, &virt_dev->cmd_list);
         xhci_queue_stop_endpoint(xhci, slot_id, 0, suspend);
         xhci_ring_cmd_db(xhci);
@@ -552,11 +552,15 @@ void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
  *  - Mark a port as being done with device resume,
  *    and ring the endpoint doorbells.
  *  - Stop the Synopsys redriver Compliance Mode polling.
+ *  - Drop and reacquire the xHCI lock, in order to wait for port resume.
  */
 static u32 xhci_get_port_status(struct usb_hcd *hcd,
                 struct xhci_bus_state *bus_state,
                 __le32 __iomem **port_array,
-                u16 wIndex, u32 raw_port_status)
+                u16 wIndex, u32 raw_port_status,
+                unsigned long flags)
+        __releases(&xhci->lock)
+        __acquires(&xhci->lock)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         u32 status = 0;
@@ -591,21 +595,42 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                         return 0xffffffff;
                 if (time_after_eq(jiffies,
                                         bus_state->resume_done[wIndex])) {
+                        int time_left;
+
                         xhci_dbg(xhci, "Resume USB2 port %d\n",
                                         wIndex + 1);
                         bus_state->resume_done[wIndex] = 0;
                         clear_bit(wIndex, &bus_state->resuming_ports);
+
+                        set_bit(wIndex, &bus_state->rexit_ports);
                         xhci_set_link_state(xhci, port_array, wIndex,
                                         XDEV_U0);
-                        xhci_dbg(xhci, "set port %d resume\n",
-                                        wIndex + 1);
-                        slot_id = xhci_find_slot_id_by_port(hcd, xhci,
-                                        wIndex + 1);
-                        if (!slot_id) {
-                                xhci_dbg(xhci, "slot_id is zero\n");
-                                return 0xffffffff;
+
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        time_left = wait_for_completion_timeout(
+                                        &bus_state->rexit_done[wIndex],
+                                        msecs_to_jiffies(
+                                                XHCI_MAX_REXIT_TIMEOUT));
+                        spin_lock_irqsave(&xhci->lock, flags);
+
+                        if (time_left) {
+                                slot_id = xhci_find_slot_id_by_port(hcd,
+                                                xhci, wIndex + 1);
+                                if (!slot_id) {
+                                        xhci_dbg(xhci, "slot_id is zero\n");
+                                        return 0xffffffff;
+                                }
+                                xhci_ring_device(xhci, slot_id);
+                        } else {
+                                int port_status = xhci_readl(xhci,
+                                                port_array[wIndex]);
+                                xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
+                                                XHCI_MAX_REXIT_TIMEOUT,
+                                                port_status);
+                                status |= USB_PORT_STAT_SUSPEND;
+                                clear_bit(wIndex, &bus_state->rexit_ports);
                         }
-                        xhci_ring_device(xhci, slot_id);
+
                         bus_state->port_c_suspend |= 1 << wIndex;
                         bus_state->suspended_ports &= ~(1 << wIndex);
                 } else {
@@ -728,7 +753,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                         break;
                 }
                 status = xhci_get_port_status(hcd, bus_state, port_array,
-                                wIndex, temp);
+                                wIndex, temp, flags);
                 if (status == 0xffffffff)
                         goto error;
 
@@ -1132,18 +1157,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                 t1 = xhci_port_state_to_neutral(t1);
                 if (t1 != t2)
                         xhci_writel(xhci, t2, port_array[port_index]);
-
-                if (hcd->speed != HCD_USB3) {
-                        /* enable remote wake up for USB 2.0 */
-                        __le32 __iomem *addr;
-                        u32 tmp;
-
-                        /* Get the port power control register address. */
-                        addr = port_array[port_index] + PORTPMSC;
-                        tmp = xhci_readl(xhci, addr);
-                        tmp |= PORT_RWE;
-                        xhci_writel(xhci, tmp, addr);
-                }
         }
         hcd->state = HC_STATE_SUSPENDED;
         bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
@@ -1222,20 +1235,6 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                                 xhci_ring_device(xhci, slot_id);
                 } else
                         xhci_writel(xhci, temp, port_array[port_index]);
-
-                if (hcd->speed != HCD_USB3) {
-                        /* disable remote wake up for USB 2.0 */
-                        __le32 __iomem *addr;
-                        u32 tmp;
-
-                        /* Add one to the port status register address to get
-                         * the port power control register address.
-                         */
-                        addr = port_array[port_index] + PORTPMSC;
-                        tmp = xhci_readl(xhci, addr);
-                        tmp &= ~PORT_RWE;
-                        xhci_writel(xhci, tmp, addr);
-                }
         }
 
         (void) xhci_readl(xhci, &xhci->op_regs->command);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 53b972c2a09f..83bcd13622c3 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2428,6 +2428,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
         for (i = 0; i < USB_MAXCHILDREN; ++i) {
                 xhci->bus_state[0].resume_done[i] = 0;
                 xhci->bus_state[1].resume_done[i] = 0;
+                /* Only the USB 2.0 completions will ever be used. */
+                init_completion(&xhci->bus_state[1].rexit_done[i]);
         }
 
         if (scratchpad_alloc(xhci, flags))
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index c2d495057eb5..b8dffd59eb25 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -35,6 +35,9 @@
 #define PCI_VENDOR_ID_ETRON             0x1b6f
 #define PCI_DEVICE_ID_ASROCK_P67        0x7023
 
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI      0x8c31
+#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
+
 static const char hcd_name[] = "xhci_hcd";
 
 /* called after powerup, by probe or system-pm "wakeup" */
@@ -69,6 +72,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                                 "QUIRK: Fresco Logic xHC needs configure"
                                 " endpoint cmd after reset endpoint");
                 }
+                if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+                                pdev->revision == 0x4) {
+                        xhci->quirks |= XHCI_SLOW_SUSPEND;
+                        xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+                                "QUIRK: Fresco Logic xHC revision %u"
+                                "must be suspended extra slowly",
+                                pdev->revision);
+                }
                 /* Fresco Logic confirms: all revisions of this chip do not
                  * support MSI, even though some of them claim to in their PCI
                  * capabilities.
@@ -110,6 +121,15 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
                 xhci->quirks |= XHCI_AVOID_BEI;
         }
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+            (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
+                /* Workaround for occasional spurious wakeups from S5 (or
+                 * any other sleep) on Haswell machines with LPT and LPT-LP
+                 * with the new Intel BIOS
+                 */
+                xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+        }
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
                         pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
@@ -217,6 +237,11 @@ static void xhci_pci_remove(struct pci_dev *dev)
                 usb_put_hcd(xhci->shared_hcd);
         }
         usb_hcd_pci_remove(dev);
+
+        /* Workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                pci_set_power_state(dev, PCI_D3hot);
+
         kfree(xhci);
 }
 
@@ -351,7 +376,7 @@ static struct pci_driver xhci_pci_driver = {
         /* suspend and resume implemented later */
 
         .shutdown =     usb_hcd_pci_shutdown,
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
         .driver = {
                 .pm = &usb_hcd_pci_pm_ops
         },
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 411da1fc7ae8..6bfbd80ec2b9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -123,6 +123,16 @@ static int enqueue_is_link_trb(struct xhci_ring *ring)
         return TRB_TYPE_LINK_LE32(link->control);
 }
 
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring)
+{
+        /* Enqueue pointer can be left pointing to the link TRB,
+         * we must handle that
+         */
+        if (TRB_TYPE_LINK_LE32(ring->enqueue->link.control))
+                return ring->enq_seg->next->trbs;
+        return ring->enqueue;
+}
+
 /* Updates trb to point to the next TRB in the ring, and updates seg if the next
  * TRB is in a new segment.  This does not skip over link TRBs, and it does not
  * effect the ring dequeue or enqueue pointers.
@@ -859,8 +869,12 @@ remove_finished_td:
                 /* Otherwise ring the doorbell(s) to restart queued transfers */
                 ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
         }
-        ep->stopped_td = NULL;
-        ep->stopped_trb = NULL;
+
+        /* Clear stopped_td and stopped_trb if endpoint is not halted */
+        if (!(ep->ep_state & EP_HALTED)) {
+                ep->stopped_td = NULL;
+                ep->stopped_trb = NULL;
+        }
 
         /*
          * Drop the lock and complete the URBs in the cancelled TD list.
@@ -1414,6 +1428,12 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                         inc_deq(xhci, xhci->cmd_ring);
                         return;
                 }
+                /* There is no command to handle if we get a stop event when the
+                 * command ring is empty, event->cmd_trb points to the next
+                 * unset command
+                 */
+                if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
+                        return;
         }
 
         switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
@@ -1743,6 +1763,19 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 }
         }
 
+        /*
+         * Check to see if xhci-hub.c is waiting on RExit to U0 transition (or
+         * RExit to a disconnect state).  If so, let the the driver know it's
+         * out of the RExit state.
+         */
+        if (!DEV_SUPERSPEED(temp) &&
+                        test_and_clear_bit(faked_port_index,
+                                &bus_state->rexit_ports)) {
+                complete(&bus_state->rexit_done[faked_port_index]);
+                bogus_port_status = true;
+                goto cleanup;
+        }
+
         if (hcd->speed != HCD_USB3)
                 xhci_test_and_clear_bit(xhci, port_array, faked_port_index,
                                         PORT_PLC);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 49b6edb84a79..6e0d886bcce5 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -730,6 +730,9 @@ void xhci_shutdown(struct usb_hcd *hcd)
 
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
+        /* Workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                xhci_reset(xhci);
         spin_unlock_irq(&xhci->lock);
 
         xhci_cleanup_msix(xhci);
@@ -737,6 +740,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "xhci_shutdown completed - status = %x",
                         xhci_readl(xhci, &xhci->op_regs->status));
+
+        /* Yet another workaround for spurious wakeups at shutdown with HSW */
+        if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+                pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot);
 }
 
 #ifdef CONFIG_PM
@@ -839,6 +846,7 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
 int xhci_suspend(struct xhci_hcd *xhci)
 {
         int                     rc = 0;
+        unsigned int            delay = XHCI_MAX_HALT_USEC;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
         u32                     command;
 
@@ -861,8 +869,12 @@ int xhci_suspend(struct xhci_hcd *xhci)
         command = xhci_readl(xhci, &xhci->op_regs->command);
         command &= ~CMD_RUN;
         xhci_writel(xhci, command, &xhci->op_regs->command);
+
+        /* Some chips from Fresco Logic need an extraordinary delay */
+        delay *= (xhci->quirks & XHCI_SLOW_SUSPEND) ? 10 : 1;
+
         if (xhci_handshake(xhci, &xhci->op_regs->status,
-                      STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC)) {
+                      STS_HALT, STS_HALT, delay)) {
                 xhci_warn(xhci, "WARN: xHC CMD_RUN timeout\n");
                 spin_unlock_irq(&xhci->lock);
                 return -ETIMEDOUT;
@@ -2598,15 +2610,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
         if (command) {
                 cmd_completion = command->completion;
                 cmd_status = &command->status;
-                command->command_trb = xhci->cmd_ring->enqueue;
-
-                /* Enqueue pointer can be left pointing to the link TRB,
-                 * we must handle that
-                 */
-                if (TRB_TYPE_LINK_LE32(command->command_trb->link.control))
-                        command->command_trb =
-                                xhci->cmd_ring->enq_seg->next->trbs;
-
+                command->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
                 list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
         } else {
                 cmd_completion = &virt_dev->cmd_completion;
@@ -2614,7 +2618,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
         }
         init_completion(cmd_completion);
 
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
         if (!ctx_change)
                 ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
                                 udev->slot_id, must_succeed);
@@ -3439,14 +3443,7 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
 
         /* Attempt to submit the Reset Device command to the command ring */
         spin_lock_irqsave(&xhci->lock, flags);
-        reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;
-
-        /* Enqueue pointer can be left pointing to the link TRB,
-         * we must handle that
-         */
-        if (TRB_TYPE_LINK_LE32(reset_device_cmd->command_trb->link.control))
-                reset_device_cmd->command_trb =
-                        xhci->cmd_ring->enq_seg->next->trbs;
+        reset_device_cmd->command_trb = xhci_find_next_enqueue(xhci->cmd_ring);
 
         list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);
         ret = xhci_queue_reset_device(xhci, slot_id);
@@ -3650,7 +3647,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
         union xhci_trb *cmd_trb;
 
         spin_lock_irqsave(&xhci->lock, flags);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
         ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);
         if (ret) {
                 spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3785,7 +3782,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
                                 slot_ctx->dev_info >> 27);
 
         spin_lock_irqsave(&xhci->lock, flags);
-        cmd_trb = xhci->cmd_ring->dequeue;
+        cmd_trb = xhci_find_next_enqueue(xhci->cmd_ring);
         ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
                                         udev->slot_id);
         if (ret) {
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 46aa14894148..941d5f59e4dc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1412,8 +1412,18 @@ struct xhci_bus_state {
         unsigned long           resume_done[USB_MAXCHILDREN];
         /* which ports have started to resume */
         unsigned long           resuming_ports;
+        /* Which ports are waiting on RExit to U0 transition. */
+        unsigned long           rexit_ports;
+        struct completion       rexit_done[USB_MAXCHILDREN];
 };
 
+
+/*
+ * It can take up to 20 ms to transition from RExit to U0 on the
+ * Intel Lynx Point LP xHCI host.
+ */
+#define XHCI_MAX_REXIT_TIMEOUT  (20 * 1000)
+
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
         if (hcd->speed == HCD_USB3)
@@ -1538,6 +1548,8 @@ struct xhci_hcd {
 #define XHCI_COMP_MODE_QUIRK    (1 << 14)
 #define XHCI_AVOID_BEI          (1 << 15)
 #define XHCI_PLAT               (1 << 16)
+#define XHCI_SLOW_SUSPEND       (1 << 17)
+#define XHCI_SPURIOUS_WAKEUP    (1 << 18)
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
         /* There are two roothubs to keep track of bus suspend info for */
@@ -1840,6 +1852,7 @@ int xhci_cancel_cmd(struct xhci_hcd *xhci, struct xhci_command *command,
                 union xhci_trb *cmd_trb);
 void xhci_ring_ep_doorbell(struct xhci_hcd *xhci, unsigned int slot_id,
                 unsigned int ep_index, unsigned int stream_id);
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring);
 
 /* xHCI roothub code */
 void xhci_set_link_state(struct xhci_hcd *xhci, __le32 __iomem **port_array,
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index e2b21c1d9c40..ba5f70f92888 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -246,6 +246,6 @@ config USB_EZUSB_FX2
 config USB_HSIC_USB3503
        tristate "USB3503 HSIC to USB20 Driver"
        depends on I2C
-       select REGMAP
+       select REGMAP_I2C
        help
          This option enables support for SMSC USB3503 HSIC to USB 2.0 Driver.
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 18e877ffe7b7..cd70cc886171 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -922,6 +922,52 @@ static void musb_generic_disable(struct musb *musb)
 }
 
 /*
+ * Program the HDRC to start (enable interrupts, dma, etc.).
+ */
+void musb_start(struct musb *musb)
+{
+        void __iomem    *regs = musb->mregs;
+        u8              devctl = musb_readb(regs, MUSB_DEVCTL);
+
+        dev_dbg(musb->controller, "<== devctl %02x\n", devctl);
+
+        /*  Set INT enable registers, enable interrupts */
+        musb->intrtxe = musb->epmask;
+        musb_writew(regs, MUSB_INTRTXE, musb->intrtxe);
+        musb->intrrxe = musb->epmask & 0xfffe;
+        musb_writew(regs, MUSB_INTRRXE, musb->intrrxe);
+        musb_writeb(regs, MUSB_INTRUSBE, 0xf7);
+
+        musb_writeb(regs, MUSB_TESTMODE, 0);
+
+        /* put into basic highspeed mode and start session */
+        musb_writeb(regs, MUSB_POWER, MUSB_POWER_ISOUPDATE
+                        | MUSB_POWER_HSENAB
+                        /* ENSUSPEND wedges tusb */
+                        /* | MUSB_POWER_ENSUSPEND */
+                   );
+
+        musb->is_active = 0;
+        devctl = musb_readb(regs, MUSB_DEVCTL);
+        devctl &= ~MUSB_DEVCTL_SESSION;
+
+        /* session started after:
+         * (a) ID-grounded irq, host mode;
+         * (b) vbus present/connect IRQ, peripheral mode;
+         * (c) peripheral initiates, using SRP
+         */
+        if (musb->port_mode != MUSB_PORT_MODE_HOST &&
+                        (devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS) {
+                musb->is_active = 1;
+        } else {
+                devctl |= MUSB_DEVCTL_SESSION;
+        }
+
+        musb_platform_enable(musb);
+        musb_writeb(regs, MUSB_DEVCTL, devctl);
+}
+
+/*
  * Make the HDRC stop (disable interrupts, etc.);
  * reversible by musb_start
  * called on gadget driver unregister
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 65f3917b4fc5..1c5bf75ee8ff 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -503,6 +503,7 @@ static inline void musb_configure_ep0(struct musb *musb)
 extern const char musb_driver_name[];
 
 extern void musb_stop(struct musb *musb);
+extern void musb_start(struct musb *musb);
 
 extern void musb_write_fifo(struct musb_hw_ep *ep, u16 len, const u8 *src);
 extern void musb_read_fifo(struct musb_hw_ep *ep, u16 len, u8 *dst);
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 4047cbb91bac..bd4138d80a48 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -535,6 +535,9 @@ static int dsps_probe(struct platform_device *pdev)
         struct dsps_glue *glue;
         int ret;
 
+        if (!strcmp(pdev->name, "musb-hdrc"))
+                return -ENODEV;
+
         match = of_match_node(musb_dsps_of_match, pdev->dev.of_node);
         if (!match) {
                 dev_err(&pdev->dev, "fail to get matching of_match struct\n");
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 9a08679d204d..3671898a4535 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1790,6 +1790,10 @@ int musb_gadget_setup(struct musb *musb)
         musb->g.max_speed = USB_SPEED_HIGH;
         musb->g.speed = USB_SPEED_UNKNOWN;
 
+        MUSB_DEV_MODE(musb);
+        musb->xceiv->otg->default_a = 0;
+        musb->xceiv->state = OTG_STATE_B_IDLE;
+
         /* this "gadget" abstracts/virtualizes the controller */
         musb->g.name = musb_driver_name;
         musb->g.is_otg = 1;
@@ -1855,6 +1859,8 @@ static int musb_gadget_start(struct usb_gadget *g,
         musb->xceiv->state = OTG_STATE_B_IDLE;
         spin_unlock_irqrestore(&musb->lock, flags);
 
+        musb_start(musb);
+
         /* REVISIT:  funcall to other code, which also
          * handles power budgeting ... this way also
          * ensures HdrcStart is indirectly called.
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index a523950c2b32..d1d6b83aabca 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -44,52 +44,6 @@
 
 #include "musb_core.h"
 
-/*
-* Program the HDRC to start (enable interrupts, dma, etc.).
-*/
-static void musb_start(struct musb *musb)
-{
-        void __iomem    *regs = musb->mregs;
-        u8              devctl = musb_readb(regs, MUSB_DEVCTL);
-
-        dev_dbg(musb->controller, "<== devctl %02x\n", devctl);
-
-        /*  Set INT enable registers, enable interrupts */
-        musb->intrtxe = musb->epmask;
-        musb_writew(regs, MUSB_INTRTXE, musb->intrtxe);
-        musb->intrrxe = musb->epmask & 0xfffe;
-        musb_writew(regs, MUSB_INTRRXE, musb->intrrxe);
-        musb_writeb(regs, MUSB_INTRUSBE, 0xf7);
-
-        musb_writeb(regs, MUSB_TESTMODE, 0);
-
-        /* put into basic highspeed mode and start session */
-        musb_writeb(regs, MUSB_POWER, MUSB_POWER_ISOUPDATE
-                                                | MUSB_POWER_HSENAB
-                                                /* ENSUSPEND wedges tusb */
-                                                /* | MUSB_POWER_ENSUSPEND */
-                                                );
-
-        musb->is_active = 0;
-        devctl = musb_readb(regs, MUSB_DEVCTL);
-        devctl &= ~MUSB_DEVCTL_SESSION;
-
-        /* session started after:
-         * (a) ID-grounded irq, host mode;
-         * (b) vbus present/connect IRQ, peripheral mode;
-         * (c) peripheral initiates, using SRP
-         */
-        if (musb->port_mode != MUSB_PORT_MODE_HOST &&
-            (devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS) {
-                musb->is_active = 1;
-        } else {
-                devctl |= MUSB_DEVCTL_SESSION;
-        }
-
-        musb_platform_enable(musb);
-        musb_writeb(regs, MUSB_DEVCTL, devctl);
-}
-
 static void musb_port_suspend(struct musb *musb, bool do_suspend)
 {
         struct usb_otg  *otg = musb->xceiv->otg;
diff --git a/drivers/usb/phy/phy-gpio-vbus-usb.c b/drivers/usb/phy/phy-gpio-vbus-usb.c
index b2f29c9aebbf..02799a5efcd4 100644
--- a/drivers/usb/phy/phy-gpio-vbus-usb.c
+++ b/drivers/usb/phy/phy-gpio-vbus-usb.c
@@ -241,7 +241,7 @@ static int gpio_vbus_set_suspend(struct usb_phy *phy, int suspend)
 
 /* platform driver interface */
 
-static int __init gpio_vbus_probe(struct platform_device *pdev)
+static int gpio_vbus_probe(struct platform_device *pdev)
 {
         struct gpio_vbus_mach_info *pdata = dev_get_platdata(&pdev->dev);
         struct gpio_vbus_data *gpio_vbus;
@@ -349,7 +349,7 @@ err_gpio:
         return err;
 }
 
-static int __exit gpio_vbus_remove(struct platform_device *pdev)
+static int gpio_vbus_remove(struct platform_device *pdev)
 {
         struct gpio_vbus_data *gpio_vbus = platform_get_drvdata(pdev);
         struct gpio_vbus_mach_info *pdata = dev_get_platdata(&pdev->dev);
@@ -398,8 +398,6 @@ static const struct dev_pm_ops gpio_vbus_dev_pm_ops = {
 };
 #endif
 
-/* NOTE:  the gpio-vbus device may *NOT* be hotplugged */
-
 MODULE_ALIAS("platform:gpio-vbus");
 
 static struct platform_driver gpio_vbus_driver = {
@@ -410,10 +408,11 @@ static struct platform_driver gpio_vbus_driver = {
                 .pm = &gpio_vbus_dev_pm_ops,
 #endif
         },
-        .remove  = __exit_p(gpio_vbus_remove),
+        .probe          = gpio_vbus_probe,
+        .remove         = gpio_vbus_remove,
 };
 
-module_platform_driver_probe(gpio_vbus_driver, gpio_vbus_probe);
+module_platform_driver(gpio_vbus_driver);
 
 MODULE_DESCRIPTION("simple GPIO controlled OTG transceiver driver");
 MODULE_AUTHOR("Philipp Zabel");
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1cf6f125f5f0..acaee066b99a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -81,6 +81,7 @@ static void option_instat_callback(struct urb *urb);
 
 #define HUAWEI_VENDOR_ID                        0x12D1
 #define HUAWEI_PRODUCT_E173                     0x140C
+#define HUAWEI_PRODUCT_E1750                    0x1406
 #define HUAWEI_PRODUCT_K4505                    0x1464
 #define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_K4605                    0x14C6
@@ -450,6 +451,10 @@ static void option_instat_callback(struct urb *urb);
 #define CHANGHONG_VENDOR_ID                     0x2077
 #define CHANGHONG_PRODUCT_CH690                 0x7001
 
+/* Inovia */
+#define INOVIA_VENDOR_ID                        0x20a6
+#define INOVIA_SEW858                           0x1105
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -567,6 +572,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &net_intf1_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t) &net_intf2_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff),
@@ -686,6 +693,222 @@ static const struct usb_device_id option_ids[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7A) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7B) },
         { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x02, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x03, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x04, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x05, 0x7C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x01) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x02) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x03) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x04) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x05) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x06) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x0F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x10) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x12) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x13) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x14) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x15) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x17) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x18) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x19) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x1C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x31) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x32) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x33) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x34) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x35) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x36) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x3F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x48) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x49) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x4C) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x61) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x62) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x63) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x64) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x65) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x66) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6D) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6E) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x6F) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x78) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x79) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7A) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7B) },
+        { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x06, 0x7C) },
 
 
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) },
@@ -1254,7 +1477,9 @@ static const struct usb_device_id option_ids[] = {
 
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
-        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
+        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+                .driver_info = (kernel_ulong_t)&net_intf6_blacklist
+        },
         { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
         { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
@@ -1342,6 +1567,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 760b78560f67..c9a35697ebe9 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -190,6 +190,7 @@ static struct usb_device_id ti_id_table_combined[] = {
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
         { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
         { }     /* terminator */
 };
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 94d75edef77f..18509e6c21ab 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -211,8 +211,11 @@ static int slave_configure(struct scsi_device *sdev)
                 /*
                  * Many devices do not respond properly to READ_CAPACITY_16.
                  * Tell the SCSI layer to try READ_CAPACITY_10 first.
+                 * However some USB 3.0 drive enclosures return capacity
+                 * modulo 2TB. Those must use READ_CAPACITY_16
                  */
-                sdev->try_rc_10_first = 1;
+                if (!(us->fflags & US_FL_NEEDS_CAP16))
+                        sdev->try_rc_10_first = 1;
 
                 /* assume SPC3 or latter devices support sense size > 18 */
                 if (sdev->scsi_level > SCSI_SPC_2)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c015f2c16729..de32cfa5bfa6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1925,6 +1925,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Oliver Neukum <oneukum@suse.com> */
+UNUSUAL_DEV(  0x174c, 0x55aa, 0x0100, 0x0100,
+                "ASMedia",
+                "AS2105",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NEEDS_CAP16),
+
 /* Reported by Jesse Feddema <jdfeddema@gmail.com> */
 UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
                 "Yarvik",
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index a9807dea3887..4fb7a8f83c8a 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -545,6 +545,8 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
         long npage;
         int ret = 0, prot = 0;
         uint64_t mask;
+        struct vfio_dma *dma = NULL;
+        unsigned long pfn;
 
         end = map->iova + map->size;
 
@@ -587,8 +589,6 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
         }
 
         for (iova = map->iova; iova < end; iova += size, vaddr += size) {
-                struct vfio_dma *dma = NULL;
-                unsigned long pfn;
                 long i;
 
                 /* Pin a contiguous chunk of memory */
@@ -597,16 +597,15 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                 if (npage <= 0) {
                         WARN_ON(!npage);
                         ret = (int)npage;
-                        break;
+                        goto out;
                 }
 
                 /* Verify pages are not already mapped */
                 for (i = 0; i < npage; i++) {
                         if (iommu_iova_to_phys(iommu->domain,
                                                iova + (i << PAGE_SHIFT))) {
-                                vfio_unpin_pages(pfn, npage, prot, true);
                                 ret = -EBUSY;
-                                break;
+                                goto out_unpin;
                         }
                 }
 
@@ -616,8 +615,7 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                 if (ret) {
                         if (ret != -EBUSY ||
                             map_try_harder(iommu, iova, pfn, npage, prot)) {
-                                vfio_unpin_pages(pfn, npage, prot, true);
-                                break;
+                                goto out_unpin;
                         }
                 }
 
@@ -672,9 +670,8 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                         dma = kzalloc(sizeof(*dma), GFP_KERNEL);
                         if (!dma) {
                                 iommu_unmap(iommu->domain, iova, size);
-                                vfio_unpin_pages(pfn, npage, prot, true);
                                 ret = -ENOMEM;
-                                break;
+                                goto out_unpin;
                         }
 
                         dma->size = size;
@@ -685,16 +682,21 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu,
                 }
         }
 
-        if (ret) {
-                struct vfio_dma *tmp;
-                iova = map->iova;
-                size = map->size;
-                while ((tmp = vfio_find_dma(iommu, iova, size))) {
-                        int r = vfio_remove_dma_overlap(iommu, iova,
-                                                        &size, tmp);
-                        if (WARN_ON(r || !size))
-                                break;
-                }
+        WARN_ON(ret);
+        mutex_unlock(&iommu->lock);
+        return ret;
+
+out_unpin:
+        vfio_unpin_pages(pfn, npage, prot, true);
+
+out:
+        iova = map->iova;
+        size = map->size;
+        while ((dma = vfio_find_dma(iommu, iova, size))) {
+                int r = vfio_remove_dma_overlap(iommu, iova,
+                                                &size, dma);
+                if (WARN_ON(r || !size))
+                        break;
         }
 
         mutex_unlock(&iommu->lock);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 592b31698fc8..e663921eebb6 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -728,7 +728,12 @@ vhost_scsi_get_tag(struct vhost_virtqueue *vq,
         }
         se_sess = tv_nexus->tvn_se_sess;
 
-        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_KERNEL);
+        tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
+        if (tag < 0) {
+                pr_err("Unable to obtain tag for tcm_vhost_cmd\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
         cmd = &((struct tcm_vhost_cmd *)se_sess->sess_cmd_map)[tag];
         sg = cmd->tvc_sgl;
         pages = cmd->tvc_upages;
@@ -1051,7 +1056,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                 if (data_direction != DMA_NONE) {
                         ret = vhost_scsi_map_iov_to_sgl(cmd,
                                         &vq->iov[data_first], data_num,
-                                        data_direction == DMA_TO_DEVICE);
+                                        data_direction == DMA_FROM_DEVICE);
                         if (unlikely(ret)) {
                                 vq_err(vq, "Failed to map iov to sgl\n");
                                 goto err_free;
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 94a403a9717a..5d05555fe841 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -21,6 +21,9 @@
 #include <asm/backlight.h>
 #endif
 
+static struct list_head backlight_dev_list;
+static struct mutex backlight_dev_list_mutex;
+
 static const char *const backlight_types[] = {
         [BACKLIGHT_RAW] = "raw",
         [BACKLIGHT_PLATFORM] = "platform",
@@ -349,10 +352,32 @@ struct backlight_device *backlight_device_register(const char *name,
         mutex_unlock(&pmac_backlight_mutex);
 #endif
 
+        mutex_lock(&backlight_dev_list_mutex);
+        list_add(&new_bd->entry, &backlight_dev_list);
+        mutex_unlock(&backlight_dev_list_mutex);
+
         return new_bd;
 }
 EXPORT_SYMBOL(backlight_device_register);
 
+bool backlight_device_registered(enum backlight_type type)
+{
+        bool found = false;
+        struct backlight_device *bd;
+
+        mutex_lock(&backlight_dev_list_mutex);
+        list_for_each_entry(bd, &backlight_dev_list, entry) {
+                if (bd->props.type == type) {
+                        found = true;
+                        break;
+                }
+        }
+        mutex_unlock(&backlight_dev_list_mutex);
+
+        return found;
+}
+EXPORT_SYMBOL(backlight_device_registered);
+
 /**
  * backlight_device_unregister - unregisters a backlight device object.
  * @bd: the backlight device object to be unregistered and freed.
@@ -364,6 +389,10 @@ void backlight_device_unregister(struct backlight_device *bd)
         if (!bd)
                 return;
 
+        mutex_lock(&backlight_dev_list_mutex);
+        list_del(&bd->entry);
+        mutex_unlock(&backlight_dev_list_mutex);
+
 #ifdef CONFIG_PMAC_BACKLIGHT
         mutex_lock(&pmac_backlight_mutex);
         if (pmac_backlight == bd)
@@ -499,6 +528,8 @@ static int __init backlight_class_init(void)
 
         backlight_class->dev_groups = bl_device_groups;
         backlight_class->pm = &backlight_class_dev_pm_ops;
+        INIT_LIST_HEAD(&backlight_dev_list);
+        mutex_init(&backlight_dev_list_mutex);
         return 0;
 }
 
diff --git a/drivers/video/mmp/hw/mmp_ctrl.c b/drivers/video/mmp/hw/mmp_ctrl.c
index 75dca19bf214..6ac755270ab4 100644
--- a/drivers/video/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/mmp/hw/mmp_ctrl.c
@@ -514,7 +514,7 @@ static int mmphw_probe(struct platform_device *pdev)
         if (IS_ERR(ctrl->clk)) {
                 dev_err(ctrl->dev, "unable to get clk %s\n", mi->clk_name);
                 ret = -ENOENT;
-                goto failed_get_clk;
+                goto failed;
         }
         clk_prepare_enable(ctrl->clk);
 
@@ -551,21 +551,8 @@ failed_path_init:
                 path_deinit(path_plat);
         }
 
-        if (ctrl->clk) {
-                devm_clk_put(ctrl->dev, ctrl->clk);
-                clk_disable_unprepare(ctrl->clk);
-        }
-failed_get_clk:
-        devm_free_irq(ctrl->dev, ctrl->irq, ctrl);
+        clk_disable_unprepare(ctrl->clk);
 failed:
-        if (ctrl) {
-                if (ctrl->reg_base)
-                        devm_iounmap(ctrl->dev, ctrl->reg_base);
-                devm_release_mem_region(ctrl->dev, res->start,
-                                resource_size(res));
-                devm_kfree(ctrl->dev, ctrl);
-        }
-
         dev_err(&pdev->dev, "device init failed\n");
 
         return ret;
diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index d250ed0f806d..27197a8048c0 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -620,6 +620,7 @@ static int mxsfb_restore_mode(struct mxsfb_info *host)
                 break;
         case 3:
                 bits_per_pixel = 32;
+                break;
         case 1:
         default:
                 return -EINVAL;
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 7ef079c146e7..c172a5281f9e 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -2075,6 +2075,7 @@ static int neofb_probe(struct pci_dev *dev, const struct pci_device_id *id)
         if (!fb_find_mode(&info->var, info, mode_option, NULL, 0,
                         info->monspecs.modedb, 16)) {
                 printk(KERN_ERR "neofb: Unable to find usable video mode.\n");
+                err = -EINVAL;
                 goto err_map_video;
         }
 
@@ -2097,7 +2098,8 @@ static int neofb_probe(struct pci_dev *dev, const struct pci_device_id *id)
                info->fix.smem_len >> 10, info->var.xres,
                info->var.yres, h_sync / 1000, h_sync % 1000, v_sync);
 
-        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0)
+        err = fb_alloc_cmap(&info->cmap, 256, 0);
+        if (err < 0)
                 goto err_map_video;
 
         err = register_framebuffer(info);
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index 171821ddd78d..ba5b40f581f6 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -120,7 +120,7 @@ int of_get_display_timing(struct device_node *np, const char *name,
                 return -EINVAL;
         }
 
-        timing_np = of_find_node_by_name(np, name);
+        timing_np = of_get_child_by_name(np, name);
         if (!timing_np) {
                 pr_err("%s: could not find node '%s'\n",
                         of_node_full_name(np), name);
@@ -143,11 +143,11 @@ struct display_timings *of_get_display_timings(struct device_node *np)
         struct display_timings *disp;
 
         if (!np) {
-                pr_err("%s: no devicenode given\n", of_node_full_name(np));
+                pr_err("%s: no device node given\n", of_node_full_name(np));
                 return NULL;
         }
 
-        timings_np = of_find_node_by_name(np, "display-timings");
+        timings_np = of_get_child_by_name(np, "display-timings");
         if (!timings_np) {
                 pr_err("%s: could not find display-timings node\n",
                         of_node_full_name(np));
diff --git a/drivers/video/omap2/displays-new/Kconfig b/drivers/video/omap2/displays-new/Kconfig
index 6c90885b0940..10b25e7cd878 100644
--- a/drivers/video/omap2/displays-new/Kconfig
+++ b/drivers/video/omap2/displays-new/Kconfig
@@ -35,6 +35,7 @@ config DISPLAY_PANEL_DPI
 
 config DISPLAY_PANEL_DSI_CM
         tristate "Generic DSI Command Mode Panel"
+        depends on BACKLIGHT_CLASS_DEVICE
         help
           Driver for generic DSI command mode panels.
 
diff --git a/drivers/video/omap2/displays-new/connector-analog-tv.c b/drivers/video/omap2/displays-new/connector-analog-tv.c
index 1b60698f141e..ccd9073f706f 100644
--- a/drivers/video/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/omap2/displays-new/connector-analog-tv.c
@@ -191,7 +191,7 @@ static int tvc_probe_pdata(struct platform_device *pdev)
         in = omap_dss_find_output(pdata->source);
         if (in == NULL) {
                 dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
 
         ddata->in = in;
diff --git a/drivers/video/omap2/displays-new/connector-dvi.c b/drivers/video/omap2/displays-new/connector-dvi.c
index bc5f8ceda371..63d88ee6dfe4 100644
--- a/drivers/video/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/omap2/displays-new/connector-dvi.c
@@ -263,7 +263,7 @@ static int dvic_probe_pdata(struct platform_device *pdev)
         in = omap_dss_find_output(pdata->source);
         if (in == NULL) {
                 dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
 
         ddata->in = in;
diff --git a/drivers/video/omap2/displays-new/connector-hdmi.c b/drivers/video/omap2/displays-new/connector-hdmi.c
index c5826716d6ab..9abe2c039ae9 100644
--- a/drivers/video/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/omap2/displays-new/connector-hdmi.c
@@ -290,7 +290,7 @@ static int hdmic_probe_pdata(struct platform_device *pdev)
         in = omap_dss_find_output(pdata->source);
         if (in == NULL) {
                 dev_err(&pdev->dev, "Failed to find video source\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
 
         ddata->in = in;
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
index 02a7340111df..477975009eee 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -3691,6 +3691,7 @@ static int __init omap_dispchw_probe(struct platform_device *pdev)
         }
 
         pm_runtime_enable(&pdev->dev);
+        pm_runtime_irq_safe(&pdev->dev);
 
         r = dispc_runtime_get();
         if (r)
diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
index 47ca86c5c6c0..d838ba829459 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/s3fb.c
@@ -1336,14 +1336,7 @@ static int s3_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                         (info->var.bits_per_pixel * info->var.xres_virtual);
         if (info->var.yres_virtual < info->var.yres) {
                 dev_err(info->device, "virtual vertical size smaller than real\n");
-                goto err_find_mode;
-        }
-
-        /* maximize virtual vertical size for fast scrolling */
-        info->var.yres_virtual = info->fix.smem_len * 8 /
-                        (info->var.bits_per_pixel * info->var.xres_virtual);
-        if (info->var.yres_virtual < info->var.yres) {
-                dev_err(info->device, "virtual vertical size smaller than real\n");
+                rc = -EINVAL;
                 goto err_find_mode;
         }
 
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index c7c64f18773d..fa932c2f7d97 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -613,6 +613,9 @@ static int w1_bus_notify(struct notifier_block *nb, unsigned long action,
         sl = dev_to_w1_slave(dev);
         fops = sl->family->fops;
 
+        if (!fops)
+                return 0;
+
         switch (action) {
         case BUS_NOTIFY_ADD_DEVICE:
                 /* if the family driver needs to initialize something... */
@@ -713,7 +716,10 @@ static int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn)
         atomic_set(&sl->refcnt, 0);
         init_completion(&sl->released);
 
+        /* slave modules need to be loaded in a context with unlocked mutex */
+        mutex_unlock(&dev->mutex);
         request_module("w1-family-0x%0x", rn->family);
+        mutex_lock(&dev->mutex);
 
         spin_lock(&w1_flock);
         f = w1_family_registered(rn->family);
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 5be5e3d14f79..19f3c3fc65f4 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -802,6 +802,12 @@ static int hpwdt_init_one(struct pci_dev *dev,
                 return -ENODEV;
         }
 
+        /*
+         * Ignore all auxilary iLO devices with the following PCI ID
+         */
+        if (dev->subsystem_device == 0x1979)
+                return -ENODEV;
+
         if (pci_enable_device(dev)) {
                 dev_warn(&dev->dev,
                         "Not possible to enable PCI Device: 0x%x:0x%x.\n",
diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c
index 491419e0772a..5c3d4df63e68 100644
--- a/drivers/watchdog/kempld_wdt.c
+++ b/drivers/watchdog/kempld_wdt.c
@@ -35,7 +35,7 @@
 #define KEMPLD_WDT_STAGE_TIMEOUT(x)     (0x1b + (x) * 4)
 #define KEMPLD_WDT_STAGE_CFG(x)         (0x18 + (x))
 #define STAGE_CFG_GET_PRESCALER(x)      (((x) & 0x30) >> 4)
-#define STAGE_CFG_SET_PRESCALER(x)      (((x) & 0x30) << 4)
+#define STAGE_CFG_SET_PRESCALER(x)      (((x) & 0x3) << 4)
 #define STAGE_CFG_PRESCALER_MASK        0x30
 #define STAGE_CFG_ACTION_MASK           0x7
 #define STAGE_CFG_ASSERT                (1 << 3)
diff --git a/drivers/watchdog/sunxi_wdt.c b/drivers/watchdog/sunxi_wdt.c
index 1f94b42764aa..f6caa77151c7 100644
--- a/drivers/watchdog/sunxi_wdt.c
+++ b/drivers/watchdog/sunxi_wdt.c
@@ -146,7 +146,7 @@ static const struct watchdog_ops sunxi_wdt_ops = {
         .set_timeout    = sunxi_wdt_set_timeout,
 };
 
-static int __init sunxi_wdt_probe(struct platform_device *pdev)
+static int sunxi_wdt_probe(struct platform_device *pdev)
 {
         struct sunxi_wdt_dev *sunxi_wdt;
         struct resource *res;
@@ -187,7 +187,7 @@ static int __init sunxi_wdt_probe(struct platform_device *pdev)
         return 0;
 }
 
-static int __exit sunxi_wdt_remove(struct platform_device *pdev)
+static int sunxi_wdt_remove(struct platform_device *pdev)
 {
         struct sunxi_wdt_dev *sunxi_wdt = platform_get_drvdata(pdev);
 
diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c
index 42913f131dc2..c9b0c627fe7e 100644
--- a/drivers/watchdog/ts72xx_wdt.c
+++ b/drivers/watchdog/ts72xx_wdt.c
@@ -310,7 +310,8 @@ static long ts72xx_wdt_ioctl(struct file *file, unsigned int cmd,
 
         case WDIOC_GETSTATUS:
         case WDIOC_GETBOOTSTATUS:
-                return put_user(0, p);
+                error = put_user(0, p);
+                break;
 
         case WDIOC_KEEPALIVE:
                 ts72xx_wdt_kick(wdt);
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index a50c6e3a7cc4..b232908a6192 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -398,8 +398,6 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
         if (nr_pages > ARRAY_SIZE(frame_list))
                 nr_pages = ARRAY_SIZE(frame_list);
 
-        scratch_page = get_balloon_scratch_page();
-
         for (i = 0; i < nr_pages; i++) {
                 page = alloc_page(gfp);
                 if (page == NULL) {
@@ -413,6 +411,12 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 
                 scrub_page(page);
 
+                /*
+                 * Ballooned out frames are effectively replaced with
+                 * a scratch frame.  Ensure direct mappings and the
+                 * p2m are consistent.
+                 */
+                scratch_page = get_balloon_scratch_page();
 #ifdef CONFIG_XEN_HAVE_PVMMU
                 if (xen_pv_domain() && !PageHighMem(page)) {
                         ret = HYPERVISOR_update_va_mapping(
@@ -422,24 +426,19 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
                         BUG_ON(ret);
                 }
 #endif
-        }
-
-        /* Ensure that ballooned highmem pages don't have kmaps. */
-        kmap_flush_unused();
-        flush_tlb_all();
-
-        /* No more mappings: invalidate P2M and add to balloon. */
-        for (i = 0; i < nr_pages; i++) {
-                pfn = mfn_to_pfn(frame_list[i]);
                 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
                         unsigned long p;
                         p = page_to_pfn(scratch_page);
                         __set_phys_to_machine(pfn, pfn_to_mfn(p));
                 }
+                put_balloon_scratch_page();
+
                 balloon_append(pfn_to_page(pfn));
         }
 
-        put_balloon_scratch_page();
+        /* Ensure that ballooned highmem pages don't have kmaps. */
+        kmap_flush_unused();
+        flush_tlb_all();
 
         set_xen_guest_handle(reservation.extent_start, frame_list);
         reservation.nr_extents   = nr_pages;
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 646337dc5201..529300327f45 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -600,9 +600,6 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 
         /* lock down the parent dentry so we can peer at it */
         parent = dget_parent(dentry);
-        if (!parent->d_inode)
-                goto out_bad;
-
         dir = AFS_FS_I(parent->d_inode);
 
         /* validate the parent directory */
diff --git a/fs/aio.c b/fs/aio.c
index 6b868f0e0c4c..067e3d340c35 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -167,10 +167,25 @@ static int __init aio_setup(void)
 }
 __initcall(aio_setup);
 
+static void put_aio_ring_file(struct kioctx *ctx)
+{
+        struct file *aio_ring_file = ctx->aio_ring_file;
+        if (aio_ring_file) {
+                truncate_setsize(aio_ring_file->f_inode, 0);
+
+                /* Prevent further access to the kioctx from migratepages */
+                spin_lock(&aio_ring_file->f_inode->i_mapping->private_lock);
+                aio_ring_file->f_inode->i_mapping->private_data = NULL;
+                ctx->aio_ring_file = NULL;
+                spin_unlock(&aio_ring_file->f_inode->i_mapping->private_lock);
+
+                fput(aio_ring_file);
+        }
+}
+
 static void aio_free_ring(struct kioctx *ctx)
 {
         int i;
-        struct file *aio_ring_file = ctx->aio_ring_file;
 
         for (i = 0; i < ctx->nr_pages; i++) {
                 pr_debug("pid(%d) [%d] page->count=%d\n", current->pid, i,
@@ -178,14 +193,10 @@ static void aio_free_ring(struct kioctx *ctx)
                 put_page(ctx->ring_pages[i]);
         }
 
+        put_aio_ring_file(ctx);
+
         if (ctx->ring_pages && ctx->ring_pages != ctx->internal_pages)
                 kfree(ctx->ring_pages);
-
-        if (aio_ring_file) {
-                truncate_setsize(aio_ring_file->f_inode, 0);
-                fput(aio_ring_file);
-                ctx->aio_ring_file = NULL;
-        }
 }
 
 static int aio_ring_mmap(struct file *file, struct vm_area_struct *vma)
@@ -207,9 +218,8 @@ static int aio_set_page_dirty(struct page *page)
 static int aio_migratepage(struct address_space *mapping, struct page *new,
                         struct page *old, enum migrate_mode mode)
 {
-        struct kioctx *ctx = mapping->private_data;
+        struct kioctx *ctx;
         unsigned long flags;
-        unsigned idx = old->index;
         int rc;
 
         /* Writeback must be complete */
@@ -224,10 +234,23 @@ static int aio_migratepage(struct address_space *mapping, struct page *new,
 
         get_page(new);
 
-        spin_lock_irqsave(&ctx->completion_lock, flags);
-        migrate_page_copy(new, old);
-        ctx->ring_pages[idx] = new;
-        spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        /* We can potentially race against kioctx teardown here.  Use the
+         * address_space's private data lock to protect the mapping's
+         * private_data.
+         */
+        spin_lock(&mapping->private_lock);
+        ctx = mapping->private_data;
+        if (ctx) {
+                pgoff_t idx;
+                spin_lock_irqsave(&ctx->completion_lock, flags);
+                migrate_page_copy(new, old);
+                idx = old->index;
+                if (idx < (pgoff_t)ctx->nr_pages)
+                        ctx->ring_pages[idx] = new;
+                spin_unlock_irqrestore(&ctx->completion_lock, flags);
+        } else
+                rc = -EBUSY;
+        spin_unlock(&mapping->private_lock);
 
         return rc;
 }
@@ -617,8 +640,7 @@ out_freepcpu:
 out_freeref:
         free_percpu(ctx->users.pcpu_count);
 out_freectx:
-        if (ctx->aio_ring_file)
-                fput(ctx->aio_ring_file);
+        put_aio_ring_file(ctx);
         kmem_cache_free(kioctx_cachep, ctx);
         pr_debug("error allocating ioctx %d\n", err);
         return ERR_PTR(err);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 100edcc5e312..4c94a79991bb 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1413,7 +1413,7 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
  *   long file_ofs
  * followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
  */
-static void fill_files_note(struct memelfnote *note)
+static int fill_files_note(struct memelfnote *note)
 {
         struct vm_area_struct *vma;
         unsigned count, size, names_ofs, remaining, n;
@@ -1428,11 +1428,11 @@ static void fill_files_note(struct memelfnote *note)
         names_ofs = (2 + 3 * count) * sizeof(data[0]);
  alloc:
         if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */
-                goto err;
+                return -EINVAL;
         size = round_up(size, PAGE_SIZE);
         data = vmalloc(size);
         if (!data)
-                goto err;
+                return -ENOMEM;
 
         start_end_ofs = data + 2;
         name_base = name_curpos = ((char *)data) + names_ofs;
@@ -1485,7 +1485,7 @@ static void fill_files_note(struct memelfnote *note)
 
         size = name_curpos - (char *)data;
         fill_note(note, "CORE", NT_FILE, size, data);
- err: ;
+        return 0;
 }
 
 #ifdef CORE_DUMP_USE_REGSET
@@ -1686,8 +1686,8 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
         fill_auxv_note(&info->auxv, current->mm);
         info->size += notesize(&info->auxv);
 
-        fill_files_note(&info->files);
-        info->size += notesize(&info->files);
+        if (fill_files_note(&info->files) == 0)
+                info->size += notesize(&info->files);
 
         return 1;
 }
@@ -1719,7 +1719,8 @@ static int write_note_info(struct elf_note_info *info,
                         return 0;
                 if (first && !writenote(&info->auxv, file, foffset))
                         return 0;
-                if (first && !writenote(&info->files, file, foffset))
+                if (first && info->files.data &&
+                                !writenote(&info->files, file, foffset))
                         return 0;
 
                 for (i = 1; i < info->thread_notes; ++i)
@@ -1806,6 +1807,7 @@ static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
 
 struct elf_note_info {
         struct memelfnote *notes;
+        struct memelfnote *notes_files;
         struct elf_prstatus *prstatus;  /* NT_PRSTATUS */
         struct elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
         struct list_head thread_list;
@@ -1896,9 +1898,12 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
 
         fill_siginfo_note(info->notes + 2, &info->csigdata, siginfo);
         fill_auxv_note(info->notes + 3, current->mm);
-        fill_files_note(info->notes + 4);
+        info->numnote = 4;
 
-        info->numnote = 5;
+        if (fill_files_note(info->notes + info->numnote) == 0) {
+                info->notes_files = info->notes + info->numnote;
+                info->numnote++;
+        }
 
         /* Try to dump the FPU. */
         info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
@@ -1960,8 +1965,9 @@ static void free_note_info(struct elf_note_info *info)
                 kfree(list_entry(tmp, struct elf_thread_status, list));
         }
 
-        /* Free data allocated by fill_files_note(): */
-        vfree(info->notes[4].data);
+        /* Free data possibly allocated by fill_files_note(): */
+        if (info->notes_files)
+                vfree(info->notes_files->data);
 
         kfree(info->prstatus);
         kfree(info->psinfo);
@@ -2044,7 +2050,7 @@ static int elf_core_dump(struct coredump_params *cprm)
         struct vm_area_struct *vma, *gate_vma;
         struct elfhdr *elf = NULL;
         loff_t offset = 0, dataoff, foffset;
-        struct elf_note_info info;
+        struct elf_note_info info = { };
         struct elf_phdr *phdr4note = NULL;
         struct elf_shdr *shdr4extnum = NULL;
         Elf_Half e_phnum;
diff --git a/fs/bio.c b/fs/bio.c
index b3b20ed9510e..ea5035da4d9a 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -917,8 +917,8 @@ void bio_copy_data(struct bio *dst, struct bio *src)
                 src_p = kmap_atomic(src_bv->bv_page);
                 dst_p = kmap_atomic(dst_bv->bv_page);
 
-                memcpy(dst_p + dst_bv->bv_offset,
-                       src_p + src_bv->bv_offset,
+                memcpy(dst_p + dst_offset,
+                       src_p + src_offset,
                        bytes);
 
                 kunmap_atomic(dst_p);
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 58b7d14b08ee..08cc08f037a6 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -107,7 +107,8 @@ static void check_idle_worker(struct btrfs_worker_thread *worker)
                 worker->idle = 1;
 
                 /* the list may be empty if the worker is just starting */
-                if (!list_empty(&worker->worker_list)) {
+                if (!list_empty(&worker->worker_list) &&
+                    !worker->workers->stopping) {
                         list_move(&worker->worker_list,
                                  &worker->workers->idle_list);
                 }
@@ -127,7 +128,8 @@ static void check_busy_worker(struct btrfs_worker_thread *worker)
                 spin_lock_irqsave(&worker->workers->lock, flags);
                 worker->idle = 0;
 
-                if (!list_empty(&worker->worker_list)) {
+                if (!list_empty(&worker->worker_list) &&
+                    !worker->workers->stopping) {
                         list_move_tail(&worker->worker_list,
                                       &worker->workers->worker_list);
                 }
@@ -412,6 +414,7 @@ void btrfs_stop_workers(struct btrfs_workers *workers)
         int can_stop;
 
         spin_lock_irq(&workers->lock);
+        workers->stopping = 1;
         list_splice_init(&workers->idle_list, &workers->worker_list);
         while (!list_empty(&workers->worker_list)) {
                 cur = workers->worker_list.next;
@@ -455,6 +458,7 @@ void btrfs_init_workers(struct btrfs_workers *workers, char *name, int max,
         workers->ordered = 0;
         workers->atomic_start_pending = 0;
         workers->atomic_worker_start = async_helper;
+        workers->stopping = 0;
 }
 
 /*
@@ -480,15 +484,19 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
         atomic_set(&worker->num_pending, 0);
         atomic_set(&worker->refs, 1);
         worker->workers = workers;
-        worker->task = kthread_run(worker_loop, worker,
-                                   "btrfs-%s-%d", workers->name,
-                                   workers->num_workers + 1);
+        worker->task = kthread_create(worker_loop, worker,
+                                      "btrfs-%s-%d", workers->name,
+                                      workers->num_workers + 1);
         if (IS_ERR(worker->task)) {
                 ret = PTR_ERR(worker->task);
-                kfree(worker);
                 goto fail;
         }
+
         spin_lock_irq(&workers->lock);
+        if (workers->stopping) {
+                spin_unlock_irq(&workers->lock);
+                goto fail_kthread;
+        }
         list_add_tail(&worker->worker_list, &workers->idle_list);
         worker->idle = 1;
         workers->num_workers++;
@@ -496,8 +504,13 @@ static int __btrfs_start_workers(struct btrfs_workers *workers)
         WARN_ON(workers->num_workers_starting < 0);
         spin_unlock_irq(&workers->lock);
 
+        wake_up_process(worker->task);
         return 0;
+
+fail_kthread:
+        kthread_stop(worker->task);
 fail:
+        kfree(worker);
         spin_lock_irq(&workers->lock);
         workers->num_workers_starting--;
         spin_unlock_irq(&workers->lock);
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index 063698b90ce2..1f26792683ed 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -107,6 +107,8 @@ struct btrfs_workers {
 
         /* extra name for this worker, used for current->name */
         char *name;
+
+        int stopping;
 };
 
 void btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work);
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 70681686e8dc..9efb94e95858 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -535,10 +535,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
         list_add(&tgt_device->dev_alloc_list, &fs_info->fs_devices->alloc_list);
 
         btrfs_rm_dev_replace_srcdev(fs_info, src_device);
-        if (src_device->bdev) {
-                /* zero out the old super */
-                btrfs_scratch_superblock(src_device);
-        }
+
         /*
          * this is again a consistent state where no dev_replace procedure
          * is running, the target device is part of the filesystem, the
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 4ae17ed13b32..62176ad89846 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1561,8 +1561,9 @@ int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
         return ret;
 }
 
-struct btrfs_root *btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
-                                              struct btrfs_key *location)
+struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info,
+                                     struct btrfs_key *location,
+                                     bool check_ref)
 {
         struct btrfs_root *root;
         int ret;
@@ -1586,7 +1587,7 @@ struct btrfs_root *btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
 again:
         root = btrfs_lookup_fs_root(fs_info, location->objectid);
         if (root) {
-                if (btrfs_root_refs(&root->root_item) == 0)
+                if (check_ref && btrfs_root_refs(&root->root_item) == 0)
                         return ERR_PTR(-ENOENT);
                 return root;
         }
@@ -1595,7 +1596,7 @@ again:
         if (IS_ERR(root))
                 return root;
 
-        if (btrfs_root_refs(&root->root_item) == 0) {
+        if (check_ref && btrfs_root_refs(&root->root_item) == 0) {
                 ret = -ENOENT;
                 goto fail;
         }
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index b71acd6e1e5b..5ce2a7da8b11 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -68,8 +68,17 @@ struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
 int btrfs_init_fs_root(struct btrfs_root *root);
 int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
                          struct btrfs_root *root);
-struct btrfs_root *btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
-                                              struct btrfs_key *location);
+
+struct btrfs_root *btrfs_get_fs_root(struct btrfs_fs_info *fs_info,
+                                     struct btrfs_key *key,
+                                     bool check_ref);
+static inline struct btrfs_root *
+btrfs_read_fs_root_no_name(struct btrfs_fs_info *fs_info,
+                           struct btrfs_key *location)
+{
+        return btrfs_get_fs_root(fs_info, location, true);
+}
+
 int btrfs_cleanup_fs_roots(struct btrfs_fs_info *fs_info);
 void btrfs_btree_balance_dirty(struct btrfs_root *root);
 void btrfs_btree_balance_dirty_nodelay(struct btrfs_root *root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index c09a40db53db..51731b76900d 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -145,8 +145,16 @@ int __init extent_io_init(void)
                                      offsetof(struct btrfs_io_bio, bio));
         if (!btrfs_bioset)
                 goto free_buffer_cache;
+
+        if (bioset_integrity_create(btrfs_bioset, BIO_POOL_SIZE))
+                goto free_bioset;
+
         return 0;
 
+free_bioset:
+        bioset_free(btrfs_bioset);
+        btrfs_bioset = NULL;
+
 free_buffer_cache:
         kmem_cache_destroy(extent_buffer_cache);
         extent_buffer_cache = NULL;
@@ -1482,10 +1490,8 @@ static noinline u64 find_delalloc_range(struct extent_io_tree *tree,
                 cur_start = state->end + 1;
                 node = rb_next(node);
                 total_bytes += state->end - state->start + 1;
-                if (total_bytes >= max_bytes) {
-                        *end = *start + max_bytes - 1;
+                if (total_bytes >= max_bytes)
                         break;
-                }
                 if (!node)
                         break;
         }
@@ -1614,7 +1620,7 @@ again:
                 *start = delalloc_start;
                 *end = delalloc_end;
                 free_extent_state(cached_state);
-                return found;
+                return 0;
         }
 
         /*
@@ -1627,10 +1633,9 @@ again:
 
         /*
          * make sure to limit the number of pages we try to lock down
-         * if we're looping.
          */
-        if (delalloc_end + 1 - delalloc_start > max_bytes && loops)
-                delalloc_end = delalloc_start + PAGE_CACHE_SIZE - 1;
+        if (delalloc_end + 1 - delalloc_start > max_bytes)
+                delalloc_end = delalloc_start + max_bytes - 1;
 
         /* step two, lock all the pages after the page that has start */
         ret = lock_delalloc_pages(inode, locked_page,
@@ -1641,8 +1646,7 @@ again:
                  */
                 free_extent_state(cached_state);
                 if (!loops) {
-                        unsigned long offset = (*start) & (PAGE_CACHE_SIZE - 1);
-                        max_bytes = PAGE_CACHE_SIZE - offset;
+                        max_bytes = PAGE_CACHE_SIZE;
                         loops = 1;
                         goto again;
                 } else {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 22ebc13b6c99..51e3afa78354 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6437,6 +6437,7 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len,
 
         if (btrfs_extent_readonly(root, disk_bytenr))
                 goto out;
+        btrfs_release_path(path);
 
         /*
          * look for other files referencing this extent, if we
@@ -7986,7 +7987,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
 
         /* check for collisions, even if the  name isn't there */
-        ret = btrfs_check_dir_item_collision(root, new_dir->i_ino,
+        ret = btrfs_check_dir_item_collision(dest, new_dir->i_ino,
                              new_dentry->d_name.name,
                              new_dentry->d_name.len);
 
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index a5a26320503f..4a355726151e 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -588,7 +588,7 @@ static struct btrfs_root *read_fs_root(struct btrfs_fs_info *fs_info,
         else
                 key.offset = (u64)-1;
 
-        return btrfs_read_fs_root_no_name(fs_info, &key);
+        return btrfs_get_fs_root(fs_info, &key, false);
 }
 
 #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 0b1f4ef8db98..ec71ea44d2b4 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -299,11 +299,6 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                         continue;
                 }
 
-                if (btrfs_root_refs(&root->root_item) == 0) {
-                        btrfs_add_dead_root(root);
-                        continue;
-                }
-
                 err = btrfs_init_fs_root(root);
                 if (err) {
                         btrfs_free_fs_root(root);
@@ -318,6 +313,9 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                         btrfs_free_fs_root(root);
                         break;
                 }
+
+                if (btrfs_root_refs(&root->root_item) == 0)
+                        btrfs_add_dead_root(root);
         }
 
         btrfs_free_path(path);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index e7a95356df83..8c81bdc1ef9b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1838,11 +1838,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         assert_qgroups_uptodate(trans);
         update_super_roots(root);
 
-        if (!root->fs_info->log_root_recovering) {
-                btrfs_set_super_log_root(root->fs_info->super_copy, 0);
-                btrfs_set_super_log_root_level(root->fs_info->super_copy, 0);
-        }
-
+        btrfs_set_super_log_root(root->fs_info->super_copy, 0);
+        btrfs_set_super_log_root_level(root->fs_info->super_copy, 0);
         memcpy(root->fs_info->super_for_commit, root->fs_info->super_copy,
                sizeof(*root->fs_info->super_copy));
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a10645830223..043b215769c2 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1716,6 +1716,7 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
                                  struct btrfs_device *srcdev)
 {
         WARN_ON(!mutex_is_locked(&fs_info->fs_devices->device_list_mutex));
+
         list_del_rcu(&srcdev->dev_list);
         list_del_rcu(&srcdev->dev_alloc_list);
         fs_info->fs_devices->num_devices--;
@@ -1725,9 +1726,13 @@ void btrfs_rm_dev_replace_srcdev(struct btrfs_fs_info *fs_info,
         }
         if (srcdev->can_discard)
                 fs_info->fs_devices->num_can_discard--;
-        if (srcdev->bdev)
+        if (srcdev->bdev) {
                 fs_info->fs_devices->open_devices--;
 
+                /* zero out the old super */
+                btrfs_scratch_superblock(srcdev);
+        }
+
         call_rcu(&srcdev->rcu, free_device);
 }
 
diff --git a/fs/buffer.c b/fs/buffer.c
index 4d7433534f5c..6024877335ca 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1005,9 +1005,19 @@ grow_dev_page(struct block_device *bdev, sector_t block,
         struct buffer_head *bh;
         sector_t end_block;
         int ret = 0;            /* Will call free_more_memory() */
+        gfp_t gfp_mask;
 
-        page = find_or_create_page(inode->i_mapping, index,
-                (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
+        gfp_mask = mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS;
+        gfp_mask |= __GFP_MOVABLE;
+        /*
+         * XXX: __getblk_slow() can not really deal with failure and
+         * will endlessly loop on improvised global reclaim.  Prefer
+         * looping in the allocator rather than here, at least that
+         * code knows what it's doing.
+         */
+        gfp_mask |= __GFP_NOFAIL;
+
+        page = find_or_create_page(inode->i_mapping, index, gfp_mask);
         if (!page)
                 return ret;
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index a16b4e58bcc6..77fc5e181077 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -120,14 +120,16 @@ cifs_read_super(struct super_block *sb)
 {
         struct inode *inode;
         struct cifs_sb_info *cifs_sb;
+        struct cifs_tcon *tcon;
         int rc = 0;
 
         cifs_sb = CIFS_SB(sb);
+        tcon = cifs_sb_master_tcon(cifs_sb);
 
         if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIXACL)
                 sb->s_flags |= MS_POSIXACL;
 
-        if (cifs_sb_master_tcon(cifs_sb)->ses->capabilities & CAP_LARGE_FILES)
+        if (tcon->ses->capabilities & tcon->ses->server->vals->cap_large_files)
                 sb->s_maxbytes = MAX_LFS_FILESIZE;
         else
                 sb->s_maxbytes = MAX_NON_LFS;
@@ -147,7 +149,7 @@ cifs_read_super(struct super_block *sb)
                 goto out_no_root;
         }
 
-        if (cifs_sb_master_tcon(cifs_sb)->nocase)
+        if (tcon->nocase)
                 sb->s_d_op = &cifs_ci_dentry_ops;
         else
                 sb->s_d_op = &cifs_dentry_ops;
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index ea723a5e8226..6d0b07217ac9 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -132,5 +132,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "2.01"
+#define CIFS_VERSION   "2.02"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index cfa14c80ef3b..52b6f6c26bfc 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -547,9 +547,6 @@ struct TCP_Server_Info {
         unsigned int max_rw;    /* maxRw specifies the maximum */
         /* message size the server can send or receive for */
         /* SMB_COM_WRITE_RAW or SMB_COM_READ_RAW. */
-        unsigned int max_vcs;   /* maximum number of smb sessions, at least
-                                   those that can be specified uniquely with
-                                   vcnumbers */
         unsigned int capabilities; /* selective disabling of caps by smb sess */
         int timeAdj;  /* Adjust for difference in server time zone in sec */
         __u64 CurrentMid;         /* multiplex id - rotating counter */
@@ -715,7 +712,6 @@ struct cifs_ses {
         enum statusEnum status;
         unsigned overrideSecFlg;  /* if non-zero override global sec flags */
         __u16 ipc_tid;          /* special tid for connection to IPC share */
-        __u16 vcnum;
         char *serverOS;         /* name of operating system underlying server */
         char *serverNOS;        /* name of network operating system of server */
         char *serverDomain;     /* security realm of server */
@@ -1272,6 +1268,7 @@ struct dfs_info3_param {
 #define CIFS_FATTR_DELETE_PENDING       0x2
 #define CIFS_FATTR_NEED_REVAL           0x4
 #define CIFS_FATTR_INO_COLLISION        0x8
+#define CIFS_FATTR_UNKNOWN_NLINK        0x10
 
 struct cifs_fattr {
         u32             cf_flags;
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 948676db8e2e..08f9dfb1a894 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -1491,15 +1491,30 @@ struct file_notify_information {
         __u8  FileName[0];
 } __attribute__((packed));
 
-struct reparse_data {
-        __u32   ReparseTag;
-        __u16   ReparseDataLength;
+/* For IO_REPARSE_TAG_SYMLINK */
+struct reparse_symlink_data {
+        __le32  ReparseTag;
+        __le16  ReparseDataLength;
         __u16   Reserved;
-        __u16   SubstituteNameOffset;
-        __u16   SubstituteNameLength;
-        __u16   PrintNameOffset;
-        __u16   PrintNameLength;
-        __u32   Flags;
+        __le16  SubstituteNameOffset;
+        __le16  SubstituteNameLength;
+        __le16  PrintNameOffset;
+        __le16  PrintNameLength;
+        __le32  Flags;
+        char    PathBuffer[0];
+} __attribute__((packed));
+
+/* For IO_REPARSE_TAG_NFS */
+#define NFS_SPECFILE_LNK        0x00000000014B4E4C
+#define NFS_SPECFILE_CHR        0x0000000000524843
+#define NFS_SPECFILE_BLK        0x00000000004B4C42
+#define NFS_SPECFILE_FIFO       0x000000004F464946
+#define NFS_SPECFILE_SOCK       0x000000004B434F53
+struct reparse_posix_data {
+        __le32  ReparseTag;
+        __le16  ReparseDataLength;
+        __u16   Reserved;
+        __le64  InodeType; /* LNK, FIFO, CHR etc. */
         char    PathBuffer[0];
 } __attribute__((packed));
 
@@ -2652,26 +2667,7 @@ typedef struct file_xattr_info {
 } __attribute__((packed)) FILE_XATTR_INFO; /* extended attribute info
                                               level 0x205 */
 
-
-/* flags for chattr command */
-#define EXT_SECURE_DELETE               0x00000001 /* EXT3_SECRM_FL */
-#define EXT_ENABLE_UNDELETE             0x00000002 /* EXT3_UNRM_FL */
-/* Reserved for compress file 0x4 */
-#define EXT_SYNCHRONOUS                 0x00000008 /* EXT3_SYNC_FL */
-#define EXT_IMMUTABLE_FL                0x00000010 /* EXT3_IMMUTABLE_FL */
-#define EXT_OPEN_APPEND_ONLY            0x00000020 /* EXT3_APPEND_FL */
-#define EXT_DO_NOT_BACKUP               0x00000040 /* EXT3_NODUMP_FL */
-#define EXT_NO_UPDATE_ATIME             0x00000080 /* EXT3_NOATIME_FL */
-/* 0x100 through 0x800 reserved for compression flags and are GET-ONLY */
-#define EXT_HASH_TREE_INDEXED_DIR       0x00001000 /* GET-ONLY EXT3_INDEX_FL */
-/* 0x2000 reserved for IMAGIC_FL */
-#define EXT_JOURNAL_THIS_FILE   0x00004000 /* GET-ONLY EXT3_JOURNAL_DATA_FL */
-/* 0x8000 reserved for EXT3_NOTAIL_FL */
-#define EXT_SYNCHRONOUS_DIR             0x00010000 /* EXT3_DIRSYNC_FL */
-#define EXT_TOPDIR                      0x00020000 /* EXT3_TOPDIR_FL */
-
-#define EXT_SET_MASK                    0x000300FF
-#define EXT_GET_MASK                    0x0003DFFF
+/* flags for lsattr and chflags commands removed arein uapi/linux/fs.h */
 
 typedef struct file_chattr_info {
         __le64  mask; /* list of all possible attribute bits */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index a3d74fea1623..ccd31ab815d4 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -463,7 +463,6 @@ decode_lanman_negprot_rsp(struct TCP_Server_Info *server, NEGOTIATE_RSP *pSMBr)
                                cifs_max_pending);
         set_credits(server, server->maxReq);
         server->maxBuf = le16_to_cpu(rsp->MaxBufSize);
-        server->max_vcs = le16_to_cpu(rsp->MaxNumberVcs);
         /* even though we do not use raw we might as well set this
         accurately, in case we ever find a need for it */
         if ((le16_to_cpu(rsp->RawMode) & RAW_ENABLE) == RAW_ENABLE) {
@@ -3089,7 +3088,8 @@ CIFSSMBQuerySymLink(const unsigned int xid, struct cifs_tcon *tcon,
         bool is_unicode;
         unsigned int sub_len;
         char *sub_start;
-        struct reparse_data *reparse_buf;
+        struct reparse_symlink_data *reparse_buf;
+        struct reparse_posix_data *posix_buf;
         __u32 data_offset, data_count;
         char *end_of_smb;
 
@@ -3138,20 +3138,47 @@ CIFSSMBQuerySymLink(const unsigned int xid, struct cifs_tcon *tcon,
                 goto qreparse_out;
         }
         end_of_smb = 2 + get_bcc(&pSMBr->hdr) + (char *)&pSMBr->ByteCount;
-        reparse_buf = (struct reparse_data *)
+        reparse_buf = (struct reparse_symlink_data *)
                                 ((char *)&pSMBr->hdr.Protocol + data_offset);
         if ((char *)reparse_buf >= end_of_smb) {
                 rc = -EIO;
                 goto qreparse_out;
         }
-        if ((reparse_buf->PathBuffer + reparse_buf->PrintNameOffset +
-                                reparse_buf->PrintNameLength) > end_of_smb) {
+        if (reparse_buf->ReparseTag == cpu_to_le32(IO_REPARSE_TAG_NFS)) {
+                cifs_dbg(FYI, "NFS style reparse tag\n");
+                posix_buf =  (struct reparse_posix_data *)reparse_buf;
+
+                if (posix_buf->InodeType != cpu_to_le64(NFS_SPECFILE_LNK)) {
+                        cifs_dbg(FYI, "unsupported file type 0x%llx\n",
+                                 le64_to_cpu(posix_buf->InodeType));
+                        rc = -EOPNOTSUPP;
+                        goto qreparse_out;
+                }
+                is_unicode = true;
+                sub_len = le16_to_cpu(reparse_buf->ReparseDataLength);
+                if (posix_buf->PathBuffer + sub_len > end_of_smb) {
+                        cifs_dbg(FYI, "reparse buf beyond SMB\n");
+                        rc = -EIO;
+                        goto qreparse_out;
+                }
+                *symlinkinfo = cifs_strndup_from_utf16(posix_buf->PathBuffer,
+                                sub_len, is_unicode, nls_codepage);
+                goto qreparse_out;
+        } else if (reparse_buf->ReparseTag !=
+                        cpu_to_le32(IO_REPARSE_TAG_SYMLINK)) {
+                rc = -EOPNOTSUPP;
+                goto qreparse_out;
+        }
+
+        /* Reparse tag is NTFS symlink */
+        sub_start = le16_to_cpu(reparse_buf->SubstituteNameOffset) +
+                                reparse_buf->PathBuffer;
+        sub_len = le16_to_cpu(reparse_buf->SubstituteNameLength);
+        if (sub_start + sub_len > end_of_smb) {
                 cifs_dbg(FYI, "reparse buf beyond SMB\n");
                 rc = -EIO;
                 goto qreparse_out;
         }
-        sub_start = reparse_buf->SubstituteNameOffset + reparse_buf->PathBuffer;
-        sub_len = reparse_buf->SubstituteNameLength;
         if (pSMBr->hdr.Flags2 & SMBFLG2_UNICODE)
                 is_unicode = true;
         else
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index eb955b525e55..7ddddf2e2504 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3254,6 +3254,9 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
         /*
          * Reads as many pages as possible from fscache. Returns -ENOBUFS
          * immediately if the cookie is negative
+         *
+         * After this point, every page in the list might have PG_fscache set,
+         * so we will need to clean that up off of every page we don't use.
          */
         rc = cifs_readpages_from_fscache(mapping->host, mapping, page_list,
                                          &num_pages);
@@ -3376,6 +3379,11 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                 kref_put(&rdata->refcount, cifs_readdata_release);
         }
 
+        /* Any pages that have been shown to fscache but didn't get added to
+         * the pagecache must be uncached before they get returned to the
+         * allocator.
+         */
+        cifs_fscache_readpages_cancel(mapping->host, page_list);
         return rc;
 }
 
diff --git a/fs/cifs/fscache.c b/fs/cifs/fscache.c
index 2f4bc5a58054..b3258f35e88a 100644
--- a/fs/cifs/fscache.c
+++ b/fs/cifs/fscache.c
@@ -223,6 +223,13 @@ void __cifs_readpage_to_fscache(struct inode *inode, struct page *page)
                 fscache_uncache_page(CIFS_I(inode)->fscache, page);
 }
 
+void __cifs_fscache_readpages_cancel(struct inode *inode, struct list_head *pages)
+{
+        cifs_dbg(FYI, "%s: (fsc: %p, i: %p)\n",
+                 __func__, CIFS_I(inode)->fscache, inode);
+        fscache_readpages_cancel(CIFS_I(inode)->fscache, pages);
+}
+
 void __cifs_fscache_invalidate_page(struct page *page, struct inode *inode)
 {
         struct cifsInodeInfo *cifsi = CIFS_I(inode);
diff --git a/fs/cifs/fscache.h b/fs/cifs/fscache.h
index 63539323e0b9..24794b6cd8ec 100644
--- a/fs/cifs/fscache.h
+++ b/fs/cifs/fscache.h
@@ -54,6 +54,7 @@ extern int __cifs_readpages_from_fscache(struct inode *,
                                          struct address_space *,
                                          struct list_head *,
                                          unsigned *);
+extern void __cifs_fscache_readpages_cancel(struct inode *, struct list_head *);
 
 extern void __cifs_readpage_to_fscache(struct inode *, struct page *);
 
@@ -91,6 +92,13 @@ static inline void cifs_readpage_to_fscache(struct inode *inode,
                 __cifs_readpage_to_fscache(inode, page);
 }
 
+static inline void cifs_fscache_readpages_cancel(struct inode *inode,
+                                                 struct list_head *pages)
+{
+        if (CIFS_I(inode)->fscache)
+                return __cifs_fscache_readpages_cancel(inode, pages);
+}
+
 #else /* CONFIG_CIFS_FSCACHE */
 static inline int cifs_fscache_register(void) { return 0; }
 static inline void cifs_fscache_unregister(void) {}
@@ -131,6 +139,11 @@ static inline int cifs_readpages_from_fscache(struct inode *inode,
 static inline void cifs_readpage_to_fscache(struct inode *inode,
                         struct page *page) {}
 
+static inline void cifs_fscache_readpages_cancel(struct inode *inode,
+                                                 struct list_head *pages)
+{
+}
+
 #endif /* CONFIG_CIFS_FSCACHE */
 
 #endif /* _CIFS_FSCACHE_H */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index f9ff9c173f78..867b7cdc794a 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -120,6 +120,33 @@ cifs_revalidate_cache(struct inode *inode, struct cifs_fattr *fattr)
         cifs_i->invalid_mapping = true;
 }
 
+/*
+ * copy nlink to the inode, unless it wasn't provided.  Provide
+ * sane values if we don't have an existing one and none was provided
+ */
+static void
+cifs_nlink_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
+{
+        /*
+         * if we're in a situation where we can't trust what we
+         * got from the server (readdir, some non-unix cases)
+         * fake reasonable values
+         */
+        if (fattr->cf_flags & CIFS_FATTR_UNKNOWN_NLINK) {
+                /* only provide fake values on a new inode */
+                if (inode->i_state & I_NEW) {
+                        if (fattr->cf_cifsattrs & ATTR_DIRECTORY)
+                                set_nlink(inode, 2);
+                        else
+                                set_nlink(inode, 1);
+                }
+                return;
+        }
+
+        /* we trust the server, so update it */
+        set_nlink(inode, fattr->cf_nlink);
+}
+
 /* populate an inode with info from a cifs_fattr struct */
 void
 cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
@@ -134,7 +161,7 @@ cifs_fattr_to_inode(struct inode *inode, struct cifs_fattr *fattr)
         inode->i_mtime = fattr->cf_mtime;
         inode->i_ctime = fattr->cf_ctime;
         inode->i_rdev = fattr->cf_rdev;
-        set_nlink(inode, fattr->cf_nlink);
+        cifs_nlink_fattr_to_inode(inode, fattr);
         inode->i_uid = fattr->cf_uid;
         inode->i_gid = fattr->cf_gid;
 
@@ -541,6 +568,7 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
         fattr->cf_bytes = le64_to_cpu(info->AllocationSize);
         fattr->cf_createtime = le64_to_cpu(info->CreationTime);
 
+        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
         if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                 fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                 fattr->cf_dtype = DT_DIR;
@@ -548,7 +576,8 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                  * Server can return wrong NumberOfLinks value for directories
                  * when Unix extensions are disabled - fake it.
                  */
-                fattr->cf_nlink = 2;
+                if (!tcon->unix_ext)
+                        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
         } else if (fattr->cf_cifsattrs & ATTR_REPARSE) {
                 fattr->cf_mode = S_IFLNK;
                 fattr->cf_dtype = DT_LNK;
@@ -561,11 +590,15 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                 if (fattr->cf_cifsattrs & ATTR_READONLY)
                         fattr->cf_mode &= ~(S_IWUGO);
 
-                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
-                if (fattr->cf_nlink < 1) {
-                        cifs_dbg(1, "replacing bogus file nlink value %u\n",
+                /*
+                 * Don't accept zero nlink from non-unix servers unless
+                 * delete is pending.  Instead mark it as unknown.
+                 */
+                if ((fattr->cf_nlink < 1) && !tcon->unix_ext &&
+                    !info->DeletePending) {
+                        cifs_dbg(1, "bogus file nlink value %u\n",
                                 fattr->cf_nlink);
-                        fattr->cf_nlink = 1;
+                        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
                 }
         }
 
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index af847e1cf1c1..651a5279607b 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -780,7 +780,9 @@ static const struct {
         ERRDOS, ERRnoaccess, 0xc0000290}, {
         ERRDOS, ERRbadfunc, 0xc000029c}, {
         ERRDOS, ERRsymlink, NT_STATUS_STOPPED_ON_SYMLINK}, {
-        ERRDOS, ERRinvlevel, 0x007c0001}, };
+        ERRDOS, ERRinvlevel, 0x007c0001}, {
+        0, 0, 0 }
+};
 
 /*****************************************************************************
  Print an error message from the status code
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 42ef03be089f..53a75f3d0179 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -180,6 +180,9 @@ cifs_fill_common_info(struct cifs_fattr *fattr, struct cifs_sb_info *cifs_sb)
                 fattr->cf_dtype = DT_REG;
         }
 
+        /* non-unix readdir doesn't provide nlink */
+        fattr->cf_flags |= CIFS_FATTR_UNKNOWN_NLINK;
+
         if (fattr->cf_cifsattrs & ATTR_READONLY)
                 fattr->cf_mode &= ~S_IWUGO;
 
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 5f99b7f19e78..e87387dbf39f 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -32,88 +32,6 @@
 #include <linux/slab.h>
 #include "cifs_spnego.h"
 
-/*
- * Checks if this is the first smb session to be reconnected after
- * the socket has been reestablished (so we know whether to use vc 0).
- * Called while holding the cifs_tcp_ses_lock, so do not block
- */
-static bool is_first_ses_reconnect(struct cifs_ses *ses)
-{
-        struct list_head *tmp;
-        struct cifs_ses *tmp_ses;
-
-        list_for_each(tmp, &ses->server->smb_ses_list) {
-                tmp_ses = list_entry(tmp, struct cifs_ses,
-                                     smb_ses_list);
-                if (tmp_ses->need_reconnect == false)
-                        return false;
-        }
-        /* could not find a session that was already connected,
-           this must be the first one we are reconnecting */
-        return true;
-}
-
-/*
- *      vc number 0 is treated specially by some servers, and should be the
- *      first one we request.  After that we can use vcnumbers up to maxvcs,
- *      one for each smb session (some Windows versions set maxvcs incorrectly
- *      so maxvc=1 can be ignored).  If we have too many vcs, we can reuse
- *      any vc but zero (some servers reset the connection on vcnum zero)
- *
- */
-static __le16 get_next_vcnum(struct cifs_ses *ses)
-{
-        __u16 vcnum = 0;
-        struct list_head *tmp;
-        struct cifs_ses *tmp_ses;
-        __u16 max_vcs = ses->server->max_vcs;
-        __u16 i;
-        int free_vc_found = 0;
-
-        /* Quoting the MS-SMB specification: "Windows-based SMB servers set this
-        field to one but do not enforce this limit, which allows an SMB client
-        to establish more virtual circuits than allowed by this value ... but
-        other server implementations can enforce this limit." */
-        if (max_vcs < 2)
-                max_vcs = 0xFFFF;
-
-        spin_lock(&cifs_tcp_ses_lock);
-        if ((ses->need_reconnect) && is_first_ses_reconnect(ses))
-                        goto get_vc_num_exit;  /* vcnum will be zero */
-        for (i = ses->server->srv_count - 1; i < max_vcs; i++) {
-                if (i == 0) /* this is the only connection, use vc 0 */
-                        break;
-
-                free_vc_found = 1;
-
-                list_for_each(tmp, &ses->server->smb_ses_list) {
-                        tmp_ses = list_entry(tmp, struct cifs_ses,
-                                             smb_ses_list);
-                        if (tmp_ses->vcnum == i) {
-                                free_vc_found = 0;
-                                break; /* found duplicate, try next vcnum */
-                        }
-                }
-                if (free_vc_found)
-                        break; /* we found a vcnumber that will work - use it */
-        }
-
-        if (i == 0)
-                vcnum = 0; /* for most common case, ie if one smb session, use
-                              vc zero.  Also for case when no free vcnum, zero
-                              is safest to send (some clients only send zero) */
-        else if (free_vc_found == 0)
-                vcnum = 1;  /* we can not reuse vc=0 safely, since some servers
-                                reset all uids on that, but 1 is ok. */
-        else
-                vcnum = i;
-        ses->vcnum = vcnum;
-get_vc_num_exit:
-        spin_unlock(&cifs_tcp_ses_lock);
-
-        return cpu_to_le16(vcnum);
-}
-
 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
 {
         __u32 capabilities = 0;
@@ -128,7 +46,7 @@ static __u32 cifs_ssetup_hdr(struct cifs_ses *ses, SESSION_SETUP_ANDX *pSMB)
                                         CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
                                         USHRT_MAX));
         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
-        pSMB->req.VcNumber = get_next_vcnum(ses);
+        pSMB->req.VcNumber = __constant_cpu_to_le16(1);
 
         /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
 
@@ -582,9 +500,9 @@ select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
                                 return NTLMv2;
                         if (global_secflags & CIFSSEC_MAY_NTLM)
                                 return NTLM;
-                        /* Fallthrough */
                 default:
-                        return Unspecified;
+                        /* Fallthrough to attempt LANMAN authentication next */
+                        break;
                 }
         case CIFS_NEGFLAVOR_LANMAN:
                 switch (requested) {
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index eba0efde66d7..edccb5252462 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -687,6 +687,10 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
         else
                 return -EIO;
 
+        /* no need to send SMB logoff if uid already closed due to reconnect */
+        if (ses->need_reconnect)
+                goto smb2_session_already_dead;
+
         rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
         if (rc)
                 return rc;
@@ -701,6 +705,8 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
          * No tcon so can't do
          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
          */
+
+smb2_session_already_dead:
         return rc;
 }
 
diff --git a/fs/cifs/smbfsctl.h b/fs/cifs/smbfsctl.h
index d952ee48f4dc..a4b2391fe66e 100644
--- a/fs/cifs/smbfsctl.h
+++ b/fs/cifs/smbfsctl.h
@@ -97,9 +97,23 @@
 #define FSCTL_QUERY_NETWORK_INTERFACE_INFO 0x001401FC /* BB add struct */
 #define FSCTL_SRV_READ_HASH          0x001441BB /* BB add struct */
 
+/* See FSCC 2.1.2.5 */
 #define IO_REPARSE_TAG_MOUNT_POINT   0xA0000003
 #define IO_REPARSE_TAG_HSM           0xC0000004
 #define IO_REPARSE_TAG_SIS           0x80000007
+#define IO_REPARSE_TAG_HSM2          0x80000006
+#define IO_REPARSE_TAG_DRIVER_EXTENDER 0x80000005
+/* Used by the DFS filter. See MS-DFSC */
+#define IO_REPARSE_TAG_DFS           0x8000000A
+/* Used by the DFS filter See MS-DFSC */
+#define IO_REPARSE_TAG_DFSR          0x80000012
+#define IO_REPARSE_TAG_FILTER_MANAGER 0x8000000B
+/* See section MS-FSCC 2.1.2.4 */
+#define IO_REPARSE_TAG_SYMLINK       0xA000000C
+#define IO_REPARSE_TAG_DEDUP         0x80000013
+#define IO_REPARSE_APPXSTREAM        0xC0000014
+/* NFS symlinks, Win 8/SMB3 and later */
+#define IO_REPARSE_TAG_NFS           0x80000014
 
 /* fsctl flags */
 /* If Flags is set to this value, the request is an FSCTL not ioctl request */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 6fdcb1b4a106..800b938e4061 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -410,8 +410,13 @@ static int
 wait_for_free_request(struct TCP_Server_Info *server, const int timeout,
                       const int optype)
 {
-        return wait_for_free_credits(server, timeout,
-                                server->ops->get_credits_field(server, optype));
+        int *val;
+
+        val = server->ops->get_credits_field(server, optype);
+        /* Since an echo is already inflight, no need to wait to send another */
+        if (*val <= 0 && optype == CIFS_ECHO_OP)
+                return -EAGAIN;
+        return wait_for_free_credits(server, timeout, val);
 }
 
 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
diff --git a/fs/dcache.c b/fs/dcache.c
index 41000305d716..20532cb0b06e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1331,14 +1331,6 @@ rename_retry:
  * list is non-empty and continue searching.
  */
 
-/**
- * have_submounts - check for mounts over a dentry
- * @parent: dentry to check.
- *
- * Return true if the parent or its subdirectories contain
- * a mount point
- */
-
 static enum d_walk_ret check_mount(void *data, struct dentry *dentry)
 {
         int *ret = data;
@@ -1349,6 +1341,13 @@ static enum d_walk_ret check_mount(void *data, struct dentry *dentry)
         return D_WALK_CONTINUE;
 }
 
+/**
+ * have_submounts - check for mounts over a dentry
+ * @parent: dentry to check.
+ *
+ * Return true if the parent or its subdirectories contain
+ * a mount point
+ */
 int have_submounts(struct dentry *parent)
 {
         int ret = 0;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index c88e355f7635..000eae2782b6 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -408,7 +408,7 @@ static loff_t lower_offset_for_page(struct ecryptfs_crypt_stat *crypt_stat,
                                     struct page *page)
 {
         return ecryptfs_lower_header_size(crypt_stat) +
-               (page->index << PAGE_CACHE_SHIFT);
+               ((loff_t)page->index << PAGE_CACHE_SHIFT);
 }
 
 /**
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 7d52806c2119..4725a07f003c 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1149,7 +1149,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
         struct ecryptfs_msg_ctx *msg_ctx;
         struct ecryptfs_message *msg = NULL;
         char *auth_tok_sig;
-        char *payload;
+        char *payload = NULL;
         size_t payload_len = 0;
         int rc;
 
@@ -1203,6 +1203,7 @@ decrypt_pki_encrypted_session_key(struct ecryptfs_auth_tok *auth_tok,
         }
 out:
         kfree(msg);
+        kfree(payload);
         return rc;
 }
 
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 1194b1f0f839..f8cde46de9cd 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1783,7 +1783,7 @@ retry:
                 d_tmpfile(dentry, inode);
                 err = ext3_orphan_add(handle, inode);
                 if (err)
-                        goto err_drop_inode;
+                        goto err_unlock_inode;
                 mark_inode_dirty(inode);
                 unlock_new_inode(inode);
         }
@@ -1791,10 +1791,9 @@ retry:
         if (err == -ENOSPC && ext3_should_retry_alloc(dir->i_sb, &retries))
                 goto retry;
         return err;
-err_drop_inode:
+err_unlock_inode:
         ext3_journal_stop(handle);
         unlock_new_inode(inode);
-        iput(inode);
         return err;
 }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 0d424d7ac02b..e274e9c1171f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2563,7 +2563,7 @@ retry:
                         break;
         }
         blk_finish_plug(&plug);
-        if (!ret && !cycled) {
+        if (!ret && !cycled && wbc->nr_to_write > 0) {
                 cycled = 1;
                 mpd.last_page = writeback_index - 1;
                 mpd.first_page = 0;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 1bec5a5c1e45..5a0408d7b114 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -2319,7 +2319,7 @@ retry:
                 d_tmpfile(dentry, inode);
                 err = ext4_orphan_add(handle, inode);
                 if (err)
-                        goto err_drop_inode;
+                        goto err_unlock_inode;
                 mark_inode_dirty(inode);
                 unlock_new_inode(inode);
         }
@@ -2328,10 +2328,9 @@ retry:
         if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
                 goto retry;
         return err;
-err_drop_inode:
+err_unlock_inode:
         ext4_journal_stop(handle);
         unlock_new_inode(inode);
-        iput(inode);
         return err;
 }
 
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index c081e34f717f..03e9bebba198 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1350,6 +1350,8 @@ retry:
                                     s_min_extra_isize) {
                                         tried_min_extra_isize++;
                                         new_extra_isize = s_min_extra_isize;
+                                        kfree(is); is = NULL;
+                                        kfree(bs); bs = NULL;
                                         goto retry;
                                 }
                                 error = -1;
diff --git a/fs/file_table.c b/fs/file_table.c
index abdd15ad13c9..e900ca518635 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -297,7 +297,7 @@ void flush_delayed_fput(void)
         delayed_fput(NULL);
 }
 
-static DECLARE_WORK(delayed_fput_work, delayed_fput);
+static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
 
 void fput(struct file *file)
 {
@@ -317,7 +317,7 @@ void fput(struct file *file)
                 }
 
                 if (llist_add(&file->f_u.fu_llist, &delayed_fput_list))
-                        schedule_work(&delayed_fput_work);
+                        schedule_delayed_work(&delayed_fput_work, 1);
         }
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 62b43b577bfc..b7989f2ab4c4 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -182,6 +182,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
         struct inode *inode;
         struct dentry *parent;
         struct fuse_conn *fc;
+        struct fuse_inode *fi;
         int ret;
 
         inode = ACCESS_ONCE(entry->d_inode);
@@ -228,7 +229,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                 if (!err && !outarg.nodeid)
                         err = -ENOENT;
                 if (!err) {
-                        struct fuse_inode *fi = get_fuse_inode(inode);
+                        fi = get_fuse_inode(inode);
                         if (outarg.nodeid != get_node_id(inode)) {
                                 fuse_queue_forget(fc, forget, outarg.nodeid, 1);
                                 goto invalid;
@@ -246,8 +247,11 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
                                        attr_version);
                 fuse_change_entry_timeout(entry, &outarg);
         } else if (inode) {
-                fc = get_fuse_conn(inode);
-                if (fc->readdirplus_auto) {
+                fi = get_fuse_inode(inode);
+                if (flags & LOOKUP_RCU) {
+                        if (test_bit(FUSE_I_INIT_RDPLUS, &fi->state))
+                                return -ECHILD;
+                } else if (test_and_clear_bit(FUSE_I_INIT_RDPLUS, &fi->state)) {
                         parent = dget_parent(entry);
                         fuse_advise_use_readdirplus(parent->d_inode);
                         dput(parent);
@@ -259,7 +263,8 @@ out:
 
 invalid:
         ret = 0;
-        if (check_submounts_and_drop(entry) != 0)
+
+        if (!(flags & LOOKUP_RCU) && check_submounts_and_drop(entry) != 0)
                 ret = 1;
         goto out;
 }
@@ -1063,6 +1068,8 @@ static int fuse_access(struct inode *inode, int mask)
         struct fuse_access_in inarg;
         int err;
 
+        BUG_ON(mask & MAY_NOT_BLOCK);
+
         if (fc->no_access)
                 return 0;
 
@@ -1150,9 +1157,6 @@ static int fuse_permission(struct inode *inode, int mask)
                    noticed immediately, only after the attribute
                    timeout has expired */
         } else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
-                if (mask & MAY_NOT_BLOCK)
-                        return -ECHILD;
-
                 err = fuse_access(inode, mask);
         } else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
                 if (!(inode->i_mode & S_IXUGO)) {
@@ -1291,6 +1295,8 @@ static int fuse_direntplus_link(struct file *file,
         }
 
 found:
+        if (fc->readdirplus_auto)
+                set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
         fuse_change_entry_timeout(dentry, o);
 
         err = 0;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d409deafc67b..4598345ab87d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -2467,6 +2467,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
 {
         struct fuse_file *ff = file->private_data;
         struct inode *inode = file->f_inode;
+        struct fuse_inode *fi = get_fuse_inode(inode);
         struct fuse_conn *fc = ff->fc;
         struct fuse_req *req;
         struct fuse_fallocate_in inarg = {
@@ -2484,10 +2485,20 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
 
         if (lock_inode) {
                 mutex_lock(&inode->i_mutex);
-                if (mode & FALLOC_FL_PUNCH_HOLE)
-                        fuse_set_nowrite(inode);
+                if (mode & FALLOC_FL_PUNCH_HOLE) {
+                        loff_t endbyte = offset + length - 1;
+                        err = filemap_write_and_wait_range(inode->i_mapping,
+                                                           offset, endbyte);
+                        if (err)
+                                goto out;
+
+                        fuse_sync_writes(inode);
+                }
         }
 
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
+                set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+
         req = fuse_get_req_nopages(fc);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
@@ -2520,11 +2531,11 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
         fuse_invalidate_attr(inode);
 
 out:
-        if (lock_inode) {
-                if (mode & FALLOC_FL_PUNCH_HOLE)
-                        fuse_release_nowrite(inode);
+        if (!(mode & FALLOC_FL_KEEP_SIZE))
+                clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+
+        if (lock_inode)
                 mutex_unlock(&inode->i_mutex);
-        }
 
         return err;
 }
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 5ced199b50bb..5b9e6f3b6aef 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -115,6 +115,8 @@ struct fuse_inode {
 enum {
         /** Advise readdirplus  */
         FUSE_I_ADVISE_RDPLUS,
+        /** Initialized with readdirplus */
+        FUSE_I_INIT_RDPLUS,
         /** An operation changing file size is in progress  */
         FUSE_I_SIZE_UNSTABLE,
 };
diff --git a/fs/jfs/jfs_inode.c b/fs/jfs/jfs_inode.c
index c1a3e603279c..7f464c513ba0 100644
--- a/fs/jfs/jfs_inode.c
+++ b/fs/jfs/jfs_inode.c
@@ -95,7 +95,7 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
 
         if (insert_inode_locked(inode) < 0) {
                 rc = -EINVAL;
-                goto fail_unlock;
+                goto fail_put;
         }
 
         inode_init_owner(inode, parent, mode);
@@ -156,7 +156,6 @@ struct inode *ialloc(struct inode *parent, umode_t mode)
 fail_drop:
         dquot_drop(inode);
         inode->i_flags |= S_NOQUOTA;
-fail_unlock:
         clear_nlink(inode);
         unlock_new_inode(inode);
 fail_put:
diff --git a/fs/namei.c b/fs/namei.c
index 645268f23eb6..caa28051e197 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2294,10 +2294,11 @@ out:
  * path_mountpoint - look up a path to be umounted
  * @dfd:        directory file descriptor to start walk from
  * @name:       full pathname to walk
+ * @path:       pointer to container for result
  * @flags:      lookup flags
  *
  * Look up the given name, but don't attempt to revalidate the last component.
- * Returns 0 and "path" will be valid on success; Retuns error otherwise.
+ * Returns 0 and "path" will be valid on success; Returns error otherwise.
  */
 static int
 path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 854a8f05a610..02b0df769e2d 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1458,7 +1458,7 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
 
         trace_nfs_atomic_open_enter(dir, ctx, open_flags);
         nfs_block_sillyrename(dentry->d_parent);
-        inode = NFS_PROTO(dir)->open_context(dir, ctx, open_flags, &attr);
+        inode = NFS_PROTO(dir)->open_context(dir, ctx, open_flags, &attr, opened);
         nfs_unblock_sillyrename(dentry->d_parent);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index e5b804dd944c..77efaf15ec90 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -19,6 +19,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
         struct inode *dir;
         unsigned openflags = filp->f_flags;
         struct iattr attr;
+        int opened = 0;
         int err;
 
         /*
@@ -55,7 +56,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
                 nfs_wb_all(inode);
         }
 
-        inode = NFS_PROTO(dir)->open_context(dir, ctx, openflags, &attr);
+        inode = NFS_PROTO(dir)->open_context(dir, ctx, openflags, &attr, &opened);
         if (IS_ERR(inode)) {
                 err = PTR_ERR(inode);
                 switch (err) {
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 95604f64cab8..c7c295e556ed 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -185,6 +185,7 @@ nfs4_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds)
         if (status)
                 goto out_put;
 
+        smp_wmb();
         ds->ds_clp = clp;
         dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
 out:
@@ -801,34 +802,35 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
         struct nfs4_file_layout_dsaddr *dsaddr = FILELAYOUT_LSEG(lseg)->dsaddr;
         struct nfs4_pnfs_ds *ds = dsaddr->ds_list[ds_idx];
         struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
-
-        if (filelayout_test_devid_unavailable(devid))
-                return NULL;
+        struct nfs4_pnfs_ds *ret = ds;
 
         if (ds == NULL) {
                 printk(KERN_ERR "NFS: %s: No data server for offset index %d\n",
                         __func__, ds_idx);
                 filelayout_mark_devid_invalid(devid);
-                return NULL;
+                goto out;
         }
+        smp_rmb();
         if (ds->ds_clp)
-                return ds;
+                goto out_test_devid;
 
         if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
                 struct nfs_server *s = NFS_SERVER(lseg->pls_layout->plh_inode);
                 int err;
 
                 err = nfs4_ds_connect(s, ds);
-                if (err) {
+                if (err)
                         nfs4_mark_deviceid_unavailable(devid);
-                        ds = NULL;
-                }
                 nfs4_clear_ds_conn_bit(ds);
         } else {
                 /* Either ds is connected, or ds is NULL */
                 nfs4_wait_ds_connect(ds);
         }
-        return ds;
+out_test_devid:
+        if (filelayout_test_devid_unavailable(devid))
+                ret = NULL;
+out:
+        return ret;
 }
 
 module_param(dataserver_retrans, uint, 0644);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 989bb9d3074d..d53d6785cba2 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -912,6 +912,7 @@ struct nfs4_opendata {
         struct iattr attrs;
         unsigned long timestamp;
         unsigned int rpc_done : 1;
+        unsigned int file_created : 1;
         unsigned int is_recover : 1;
         int rpc_status;
         int cancelled;
@@ -1946,8 +1947,13 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
 
         nfs_fattr_map_and_free_names(server, &data->f_attr);
 
-        if (o_arg->open_flags & O_CREAT)
+        if (o_arg->open_flags & O_CREAT) {
                 update_changeattr(dir, &o_res->cinfo);
+                if (o_arg->open_flags & O_EXCL)
+                        data->file_created = 1;
+                else if (o_res->cinfo.before != o_res->cinfo.after)
+                        data->file_created = 1;
+        }
         if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
                 server->caps &= ~NFS_CAP_POSIX_LOCK;
         if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
@@ -2191,7 +2197,8 @@ static int _nfs4_do_open(struct inode *dir,
                         struct nfs_open_context *ctx,
                         int flags,
                         struct iattr *sattr,
-                        struct nfs4_label *label)
+                        struct nfs4_label *label,
+                        int *opened)
 {
         struct nfs4_state_owner  *sp;
         struct nfs4_state     *state = NULL;
@@ -2261,6 +2268,8 @@ static int _nfs4_do_open(struct inode *dir,
                         nfs_setsecurity(state->inode, opendata->o_res.f_attr, olabel);
                 }
         }
+        if (opendata->file_created)
+                *opened |= FILE_CREATED;
 
         if (pnfs_use_threshold(ctx_th, opendata->f_attr.mdsthreshold, server))
                 *ctx_th = opendata->f_attr.mdsthreshold;
@@ -2289,7 +2298,8 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
                                         struct nfs_open_context *ctx,
                                         int flags,
                                         struct iattr *sattr,
-                                        struct nfs4_label *label)
+                                        struct nfs4_label *label,
+                                        int *opened)
 {
         struct nfs_server *server = NFS_SERVER(dir);
         struct nfs4_exception exception = { };
@@ -2297,7 +2307,7 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
         int status;
 
         do {
-                status = _nfs4_do_open(dir, ctx, flags, sattr, label);
+                status = _nfs4_do_open(dir, ctx, flags, sattr, label, opened);
                 res = ctx->state;
                 trace_nfs4_open_file(ctx, flags, status);
                 if (status == 0)
@@ -2659,7 +2669,8 @@ out:
 }
 
 static struct inode *
-nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx, int open_flags, struct iattr *attr)
+nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx,
+                int open_flags, struct iattr *attr, int *opened)
 {
         struct nfs4_state *state;
         struct nfs4_label l = {0, 0, 0, NULL}, *label = NULL;
@@ -2667,7 +2678,7 @@ nfs4_atomic_open(struct inode *dir, struct nfs_open_context *ctx, int open_flags
         label = nfs4_label_init_security(dir, ctx->dentry, attr, &l);
 
         /* Protect against concurrent sillydeletes */
-        state = nfs4_do_open(dir, ctx, open_flags, attr, label);
+        state = nfs4_do_open(dir, ctx, open_flags, attr, label, opened);
 
         nfs4_label_release_security(label);
 
@@ -3332,6 +3343,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
         struct nfs4_label l, *ilabel = NULL;
         struct nfs_open_context *ctx;
         struct nfs4_state *state;
+        int opened = 0;
         int status = 0;
 
         ctx = alloc_nfs_open_context(dentry, FMODE_READ);
@@ -3341,7 +3353,7 @@ nfs4_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr,
         ilabel = nfs4_label_init_security(dir, dentry, sattr, &l);
 
         sattr->ia_mode &= ~current_umask();
-        state = nfs4_do_open(dir, ctx, flags, sattr, ilabel);
+        state = nfs4_do_open(dir, ctx, flags, sattr, ilabel, &opened);
         if (IS_ERR(state)) {
                 status = PTR_ERR(state);
                 goto out;
@@ -7564,8 +7576,10 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
 {
         int err;
         struct page *page;
-        rpc_authflavor_t flavor;
+        rpc_authflavor_t flavor = RPC_AUTH_MAXFLAVOR;
         struct nfs4_secinfo_flavors *flavors;
+        struct nfs4_secinfo4 *secinfo;
+        int i;
 
         page = alloc_page(GFP_KERNEL);
         if (!page) {
@@ -7587,9 +7601,31 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
         if (err)
                 goto out_freepage;
 
-        flavor = nfs_find_best_sec(flavors);
-        if (err == 0)
-                err = nfs4_lookup_root_sec(server, fhandle, info, flavor);
+        for (i = 0; i < flavors->num_flavors; i++) {
+                secinfo = &flavors->flavors[i];
+
+                switch (secinfo->flavor) {
+                case RPC_AUTH_NULL:
+                case RPC_AUTH_UNIX:
+                case RPC_AUTH_GSS:
+                        flavor = rpcauth_get_pseudoflavor(secinfo->flavor,
+                                        &secinfo->flavor_info);
+                        break;
+                default:
+                        flavor = RPC_AUTH_MAXFLAVOR;
+                        break;
+                }
+
+                if (flavor != RPC_AUTH_MAXFLAVOR) {
+                        err = nfs4_lookup_root_sec(server, fhandle,
+                                                   info, flavor);
+                        if (!err)
+                                break;
+                }
+        }
+
+        if (flavor == RPC_AUTH_MAXFLAVOR)
+                err = -EPERM;
 
 out_freepage:
         put_page(page);
diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
index 0ba679866e50..da276640f776 100644
--- a/fs/nilfs2/page.c
+++ b/fs/nilfs2/page.c
@@ -94,6 +94,7 @@ void nilfs_forget_buffer(struct buffer_head *bh)
         clear_buffer_nilfs_volatile(bh);
         clear_buffer_nilfs_checked(bh);
         clear_buffer_nilfs_redirected(bh);
+        clear_buffer_async_write(bh);
         clear_buffer_dirty(bh);
         if (nilfs_page_buffers_clean(page))
                 __nilfs_clear_page_dirty(page);
@@ -429,6 +430,7 @@ void nilfs_clear_dirty_page(struct page *page, bool silent)
                                         "discard block %llu, size %zu",
                                         (u64)bh->b_blocknr, bh->b_size);
                         }
+                        clear_buffer_async_write(bh);
                         clear_buffer_dirty(bh);
                         clear_buffer_nilfs_volatile(bh);
                         clear_buffer_nilfs_checked(bh);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index bd88a7461063..9f6b486b6c01 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -665,7 +665,7 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode,
 
                 bh = head = page_buffers(page);
                 do {
-                        if (!buffer_dirty(bh))
+                        if (!buffer_dirty(bh) || buffer_async_write(bh))
                                 continue;
                         get_bh(bh);
                         list_add_tail(&bh->b_assoc_buffers, listp);
@@ -699,7 +699,8 @@ static void nilfs_lookup_dirty_node_buffers(struct inode *inode,
                 for (i = 0; i < pagevec_count(&pvec); i++) {
                         bh = head = page_buffers(pvec.pages[i]);
                         do {
-                                if (buffer_dirty(bh)) {
+                                if (buffer_dirty(bh) &&
+                                                !buffer_async_write(bh)) {
                                         get_bh(bh);
                                         list_add_tail(&bh->b_assoc_buffers,
                                                       listp);
@@ -1579,6 +1580,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
 
                 list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
                                     b_assoc_buffers) {
+                        set_buffer_async_write(bh);
                         if (bh->b_page != bd_page) {
                                 if (bd_page) {
                                         lock_page(bd_page);
@@ -1592,6 +1594,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
 
                 list_for_each_entry(bh, &segbuf->sb_payload_buffers,
                                     b_assoc_buffers) {
+                        set_buffer_async_write(bh);
                         if (bh == segbuf->sb_super_root) {
                                 if (bh->b_page != bd_page) {
                                         lock_page(bd_page);
@@ -1677,6 +1680,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
         list_for_each_entry(segbuf, logs, sb_list) {
                 list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
                                     b_assoc_buffers) {
+                        clear_buffer_async_write(bh);
                         if (bh->b_page != bd_page) {
                                 if (bd_page)
                                         end_page_writeback(bd_page);
@@ -1686,6 +1690,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
 
                 list_for_each_entry(bh, &segbuf->sb_payload_buffers,
                                     b_assoc_buffers) {
+                        clear_buffer_async_write(bh);
                         if (bh == segbuf->sb_super_root) {
                                 if (bh->b_page != bd_page) {
                                         end_page_writeback(bd_page);
@@ -1755,6 +1760,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
                                     b_assoc_buffers) {
                         set_buffer_uptodate(bh);
                         clear_buffer_dirty(bh);
+                        clear_buffer_async_write(bh);
                         if (bh->b_page != bd_page) {
                                 if (bd_page)
                                         end_page_writeback(bd_page);
@@ -1776,6 +1782,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
                                     b_assoc_buffers) {
                         set_buffer_uptodate(bh);
                         clear_buffer_dirty(bh);
+                        clear_buffer_async_write(bh);
                         clear_buffer_delay(bh);
                         clear_buffer_nilfs_volatile(bh);
                         clear_buffer_nilfs_redirected(bh);
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index ef999729e274..0d3a97d2d5f6 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -70,9 +70,10 @@ static int ocfs2_dentry_revalidate(struct dentry *dentry, unsigned int flags)
          */
         if (inode == NULL) {
                 unsigned long gen = (unsigned long) dentry->d_fsdata;
-                unsigned long pgen =
-                        OCFS2_I(dentry->d_parent->d_inode)->ip_dir_lock_gen;
-
+                unsigned long pgen;
+                spin_lock(&dentry->d_lock);
+                pgen = OCFS2_I(dentry->d_parent->d_inode)->ip_dir_lock_gen;
+                spin_unlock(&dentry->d_lock);
                 trace_ocfs2_dentry_revalidate_negative(dentry->d_name.len,
                                                        dentry->d_name.name,
                                                        pgen, gen);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 121da2dc3be8..d4e81e4a9b04 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1924,7 +1924,7 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
 {
         int tmp, hangup_needed = 0;
         struct ocfs2_super *osb = NULL;
-        char nodestr[8];
+        char nodestr[12];
 
         trace_ocfs2_dismount_volume(sb);
 
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 9f8ef9b7674d..8eaa1ba793fc 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -288,10 +288,14 @@ static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
 static unsigned long proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr, unsigned long len, unsigned long pgoff, unsigned long flags)
 {
         struct proc_dir_entry *pde = PDE(file_inode(file));
-        int rv = -EIO;
-        unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+        unsigned long rv = -EIO;
+        unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long) = NULL;
         if (use_pde(pde)) {
-                get_unmapped_area = pde->proc_fops->get_unmapped_area;
+#ifdef CONFIG_MMU
+                get_unmapped_area = current->mm->get_unmapped_area;
+#endif
+                if (pde->proc_fops->get_unmapped_area)
+                        get_unmapped_area = pde->proc_fops->get_unmapped_area;
                 if (get_unmapped_area)
                         rv = get_unmapped_area(file, orig_addr, len, pgoff, flags);
                 unuse_pde(pde);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 7366e9d63cee..390bdab01c3c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -941,6 +941,8 @@ static void pte_to_pagemap_entry(pagemap_entry_t *pme, struct pagemapread *pm,
                 frame = pte_pfn(pte);
                 flags = PM_PRESENT;
                 page = vm_normal_page(vma, addr, pte);
+                if (pte_soft_dirty(pte))
+                        flags2 |= __PM_SOFT_DIRTY;
         } else if (is_swap_pte(pte)) {
                 swp_entry_t entry;
                 if (pte_swp_soft_dirty(pte))
@@ -960,7 +962,7 @@ static void pte_to_pagemap_entry(pagemap_entry_t *pme, struct pagemapread *pm,
 
         if (page && !PageAnon(page))
                 flags |= PM_FILE;
-        if ((vma->vm_flags & VM_SOFTDIRTY) || pte_soft_dirty(pte))
+        if ((vma->vm_flags & VM_SOFTDIRTY))
                 flags2 |= __PM_SOFT_DIRTY;
 
         *pme = make_pme(PM_PFRAME(frame) | PM_STATUS2(pm->v2, flags2) | flags);
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 73feacc49b2e..fd777032c2ba 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -1163,21 +1163,6 @@ static struct reiserfs_journal_list *find_newer_jl_for_cn(struct
         return NULL;
 }
 
-static int newer_jl_done(struct reiserfs_journal_cnode *cn)
-{
-        struct super_block *sb = cn->sb;
-        b_blocknr_t blocknr = cn->blocknr;
-
-        cn = cn->hprev;
-        while (cn) {
-                if (cn->sb == sb && cn->blocknr == blocknr && cn->jlist &&
-                    atomic_read(&cn->jlist->j_commit_left) != 0)
-                                    return 0;
-                cn = cn->hprev;
-        }
-        return 1;
-}
-
 static void remove_journal_hash(struct super_block *,
                                 struct reiserfs_journal_cnode **,
                                 struct reiserfs_journal_list *, unsigned long,
@@ -1353,7 +1338,6 @@ static int flush_journal_list(struct super_block *s,
                 reiserfs_warning(s, "clm-2048", "called with wcount %d",
                                  atomic_read(&journal->j_wcount));
         }
-        BUG_ON(jl->j_trans_id == 0);
 
         /* if flushall == 0, the lock is already held */
         if (flushall) {
@@ -1593,31 +1577,6 @@ static int flush_journal_list(struct super_block *s,
         return err;
 }
 
-static int test_transaction(struct super_block *s,
-                            struct reiserfs_journal_list *jl)
-{
-        struct reiserfs_journal_cnode *cn;
-
-        if (jl->j_len == 0 || atomic_read(&jl->j_nonzerolen) == 0)
-                return 1;
-
-        cn = jl->j_realblock;
-        while (cn) {
-                /* if the blocknr == 0, this has been cleared from the hash,
-                 ** skip it
-                 */
-                if (cn->blocknr == 0) {
-                        goto next;
-                }
-                if (cn->bh && !newer_jl_done(cn))
-                        return 0;
-              next:
-                cn = cn->next;
-                cond_resched();
-        }
-        return 0;
-}
-
 static int write_one_transaction(struct super_block *s,
                                  struct reiserfs_journal_list *jl,
                                  struct buffer_chunk *chunk)
@@ -1805,6 +1764,8 @@ static int flush_used_journal_lists(struct super_block *s,
                         break;
                 tjl = JOURNAL_LIST_ENTRY(tjl->j_list.next);
         }
+        get_journal_list(jl);
+        get_journal_list(flush_jl);
         /* try to find a group of blocks we can flush across all the
          ** transactions, but only bother if we've actually spanned
          ** across multiple lists
@@ -1813,6 +1774,8 @@ static int flush_used_journal_lists(struct super_block *s,
                 ret = kupdate_transactions(s, jl, &tjl, &trans_id, len, i);
         }
         flush_journal_list(s, flush_jl, 1);
+        put_journal_list(s, flush_jl);
+        put_journal_list(s, jl);
         return 0;
 }
 
@@ -3868,27 +3831,6 @@ int reiserfs_prepare_for_journal(struct super_block *sb,
         return 1;
 }
 
-static void flush_old_journal_lists(struct super_block *s)
-{
-        struct reiserfs_journal *journal = SB_JOURNAL(s);
-        struct reiserfs_journal_list *jl;
-        struct list_head *entry;
-        time_t now = get_seconds();
-
-        while (!list_empty(&journal->j_journal_list)) {
-                entry = journal->j_journal_list.next;
-                jl = JOURNAL_LIST_ENTRY(entry);
-                /* this check should always be run, to send old lists to disk */
-                if (jl->j_timestamp < (now - (JOURNAL_MAX_TRANS_AGE * 4)) &&
-                    atomic_read(&jl->j_commit_left) == 0 &&
-                    test_transaction(s, jl)) {
-                        flush_used_journal_lists(s, jl);
-                } else {
-                        break;
-                }
-        }
-}
-
 /*
 ** long and ugly.  If flush, will not return until all commit
 ** blocks and all real buffers in the trans are on disk.
@@ -4232,7 +4174,6 @@ static int do_journal_end(struct reiserfs_transaction_handle *th,
                         }
                 }
         }
-        flush_old_journal_lists(sb);
 
         journal->j_current_jl->j_list_bitmap =
             get_list_bitmap(sb, journal->j_current_jl);
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 3135c2525c76..a290157265ef 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -328,6 +328,8 @@ loff_t seq_lseek(struct file *file, loff_t offset, int whence)
                                 m->read_pos = offset;
                                 retval = file->f_pos = offset;
                         }
+                } else {
+                        file->f_pos = offset;
                 }
         }
         file->f_version = m->version;
diff --git a/fs/statfs.c b/fs/statfs.c
index c219e733f553..083dc0ac9140 100644
--- a/fs/statfs.c
+++ b/fs/statfs.c
@@ -94,7 +94,7 @@ retry:
 
 int fd_statfs(int fd, struct kstatfs *st)
 {
-        struct fd f = fdget(fd);
+        struct fd f = fdget_raw(fd);
         int error = -EBADF;
         if (f.file) {
                 error = vfs_statfs(&f.file->f_path, st);
diff --git a/fs/super.c b/fs/super.c
index 3a96c9783a8b..0225c20f8770 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -264,6 +264,8 @@ out_free_sb:
  */
 static inline void destroy_super(struct super_block *s)
 {
+        list_lru_destroy(&s->s_dentry_lru);
+        list_lru_destroy(&s->s_inode_lru);
 #ifdef CONFIG_SMP
         free_percpu(s->s_files);
 #endif
@@ -323,8 +325,6 @@ void deactivate_locked_super(struct super_block *s)
 
                 /* caches are now gone, we can safely kill the shrinker now */
                 unregister_shrinker(&s->s_shrink);
-                list_lru_destroy(&s->s_dentry_lru);
-                list_lru_destroy(&s->s_inode_lru);
 
                 put_filesystem(fs);
                 put_super(s);
diff --git a/fs/sysv/super.c b/fs/sysv/super.c
index d0c6a007ce83..eda10959714f 100644
--- a/fs/sysv/super.c
+++ b/fs/sysv/super.c
@@ -487,6 +487,7 @@ static int v7_fill_super(struct super_block *sb, void *data, int silent)
         sbi->s_sb = sb;
         sbi->s_block_base = 0;
         sbi->s_type = FSTYPE_V7;
+        mutex_init(&sbi->s_lock);
         sb->s_fs_info = sbi;
         
         sb_set_blocksize(sb, 512);
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 7e5aae4bf46f..6eaf5edf1ea1 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -30,18 +30,17 @@ void udf_free_inode(struct inode *inode)
 {
         struct super_block *sb = inode->i_sb;
         struct udf_sb_info *sbi = UDF_SB(sb);
+        struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb);
 
-        mutex_lock(&sbi->s_alloc_mutex);
-        if (sbi->s_lvid_bh) {
-                struct logicalVolIntegrityDescImpUse *lvidiu =
-                                                        udf_sb_lvidiu(sbi);
+        if (lvidiu) {
+                mutex_lock(&sbi->s_alloc_mutex);
                 if (S_ISDIR(inode->i_mode))
                         le32_add_cpu(&lvidiu->numDirs, -1);
                 else
                         le32_add_cpu(&lvidiu->numFiles, -1);
                 udf_updated_lvid(sb);
+                mutex_unlock(&sbi->s_alloc_mutex);
         }
-        mutex_unlock(&sbi->s_alloc_mutex);
 
         udf_free_blocks(sb, NULL, &UDF_I(inode)->i_location, 0, 1);
 }
@@ -55,6 +54,7 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err)
         uint32_t start = UDF_I(dir)->i_location.logicalBlockNum;
         struct udf_inode_info *iinfo;
         struct udf_inode_info *dinfo = UDF_I(dir);
+        struct logicalVolIntegrityDescImpUse *lvidiu;
 
         inode = new_inode(sb);
 
@@ -92,12 +92,10 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode, int *err)
                 return NULL;
         }
 
-        if (sbi->s_lvid_bh) {
-                struct logicalVolIntegrityDescImpUse *lvidiu;
-
+        lvidiu = udf_sb_lvidiu(sb);
+        if (lvidiu) {
                 iinfo->i_unique = lvid_get_unique_id(sb);
                 mutex_lock(&sbi->s_alloc_mutex);
-                lvidiu = udf_sb_lvidiu(sbi);
                 if (S_ISDIR(mode))
                         le32_add_cpu(&lvidiu->numDirs, 1);
                 else
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 839a2bad7f45..91219385691d 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -94,13 +94,25 @@ static unsigned int udf_count_free(struct super_block *);
 static int udf_statfs(struct dentry *, struct kstatfs *);
 static int udf_show_options(struct seq_file *, struct dentry *);
 
-struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct udf_sb_info *sbi)
+struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
 {
-        struct logicalVolIntegrityDesc *lvid =
-                (struct logicalVolIntegrityDesc *)sbi->s_lvid_bh->b_data;
-        __u32 number_of_partitions = le32_to_cpu(lvid->numOfPartitions);
-        __u32 offset = number_of_partitions * 2 *
-                                sizeof(uint32_t)/sizeof(uint8_t);
+        struct logicalVolIntegrityDesc *lvid;
+        unsigned int partnum;
+        unsigned int offset;
+
+        if (!UDF_SB(sb)->s_lvid_bh)
+                return NULL;
+        lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
+        partnum = le32_to_cpu(lvid->numOfPartitions);
+        if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
+             offsetof(struct logicalVolIntegrityDesc, impUse)) /
+             (2 * sizeof(uint32_t)) < partnum) {
+                udf_err(sb, "Logical volume integrity descriptor corrupted "
+                        "(numOfPartitions = %u)!\n", partnum);
+                return NULL;
+        }
+        /* The offset is to skip freeSpaceTable and sizeTable arrays */
+        offset = partnum * 2 * sizeof(uint32_t);
         return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
 }
 
@@ -629,9 +641,10 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options)
         struct udf_options uopt;
         struct udf_sb_info *sbi = UDF_SB(sb);
         int error = 0;
+        struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb);
 
-        if (sbi->s_lvid_bh) {
-                int write_rev = le16_to_cpu(udf_sb_lvidiu(sbi)->minUDFWriteRev);
+        if (lvidiu) {
+                int write_rev = le16_to_cpu(lvidiu->minUDFWriteRev);
                 if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & MS_RDONLY))
                         return -EACCES;
         }
@@ -1905,11 +1918,12 @@ static void udf_open_lvid(struct super_block *sb)
 
         if (!bh)
                 return;
-
-        mutex_lock(&sbi->s_alloc_mutex);
         lvid = (struct logicalVolIntegrityDesc *)bh->b_data;
-        lvidiu = udf_sb_lvidiu(sbi);
+        lvidiu = udf_sb_lvidiu(sb);
+        if (!lvidiu)
+                return;
 
+        mutex_lock(&sbi->s_alloc_mutex);
         lvidiu->impIdent.identSuffix[0] = UDF_OS_CLASS_UNIX;
         lvidiu->impIdent.identSuffix[1] = UDF_OS_ID_LINUX;
         udf_time_to_disk_stamp(&lvid->recordingDateAndTime,
@@ -1937,10 +1951,12 @@ static void udf_close_lvid(struct super_block *sb)
 
         if (!bh)
                 return;
+        lvid = (struct logicalVolIntegrityDesc *)bh->b_data;
+        lvidiu = udf_sb_lvidiu(sb);
+        if (!lvidiu)
+                return;
 
         mutex_lock(&sbi->s_alloc_mutex);
-        lvid = (struct logicalVolIntegrityDesc *)bh->b_data;
-        lvidiu = udf_sb_lvidiu(sbi);
         lvidiu->impIdent.identSuffix[0] = UDF_OS_CLASS_UNIX;
         lvidiu->impIdent.identSuffix[1] = UDF_OS_ID_LINUX;
         udf_time_to_disk_stamp(&lvid->recordingDateAndTime, CURRENT_TIME);
@@ -2093,15 +2109,19 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
 
         if (sbi->s_lvid_bh) {
                 struct logicalVolIntegrityDescImpUse *lvidiu =
-                                                        udf_sb_lvidiu(sbi);
-                uint16_t minUDFReadRev = le16_to_cpu(lvidiu->minUDFReadRev);
-                uint16_t minUDFWriteRev = le16_to_cpu(lvidiu->minUDFWriteRev);
-                /* uint16_t maxUDFWriteRev =
-                                le16_to_cpu(lvidiu->maxUDFWriteRev); */
+                                                        udf_sb_lvidiu(sb);
+                uint16_t minUDFReadRev;
+                uint16_t minUDFWriteRev;
 
+                if (!lvidiu) {
+                        ret = -EINVAL;
+                        goto error_out;
+                }
+                minUDFReadRev = le16_to_cpu(lvidiu->minUDFReadRev);
+                minUDFWriteRev = le16_to_cpu(lvidiu->minUDFWriteRev);
                 if (minUDFReadRev > UDF_MAX_READ_VERSION) {
                         udf_err(sb, "minUDFReadRev=%x (max is %x)\n",
-                                le16_to_cpu(lvidiu->minUDFReadRev),
+                                minUDFReadRev,
                                 UDF_MAX_READ_VERSION);
                         ret = -EINVAL;
                         goto error_out;
@@ -2265,11 +2285,7 @@ static int udf_statfs(struct dentry *dentry, struct kstatfs *buf)
         struct logicalVolIntegrityDescImpUse *lvidiu;
         u64 id = huge_encode_dev(sb->s_bdev->bd_dev);
 
-        if (sbi->s_lvid_bh != NULL)
-                lvidiu = udf_sb_lvidiu(sbi);
-        else
-                lvidiu = NULL;
-
+        lvidiu = udf_sb_lvidiu(sb);
         buf->f_type = UDF_SUPER_MAGIC;
         buf->f_bsize = sb->s_blocksize;
         buf->f_blocks = sbi->s_partmaps[sbi->s_partition].s_partition_len;
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
index ed401e94aa8c..1f32c7bd9f57 100644
--- a/fs/udf/udf_sb.h
+++ b/fs/udf/udf_sb.h
@@ -162,7 +162,7 @@ static inline struct udf_sb_info *UDF_SB(struct super_block *sb)
         return sb->s_fs_info;
 }
 
-struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct udf_sb_info *sbi);
+struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb);
 
 int udf_compute_nr_groups(struct super_block *sb, u32 partition);
 
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 88c5ea75ebf6..f1d85cfc0a54 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -628,6 +628,7 @@ xfs_buf_item_unlock(
                 else if (aborted) {
                         ASSERT(XFS_FORCED_SHUTDOWN(lip->li_mountp));
                         if (lip->li_flags & XFS_LI_IN_AIL) {
+                                spin_lock(&lip->li_ailp->xa_lock);
                                 xfs_trans_ail_delete(lip->li_ailp, lip,
                                                      SHUTDOWN_LOG_IO_ERROR);
                         }
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 069537c845e5..20bf8e8002d6 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -1224,6 +1224,7 @@ xfs_da3_node_toosmall(
         /* start with smaller blk num */
         forward = nodehdr.forw < nodehdr.back;
         for (i = 0; i < 2; forward = !forward, i++) {
+                struct xfs_da3_icnode_hdr thdr;
                 if (forward)
                         blkno = nodehdr.forw;
                 else
@@ -1236,10 +1237,10 @@ xfs_da3_node_toosmall(
                         return(error);
 
                 node = bp->b_addr;
-                xfs_da3_node_hdr_from_disk(&nodehdr, node);
+                xfs_da3_node_hdr_from_disk(&thdr, node);
                 xfs_trans_brelse(state->args->trans, bp);
 
-                if (count - nodehdr.count >= 0)
+                if (count - thdr.count >= 0)
                         break;  /* fits with at least 25% to spare */
         }
         if (i >= 2) {
diff --git a/fs/xfs/xfs_dir2_block.c b/fs/xfs/xfs_dir2_block.c
index 0957aa98b6c0..12dad188939d 100644
--- a/fs/xfs/xfs_dir2_block.c
+++ b/fs/xfs/xfs_dir2_block.c
@@ -1158,7 +1158,7 @@ xfs_dir2_sf_to_block(
         /*
          * Create entry for .
          */
-        dep = xfs_dir3_data_dot_entry_p(hdr);
+        dep = xfs_dir3_data_dot_entry_p(mp, hdr);
         dep->inumber = cpu_to_be64(dp->i_ino);
         dep->namelen = 1;
         dep->name[0] = '.';
@@ -1172,7 +1172,7 @@ xfs_dir2_sf_to_block(
         /*
          * Create entry for ..
          */
-        dep = xfs_dir3_data_dotdot_entry_p(hdr);
+        dep = xfs_dir3_data_dotdot_entry_p(mp, hdr);
         dep->inumber = cpu_to_be64(xfs_dir2_sf_get_parent_ino(sfp));
         dep->namelen = 2;
         dep->name[0] = dep->name[1] = '.';
@@ -1183,7 +1183,7 @@ xfs_dir2_sf_to_block(
         blp[1].hashval = cpu_to_be32(xfs_dir_hash_dotdot);
         blp[1].address = cpu_to_be32(xfs_dir2_byte_to_dataptr(mp,
                                 (char *)dep - (char *)hdr));
-        offset = xfs_dir3_data_first_offset(hdr);
+        offset = xfs_dir3_data_first_offset(mp);
         /*
          * Loop over existing entries, stuff them in.
          */
diff --git a/fs/xfs/xfs_dir2_format.h b/fs/xfs/xfs_dir2_format.h
index a0961a61ac1a..9cf67381adf6 100644
--- a/fs/xfs/xfs_dir2_format.h
+++ b/fs/xfs/xfs_dir2_format.h
@@ -497,69 +497,58 @@ xfs_dir3_data_unused_p(struct xfs_dir2_data_hdr *hdr)
 /*
  * Offsets of . and .. in data space (always block 0)
  *
- * The macros are used for shortform directories as they have no headers to read
- * the magic number out of. Shortform directories need to know the size of the
- * data block header because the sfe embeds the block offset of the entry into
- * it so that it doesn't change when format conversion occurs. Bad Things Happen
- * if we don't follow this rule.
- *
  * XXX: there is scope for significant optimisation of the logic here. Right
  * now we are checking for "dir3 format" over and over again. Ideally we should
  * only do it once for each operation.
  */
-#define XFS_DIR3_DATA_DOT_OFFSET(mp)    \
-        xfs_dir3_data_hdr_size(xfs_sb_version_hascrc(&(mp)->m_sb))
-#define XFS_DIR3_DATA_DOTDOT_OFFSET(mp) \
-        (XFS_DIR3_DATA_DOT_OFFSET(mp) + xfs_dir3_data_entsize(mp, 1))
-#define XFS_DIR3_DATA_FIRST_OFFSET(mp)          \
-        (XFS_DIR3_DATA_DOTDOT_OFFSET(mp) + xfs_dir3_data_entsize(mp, 2))
-
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_dot_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dot_offset(struct xfs_mount *mp)
 {
-        return xfs_dir3_data_entry_offset(hdr);
+        return xfs_dir3_data_hdr_size(xfs_sb_version_hascrc(&mp->m_sb));
 }
 
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_dotdot_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dotdot_offset(struct xfs_mount *mp)
 {
-        bool dir3 = hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
-                    hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC);
-        return xfs_dir3_data_dot_offset(hdr) +
-                __xfs_dir3_data_entsize(dir3, 1);
+        return xfs_dir3_data_dot_offset(mp) +
+                xfs_dir3_data_entsize(mp, 1);
 }
 
 static inline xfs_dir2_data_aoff_t
-xfs_dir3_data_first_offset(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_first_offset(struct xfs_mount *mp)
 {
-        bool dir3 = hdr->magic == cpu_to_be32(XFS_DIR3_DATA_MAGIC) ||
-                    hdr->magic == cpu_to_be32(XFS_DIR3_BLOCK_MAGIC);
-        return xfs_dir3_data_dotdot_offset(hdr) +
-                __xfs_dir3_data_entsize(dir3, 2);
+        return xfs_dir3_data_dotdot_offset(mp) +
+                xfs_dir3_data_entsize(mp, 2);
 }
 
 /*
  * location of . and .. in data space (always block 0)
  */
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_dot_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dot_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
         return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_dot_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_dot_offset(mp));
 }
 
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_dotdot_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_dotdot_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
         return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_dotdot_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_dotdot_offset(mp));
 }
 
 static inline struct xfs_dir2_data_entry *
-xfs_dir3_data_first_entry_p(struct xfs_dir2_data_hdr *hdr)
+xfs_dir3_data_first_entry_p(
+        struct xfs_mount        *mp,
+        struct xfs_dir2_data_hdr *hdr)
 {
         return (struct xfs_dir2_data_entry *)
-                ((char *)hdr + xfs_dir3_data_first_offset(hdr));
+                ((char *)hdr + xfs_dir3_data_first_offset(mp));
 }
 
 /*
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 8993ec17452c..8f84153e98a8 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -119,9 +119,9 @@ xfs_dir2_sf_getdents(
          * mp->m_dirdatablk.
          */
         dot_offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk,
-                                             XFS_DIR3_DATA_DOT_OFFSET(mp));
+                                             xfs_dir3_data_dot_offset(mp));
         dotdot_offset = xfs_dir2_db_off_to_dataptr(mp, mp->m_dirdatablk,
-                                                XFS_DIR3_DATA_DOTDOT_OFFSET(mp));
+                                                xfs_dir3_data_dotdot_offset(mp));
 
         /*
          * Put . entry unless we're starting past it.
diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
index bb6e2848f473..3ef6d402084c 100644
--- a/fs/xfs/xfs_dir2_sf.c
+++ b/fs/xfs/xfs_dir2_sf.c
@@ -557,7 +557,7 @@ xfs_dir2_sf_addname_hard(
          * to insert the new entry.
          * If it's going to end up at the end then oldsfep will point there.
          */
-        for (offset = XFS_DIR3_DATA_FIRST_OFFSET(mp),
+        for (offset = xfs_dir3_data_first_offset(mp),
               oldsfep = xfs_dir2_sf_firstentry(oldsfp),
               add_datasize = xfs_dir3_data_entsize(mp, args->namelen),
               eof = (char *)oldsfep == &buf[old_isize];
@@ -640,7 +640,7 @@ xfs_dir2_sf_addname_pick(
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
         size = xfs_dir3_data_entsize(mp, args->namelen);
-        offset = XFS_DIR3_DATA_FIRST_OFFSET(mp);
+        offset = xfs_dir3_data_first_offset(mp);
         sfep = xfs_dir2_sf_firstentry(sfp);
         holefit = 0;
         /*
@@ -713,7 +713,7 @@ xfs_dir2_sf_check(
         mp = dp->i_mount;
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
-        offset = XFS_DIR3_DATA_FIRST_OFFSET(mp);
+        offset = xfs_dir3_data_first_offset(mp);
         ino = xfs_dir2_sf_get_parent_ino(sfp);
         i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
 
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index 71520e6e5d65..1ee776d477c3 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -64,7 +64,8 @@ int xfs_dqerror_mod = 33;
 struct kmem_zone                *xfs_qm_dqtrxzone;
 static struct kmem_zone         *xfs_qm_dqzone;
 
-static struct lock_class_key xfs_dquot_other_class;
+static struct lock_class_key xfs_dquot_group_class;
+static struct lock_class_key xfs_dquot_project_class;
 
 /*
  * This is called to free all the memory associated with a dquot
@@ -703,8 +704,20 @@ xfs_qm_dqread(
          * Make sure group quotas have a different lock class than user
          * quotas.
          */
-        if (!(type & XFS_DQ_USER))
-                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_other_class);
+        switch (type) {
+        case XFS_DQ_USER:
+                /* uses the default lock class */
+                break;
+        case XFS_DQ_GROUP:
+                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_group_class);
+                break;
+        case XFS_DQ_PROJ:
+                lockdep_set_class(&dqp->q_qlock, &xfs_dquot_project_class);
+                break;
+        default:
+                ASSERT(0);
+                break;
+        }
 
         XFS_STATS_INC(xs_qm_dquot);
 
diff --git a/fs/xfs/xfs_fs.h b/fs/xfs/xfs_fs.h
index 1edb5cc3e5f4..18272c766a50 100644
--- a/fs/xfs/xfs_fs.h
+++ b/fs/xfs/xfs_fs.h
@@ -515,7 +515,7 @@ typedef struct xfs_swapext
 /*      XFS_IOC_GETBIOSIZE ---- deprecated 47      */
 #define XFS_IOC_GETBMAPX        _IOWR('X', 56, struct getbmap)
 #define XFS_IOC_ZERO_RANGE      _IOW ('X', 57, struct xfs_flock64)
-#define XFS_IOC_FREE_EOFBLOCKS  _IOR ('X', 58, struct xfs_eofblocks)
+#define XFS_IOC_FREE_EOFBLOCKS  _IOR ('X', 58, struct xfs_fs_eofblocks)
 
 /*
  * ioctl commands that replace IRIX syssgi()'s
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 193206ba4358..474807a401c8 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -119,11 +119,6 @@ xfs_inode_free(
                 ip->i_itemp = NULL;
         }
 
-        /* asserts to verify all state is correct here */
-        ASSERT(atomic_read(&ip->i_pincount) == 0);
-        ASSERT(!spin_is_locked(&ip->i_flags_lock));
-        ASSERT(!xfs_isiflocked(ip));
-
         /*
          * Because we use RCU freeing we need to ensure the inode always
          * appears to be reclaimed with an invalid inode number when in the
@@ -135,6 +130,10 @@ xfs_inode_free(
         ip->i_ino = 0;
         spin_unlock(&ip->i_flags_lock);
 
+        /* asserts to verify all state is correct here */
+        ASSERT(atomic_read(&ip->i_pincount) == 0);
+        ASSERT(!xfs_isiflocked(ip));
+
         call_rcu(&VFS_I(ip)->i_rcu, xfs_inode_free_callback);
 }
 
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index dabda9521b4b..39797490a1f1 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1585,6 +1585,7 @@ xlog_recover_add_to_trans(
                 "bad number of regions (%d) in inode log format",
                                   in_f->ilf_size);
                         ASSERT(0);
+                        kmem_free(ptr);
                         return XFS_ERROR(EIO);
                 }
 
@@ -1970,6 +1971,13 @@ xlog_recover_do_inode_buffer(
  * magic number.  If we don't recognise the magic number in the buffer, then
  * return a LSN of -1 so that the caller knows it was an unrecognised block and
  * so can recover the buffer.
+ *
+ * Note: we cannot rely solely on magic number matches to determine that the
+ * buffer has a valid LSN - we also need to verify that it belongs to this
+ * filesystem, so we need to extract the object's LSN and compare it to that
+ * which we read from the superblock. If the UUIDs don't match, then we've got a
+ * stale metadata block from an old filesystem instance that we need to recover
+ * over the top of.
  */
 static xfs_lsn_t
 xlog_recover_get_buf_lsn(
@@ -1980,6 +1988,8 @@ xlog_recover_get_buf_lsn(
         __uint16_t              magic16;
         __uint16_t              magicda;
         void                    *blk = bp->b_addr;
+        uuid_t                  *uuid;
+        xfs_lsn_t               lsn = -1;
 
         /* v4 filesystems always recover immediately */
         if (!xfs_sb_version_hascrc(&mp->m_sb))
@@ -1992,43 +2002,79 @@ xlog_recover_get_buf_lsn(
         case XFS_ABTB_MAGIC:
         case XFS_ABTC_MAGIC:
         case XFS_IBT_CRC_MAGIC:
-        case XFS_IBT_MAGIC:
-                return be64_to_cpu(
-                                ((struct xfs_btree_block *)blk)->bb_u.s.bb_lsn);
+        case XFS_IBT_MAGIC: {
+                struct xfs_btree_block *btb = blk;
+
+                lsn = be64_to_cpu(btb->bb_u.s.bb_lsn);
+                uuid = &btb->bb_u.s.bb_uuid;
+                break;
+        }
         case XFS_BMAP_CRC_MAGIC:
-        case XFS_BMAP_MAGIC:
-                return be64_to_cpu(
-                                ((struct xfs_btree_block *)blk)->bb_u.l.bb_lsn);
+        case XFS_BMAP_MAGIC: {
+                struct xfs_btree_block *btb = blk;
+
+                lsn = be64_to_cpu(btb->bb_u.l.bb_lsn);
+                uuid = &btb->bb_u.l.bb_uuid;
+                break;
+        }
         case XFS_AGF_MAGIC:
-                return be64_to_cpu(((struct xfs_agf *)blk)->agf_lsn);
+                lsn = be64_to_cpu(((struct xfs_agf *)blk)->agf_lsn);
+                uuid = &((struct xfs_agf *)blk)->agf_uuid;
+                break;
         case XFS_AGFL_MAGIC:
-                return be64_to_cpu(((struct xfs_agfl *)blk)->agfl_lsn);
+                lsn = be64_to_cpu(((struct xfs_agfl *)blk)->agfl_lsn);
+                uuid = &((struct xfs_agfl *)blk)->agfl_uuid;
+                break;
         case XFS_AGI_MAGIC:
-                return be64_to_cpu(((struct xfs_agi *)blk)->agi_lsn);
+                lsn = be64_to_cpu(((struct xfs_agi *)blk)->agi_lsn);
+                uuid = &((struct xfs_agi *)blk)->agi_uuid;
+                break;
         case XFS_SYMLINK_MAGIC:
-                return be64_to_cpu(((struct xfs_dsymlink_hdr *)blk)->sl_lsn);
+                lsn = be64_to_cpu(((struct xfs_dsymlink_hdr *)blk)->sl_lsn);
+                uuid = &((struct xfs_dsymlink_hdr *)blk)->sl_uuid;
+                break;
         case XFS_DIR3_BLOCK_MAGIC:
         case XFS_DIR3_DATA_MAGIC:
         case XFS_DIR3_FREE_MAGIC:
-                return be64_to_cpu(((struct xfs_dir3_blk_hdr *)blk)->lsn);
+                lsn = be64_to_cpu(((struct xfs_dir3_blk_hdr *)blk)->lsn);
+                uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
+                break;
         case XFS_ATTR3_RMT_MAGIC:
-                return be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+                lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+                uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
+                break;
         case XFS_SB_MAGIC:
-                return be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+                lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+                uuid = &((struct xfs_dsb *)blk)->sb_uuid;
+                break;
         default:
                 break;
         }
 
+        if (lsn != (xfs_lsn_t)-1) {
+                if (!uuid_equal(&mp->m_sb.sb_uuid, uuid))
+                        goto recover_immediately;
+                return lsn;
+        }
+
         magicda = be16_to_cpu(((struct xfs_da_blkinfo *)blk)->magic);
         switch (magicda) {
         case XFS_DIR3_LEAF1_MAGIC:
         case XFS_DIR3_LEAFN_MAGIC:
         case XFS_DA3_NODE_MAGIC:
-                return be64_to_cpu(((struct xfs_da3_blkinfo *)blk)->lsn);
+                lsn = be64_to_cpu(((struct xfs_da3_blkinfo *)blk)->lsn);
+                uuid = &((struct xfs_da3_blkinfo *)blk)->uuid;
+                break;
         default:
                 break;
         }
 
+        if (lsn != (xfs_lsn_t)-1) {
+                if (!uuid_equal(&mp->m_sb.sb_uuid, uuid))
+                        goto recover_immediately;
+                return lsn;
+        }
+
         /*
          * We do individual object checks on dquot and inode buffers as they
          * have their own individual LSN records. Also, we could have a stale
diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h
index 1c16f821434f..d98c67001840 100644
--- a/include/acpi/acconfig.h
+++ b/include/acpi/acconfig.h
@@ -100,7 +100,9 @@
  *      ACPI PM timer
  *      FACS table (Waking vectors and Global Lock)
  */
+#ifndef ACPI_REDUCED_HARDWARE
 #define ACPI_REDUCED_HARDWARE           FALSE
+#endif
 
 /******************************************************************************
  *
diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
index cf051e05a8fe..4e280bd226dd 100644
--- a/include/acpi/acexcep.h
+++ b/include/acpi/acexcep.h
@@ -125,8 +125,9 @@ struct acpi_exception_info {
 #define AE_NO_HANDLER                   EXCEP_ENV (0x001A)
 #define AE_OWNER_ID_LIMIT               EXCEP_ENV (0x001B)
 #define AE_NOT_CONFIGURED               EXCEP_ENV (0x001C)
+#define AE_ACCESS                       EXCEP_ENV (0x001D)
 
-#define AE_CODE_ENV_MAX                 0x001C
+#define AE_CODE_ENV_MAX                 0x001D
 
 /*
  * Programmer exceptions
@@ -227,7 +228,7 @@ static const struct acpi_exception_info acpi_gbl_exception_names_env[] = {
         EXCEP_TXT("AE_NO_ACPI_TABLES", "ACPI tables could not be found"),
         EXCEP_TXT("AE_NO_NAMESPACE", "A namespace has not been loaded"),
         EXCEP_TXT("AE_NO_MEMORY", "Insufficient dynamic memory"),
-        EXCEP_TXT("AE_NOT_FOUND", "The name was not found in the namespace"),
+        EXCEP_TXT("AE_NOT_FOUND", "A requested entity is not found"),
         EXCEP_TXT("AE_NOT_EXIST", "A required entity does not exist"),
         EXCEP_TXT("AE_ALREADY_EXISTS", "An entity already exists"),
         EXCEP_TXT("AE_TYPE", "The object type is incorrect"),
@@ -259,7 +260,8 @@ static const struct acpi_exception_info acpi_gbl_exception_names_env[] = {
         EXCEP_TXT("AE_OWNER_ID_LIMIT",
                   "There are no more Owner IDs available for ACPI tables or control methods"),
         EXCEP_TXT("AE_NOT_CONFIGURED",
-                  "The interface is not part of the current subsystem configuration")
+                  "The interface is not part of the current subsystem configuration"),
+        EXCEP_TXT("AE_ACCESS", "Permission denied for the requested operation")
 };
 
 static const struct acpi_exception_info acpi_gbl_exception_names_pgm[] = {
diff --git a/include/acpi/acnames.h b/include/acpi/acnames.h
index ce08ef7d969c..1f36777e26fe 100644
--- a/include/acpi/acnames.h
+++ b/include/acpi/acnames.h
@@ -46,25 +46,25 @@
 
 /* Method names - these methods can appear anywhere in the namespace */
 
-#define METHOD_NAME__SB_        "_SB_"
-#define METHOD_NAME__HID        "_HID"
-#define METHOD_NAME__CID        "_CID"
-#define METHOD_NAME__UID        "_UID"
-#define METHOD_NAME__SUB        "_SUB"
 #define METHOD_NAME__ADR        "_ADR"
-#define METHOD_NAME__INI        "_INI"
-#define METHOD_NAME__STA        "_STA"
-#define METHOD_NAME__REG        "_REG"
-#define METHOD_NAME__SEG        "_SEG"
+#define METHOD_NAME__AEI        "_AEI"
 #define METHOD_NAME__BBN        "_BBN"
-#define METHOD_NAME__PRT        "_PRT"
+#define METHOD_NAME__CBA        "_CBA"
+#define METHOD_NAME__CID        "_CID"
 #define METHOD_NAME__CRS        "_CRS"
+#define METHOD_NAME__HID        "_HID"
+#define METHOD_NAME__INI        "_INI"
+#define METHOD_NAME__PLD        "_PLD"
 #define METHOD_NAME__PRS        "_PRS"
-#define METHOD_NAME__AEI        "_AEI"
+#define METHOD_NAME__PRT        "_PRT"
 #define METHOD_NAME__PRW        "_PRW"
+#define METHOD_NAME__REG        "_REG"
+#define METHOD_NAME__SB_        "_SB_"
+#define METHOD_NAME__SEG        "_SEG"
 #define METHOD_NAME__SRS        "_SRS"
-#define METHOD_NAME__CBA        "_CBA"
-#define METHOD_NAME__PLD        "_PLD"
+#define METHOD_NAME__STA        "_STA"
+#define METHOD_NAME__SUB        "_SUB"
+#define METHOD_NAME__UID        "_UID"
 
 /* Method names - these methods must appear at the namespace root */
 
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index d64a3010332f..89c60b0f6408 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -222,7 +222,8 @@ struct acpi_device_power_flags {
         u32 power_resources:1;  /* Power resources */
         u32 inrush_current:1;   /* Serialize Dx->D0 */
         u32 power_removed:1;    /* Optimize Dx->D0 */
-        u32 reserved:28;
+        u32 ignore_parent:1;    /* Power is independent of parent power state */
+        u32 reserved:27;
 };
 
 struct acpi_device_power_state {
@@ -311,7 +312,6 @@ struct acpi_device {
         unsigned int physical_node_count;
         struct list_head physical_node_list;
         struct mutex physical_node_lock;
-        struct list_head power_dependent;
         void (*remove)(struct acpi_device *);
 };
 
@@ -444,8 +444,6 @@ acpi_status acpi_add_pm_notifier(struct acpi_device *adev,
 acpi_status acpi_remove_pm_notifier(struct acpi_device *adev,
                                     acpi_notify_handler handler);
 int acpi_pm_device_sleep_state(struct device *, int *, int);
-void acpi_dev_pm_add_dependent(acpi_handle handle, struct device *depdev);
-void acpi_dev_pm_remove_dependent(acpi_handle handle, struct device *depdev);
 #else
 static inline acpi_status acpi_add_pm_notifier(struct acpi_device *adev,
                                                acpi_notify_handler handler,
@@ -466,10 +464,6 @@ static inline int acpi_pm_device_sleep_state(struct device *d, int *p, int m)
         return (m >= ACPI_STATE_D0 && m <= ACPI_STATE_D3_COLD) ?
                 m : ACPI_STATE_D0;
 }
-static inline void acpi_dev_pm_add_dependent(acpi_handle handle,
-                                             struct device *depdev) {}
-static inline void acpi_dev_pm_remove_dependent(acpi_handle handle,
-                                                struct device *depdev) {}
 #endif
 
 #ifdef CONFIG_PM_RUNTIME
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index 505cb4d59f23..01e6c6d8b7e1 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -77,54 +77,80 @@ struct acpi_signal_fatal_info {
 /*
  * OSL Initialization and shutdown primitives
  */
-acpi_status __init acpi_os_initialize(void);
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_initialize
+acpi_status acpi_os_initialize(void);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_terminate
 acpi_status acpi_os_terminate(void);
+#endif
 
 /*
  * ACPI Table interfaces
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_root_pointer
 acpi_physical_address acpi_os_get_root_pointer(void);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_predefined_override
 acpi_status
 acpi_os_predefined_override(const struct acpi_predefined_names *init_val,
                             acpi_string * new_val);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_table_override
 acpi_status
 acpi_os_table_override(struct acpi_table_header *existing_table,
                        struct acpi_table_header **new_table);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_physical_table_override
 acpi_status
 acpi_os_physical_table_override(struct acpi_table_header *existing_table,
                                 acpi_physical_address * new_address,
                                 u32 *new_table_length);
+#endif
 
 /*
  * Spinlock primitives
  */
-#ifndef acpi_os_create_lock
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_create_lock
 acpi_status acpi_os_create_lock(acpi_spinlock * out_handle);
 #endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_delete_lock
 void acpi_os_delete_lock(acpi_spinlock handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_acquire_lock
 acpi_cpu_flags acpi_os_acquire_lock(acpi_spinlock handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_release_lock
 void acpi_os_release_lock(acpi_spinlock handle, acpi_cpu_flags flags);
+#endif
 
 /*
  * Semaphore primitives
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_create_semaphore
 acpi_status
 acpi_os_create_semaphore(u32 max_units,
                          u32 initial_units, acpi_semaphore * out_handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_delete_semaphore
 acpi_status acpi_os_delete_semaphore(acpi_semaphore handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_wait_semaphore
 acpi_status
 acpi_os_wait_semaphore(acpi_semaphore handle, u32 units, u16 timeout);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_signal_semaphore
 acpi_status acpi_os_signal_semaphore(acpi_semaphore handle, u32 units);
+#endif
 
 /*
  * Mutex primitives. May be configured to use semaphores instead via
@@ -132,29 +158,48 @@ acpi_status acpi_os_signal_semaphore(acpi_semaphore handle, u32 units);
  */
 #if (ACPI_MUTEX_TYPE != ACPI_BINARY_SEMAPHORE)
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_create_mutex
 acpi_status acpi_os_create_mutex(acpi_mutex * out_handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_delete_mutex
 void acpi_os_delete_mutex(acpi_mutex handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_acquire_mutex
 acpi_status acpi_os_acquire_mutex(acpi_mutex handle, u16 timeout);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_release_mutex
 void acpi_os_release_mutex(acpi_mutex handle);
 #endif
 
+#endif
+
 /*
  * Memory allocation and mapping
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_allocate
 void *acpi_os_allocate(acpi_size size);
+#endif
+
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_allocate_zeroed
+void *acpi_os_allocate_zeroed(acpi_size size);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_free
 void acpi_os_free(void *memory);
+#endif
 
-void __iomem *acpi_os_map_memory(acpi_physical_address where,
-                                acpi_size length);
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_map_memory
+void *acpi_os_map_memory(acpi_physical_address where, acpi_size length);
+#endif
 
-void acpi_os_unmap_memory(void __iomem * logical_address, acpi_size size);
-void early_acpi_os_unmap_memory(void __iomem * virt, acpi_size size);
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_unmap_memory
+void acpi_os_unmap_memory(void *logical_address, acpi_size size);
+#endif
 
-#ifdef ACPI_FUTURE_USAGE
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_physical_address
 acpi_status
 acpi_os_get_physical_address(void *logical_address,
                              acpi_physical_address * physical_address);
@@ -163,114 +208,195 @@ acpi_os_get_physical_address(void *logical_address,
 /*
  * Memory/Object Cache
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_create_cache
 acpi_status
 acpi_os_create_cache(char *cache_name,
                      u16 object_size,
                      u16 max_depth, acpi_cache_t ** return_cache);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_delete_cache
 acpi_status acpi_os_delete_cache(acpi_cache_t * cache);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_purge_cache
 acpi_status acpi_os_purge_cache(acpi_cache_t * cache);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_acquire_object
 void *acpi_os_acquire_object(acpi_cache_t * cache);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_release_object
 acpi_status acpi_os_release_object(acpi_cache_t * cache, void *object);
+#endif
 
 /*
  * Interrupt handlers
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_install_interrupt_handler
 acpi_status
 acpi_os_install_interrupt_handler(u32 interrupt_number,
                                   acpi_osd_handler service_routine,
                                   void *context);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_remove_interrupt_handler
 acpi_status
 acpi_os_remove_interrupt_handler(u32 interrupt_number,
                                  acpi_osd_handler service_routine);
-
-void acpi_os_gpe_count(u32 gpe_number);
-void acpi_os_fixed_event_count(u32 fixed_event_number);
+#endif
 
 /*
  * Threads and Scheduling
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_thread_id
 acpi_thread_id acpi_os_get_thread_id(void);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_execute
 acpi_status
 acpi_os_execute(acpi_execute_type type,
                 acpi_osd_exec_callback function, void *context);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_wait_events_complete
 void acpi_os_wait_events_complete(void);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_sleep
 void acpi_os_sleep(u64 milliseconds);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_stall
 void acpi_os_stall(u32 microseconds);
+#endif
 
 /*
  * Platform and hardware-independent I/O interfaces
  */
-acpi_status acpi_os_read_port(acpi_io_address address, u32 * value, u32 width);
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_read_port
+acpi_status acpi_os_read_port(acpi_io_address address, u32 *value, u32 width);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_write_port
 acpi_status acpi_os_write_port(acpi_io_address address, u32 value, u32 width);
+#endif
 
 /*
  * Platform and hardware-independent physical memory interfaces
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_read_memory
 acpi_status
 acpi_os_read_memory(acpi_physical_address address, u64 *value, u32 width);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_write_memory
 acpi_status
 acpi_os_write_memory(acpi_physical_address address, u64 value, u32 width);
+#endif
 
 /*
  * Platform and hardware-independent PCI configuration space access
  * Note: Can't use "Register" as a parameter, changed to "Reg" --
  * certain compilers complain.
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_read_pci_configuration
 acpi_status
 acpi_os_read_pci_configuration(struct acpi_pci_id *pci_id,
                                u32 reg, u64 *value, u32 width);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_write_pci_configuration
 acpi_status
 acpi_os_write_pci_configuration(struct acpi_pci_id *pci_id,
                                 u32 reg, u64 value, u32 width);
+#endif
 
 /*
  * Miscellaneous
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_readable
+u8 acpi_os_readable(void *pointer, acpi_size length);
+#endif
+
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_writable
+u8 acpi_os_writable(void *pointer, acpi_size length);
+#endif
+
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_timer
 u64 acpi_os_get_timer(void);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_signal
 acpi_status acpi_os_signal(u32 function, void *info);
+#endif
 
 /*
  * Debug print routines
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_printf
 void ACPI_INTERNAL_VAR_XFACE acpi_os_printf(const char *format, ...);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_vprintf
 void acpi_os_vprintf(const char *format, va_list args);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_redirect_output
 void acpi_os_redirect_output(void *destination);
+#endif
 
-#ifdef ACPI_FUTURE_USAGE
 /*
  * Debug input
  */
-u32 acpi_os_get_line(char *buffer);
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_line
+acpi_status acpi_os_get_line(char *buffer, u32 buffer_length, u32 *bytes_read);
+#endif
+
+/*
+ * Obtain ACPI table(s)
+ */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_table_by_name
+acpi_status
+acpi_os_get_table_by_name(char *signature,
+                          u32 instance,
+                          struct acpi_table_header **table,
+                          acpi_physical_address * address);
+#endif
+
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_table_by_index
+acpi_status
+acpi_os_get_table_by_index(u32 index,
+                           struct acpi_table_header **table,
+                           u32 *instance, acpi_physical_address * address);
+#endif
+
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_table_by_address
+acpi_status
+acpi_os_get_table_by_address(acpi_physical_address address,
+                             struct acpi_table_header **table);
 #endif
 
 /*
  * Directory manipulation
  */
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_open_directory
 void *acpi_os_open_directory(char *pathname,
                              char *wildcard_spec, char requested_file_type);
+#endif
 
 /* requeste_file_type values */
 
 #define REQUEST_FILE_ONLY                   0
 #define REQUEST_DIR_ONLY                    1
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_next_filename
 char *acpi_os_get_next_filename(void *dir_handle);
+#endif
 
+#ifndef ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_close_directory
 void acpi_os_close_directory(void *dir_handle);
+#endif
 
 #endif                          /* __ACPIOSXF_H__ */
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 85bfdbe17805..d8f9457755b4 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -46,7 +46,7 @@
 
 /* Current ACPICA subsystem version in YYYYMMDD format */
 
-#define ACPI_CA_VERSION                 0x20130725
+#define ACPI_CA_VERSION                 0x20130927
 
 #include <acpi/acconfig.h>
 #include <acpi/actypes.h>
@@ -54,6 +54,7 @@
 #include <acpi/acbuffer.h>
 
 extern u8 acpi_gbl_permanent_mmap;
+extern u32 acpi_rsdt_forced;
 
 /*
  * Globals that are publically available
@@ -106,39 +107,41 @@ extern u8 acpi_gbl_disable_ssdt_table_load;
         static ACPI_INLINE prototype {return(AE_OK);}
 
 #define ACPI_HW_DEPENDENT_RETURN_VOID(prototype) \
-        static ACPI_INLINE prototype {}
+        static ACPI_INLINE prototype {return;}
 
 #endif                          /* !ACPI_REDUCED_HARDWARE */
 
-extern u32 acpi_rsdt_forced;
 /*
  * Initialization
  */
-acpi_status
+acpi_status __init
 acpi_initialize_tables(struct acpi_table_desc *initial_storage,
                        u32 initial_table_count, u8 allow_resize);
 
 acpi_status __init acpi_initialize_subsystem(void);
 
-acpi_status acpi_enable_subsystem(u32 flags);
+acpi_status __init acpi_enable_subsystem(u32 flags);
 
-acpi_status acpi_initialize_objects(u32 flags);
+acpi_status __init acpi_initialize_objects(u32 flags);
 
-acpi_status acpi_terminate(void);
+acpi_status __init acpi_terminate(void);
 
 /*
  * Miscellaneous global interfaces
  */
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable(void))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable(void))
 #ifdef ACPI_FUTURE_USAGE
-acpi_status acpi_subsystem_status(void);
+ acpi_status acpi_subsystem_status(void);
 #endif
 
 #ifdef ACPI_FUTURE_USAGE
 acpi_status acpi_get_system_info(struct acpi_buffer *ret_buffer);
 #endif
 
+acpi_status acpi_get_statistics(struct acpi_statistics *stats);
+
 const char *acpi_format_exception(acpi_status exception);
 
 acpi_status acpi_purge_cached_objects(void);
@@ -159,29 +162,20 @@ acpi_decode_pld_buffer(u8 *in_buffer,
                        acpi_size length, struct acpi_pld_info **return_buffer);
 
 /*
- * ACPI Memory management
- */
-void *acpi_allocate(u32 size);
-
-void *acpi_callocate(u32 size);
-
-void acpi_free(void *address);
-
-/*
  * ACPI table load/unload interfaces
  */
 acpi_status acpi_load_table(struct acpi_table_header *table);
 
 acpi_status acpi_unload_parent_table(acpi_handle object);
 
-acpi_status acpi_load_tables(void);
+acpi_status __init acpi_load_tables(void);
 
 /*
  * ACPI table manipulation interfaces
  */
-acpi_status acpi_reallocate_root_table(void);
+acpi_status __init acpi_reallocate_root_table(void);
 
-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address);
+acpi_status __init acpi_find_root_pointer(acpi_size *rsdp_address);
 
 acpi_status acpi_unload_table_id(acpi_owner_id id);
 
@@ -193,6 +187,7 @@ acpi_status
 acpi_get_table_with_size(acpi_string signature,
                u32 instance, struct acpi_table_header **out_table,
                acpi_size *tbl_size);
+
 acpi_status
 acpi_get_table(acpi_string signature,
                u32 instance, struct acpi_table_header **out_table);
@@ -280,8 +275,18 @@ acpi_status
 acpi_install_initialization_handler(acpi_init_handler handler, u32 function);
 
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
-                                acpi_install_global_event_handler
-                                (acpi_gbl_event_handler handler, void *context))
+                                acpi_install_sci_handler(acpi_sci_handler
+                                                         address,
+                                                         void *context))
+
+ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
+                                 acpi_remove_sci_handler(acpi_sci_handler
+                                                         address))
+
+ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
+                                 acpi_install_global_event_handler
+                                 (acpi_gbl_event_handler handler,
+                                  void *context))
 
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_install_fixed_event_handler(u32
@@ -290,10 +295,12 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                                                   handler,
                                                                   void
                                                                   *context))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_remove_fixed_event_handler(u32 acpi_event,
                                                                  acpi_event_handler
                                                                  handler))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_install_gpe_handler(acpi_handle
                                                           gpe_device,
@@ -302,6 +309,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                                           acpi_gpe_handler
                                                           address,
                                                           void *context))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_remove_gpe_handler(acpi_handle gpe_device,
                                                          u32 gpe_number,
@@ -338,6 +346,7 @@ acpi_status acpi_install_interface_handler(acpi_interface_handler handler);
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                 acpi_acquire_global_lock(u16 timeout,
                                                          u32 *handle))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                 acpi_release_global_lock(u32 handle))
 
@@ -364,6 +373,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                 acpi_get_event_status(u32 event,
                                                       acpi_event_status
                                                       *event_status))
+
 /*
  * General Purpose Event (GPE) Interfaces
  */
@@ -394,10 +404,12 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                                         parent_device,
                                                         acpi_handle gpe_device,
                                                         u32 gpe_number))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_set_gpe_wake_mask(acpi_handle gpe_device,
                                                         u32 gpe_number,
                                                         u8 action))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_get_gpe_status(acpi_handle gpe_device,
                                                      u32 gpe_number,
@@ -419,6 +431,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                                        *gpe_block_address,
                                                        u32 register_count,
                                                        u32 interrupt_number))
+
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                  acpi_remove_gpe_block(acpi_handle gpe_device))
 
@@ -493,13 +506,13 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
  * Sleep/Wake interfaces
  */
 acpi_status
-acpi_get_sleep_type_data(u8 sleep_state, u8 * slp_typ_a, u8 * slp_typ_b);
+acpi_get_sleep_type_data(u8 sleep_state, u8 *slp_typ_a, u8 *slp_typ_b);
 
 acpi_status acpi_enter_sleep_state_prep(u8 sleep_state);
 
-acpi_status asmlinkage acpi_enter_sleep_state(u8 sleep_state);
+acpi_status acpi_enter_sleep_state(u8 sleep_state);
 
-ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status asmlinkage acpi_enter_sleep_state_s4bios(void))
+ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enter_sleep_state_s4bios(void))
 
 acpi_status acpi_leave_sleep_state_prep(u8 sleep_state);
 
@@ -508,7 +521,6 @@ acpi_status acpi_leave_sleep_state(u8 sleep_state);
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                 acpi_set_firmware_waking_vector(u32
                                                                 physical_address))
-
 #if ACPI_MACHINE_WIDTH == 64
 ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
                                 acpi_set_firmware_waking_vector64(u64
@@ -532,50 +544,53 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status
 /*
  * Error/Warning output
  */
+ACPI_PRINTF_LIKE(3)
 void ACPI_INTERNAL_VAR_XFACE
-acpi_error(const char *module_name,
-           u32 line_number, const char *format, ...) ACPI_PRINTF_LIKE(3);
+acpi_error(const char *module_name, u32 line_number, const char *format, ...);
 
+ACPI_PRINTF_LIKE(4)
 void ACPI_INTERNAL_VAR_XFACE
 acpi_exception(const char *module_name,
-               u32 line_number,
-               acpi_status status, const char *format, ...) ACPI_PRINTF_LIKE(4);
+               u32 line_number, acpi_status status, const char *format, ...);
 
+ACPI_PRINTF_LIKE(3)
 void ACPI_INTERNAL_VAR_XFACE
-acpi_warning(const char *module_name,
-             u32 line_number, const char *format, ...) ACPI_PRINTF_LIKE(3);
+acpi_warning(const char *module_name, u32 line_number, const char *format, ...);
 
+ACPI_PRINTF_LIKE(3)
 void ACPI_INTERNAL_VAR_XFACE
-acpi_info(const char *module_name,
-          u32 line_number, const char *format, ...) ACPI_PRINTF_LIKE(3);
+acpi_info(const char *module_name, u32 line_number, const char *format, ...);
 
+ACPI_PRINTF_LIKE(3)
 void ACPI_INTERNAL_VAR_XFACE
 acpi_bios_error(const char *module_name,
-                u32 line_number, const char *format, ...) ACPI_PRINTF_LIKE(3);
+                u32 line_number, const char *format, ...);
 
+ACPI_PRINTF_LIKE(3)
 void ACPI_INTERNAL_VAR_XFACE
 acpi_bios_warning(const char *module_name,
-                  u32 line_number, const char *format, ...) ACPI_PRINTF_LIKE(3);
+                  u32 line_number, const char *format, ...);
 
 /*
  * Debug output
  */
 #ifdef ACPI_DEBUG_OUTPUT
 
+ACPI_PRINTF_LIKE(6)
 void ACPI_INTERNAL_VAR_XFACE
 acpi_debug_print(u32 requested_debug_level,
                  u32 line_number,
                  const char *function_name,
                  const char *module_name,
-                 u32 component_id, const char *format, ...) ACPI_PRINTF_LIKE(6);
+                 u32 component_id, const char *format, ...);
 
+ACPI_PRINTF_LIKE(6)
 void ACPI_INTERNAL_VAR_XFACE
 acpi_debug_print_raw(u32 requested_debug_level,
                      u32 line_number,
                      const char *function_name,
                      const char *module_name,
-                     u32 component_id,
-                     const char *format, ...) ACPI_PRINTF_LIKE(6);
+                     u32 component_id, const char *format, ...);
 #endif
 
 #endif                          /* __ACXFACE_H__ */
diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index 9b58a8f43771..94970880126f 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -146,7 +146,24 @@ struct acpi_table_rsdp {
         u8 reserved[3];         /* Reserved, must be zero */
 };
 
-#define ACPI_RSDP_REV0_SIZE     20      /* Size of original ACPI 1.0 RSDP */
+/* Standalone struct for the ACPI 1.0 RSDP */
+
+struct acpi_rsdp_common {
+        char signature[8];
+        u8 checksum;
+        char oem_id[ACPI_OEM_ID_SIZE];
+        u8 revision;
+        u32 rsdt_physical_address;
+};
+
+/* Standalone struct for the extended part of the RSDP (ACPI 2.0+) */
+
+struct acpi_rsdp_extension {
+        u32 length;
+        u64 xsdt_physical_address;
+        u8 extended_checksum;
+        u8 reserved[3];
+};
 
 /*******************************************************************************
  *
diff --git a/include/acpi/actbl2.h b/include/acpi/actbl2.h
index ffaac0e7e0c6..40f7ed115452 100644
--- a/include/acpi/actbl2.h
+++ b/include/acpi/actbl2.h
@@ -444,8 +444,8 @@ enum acpi_dmar_scope_type {
 };
 
 struct acpi_dmar_pci_path {
-        u8 dev;
-        u8 fn;
+        u8 device;
+        u8 function;
 };
 
 /*
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index b748aefce929..809b1a0fee7f 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -299,13 +299,57 @@ typedef u32 acpi_physical_address;
 #endif
 
 /*
- * All ACPICA functions that are available to the rest of the kernel are
- * tagged with this macro which can be defined as appropriate for the host.
+ * All ACPICA external functions that are available to the rest of the kernel
+ * are tagged with thes macros which can be defined as appropriate for the host.
+ *
+ * Notes:
+ * ACPI_EXPORT_SYMBOL_INIT is used for initialization and termination
+ * interfaces that may need special processing.
+ * ACPI_EXPORT_SYMBOL is used for all other public external functions.
  */
+#ifndef ACPI_EXPORT_SYMBOL_INIT
+#define ACPI_EXPORT_SYMBOL_INIT(symbol)
+#endif
+
 #ifndef ACPI_EXPORT_SYMBOL
 #define ACPI_EXPORT_SYMBOL(symbol)
 #endif
 
+/*
+ * Compiler/Clibrary-dependent debug initialization. Used for ACPICA
+ * utilities only.
+ */
+#ifndef ACPI_DEBUG_INITIALIZE
+#define ACPI_DEBUG_INITIALIZE()
+#endif
+
+/*******************************************************************************
+ *
+ * Configuration
+ *
+ ******************************************************************************/
+
+#ifdef ACPI_DBG_TRACK_ALLOCATIONS
+/*
+ * Memory allocation tracking (used by acpi_exec to detect memory leaks)
+ */
+#define ACPI_MEM_PARAMETERS             _COMPONENT, _acpi_module_name, __LINE__
+#define ACPI_ALLOCATE(a)                acpi_ut_allocate_and_track ((acpi_size) (a), ACPI_MEM_PARAMETERS)
+#define ACPI_ALLOCATE_ZEROED(a)         acpi_ut_allocate_zeroed_and_track ((acpi_size) (a), ACPI_MEM_PARAMETERS)
+#define ACPI_FREE(a)                    acpi_ut_free_and_track (a, ACPI_MEM_PARAMETERS)
+#define ACPI_MEM_TRACKING(a)            a
+
+#else
+/*
+ * Normal memory allocation directly via the OS services layer
+ */
+#define ACPI_ALLOCATE(a)                acpi_os_allocate ((acpi_size) (a))
+#define ACPI_ALLOCATE_ZEROED(a)         acpi_os_allocate_zeroed ((acpi_size) (a))
+#define ACPI_FREE(a)                    acpi_os_free (a)
+#define ACPI_MEM_TRACKING(a)
+
+#endif                          /* ACPI_DBG_TRACK_ALLOCATIONS */
+
 /******************************************************************************
  *
  * ACPI Specification constants (Do not change unless the specification changes)
@@ -322,6 +366,7 @@ typedef u32 acpi_physical_address;
 #define ACPI_PM1_REGISTER_WIDTH         16
 #define ACPI_PM2_REGISTER_WIDTH         8
 #define ACPI_PM_TIMER_WIDTH             32
+#define ACPI_RESET_REGISTER_WIDTH       8
 
 /* Names within the namespace are 4 bytes long */
 
@@ -474,6 +519,11 @@ typedef u64 acpi_integer;
 #define ACPI_MOVE_NAME(dest,src)        (ACPI_STRNCPY (ACPI_CAST_PTR (char, (dest)), ACPI_CAST_PTR (char, (src)), ACPI_NAME_SIZE))
 #endif
 
+/* Support for the special RSDP signature (8 characters) */
+
+#define ACPI_VALIDATE_RSDP_SIG(a)       (!ACPI_STRNCMP (ACPI_CAST_PTR (char, (a)), ACPI_SIG_RSDP, 8))
+#define ACPI_MAKE_RSDP_SIG(dest)        (ACPI_MEMCPY (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))
+
 /*******************************************************************************
  *
  * Miscellaneous constants
@@ -886,9 +936,13 @@ struct acpi_buffer {
         void *pointer;          /* pointer to buffer */
 };
 
-/* Free a buffer created in an struct acpi_buffer via ACPI_ALLOCATE_LOCAL_BUFFER */
-
-#define ACPI_FREE_BUFFER(b)         ACPI_FREE(b.pointer)
+/*
+ * Free a buffer created in an struct acpi_buffer via ACPI_ALLOCATE_BUFFER.
+ * Note: We use acpi_os_free here because acpi_os_allocate was used to allocate
+ * the buffer. This purposefully bypasses the internal allocation tracking
+ * mechanism (if it is enabled).
+ */
+#define ACPI_FREE_BUFFER(b)         acpi_os_free((b).pointer)
 
 /*
  * name_type for acpi_get_name
@@ -927,6 +981,16 @@ struct acpi_system_info {
         u32 debug_layer;
 };
 
+/*
+ * System statistics returned by acpi_get_statistics()
+ */
+struct acpi_statistics {
+        u32 sci_count;
+        u32 gpe_count;
+        u32 fixed_event_count[ACPI_NUM_FIXED_EVENTS];
+        u32 method_count;
+};
+
 /* Table Event Types */
 
 #define ACPI_TABLE_EVENT_LOAD           0x0
@@ -946,6 +1010,9 @@ typedef void
  * Various handlers and callback procedures
  */
 typedef
+u32 (*acpi_sci_handler) (void *context);
+
+typedef
 void (*acpi_gbl_event_handler) (u32 event_type,
                                acpi_handle device,
                                u32 event_number, void *context);
diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
index ef04b36ca6ed..974d3ef7c141 100644
--- a/include/acpi/platform/acenv.h
+++ b/include/acpi/platform/acenv.h
@@ -96,10 +96,11 @@
 #endif
 
 /*
- * acpi_bin/acpi_help/acpi_src configuration. All single threaded, with
- * no debug output.
+ * acpi_bin/acpi_dump/acpi_src/acpi_xtract configuration. All single
+ * threaded, with no debug output.
  */
 #if (defined ACPI_BIN_APP)   || \
+        (defined ACPI_DUMP_APP)  || \
         (defined ACPI_SRC_APP)   || \
         (defined ACPI_XTRACT_APP)
 #define ACPI_APPLICATION
@@ -147,6 +148,9 @@
 #if defined(_LINUX) || defined(__linux__)
 #include <acpi/platform/aclinux.h>
 
+#elif defined(_APPLE) || defined(__APPLE__)
+#include "acmacosx.h"
+
 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
 #include "acfreebsd.h"
 
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 68534ef86ec8..28f4f4dba0b6 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -50,7 +50,6 @@
 #define ACPI_USE_DO_WHILE_0
 #define ACPI_MUTEX_TYPE             ACPI_BINARY_SEMAPHORE
 
-
 #ifdef __KERNEL__
 
 #include <linux/string.h>
@@ -58,11 +57,13 @@
 #include <linux/ctype.h>
 #include <linux/sched.h>
 #include <linux/atomic.h>
-#include <asm/div64.h>
-#include <asm/acpi.h>
+#include <linux/math64.h>
 #include <linux/slab.h>
 #include <linux/spinlock_types.h>
-#include <asm/current.h>
+#ifdef EXPORT_ACPI_INTERFACES
+#include <linux/export.h>
+#endif
+#include <asm/acpi.h>
 
 /* Host-dependent types and defines for in-kernel ACPICA */
 
@@ -74,7 +75,7 @@
 #define acpi_spinlock                       spinlock_t *
 #define acpi_cpu_flags                      unsigned long
 
-#else /* !__KERNEL__ */
+#else                           /* !__KERNEL__ */
 
 #include <stdarg.h>
 #include <string.h>
@@ -87,7 +88,7 @@
 #define ACPI_FLUSH_CPU_CACHE()
 #define ACPI_CAST_PTHREAD_T(pthread) ((acpi_thread_id) (pthread))
 
-#if defined(__ia64__) || defined(__x86_64__)
+#if defined(__ia64__) || defined(__x86_64__) || defined(__aarch64__)
 #define ACPI_MACHINE_WIDTH          64
 #define COMPILER_DEPENDENT_INT64    long
 #define COMPILER_DEPENDENT_UINT64   unsigned long
@@ -102,21 +103,35 @@
 #define __cdecl
 #endif
 
-#endif /* __KERNEL__ */
+#endif                          /* __KERNEL__ */
 
 /* Linux uses GCC */
 
 #include <acpi/platform/acgcc.h>
 
 #ifdef __KERNEL__
+
+/*
+ * FIXME: Inclusion of actypes.h
+ * Linux kernel need this before defining inline OSL interfaces as
+ * actypes.h need to be included to find ACPICA type definitions.
+ * Since from ACPICA's perspective, the actypes.h should be included after
+ * acenv.h (aclinux.h), this leads to a inclusion mis-ordering issue.
+ */
 #include <acpi/actypes.h>
+
 /*
  * Overrides for in-kernel ACPICA
  */
-static inline acpi_thread_id acpi_os_get_thread_id(void)
-{
-        return (acpi_thread_id)(unsigned long)current;
-}
+acpi_status __init acpi_os_initialize(void);
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_initialize
+
+acpi_status acpi_os_terminate(void);
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_terminate
+
+/*
+ * Memory allocation/deallocation
+ */
 
 /*
  * The irqs_disabled() check is for resume from RAM.
@@ -126,25 +141,45 @@ static inline acpi_thread_id acpi_os_get_thread_id(void)
  */
 static inline void *acpi_os_allocate(acpi_size size)
 {
-        return kmalloc(size, irqs_disabled() ? GFP_ATOMIC : GFP_KERNEL);
+        return kmalloc(size, irqs_disabled()? GFP_ATOMIC : GFP_KERNEL);
 }
 
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_allocate
+
+/* Use native linux version of acpi_os_allocate_zeroed */
+
 static inline void *acpi_os_allocate_zeroed(acpi_size size)
 {
-        return kzalloc(size, irqs_disabled() ? GFP_ATOMIC : GFP_KERNEL);
+        return kzalloc(size, irqs_disabled()? GFP_ATOMIC : GFP_KERNEL);
+}
+
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_allocate_zeroed
+#define USE_NATIVE_ALLOCATE_ZEROED
+
+static inline void acpi_os_free(void *memory)
+{
+        kfree(memory);
 }
 
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_free
+
 static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
 {
         return kmem_cache_zalloc(cache,
-                irqs_disabled() ? GFP_ATOMIC : GFP_KERNEL);
+                                 irqs_disabled()? GFP_ATOMIC : GFP_KERNEL);
+}
+
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_acquire_object
+
+static inline acpi_thread_id acpi_os_get_thread_id(void)
+{
+        return (acpi_thread_id) (unsigned long)current;
 }
 
-#define ACPI_ALLOCATE(a)        acpi_os_allocate(a)
-#define ACPI_ALLOCATE_ZEROED(a) acpi_os_allocate_zeroed(a)
-#define ACPI_FREE(a)            kfree(a)
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_thread_id
 
 #ifndef CONFIG_PREEMPT
+
 /*
  * Used within ACPICA to show where it is safe to preempt execution
  * when CONFIG_PREEMPT=n
@@ -154,6 +189,7 @@ static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
                 if (!irqs_disabled()) \
                         cond_resched(); \
         } while (0)
+
 #endif
 
 /*
@@ -163,17 +199,50 @@ static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
  * all locks to the name of the argument of acpi_os_create_lock(), which
  * prevents lockdep from reporting false positives for ACPICA locks.
  */
-#define acpi_os_create_lock(__handle)                           \
-({                                                              \
-        spinlock_t *lock = ACPI_ALLOCATE(sizeof(*lock));        \
-                                                                \
-        if (lock) {                                             \
-                *(__handle) = lock;                             \
-                spin_lock_init(*(__handle));                    \
-        }                                                       \
-        lock ? AE_OK : AE_NO_MEMORY;                            \
-})
-
-#endif /* __KERNEL__ */
-
-#endif /* __ACLINUX_H__ */
+#define acpi_os_create_lock(__handle) \
+        ({ \
+                spinlock_t *lock = ACPI_ALLOCATE(sizeof(*lock)); \
+                if (lock) { \
+                        *(__handle) = lock; \
+                        spin_lock_init(*(__handle)); \
+                } \
+                lock ? AE_OK : AE_NO_MEMORY; \
+        })
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_create_lock
+
+void __iomem *acpi_os_map_memory(acpi_physical_address where, acpi_size length);
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_map_memory
+
+void acpi_os_unmap_memory(void __iomem * logical_address, acpi_size size);
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_unmap_memory
+
+/*
+ * OSL interfaces used by debugger/disassembler
+ */
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_readable
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_writable
+
+/*
+ * OSL interfaces used by utilities
+ */
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_redirect_output
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_line
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_table_by_name
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_table_by_index
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_table_by_address
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_open_directory
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_get_next_filename
+#define ACPI_USE_ALTERNATE_PROTOTYPE_acpi_os_close_directory
+
+/*
+ * OSL interfaces added by Linux
+ */
+void early_acpi_os_unmap_memory(void __iomem * virt, acpi_size size);
+
+void acpi_os_gpe_count(u32 gpe_number);
+
+void acpi_os_fixed_event_count(u32 fixed_event_number);
+
+#endif                          /* __KERNEL__ */
+
+#endif                          /* __ACLINUX_H__ */
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 66096d06925e..6eb1d3cb5104 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -199,6 +199,7 @@ struct acpi_processor_flags {
 struct acpi_processor {
         acpi_handle handle;
         u32 acpi_id;
+        u32 apic_id;
         u32 id;
         u32 pblk;
         int performance_platform_limit;
@@ -224,7 +225,6 @@ struct acpi_processor_errata {
         } piix4;
 };
 
-extern void acpi_processor_load_module(struct acpi_processor *pr);
 extern int acpi_processor_preregister_performance(struct
                                                   acpi_processor_performance
                                                   __percpu *performance);
@@ -314,6 +314,8 @@ static inline int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
 
 /* in processor_core.c */
 void acpi_processor_set_pdc(acpi_handle handle);
+int acpi_get_apicid(acpi_handle, int type, u32 acpi_id);
+int acpi_map_cpuid(int apic_id, u32 acpi_id);
 int acpi_get_cpuid(acpi_handle, int type, u32 acpi_id);
 
 /* in processor_throttling.c */
diff --git a/include/asm-generic/hugetlb.h b/include/asm-generic/hugetlb.h
index d06079c774a0..99b490b4d05a 100644
--- a/include/asm-generic/hugetlb.h
+++ b/include/asm-generic/hugetlb.h
@@ -6,12 +6,12 @@ static inline pte_t mk_huge_pte(struct page *page, pgprot_t pgprot)
         return mk_pte(page, pgprot);
 }
 
-static inline int huge_pte_write(pte_t pte)
+static inline unsigned long huge_pte_write(pte_t pte)
 {
         return pte_write(pte);
 }
 
-static inline int huge_pte_dirty(pte_t pte)
+static inline unsigned long huge_pte_dirty(pte_t pte)
 {
         return pte_dirty(pte);
 }
diff --git a/include/asm-generic/vtime.h b/include/asm-generic/vtime.h
index e69de29bb2d1..b1a49677fe25 100644
--- a/include/asm-generic/vtime.h
+++ b/include/asm-generic/vtime.h
@@ -0,0 +1 @@
+/* no content, but patch(1) dislikes empty files */
diff --git a/include/dt-bindings/pinctrl/omap.h b/include/dt-bindings/pinctrl/omap.h
index edbd250809cb..bed35e36fd27 100644
--- a/include/dt-bindings/pinctrl/omap.h
+++ b/include/dt-bindings/pinctrl/omap.h
@@ -23,7 +23,7 @@
 #define PULL_UP                 (1 << 4)
 #define ALTELECTRICALSEL        (1 << 5)
 
-/* 34xx specific mux bit defines */
+/* omap3/4/5 specific mux bit defines */
 #define INPUT_EN                (1 << 8)
 #define OFF_EN                  (1 << 9)
 #define OFFOUT_EN               (1 << 10)
@@ -31,8 +31,6 @@
 #define OFF_PULL_EN             (1 << 12)
 #define OFF_PULL_UP             (1 << 13)
 #define WAKEUP_EN               (1 << 14)
-
-/* 44xx specific mux bit defines */
 #define WAKEUP_EVENT            (1 << 15)
 
 /* Active pin states */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index a5db4aeefa36..3bc74141453f 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -116,7 +116,7 @@ void acpi_numa_arch_fixup(void);
 
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 /* Arch dependent functions for cpu hotplug support */
-int acpi_map_lsapic(acpi_handle handle, int *pcpu);
+int acpi_map_lsapic(acpi_handle handle, int physid, int *pcpu);
 int acpi_unmap_lsapic(int cpu);
 #endif /* CONFIG_ACPI_HOTPLUG_CPU */
 
diff --git a/include/linux/backlight.h b/include/linux/backlight.h
index 53b77949c79d..5f9cd963213d 100644
--- a/include/linux/backlight.h
+++ b/include/linux/backlight.h
@@ -100,6 +100,9 @@ struct backlight_device {
         /* The framebuffer notifier block */
         struct notifier_block fb_notif;
 
+        /* list entry of all registered backlight devices */
+        struct list_head entry;
+
         struct device dev;
 };
 
@@ -123,6 +126,7 @@ extern void devm_backlight_device_unregister(struct device *dev,
                                         struct backlight_device *bd);
 extern void backlight_force_update(struct backlight_device *bd,
                                    enum backlight_update_reason reason);
+extern bool backlight_device_registered(enum backlight_type type);
 
 #define to_backlight_device(obj) container_of(obj, struct backlight_device, dev)
 
diff --git a/include/linux/balloon_compaction.h b/include/linux/balloon_compaction.h
index f7f1d7169b11..089743ade734 100644
--- a/include/linux/balloon_compaction.h
+++ b/include/linux/balloon_compaction.h
@@ -159,6 +159,26 @@ static inline bool balloon_page_movable(struct page *page)
 }
 
 /*
+ * isolated_balloon_page - identify an isolated balloon page on private
+ *                         compaction/migration page lists.
+ *
+ * After a compaction thread isolates a balloon page for migration, it raises
+ * the page refcount to prevent concurrent compaction threads from re-isolating
+ * the same page. For that reason putback_movable_pages(), or other routines
+ * that need to identify isolated balloon pages on private pagelists, cannot
+ * rely on balloon_page_movable() to accomplish the task.
+ */
+static inline bool isolated_balloon_page(struct page *page)
+{
+        /* Already isolated balloon pages, by default, have a raised refcount */
+        if (page_flags_cleared(page) && !page_mapped(page) &&
+            page_count(page) >= 2)
+                return __is_movable_balloon_page(page);
+
+        return false;
+}
+
+/*
  * balloon_page_insert - insert a page into the balloon's page list and make
  *                       the page->mapping assignment accordingly.
  * @page    : page to be assigned as a 'balloon page'
@@ -243,6 +263,11 @@ static inline bool balloon_page_movable(struct page *page)
         return false;
 }
 
+static inline bool isolated_balloon_page(struct page *page)
+{
+        return false;
+}
+
 static inline bool balloon_page_isolate(struct page *page)
 {
         return false;
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index d66033f418c9..0333e605ea0d 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -242,6 +242,7 @@ extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                  struct bcma_device *core, bool enable);
 extern void bcma_core_pci_up(struct bcma_bus *bus);
 extern void bcma_core_pci_down(struct bcma_bus *bus);
+extern void bcma_core_pci_power_save(struct bcma_bus *bus, bool up);
 
 extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
 extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index a3b6b82108b9..5a1c8b71ccd8 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -4,8 +4,11 @@
 
 #ifdef  __KERNEL__
 #define BIT(nr)                 (1UL << (nr))
+#define BIT_ULL(nr)             (1ULL << (nr))
 #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
 #define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
+#define BIT_ULL_MASK(nr)        (1ULL << ((nr) % BITS_PER_LONG_LONG))
+#define BIT_ULL_WORD(nr)        ((nr) / BITS_PER_LONG_LONG)
 #define BITS_PER_BYTE           8
 #define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
 #endif
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 842de225055f..ded429966c1f 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -65,6 +65,21 @@
 #define __visible __attribute__((externally_visible))
 #endif
 
+/*
+ * GCC 'asm goto' miscompiles certain code sequences:
+ *
+ *   http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
+ *
+ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
+ * Fixed in GCC 4.8.2 and later versions.
+ *
+ * (asm goto is automatically volatile - the naming reflects this.)
+ */
+#if GCC_VERSION <= 40801
+# define asm_volatile_goto(x...)        do { asm goto(x); asm (""); } while (0)
+#else
+# define asm_volatile_goto(x...)        do { asm goto(x); } while (0)
+#endif
 
 #ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
 #if GCC_VERSION >= 40400
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index fcabc42d66ab..5bd6ab9b0c27 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -85,6 +85,20 @@ struct cpufreq_policy {
         struct list_head        policy_list;
         struct kobject          kobj;
         struct completion       kobj_unregister;
+
+        /*
+         * The rules for this semaphore:
+         * - Any routine that wants to read from the policy structure will
+         *   do a down_read on this semaphore.
+         * - Any routine that will write to the policy structure and/or may take away
+         *   the policy altogether (eg. CPU hotplug), will hold this lock in write
+         *   mode before doing so.
+         *
+         * Additional rules:
+         * - Lock should not be held across
+         *     __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
+         */
+        struct rw_semaphore     rwsem;
 };
 
 /* Only for ACPI */
@@ -180,13 +194,6 @@ __ATTR(_name, 0644, show_##_name, store_##_name)
 struct cpufreq_driver {
         char                    name[CPUFREQ_NAME_LEN];
         u8                      flags;
-        /*
-         * This should be set by platforms having multiple clock-domains, i.e.
-         * supporting multiple policies. With this sysfs directories of governor
-         * would be created in cpu/cpu<num>/cpufreq/ directory and so they can
-         * use the same governor with different tunables for different clusters.
-         */
-        bool                    have_governor_per_policy;
 
         /* needed by all drivers */
         int     (*init)         (struct cpufreq_policy *policy);
@@ -194,9 +201,11 @@ struct cpufreq_driver {
 
         /* define one out of two */
         int     (*setpolicy)    (struct cpufreq_policy *policy);
-        int     (*target)       (struct cpufreq_policy *policy,
+        int     (*target)       (struct cpufreq_policy *policy, /* Deprecated */
                                  unsigned int target_freq,
                                  unsigned int relation);
+        int     (*target_index) (struct cpufreq_policy *policy,
+                                 unsigned int index);
 
         /* should be defined, if possible */
         unsigned int    (*get)  (unsigned int cpu);
@@ -211,13 +220,29 @@ struct cpufreq_driver {
 };
 
 /* flags */
-#define CPUFREQ_STICKY          0x01    /* the driver isn't removed even if
-                                         * all ->init() calls failed */
-#define CPUFREQ_CONST_LOOPS     0x02    /* loops_per_jiffy or other kernel
-                                         * "constants" aren't affected by
-                                         * frequency transitions */
-#define CPUFREQ_PM_NO_WARN      0x04    /* don't warn on suspend/resume speed
-                                         * mismatches */
+#define CPUFREQ_STICKY          (1 << 0)        /* driver isn't removed even if
+                                                   all ->init() calls failed */
+#define CPUFREQ_CONST_LOOPS     (1 << 1)        /* loops_per_jiffy or other
+                                                   kernel "constants" aren't
+                                                   affected by frequency
+                                                   transitions */
+#define CPUFREQ_PM_NO_WARN      (1 << 2)        /* don't warn on suspend/resume
+                                                   speed mismatches */
+
+/*
+ * This should be set by platforms having multiple clock-domains, i.e.
+ * supporting multiple policies. With this sysfs directories of governor would
+ * be created in cpu/cpu<num>/cpufreq/ directory and so they can use the same
+ * governor with different tunables for different clusters.
+ */
+#define CPUFREQ_HAVE_GOVERNOR_PER_POLICY (1 << 3)
+
+/*
+ * Driver will do POSTCHANGE notifications from outside of their ->target()
+ * routine and so must set cpufreq_driver->flags with this flag, so that core
+ * can handle them specially.
+ */
+#define CPUFREQ_ASYNC_NOTIFICATION  (1 << 4)
 
 int cpufreq_register_driver(struct cpufreq_driver *driver_data);
 int cpufreq_unregister_driver(struct cpufreq_driver *driver_data);
@@ -240,6 +265,13 @@ static inline void cpufreq_verify_within_limits(struct cpufreq_policy *policy,
         return;
 }
 
+static inline void
+cpufreq_verify_within_cpu_limits(struct cpufreq_policy *policy)
+{
+        cpufreq_verify_within_limits(policy, policy->cpuinfo.min_freq,
+                        policy->cpuinfo.max_freq);
+}
+
 /*********************************************************************
  *                     CPUFREQ NOTIFIER INTERFACE                    *
  *********************************************************************/
@@ -392,6 +424,7 @@ int cpufreq_frequency_table_cpuinfo(struct cpufreq_policy *policy,
 
 int cpufreq_frequency_table_verify(struct cpufreq_policy *policy,
                                    struct cpufreq_frequency_table *table);
+int cpufreq_generic_frequency_table_verify(struct cpufreq_policy *policy);
 
 int cpufreq_frequency_table_target(struct cpufreq_policy *policy,
                                    struct cpufreq_frequency_table *table,
@@ -407,8 +440,20 @@ struct cpufreq_frequency_table *cpufreq_frequency_get_table(unsigned int cpu);
 
 /* the following are really really optional */
 extern struct freq_attr cpufreq_freq_attr_scaling_available_freqs;
+extern struct freq_attr *cpufreq_generic_attr[];
 void cpufreq_frequency_table_get_attr(struct cpufreq_frequency_table *table,
                                       unsigned int cpu);
 void cpufreq_frequency_table_put_attr(unsigned int cpu);
+int cpufreq_table_validate_and_show(struct cpufreq_policy *policy,
+                                      struct cpufreq_frequency_table *table);
+
+int cpufreq_generic_init(struct cpufreq_policy *policy,
+                struct cpufreq_frequency_table *table,
+                unsigned int transition_latency);
+static inline int cpufreq_generic_exit(struct cpufreq_policy *policy)
+{
+        cpufreq_frequency_table_put_attr(policy->cpu);
+        return 0;
+}
 
 #endif /* _LINUX_CPUFREQ_H */
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 781addc66f03..50fcbb0ac4e7 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -114,7 +114,7 @@ struct cpuidle_driver {
         int                     safe_state_index;
 
         /* the driver handles the cpus in cpumask */
-        struct cpumask       *cpumask;
+        struct cpumask          *cpumask;
 };
 
 #ifdef CONFIG_CPU_IDLE
@@ -195,16 +195,10 @@ struct cpuidle_governor {
 };
 
 #ifdef CONFIG_CPU_IDLE
-
 extern int cpuidle_register_governor(struct cpuidle_governor *gov);
-extern void cpuidle_unregister_governor(struct cpuidle_governor *gov);
-
 #else
-
 static inline int cpuidle_register_governor(struct cpuidle_governor *gov)
 {return 0;}
-static inline void cpuidle_unregister_governor(struct cpuidle_governor *gov) { }
-
 #endif
 
 #ifdef CONFIG_ARCH_HAS_CPU_RELAX
diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
index 5f1ab92107e6..7a7cc74d7f27 100644
--- a/include/linux/devfreq.h
+++ b/include/linux/devfreq.h
@@ -15,7 +15,7 @@
 
 #include <linux/device.h>
 #include <linux/notifier.h>
-#include <linux/opp.h>
+#include <linux/pm_opp.h>
 
 #define DEVFREQ_NAME_LEN 16
 
@@ -187,7 +187,7 @@ extern int devfreq_suspend_device(struct devfreq *devfreq);
 extern int devfreq_resume_device(struct devfreq *devfreq);
 
 /* Helper functions for devfreq user device driver with OPP. */
-extern struct opp *devfreq_recommended_opp(struct device *dev,
+extern struct dev_pm_opp *devfreq_recommended_opp(struct device *dev,
                                            unsigned long *freq, u32 flags);
 extern int devfreq_register_opp_notifier(struct device *dev,
                                          struct devfreq *devfreq);
@@ -238,7 +238,7 @@ static inline int devfreq_resume_device(struct devfreq *devfreq)
         return 0;
 }
 
-static inline struct opp *devfreq_recommended_opp(struct device *dev,
+static inline struct dev_pm_opp *devfreq_recommended_opp(struct device *dev,
                                            unsigned long *freq, u32 flags)
 {
         return ERR_PTR(-EINVAL);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 653073de09e3..ed419c62dde1 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -406,13 +406,14 @@ int dm_noflush_suspending(struct dm_target *ti);
 union map_info *dm_get_mapinfo(struct bio *bio);
 union map_info *dm_get_rq_mapinfo(struct request *rq);
 
+struct queue_limits *dm_get_queue_limits(struct mapped_device *md);
+
 /*
  * Geometry functions.
  */
 int dm_get_geometry(struct mapped_device *md, struct hd_geometry *geo);
 int dm_set_geometry(struct mapped_device *md, struct hd_geometry *geo);
 
-
 /*-----------------------------------------------------------------
  * Functions for manipulating device-mapper tables.
  *---------------------------------------------------------------*/
diff --git a/include/linux/filter.h b/include/linux/filter.h
index a6ac84871d6d..ff4e40cd45b1 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -6,6 +6,7 @@
 
 #include <linux/atomic.h>
 #include <linux/compat.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/filter.h>
 
 #ifdef CONFIG_COMPAT
@@ -25,15 +26,19 @@ struct sk_filter
 {
         atomic_t                refcnt;
         unsigned int            len;    /* Number of filter blocks */
+        struct rcu_head         rcu;
         unsigned int            (*bpf_func)(const struct sk_buff *skb,
                                             const struct sock_filter *filter);
-        struct rcu_head         rcu;
-        struct sock_filter      insns[0];
+        union {
+                struct sock_filter      insns[0];
+                struct work_struct      work;
+        };
 };
 
-static inline unsigned int sk_filter_len(const struct sk_filter *fp)
+static inline unsigned int sk_filter_size(unsigned int proglen)
 {
-        return fp->len * sizeof(struct sock_filter) + sizeof(*fp);
+        return max(sizeof(struct sk_filter),
+                   offsetof(struct sk_filter, insns[proglen]));
 }
 
 extern int sk_filter(struct sock *sk, struct sk_buff *skb);
@@ -67,11 +72,13 @@ static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
 }
 #define SK_RUN_FILTER(FILTER, SKB) (*FILTER->bpf_func)(SKB, FILTER->insns)
 #else
+#include <linux/slab.h>
 static inline void bpf_jit_compile(struct sk_filter *fp)
 {
 }
 static inline void bpf_jit_free(struct sk_filter *fp)
 {
+        kfree(fp);
 }
 #define SK_RUN_FILTER(FILTER, SKB) sk_run_filter(SKB, FILTER->insns)
 #endif
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index a3b8b2e2d244..d98503bde7e9 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -30,10 +30,13 @@
 /*
  * Framework version for util services.
  */
+#define UTIL_FW_MINOR  0
+
+#define UTIL_WS2K8_FW_MAJOR  1
+#define UTIL_WS2K8_FW_VERSION     (UTIL_WS2K8_FW_MAJOR << 16 | UTIL_FW_MINOR)
 
 #define UTIL_FW_MAJOR  3
-#define UTIL_FW_MINOR  0
-#define UTIL_FW_MAJOR_MINOR     (UTIL_FW_MAJOR << 16 | UTIL_FW_MINOR)
+#define UTIL_FW_VERSION     (UTIL_FW_MAJOR << 16 | UTIL_FW_MINOR)
 
 
 /*
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 78e2ada50cd5..d380c5e68008 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -55,7 +55,7 @@
 #define DMAR_IQT_REG    0x88    /* Invalidation queue tail register */
 #define DMAR_IQ_SHIFT   4       /* Invalidation queue head/tail shift */
 #define DMAR_IQA_REG    0x90    /* Invalidation queue addr register */
-#define DMAR_ICS_REG    0x98    /* Invalidation complete status register */
+#define DMAR_ICS_REG    0x9c    /* Invalidation complete status register */
 #define DMAR_IRTA_REG   0xb8    /* Interrupt remapping table addr register */
 
 #define OFFSET_STRIDE           (9)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 482ad2d84a32..672ddc4de4af 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -439,6 +439,17 @@ static inline char *hex_byte_pack(char *buf, u8 byte)
         return buf;
 }
 
+extern const char hex_asc_upper[];
+#define hex_asc_upper_lo(x)     hex_asc_upper[((x) & 0x0f)]
+#define hex_asc_upper_hi(x)     hex_asc_upper[((x) & 0xf0) >> 4]
+
+static inline char *hex_byte_pack_upper(char *buf, u8 byte)
+{
+        *buf++ = hex_asc_upper_hi(byte);
+        *buf++ = hex_asc_upper_lo(byte);
+        return buf;
+}
+
 static inline char * __deprecated pack_hex_byte(char *buf, u8 byte)
 {
         return hex_byte_pack(buf, byte);
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 60e95872da29..b3e7a667e03c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -53,23 +53,6 @@ struct mem_cgroup_reclaim_cookie {
         unsigned int generation;
 };
 
-enum mem_cgroup_filter_t {
-        VISIT,          /* visit current node */
-        SKIP,           /* skip the current node and continue traversal */
-        SKIP_TREE,      /* skip the whole subtree and continue traversal */
-};
-
-/*
- * mem_cgroup_filter_t predicate might instruct mem_cgroup_iter_cond how to
- * iterate through the hierarchy tree. Each tree element is checked by the
- * predicate before it is returned by the iterator. If a filter returns
- * SKIP or SKIP_TREE then the iterator code continues traversal (with the
- * next node down the hierarchy or the next node that doesn't belong under the
- * memcg's subtree).
- */
-typedef enum mem_cgroup_filter_t
-(*mem_cgroup_iter_filter)(struct mem_cgroup *memcg, struct mem_cgroup *root);
-
 #ifdef CONFIG_MEMCG
 /*
  * All "charge" functions with gfp_mask should use GFP_KERNEL or
@@ -137,18 +120,9 @@ mem_cgroup_prepare_migration(struct page *page, struct page *newpage,
 extern void mem_cgroup_end_migration(struct mem_cgroup *memcg,
         struct page *oldpage, struct page *newpage, bool migration_ok);
 
-struct mem_cgroup *mem_cgroup_iter_cond(struct mem_cgroup *root,
-                                   struct mem_cgroup *prev,
-                                   struct mem_cgroup_reclaim_cookie *reclaim,
-                                   mem_cgroup_iter_filter cond);
-
-static inline struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
-                                   struct mem_cgroup *prev,
-                                   struct mem_cgroup_reclaim_cookie *reclaim)
-{
-        return mem_cgroup_iter_cond(root, prev, reclaim, NULL);
-}
-
+struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *,
+                                   struct mem_cgroup *,
+                                   struct mem_cgroup_reclaim_cookie *);
 void mem_cgroup_iter_break(struct mem_cgroup *, struct mem_cgroup *);
 
 /*
@@ -163,47 +137,24 @@ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
 extern void mem_cgroup_replace_page_cache(struct page *oldpage,
                                         struct page *newpage);
 
-/**
- * mem_cgroup_toggle_oom - toggle the memcg OOM killer for the current task
- * @new: true to enable, false to disable
- *
- * Toggle whether a failed memcg charge should invoke the OOM killer
- * or just return -ENOMEM.  Returns the previous toggle state.
- *
- * NOTE: Any path that enables the OOM killer before charging must
- *       call mem_cgroup_oom_synchronize() afterward to finalize the
- *       OOM handling and clean up.
- */
-static inline bool mem_cgroup_toggle_oom(bool new)
+static inline void mem_cgroup_oom_enable(void)
 {
-        bool old;
-
-        old = current->memcg_oom.may_oom;
-        current->memcg_oom.may_oom = new;
-
-        return old;
+        WARN_ON(current->memcg_oom.may_oom);
+        current->memcg_oom.may_oom = 1;
 }
 
-static inline void mem_cgroup_enable_oom(void)
+static inline void mem_cgroup_oom_disable(void)
 {
-        bool old = mem_cgroup_toggle_oom(true);
-
-        WARN_ON(old == true);
-}
-
-static inline void mem_cgroup_disable_oom(void)
-{
-        bool old = mem_cgroup_toggle_oom(false);
-
-        WARN_ON(old == false);
+        WARN_ON(!current->memcg_oom.may_oom);
+        current->memcg_oom.may_oom = 0;
 }
 
 static inline bool task_in_memcg_oom(struct task_struct *p)
 {
-        return p->memcg_oom.in_memcg_oom;
+        return p->memcg_oom.memcg;
 }
 
-bool mem_cgroup_oom_synchronize(void);
+bool mem_cgroup_oom_synchronize(bool wait);
 
 #ifdef CONFIG_MEMCG_SWAP
 extern int do_swap_account;
@@ -260,9 +211,9 @@ static inline void mem_cgroup_dec_page_stat(struct page *page,
         mem_cgroup_update_page_stat(page, idx, -1);
 }
 
-enum mem_cgroup_filter_t
-mem_cgroup_soft_reclaim_eligible(struct mem_cgroup *memcg,
-                struct mem_cgroup *root);
+unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
+                                                gfp_t gfp_mask,
+                                                unsigned long *total_scanned);
 
 void __mem_cgroup_count_vm_event(struct mm_struct *mm, enum vm_event_item idx);
 static inline void mem_cgroup_count_vm_event(struct mm_struct *mm,
@@ -376,15 +327,6 @@ static inline void mem_cgroup_end_migration(struct mem_cgroup *memcg,
                 struct page *oldpage, struct page *newpage, bool migration_ok)
 {
 }
-static inline struct mem_cgroup *
-mem_cgroup_iter_cond(struct mem_cgroup *root,
-                struct mem_cgroup *prev,
-                struct mem_cgroup_reclaim_cookie *reclaim,
-                mem_cgroup_iter_filter cond)
-{
-        /* first call must return non-NULL, second return NULL */
-        return (struct mem_cgroup *)(unsigned long)!prev;
-}
 
 static inline struct mem_cgroup *
 mem_cgroup_iter(struct mem_cgroup *root,
@@ -437,16 +379,11 @@ static inline void mem_cgroup_end_update_page_stat(struct page *page,
 {
 }
 
-static inline bool mem_cgroup_toggle_oom(bool new)
+static inline void mem_cgroup_oom_enable(void)
 {
-        return false;
 }
 
-static inline void mem_cgroup_enable_oom(void)
-{
-}
-
-static inline void mem_cgroup_disable_oom(void)
+static inline void mem_cgroup_oom_disable(void)
 {
 }
 
@@ -455,7 +392,7 @@ static inline bool task_in_memcg_oom(struct task_struct *p)
         return false;
 }
 
-static inline bool mem_cgroup_oom_synchronize(void)
+static inline bool mem_cgroup_oom_synchronize(bool wait)
 {
         return false;
 }
@@ -471,11 +408,11 @@ static inline void mem_cgroup_dec_page_stat(struct page *page,
 }
 
 static inline
-enum mem_cgroup_filter_t
-mem_cgroup_soft_reclaim_eligible(struct mem_cgroup *memcg,
-                struct mem_cgroup *root)
+unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
+                                            gfp_t gfp_mask,
+                                            unsigned long *total_scanned)
 {
-        return VISIT;
+        return 0;
 }
 
 static inline void mem_cgroup_split_huge_fixup(struct page *head)
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 09c2300ddb37..cb358355ef43 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -45,6 +45,7 @@
 #define MAPPER_CTRL_MINOR       236
 #define LOOP_CTRL_MINOR         237
 #define VHOST_NET_MINOR         238
+#define UHID_MINOR              239
 #define MISC_DYNAMIC_MINOR      255
 
 struct device;
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 68029b30c3dc..5eb4e31af22b 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -181,7 +181,7 @@ enum {
         MLX5_DEV_CAP_FLAG_TLP_HINTS     = 1LL << 39,
         MLX5_DEV_CAP_FLAG_SIG_HAND_OVER = 1LL << 40,
         MLX5_DEV_CAP_FLAG_DCT           = 1LL << 41,
-        MLX5_DEV_CAP_FLAG_CMDIF_CSUM    = 1LL << 46,
+        MLX5_DEV_CAP_FLAG_CMDIF_CSUM    = 3LL << 46,
 };
 
 enum {
@@ -417,7 +417,7 @@ struct mlx5_init_seg {
         struct health_buffer    health;
         __be32                  rsvd2[884];
         __be32                  health_counter;
-        __be32                  rsvd3[1023];
+        __be32                  rsvd3[1019];
         __be64                  ieee1588_clk;
         __be32                  ieee1588_clk_type;
         __be32                  clr_intx;
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 8888381fc150..6b8c496572c8 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -82,7 +82,7 @@ enum {
 };
 
 enum {
-        MLX5_MAX_EQ_NAME        = 20
+        MLX5_MAX_EQ_NAME        = 32
 };
 
 enum {
@@ -747,8 +747,7 @@ static inline u32 mlx5_idx_to_mkey(u32 mkey_idx)
 
 enum {
         MLX5_PROF_MASK_QP_SIZE          = (u64)1 << 0,
-        MLX5_PROF_MASK_CMDIF_CSUM       = (u64)1 << 1,
-        MLX5_PROF_MASK_MR_CACHE         = (u64)1 << 2,
+        MLX5_PROF_MASK_MR_CACHE         = (u64)1 << 1,
 };
 
 enum {
@@ -758,7 +757,6 @@ enum {
 struct mlx5_profile {
         u64     mask;
         u32     log_max_qp;
-        int     cmdif_csum;
         struct {
                 int     size;
                 int     limit;
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index ccd4260834c5..bab49da8a0f0 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -15,8 +15,8 @@
 #include <linux/spinlock_types.h>
 #include <linux/linkage.h>
 #include <linux/lockdep.h>
-
 #include <linux/atomic.h>
+#include <asm/processor.h>
 
 /*
  * Simple, straightforward mutexes with strict semantics:
@@ -175,8 +175,8 @@ extern void mutex_unlock(struct mutex *lock);
 
 extern int atomic_dec_and_mutex_lock(atomic_t *cnt, struct mutex *lock);
 
-#ifndef CONFIG_HAVE_ARCH_MUTEX_CPU_RELAX
-#define arch_mutex_cpu_relax()  cpu_relax()
+#ifndef arch_mutex_cpu_relax
+# define arch_mutex_cpu_relax() cpu_relax()
 #endif
 
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3de49aca4519..25f5d2d11e7c 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2264,11 +2264,12 @@ static inline void netif_wake_subqueue(struct net_device *dev, u16 queue_index)
 }
 
 #ifdef CONFIG_XPS
-extern int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask,
+extern int netif_set_xps_queue(struct net_device *dev,
+                               const struct cpumask *mask,
                                u16 index);
 #else
 static inline int netif_set_xps_queue(struct net_device *dev,
-                                      struct cpumask *mask,
+                                      const struct cpumask *mask,
                                       u16 index)
 {
         return 0;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 01fd84b566f7..49f52c8f4422 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -1455,7 +1455,8 @@ struct nfs_rpc_ops {
         struct inode * (*open_context) (struct inode *dir,
                                 struct nfs_open_context *ctx,
                                 int open_flags,
-                                struct iattr *iattr);
+                                struct iattr *iattr,
+                                int *);
         int (*have_delegation)(struct inode *, fmode_t);
         int (*return_delegation)(struct inode *);
         struct nfs_client *(*alloc_client) (const struct nfs_client_initdata *);
diff --git a/include/linux/of_irq.h b/include/linux/of_irq.h
index 535cecf1e02f..fcd63baee5f2 100644
--- a/include/linux/of_irq.h
+++ b/include/linux/of_irq.h
@@ -1,8 +1,6 @@
 #ifndef __OF_IRQ_H
 #define __OF_IRQ_H
 
-#if defined(CONFIG_OF)
-struct of_irq;
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/irq.h>
@@ -10,14 +8,6 @@ struct of_irq;
 #include <linux/ioport.h>
 #include <linux/of.h>
 
-/*
- * irq_of_parse_and_map() is used by all OF enabled platforms; but SPARC
- * implements it differently.  However, the prototype is the same for all,
- * so declare it here regardless of the CONFIG_OF_IRQ setting.
- */
-extern unsigned int irq_of_parse_and_map(struct device_node *node, int index);
-
-#if defined(CONFIG_OF_IRQ)
 /**
  * of_irq - container for device_node/irq_specifier pair for an irq controller
  * @controller: pointer to interrupt controller device tree node
@@ -71,11 +61,17 @@ extern int of_irq_to_resource(struct device_node *dev, int index,
 extern int of_irq_count(struct device_node *dev);
 extern int of_irq_to_resource_table(struct device_node *dev,
                 struct resource *res, int nr_irqs);
-extern struct device_node *of_irq_find_parent(struct device_node *child);
 
 extern void of_irq_init(const struct of_device_id *matches);
 
-#endif /* CONFIG_OF_IRQ */
+#if defined(CONFIG_OF)
+/*
+ * irq_of_parse_and_map() is used by all OF enabled platforms; but SPARC
+ * implements it differently.  However, the prototype is the same for all,
+ * so declare it here regardless of the CONFIG_OF_IRQ setting.
+ */
+extern unsigned int irq_of_parse_and_map(struct device_node *node, int index);
+extern struct device_node *of_irq_find_parent(struct device_node *child);
 
 #else /* !CONFIG_OF */
 static inline unsigned int irq_of_parse_and_map(struct device_node *dev,
diff --git a/include/linux/of_reserved_mem.h b/include/linux/of_reserved_mem.h
deleted file mode 100644
index c84128255814..000000000000
--- a/include/linux/of_reserved_mem.h
+++ /dev/null
@@ -1,14 +0,0 @@
-#ifndef __OF_RESERVED_MEM_H
-#define __OF_RESERVED_MEM_H
-
-#ifdef CONFIG_OF_RESERVED_MEM
-void of_reserved_mem_device_init(struct device *dev);
-void of_reserved_mem_device_release(struct device *dev);
-void early_init_dt_scan_reserved_mem(void);
-#else
-static inline void of_reserved_mem_device_init(struct device *dev) { }
-static inline void of_reserved_mem_device_release(struct device *dev) { }
-static inline void early_init_dt_scan_reserved_mem(void) { }
-#endif
-
-#endif /* __OF_RESERVED_MEM_H */
diff --git a/include/linux/opp.h b/include/linux/opp.h
deleted file mode 100644
index 3aca2b8def33..000000000000
--- a/include/linux/opp.h
+++ /dev/null
@@ -1,134 +0,0 @@
-/*
- * Generic OPP Interface
- *
- * Copyright (C) 2009-2010 Texas Instruments Incorporated.
- *      Nishanth Menon
- *      Romit Dasgupta
- *      Kevin Hilman
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef __LINUX_OPP_H__
-#define __LINUX_OPP_H__
-
-#include <linux/err.h>
-#include <linux/cpufreq.h>
-#include <linux/notifier.h>
-
-struct opp;
-struct device;
-
-enum opp_event {
-        OPP_EVENT_ADD, OPP_EVENT_ENABLE, OPP_EVENT_DISABLE,
-};
-
-#if defined(CONFIG_PM_OPP)
-
-unsigned long opp_get_voltage(struct opp *opp);
-
-unsigned long opp_get_freq(struct opp *opp);
-
-int opp_get_opp_count(struct device *dev);
-
-struct opp *opp_find_freq_exact(struct device *dev, unsigned long freq,
-                                bool available);
-
-struct opp *opp_find_freq_floor(struct device *dev, unsigned long *freq);
-
-struct opp *opp_find_freq_ceil(struct device *dev, unsigned long *freq);
-
-int opp_add(struct device *dev, unsigned long freq, unsigned long u_volt);
-
-int opp_enable(struct device *dev, unsigned long freq);
-
-int opp_disable(struct device *dev, unsigned long freq);
-
-struct srcu_notifier_head *opp_get_notifier(struct device *dev);
-#else
-static inline unsigned long opp_get_voltage(struct opp *opp)
-{
-        return 0;
-}
-
-static inline unsigned long opp_get_freq(struct opp *opp)
-{
-        return 0;
-}
-
-static inline int opp_get_opp_count(struct device *dev)
-{
-        return 0;
-}
-
-static inline struct opp *opp_find_freq_exact(struct device *dev,
-                                        unsigned long freq, bool available)
-{
-        return ERR_PTR(-EINVAL);
-}
-
-static inline struct opp *opp_find_freq_floor(struct device *dev,
-                                        unsigned long *freq)
-{
-        return ERR_PTR(-EINVAL);
-}
-
-static inline struct opp *opp_find_freq_ceil(struct device *dev,
-                                        unsigned long *freq)
-{
-        return ERR_PTR(-EINVAL);
-}
-
-static inline int opp_add(struct device *dev, unsigned long freq,
-                                        unsigned long u_volt)
-{
-        return -EINVAL;
-}
-
-static inline int opp_enable(struct device *dev, unsigned long freq)
-{
-        return 0;
-}
-
-static inline int opp_disable(struct device *dev, unsigned long freq)
-{
-        return 0;
-}
-
-static inline struct srcu_notifier_head *opp_get_notifier(struct device *dev)
-{
-        return ERR_PTR(-EINVAL);
-}
-#endif          /* CONFIG_PM_OPP */
-
-#if defined(CONFIG_PM_OPP) && defined(CONFIG_OF)
-int of_init_opp_table(struct device *dev);
-#else
-static inline int of_init_opp_table(struct device *dev)
-{
-        return -EINVAL;
-}
-#endif
-
-#if defined(CONFIG_CPU_FREQ) && defined(CONFIG_PM_OPP)
-int opp_init_cpufreq_table(struct device *dev,
-                            struct cpufreq_frequency_table **table);
-void opp_free_cpufreq_table(struct device *dev,
-                                struct cpufreq_frequency_table **table);
-#else
-static inline int opp_init_cpufreq_table(struct device *dev,
-                            struct cpufreq_frequency_table **table)
-{
-        return -EINVAL;
-}
-
-static inline
-void opp_free_cpufreq_table(struct device *dev,
-                                struct cpufreq_frequency_table **table)
-{
-}
-#endif          /* CONFIG_CPU_FREQ */
-
-#endif          /* __LINUX_OPP_H__ */
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 866e85c5eb94..c8ba627c1d60 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -294,9 +294,31 @@ struct ring_buffer;
  */
 struct perf_event {
 #ifdef CONFIG_PERF_EVENTS
-        struct list_head                group_entry;
+        /*
+         * entry onto perf_event_context::event_list;
+         *   modifications require ctx->lock
+         *   RCU safe iterations.
+         */
         struct list_head                event_entry;
+
+        /*
+         * XXX: group_entry and sibling_list should be mutually exclusive;
+         * either you're a sibling on a group, or you're the group leader.
+         * Rework the code to always use the same list element.
+         *
+         * Locked for modification by both ctx->mutex and ctx->lock; holding
+         * either sufficies for read.
+         */
+        struct list_head                group_entry;
         struct list_head                sibling_list;
+
+        /*
+         * We need storage to track the entries in perf_pmu_migrate_context; we
+         * cannot use the event_entry because of RCU and we want to keep the
+         * group in tact which avoids us using the other two entries.
+         */
+        struct list_head                migrate_entry;
+
         struct hlist_node               hlist_entry;
         int                             nr_siblings;
         int                             group_flags;
diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
new file mode 100644
index 000000000000..5151b0059585
--- /dev/null
+++ b/include/linux/pm_opp.h
@@ -0,0 +1,139 @@
+/*
+ * Generic OPP Interface
+ *
+ * Copyright (C) 2009-2010 Texas Instruments Incorporated.
+ *      Nishanth Menon
+ *      Romit Dasgupta
+ *      Kevin Hilman
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __LINUX_OPP_H__
+#define __LINUX_OPP_H__
+
+#include <linux/err.h>
+#include <linux/cpufreq.h>
+#include <linux/notifier.h>
+
+struct dev_pm_opp;
+struct device;
+
+enum dev_pm_opp_event {
+        OPP_EVENT_ADD, OPP_EVENT_ENABLE, OPP_EVENT_DISABLE,
+};
+
+#if defined(CONFIG_PM_OPP)
+
+unsigned long dev_pm_opp_get_voltage(struct dev_pm_opp *opp);
+
+unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp);
+
+int dev_pm_opp_get_opp_count(struct device *dev);
+
+struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+                                              unsigned long freq,
+                                              bool available);
+
+struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+                                              unsigned long *freq);
+
+struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+                                             unsigned long *freq);
+
+int dev_pm_opp_add(struct device *dev, unsigned long freq,
+                   unsigned long u_volt);
+
+int dev_pm_opp_enable(struct device *dev, unsigned long freq);
+
+int dev_pm_opp_disable(struct device *dev, unsigned long freq);
+
+struct srcu_notifier_head *dev_pm_opp_get_notifier(struct device *dev);
+#else
+static inline unsigned long dev_pm_opp_get_voltage(struct dev_pm_opp *opp)
+{
+        return 0;
+}
+
+static inline unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
+{
+        return 0;
+}
+
+static inline int dev_pm_opp_get_opp_count(struct device *dev)
+{
+        return 0;
+}
+
+static inline struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+                                        unsigned long freq, bool available)
+{
+        return ERR_PTR(-EINVAL);
+}
+
+static inline struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+                                        unsigned long *freq)
+{
+        return ERR_PTR(-EINVAL);
+}
+
+static inline struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+                                        unsigned long *freq)
+{
+        return ERR_PTR(-EINVAL);
+}
+
+static inline int dev_pm_opp_add(struct device *dev, unsigned long freq,
+                                        unsigned long u_volt)
+{
+        return -EINVAL;
+}
+
+static inline int dev_pm_opp_enable(struct device *dev, unsigned long freq)
+{
+        return 0;
+}
+
+static inline int dev_pm_opp_disable(struct device *dev, unsigned long freq)
+{
+        return 0;
+}
+
+static inline struct srcu_notifier_head *dev_pm_opp_get_notifier(
+                                                        struct device *dev)
+{
+        return ERR_PTR(-EINVAL);
+}
+#endif          /* CONFIG_PM_OPP */
+
+#if defined(CONFIG_PM_OPP) && defined(CONFIG_OF)
+int of_init_opp_table(struct device *dev);
+#else
+static inline int of_init_opp_table(struct device *dev)
+{
+        return -EINVAL;
+}
+#endif
+
+#if defined(CONFIG_CPU_FREQ) && defined(CONFIG_PM_OPP)
+int dev_pm_opp_init_cpufreq_table(struct device *dev,
+                            struct cpufreq_frequency_table **table);
+void dev_pm_opp_free_cpufreq_table(struct device *dev,
+                                struct cpufreq_frequency_table **table);
+#else
+static inline int dev_pm_opp_init_cpufreq_table(struct device *dev,
+                            struct cpufreq_frequency_table **table)
+{
+        return -EINVAL;
+}
+
+static inline
+void dev_pm_opp_free_cpufreq_table(struct device *dev,
+                                struct cpufreq_frequency_table **table)
+{
+}
+#endif          /* CONFIG_CPU_FREQ */
+
+#endif          /* __LINUX_OPP_H__ */
diff --git a/include/linux/powercap.h b/include/linux/powercap.h
new file mode 100644
index 000000000000..4e250417ee30
--- /dev/null
+++ b/include/linux/powercap.h
@@ -0,0 +1,325 @@
+/*
+ * powercap.h: Data types and headers for sysfs power capping interface
+ * Copyright (c) 2013, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.
+ *
+ */
+
+#ifndef __POWERCAP_H__
+#define __POWERCAP_H__
+
+#include <linux/device.h>
+#include <linux/idr.h>
+
+/*
+ * A power cap class device can contain multiple powercap control_types.
+ * Each control_type can have multiple power zones, which can be independently
+ * controlled. Each power zone can have one or more constraints.
+ */
+
+struct powercap_control_type;
+struct powercap_zone;
+struct powercap_zone_constraint;
+
+/**
+ * struct powercap_control_type_ops - Define control type callbacks
+ * @set_enable:         Enable/Disable whole control type.
+ *                      Default is enabled. But this callback allows all zones
+ *                      to be in disable state and remove any applied power
+ *                      limits. If disabled power zone can only be monitored
+ *                      not controlled.
+ * @get_enable:         get Enable/Disable status.
+ * @release:            Callback to inform that last reference to this
+ *                      control type is closed. So it is safe to free data
+ *                      structure associated with this control type.
+ *                      This callback is mandatory if the client own memory
+ *                      for the control type.
+ *
+ * This structure defines control type callbacks to be implemented by client
+ * drivers
+ */
+struct powercap_control_type_ops {
+        int (*set_enable) (struct powercap_control_type *, bool mode);
+        int (*get_enable) (struct powercap_control_type *, bool *mode);
+        int (*release) (struct powercap_control_type *);
+};
+
+/**
+ * struct powercap_control_type- Defines a powercap control_type
+ * @name:               name of control_type
+ * @dev:                device for this control_type
+ * @idr:                idr to have unique id for its child
+ * @root_node:          Root holding power zones for this control_type
+ * @ops:                Pointer to callback struct
+ * @node_lock:          mutex for control type
+ * @allocated:          This is possible that client owns the memory
+ *                      used by this structure. In this case
+ *                      this flag is set to false by framework to
+ *                      prevent deallocation during release process.
+ *                      Otherwise this flag is set to true.
+ * @ctrl_inst:          link to the control_type list
+ *
+ * Defines powercap control_type. This acts as a container for power
+ * zones, which use same method to control power. E.g. RAPL, RAPL-PCI etc.
+ * All fields are private and should not be used by client drivers.
+ */
+struct powercap_control_type {
+        struct device dev;
+        struct idr idr;
+        int nr_zones;
+        const struct powercap_control_type_ops *ops;
+        struct mutex lock;
+        bool allocated;
+        struct list_head node;
+};
+
+/**
+ * struct powercap_zone_ops - Define power zone callbacks
+ * @get_max_energy_range_uj:    Get maximum range of energy counter in
+ *                              micro-joules.
+ * @get_energy_uj:              Get current energy counter in micro-joules.
+ * @reset_energy_uj:            Reset micro-joules energy counter.
+ * @get_max_power_range_uw:     Get maximum range of power counter in
+ *                              micro-watts.
+ * @get_power_uw:               Get current power counter in micro-watts.
+ * @set_enable:                 Enable/Disable power zone controls.
+ *                              Default is enabled.
+ * @get_enable:                 get Enable/Disable status.
+ * @release:                    Callback to inform that last reference to this
+ *                              control type is closed. So it is safe to free
+ *                              data structure associated with this
+ *                              control type. Mandatory, if client driver owns
+ *                              the power_zone memory.
+ *
+ * This structure defines zone callbacks to be implemented by client drivers.
+ * Client drives can define both energy and power related callbacks. But at
+ * the least one type (either power or energy) is mandatory. Client drivers
+ * should handle mutual exclusion, if required in callbacks.
+ */
+struct powercap_zone_ops {
+        int (*get_max_energy_range_uj) (struct powercap_zone *, u64 *);
+        int (*get_energy_uj) (struct powercap_zone *, u64 *);
+        int (*reset_energy_uj) (struct powercap_zone *);
+        int (*get_max_power_range_uw) (struct powercap_zone *, u64 *);
+        int (*get_power_uw) (struct powercap_zone *, u64 *);
+        int (*set_enable) (struct powercap_zone *, bool mode);
+        int (*get_enable) (struct powercap_zone *, bool *mode);
+        int (*release) (struct powercap_zone *);
+};
+
+#define POWERCAP_ZONE_MAX_ATTRS         6
+#define POWERCAP_CONSTRAINTS_ATTRS      8
+#define MAX_CONSTRAINTS_PER_ZONE        10
+/**
+ * struct powercap_zone- Defines instance of a power cap zone
+ * @id:                 Unique id
+ * @name:               Power zone name.
+ * @control_type_inst:  Control type instance for this zone.
+ * @ops:                Pointer to the zone operation structure.
+ * @dev:                Instance of a device.
+ * @const_id_cnt:       Number of constraint defined.
+ * @idr:                Instance to an idr entry for children zones.
+ * @parent_idr:         To remove reference from the parent idr.
+ * @private_data:       Private data pointer if any for this zone.
+ * @zone_dev_attrs:     Attributes associated with this device.
+ * @zone_attr_count:    Attribute count.
+ * @dev_zone_attr_group: Attribute group for attributes.
+ * @dev_attr_groups:    Attribute group store to register with device.
+ * @allocated:          This is possible that client owns the memory
+ *                      used by this structure. In this case
+ *                      this flag is set to false by framework to
+ *                      prevent deallocation during release process.
+ *                      Otherwise this flag is set to true.
+ * @constraint_ptr:     List of constraints for this zone.
+ *
+ * This defines a power zone instance. The fields of this structure are
+ * private, and should not be used by client drivers.
+ */
+struct powercap_zone {
+        int id;
+        char *name;
+        void *control_type_inst;
+        const struct powercap_zone_ops *ops;
+        struct device dev;
+        int const_id_cnt;
+        struct idr idr;
+        struct idr *parent_idr;
+        void *private_data;
+        struct attribute **zone_dev_attrs;
+        int zone_attr_count;
+        struct attribute_group dev_zone_attr_group;
+        const struct attribute_group *dev_attr_groups[2]; /* 1 group + NULL */
+        bool allocated;
+        struct powercap_zone_constraint *constraints;
+};
+
+/**
+ * struct powercap_zone_constraint_ops - Define constraint callbacks
+ * @set_power_limit_uw:         Set power limit in micro-watts.
+ * @get_power_limit_uw:         Get power limit in micro-watts.
+ * @set_time_window_us:         Set time window in micro-seconds.
+ * @get_time_window_us:         Get time window in micro-seconds.
+ * @get_max_power_uw:           Get max power allowed in micro-watts.
+ * @get_min_power_uw:           Get min power allowed in micro-watts.
+ * @get_max_time_window_us:     Get max time window allowed in micro-seconds.
+ * @get_min_time_window_us:     Get min time window allowed in micro-seconds.
+ * @get_name:                   Get the name of constraint
+ *
+ * This structure is used to define the constraint callbacks for the client
+ * drivers. The following callbacks are mandatory and can't be NULL:
+ *  set_power_limit_uw
+ *  get_power_limit_uw
+ *  set_time_window_us
+ *  get_time_window_us
+ *  get_name
+ *  Client drivers should handle mutual exclusion, if required in callbacks.
+ */
+struct powercap_zone_constraint_ops {
+        int (*set_power_limit_uw) (struct powercap_zone *, int, u64);
+        int (*get_power_limit_uw) (struct powercap_zone *, int, u64 *);
+        int (*set_time_window_us) (struct powercap_zone *, int, u64);
+        int (*get_time_window_us) (struct powercap_zone *, int, u64 *);
+        int (*get_max_power_uw) (struct powercap_zone *, int, u64 *);
+        int (*get_min_power_uw) (struct powercap_zone *, int, u64 *);
+        int (*get_max_time_window_us) (struct powercap_zone *, int, u64 *);
+        int (*get_min_time_window_us) (struct powercap_zone *, int, u64 *);
+        const char *(*get_name) (struct powercap_zone *, int);
+};
+
+/**
+ * struct powercap_zone_constraint- Defines instance of a constraint
+ * @id:                 Instance Id of this constraint.
+ * @power_zone:         Pointer to the power zone for this constraint.
+ * @ops:                Pointer to the constraint callbacks.
+ *
+ * This defines a constraint instance.
+ */
+struct powercap_zone_constraint {
+        int id;
+        struct powercap_zone *power_zone;
+        struct powercap_zone_constraint_ops *ops;
+};
+
+
+/* For clients to get their device pointer, may be used for dev_dbgs */
+#define POWERCAP_GET_DEV(power_zone)    (&power_zone->dev)
+
+/**
+* powercap_set_zone_data() - Set private data for a zone
+* @power_zone:  A pointer to the valid zone instance.
+* @pdata:       A pointer to the user private data.
+*
+* Allows client drivers to associate some private data to zone instance.
+*/
+static inline void powercap_set_zone_data(struct powercap_zone *power_zone,
+                                                void *pdata)
+{
+        if (power_zone)
+                power_zone->private_data = pdata;
+}
+
+/**
+* powercap_get_zone_data() - Get private data for a zone
+* @power_zone:  A pointer to the valid zone instance.
+*
+* Allows client drivers to get private data associate with a zone,
+* using call to powercap_set_zone_data.
+*/
+static inline void *powercap_get_zone_data(struct powercap_zone *power_zone)
+{
+        if (power_zone)
+                return power_zone->private_data;
+        return NULL;
+}
+
+/**
+* powercap_register_control_type() - Register a control_type with framework
+* @control_type:        Pointer to client allocated memory for the control type
+*                       structure storage. If this is NULL, powercap framework
+*                       will allocate memory and own it.
+*                       Advantage of this parameter is that client can embed
+*                       this data in its data structures and allocate in a
+*                       single call, preventing multiple allocations.
+* @control_type_name:   The Name of this control_type, which will be shown
+*                       in the sysfs Interface.
+* @ops:                 Callbacks for control type. This parameter is optional.
+*
+* Used to create a control_type with the power capping class. Here control_type
+* can represent a type of technology, which can control a range of power zones.
+* For example a control_type can be RAPL (Running Average Power Limit)
+* Intel® 64 and IA-32 Processor Architectures. The name can be any string
+* which must be unique, otherwise this function returns NULL.
+* A pointer to the control_type instance is returned on success.
+*/
+struct powercap_control_type *powercap_register_control_type(
+                                struct powercap_control_type *control_type,
+                                const char *name,
+                                const struct powercap_control_type_ops *ops);
+
+/**
+* powercap_unregister_control_type() - Unregister a control_type from framework
+* @instance:    A pointer to the valid control_type instance.
+*
+* Used to unregister a control_type with the power capping class.
+* All power zones registered under this control type have to be unregistered
+* before calling this function, or it will fail with an error code.
+*/
+int powercap_unregister_control_type(struct powercap_control_type *instance);
+
+/* Zone register/unregister API */
+
+/**
+* powercap_register_zone() - Register a power zone
+* @power_zone:  Pointer to client allocated memory for the power zone structure
+*               storage. If this is NULL, powercap framework will allocate
+*               memory and own it. Advantage of this parameter is that client
+*               can embed this data in its data structures and allocate in a
+*               single call, preventing multiple allocations.
+* @control_type: A control_type instance under which this zone operates.
+* @name:        A name for this zone.
+* @parent:      A pointer to the parent power zone instance if any or NULL
+* @ops:         Pointer to zone operation callback structure.
+* @no_constraints: Number of constraints for this zone
+* @const_ops:   Pointer to constraint callback structure
+*
+* Register a power zone under a given control type. A power zone must register
+* a pointer to a structure representing zone callbacks.
+* A power zone can be located under a parent power zone, in which case @parent
+* should point to it.  Otherwise, if @parent is NULL, the new power zone will
+* be located directly under the given control type
+* For each power zone there may be a number of constraints that appear in the
+* sysfs under that zone as attributes with unique numeric IDs.
+* Returns pointer to the power_zone on success.
+*/
+struct powercap_zone *powercap_register_zone(
+                        struct powercap_zone *power_zone,
+                        struct powercap_control_type *control_type,
+                        const char *name,
+                        struct powercap_zone *parent,
+                        const struct powercap_zone_ops *ops,
+                        int nr_constraints,
+                        struct powercap_zone_constraint_ops *const_ops);
+
+/**
+* powercap_unregister_zone() - Unregister a zone device
+* @control_type:        A pointer to the valid instance of a control_type.
+* @power_zone:  A pointer to the valid zone instance for a control_type
+*
+* Used to unregister a zone device for a control_type.  Caller should
+* make sure that children for this zone are unregistered first.
+*/
+int powercap_unregister_zone(struct powercap_control_type *control_type,
+                                struct powercap_zone *power_zone);
+
+#endif
diff --git a/include/linux/random.h b/include/linux/random.h
index 3b9377d6b7a5..6312dd9ba449 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -17,6 +17,7 @@ extern void add_interrupt_randomness(int irq, int irq_flags);
 extern void get_random_bytes(void *buf, int nbytes);
 extern void get_random_bytes_arch(void *buf, int nbytes);
 void generate_random_uuid(unsigned char uuid_out[16]);
+extern int random_int_secret_init(void);
 
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index 67e13aa5a478..9bdad43ad228 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -40,6 +40,8 @@ enum regulator_status {
 };
 
 /**
+ * struct regulator_linear_range - specify linear voltage ranges
+ *
  * Specify a range of voltages for regulator_map_linar_range() and
  * regulator_list_linear_range().
  *
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6682da36b293..e27baeeda3f4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1394,11 +1394,10 @@ struct task_struct {
         } memcg_batch;
         unsigned int memcg_kmem_skip_account;
         struct memcg_oom_info {
+                struct mem_cgroup *memcg;
+                gfp_t gfp_mask;
+                int order;
                 unsigned int may_oom:1;
-                unsigned int in_memcg_oom:1;
-                unsigned int oom_locked:1;
-                int wakeups;
-                struct mem_cgroup *wait_on_memcg;
         } memcg_oom;
 #endif
 #ifdef CONFIG_UPROBES
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2ddb48d9312c..c2d89335f637 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -498,7 +498,7 @@ struct sk_buff {
          * headers if needed
          */
         __u8                    encapsulation:1;
-        /* 7/9 bit hole (depending on ndisc_nodetype presence) */
+        /* 6/8 bit hole (depending on ndisc_nodetype presence) */
         kmemcheck_bitfield_end(flags2);
 
 #if defined CONFIG_NET_DMA || defined CONFIG_NET_RX_BUSY_POLL
diff --git a/include/linux/smp.h b/include/linux/smp.h
index cfb7ca094b38..731f5237d5f4 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -155,6 +155,12 @@ smp_call_function_any(const struct cpumask *mask, smp_call_func_t func,
 
 static inline void kick_all_cpus_sync(void) {  }
 
+static inline void __smp_call_function_single(int cpuid,
+                struct call_single_data *data, int wait)
+{
+        on_each_cpu(data->func, data->info, wait);
+}
+
 #endif /* !SMP */
 
 /*
diff --git a/include/linux/timex.h b/include/linux/timex.h
index dd3edd7dfc94..9d3f1a5b6178 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -64,6 +64,20 @@
 
 #include <asm/timex.h>
 
+#ifndef random_get_entropy
+/*
+ * The random_get_entropy() function is used by the /dev/random driver
+ * in order to extract entropy via the relative unpredictability of
+ * when an interrupt takes places versus a high speed, fine-grained
+ * timing source or cycle counter.  Since it will be occurred on every
+ * single interrupt, it must have a very low cost/overhead.
+ *
+ * By default we use get_cycles() for this purpose, but individual
+ * architectures may override this in their asm/timex.h header file.
+ */
+#define random_get_entropy()    get_cycles()
+#endif
+
 /*
  * SHIFT_PLL is used as a dampening factor to define how much we
  * adjust the frequency correction for a given offset in PLL mode.
diff --git a/include/linux/usb/usb_phy_gen_xceiv.h b/include/linux/usb/usb_phy_gen_xceiv.h
index f9a7e7bc925b..11d85b9c1b08 100644
--- a/include/linux/usb/usb_phy_gen_xceiv.h
+++ b/include/linux/usb/usb_phy_gen_xceiv.h
@@ -12,7 +12,7 @@ struct usb_phy_gen_xceiv_platform_data {
         unsigned int needs_reset:1;
 };
 
-#if IS_ENABLED(CONFIG_NOP_USB_XCEIV)
+#if defined(CONFIG_NOP_USB_XCEIV) || (defined(CONFIG_NOP_USB_XCEIV_MODULE) && defined(MODULE))
 /* sometimes transceivers are accessed only through e.g. ULPI */
 extern void usb_nop_xceiv_register(void);
 extern void usb_nop_xceiv_unregister(void);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 9cb2fe8ca944..e303eef94dd5 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -42,6 +42,7 @@ struct usbnet {
         struct usb_host_endpoint *status;
         unsigned                maxpacket;
         struct timer_list       delay;
+        const char              *padding_pkt;
 
         /* protocol/interface state */
         struct net_device       *net;
diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
index bf99cd01be20..630356866030 100644
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -66,7 +66,9 @@
         US_FLAG(INITIAL_READ10, 0x00100000)                     \
                 /* Initial READ(10) (and others) must be retried */     \
         US_FLAG(WRITE_CACHE,    0x00200000)                     \
-                /* Write Cache status is not available */
+                /* Write Cache status is not available */       \
+        US_FLAG(NEEDS_CAP16,    0x00400000)
+                /* cannot handle READ_CAPACITY_10 */
 
 #define US_FLAG(name, value)    US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index 80cf8173a65b..2c02f3a8d2ba 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -65,15 +65,8 @@ struct pci_dev;
  *     out of the arbitration process (and can be safe to take
  *     interrupts at any time.
  */
-#if defined(CONFIG_VGA_ARB)
 extern void vga_set_legacy_decoding(struct pci_dev *pdev,
                                     unsigned int decodes);
-#else
-static inline void vga_set_legacy_decoding(struct pci_dev *pdev,
-                                           unsigned int decodes)
-{
-}
-#endif
 
 /**
  *     vga_get         - acquire & locks VGA resources
diff --git a/include/linux/yam.h b/include/linux/yam.h
index 7fe28228b274..512cdc2fb80f 100644
--- a/include/linux/yam.h
+++ b/include/linux/yam.h
@@ -77,6 +77,6 @@ struct yamdrv_ioctl_cfg {
 
 struct yamdrv_ioctl_mcs {
         int cmd;
-        int bitrate;
+        unsigned int bitrate;
         unsigned char bits[YAM_FPGA_SIZE];
 };
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index fb314de2b61b..86505bfa5d2c 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -67,6 +67,10 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
 #endif
 
+bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
+                                   const unsigned int prefix_len,
+                                   struct net_device *dev);
+
 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev);
 
 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net,
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index aaeaf0938ec0..15f10841e2b5 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -104,6 +104,7 @@ enum {
 enum {
         HCI_SETUP,
         HCI_AUTO_OFF,
+        HCI_RFKILLED,
         HCI_MGMT,
         HCI_PAIRABLE,
         HCI_SERVICE_CACHE,
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index a7a683e30b64..a8c2ef6d3b93 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
         unsigned char err_offset = 0;
         u8 opt_len = opt[1];
         u8 opt_iter;
+        u8 tag_len;
 
         if (opt_len < 8) {
                 err_offset = 1;
@@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
         }
 
         for (opt_iter = 6; opt_iter < opt_len;) {
-                if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
+                tag_len = opt[opt_iter + 1];
+                if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
                         err_offset = opt_iter + 1;
                         goto out;
                 }
-                opt_iter += opt[opt_iter + 1];
+                opt_iter += tag_len;
         }
 
 out:
diff --git a/include/net/dst.h b/include/net/dst.h
index 3bc4865f8267..3c4c944096c9 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -479,10 +479,22 @@ static inline struct dst_entry *xfrm_lookup(struct net *net,
 {
         return dst_orig;
 } 
+
+static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
+{
+        return NULL;
+}
+
 #else
 extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                                      const struct flowi *fl, struct sock *sk,
                                      int flags);
+
+/* skb attached with this dst needs transformation if dst->xfrm is valid */
+static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
+{
+        return dst->xfrm;
+}
 #endif
 
 #endif /* _NET_DST_H */
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index f525e7038cca..2b786b7e3585 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -194,11 +194,9 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
                skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
 }
 
-static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt, struct in6_addr *dest)
+static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt)
 {
-        if (rt->rt6i_flags & RTF_GATEWAY)
-                return &rt->rt6i_gateway;
-        return dest;
+        return &rt->rt6i_gateway;
 }
 
 #endif
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index f0d70f066f3d..9c4d37ec45a1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -723,8 +723,6 @@ struct ip_vs_dest_dst {
         struct rcu_head         rcu_head;
 };
 
-/* In grace period after removing */
-#define IP_VS_DEST_STATE_REMOVING       0x01
 /*
  *      The real server destination forwarding entry
  *      with ip address, port number, and so on.
@@ -742,7 +740,7 @@ struct ip_vs_dest {
 
         atomic_t                refcnt;         /* reference counter */
         struct ip_vs_stats      stats;          /* statistics */
-        unsigned long           state;          /* state flags */
+        unsigned long           idle_start;     /* start time, jiffies */
 
         /* connection counters and thresholds */
         atomic_t                activeconns;    /* active connections */
@@ -756,14 +754,13 @@ struct ip_vs_dest {
         struct ip_vs_dest_dst __rcu *dest_dst;  /* cached dst info */
 
         /* for virtual service */
-        struct ip_vs_service    *svc;           /* service it belongs to */
+        struct ip_vs_service __rcu *svc;        /* service it belongs to */
         __u16                   protocol;       /* which protocol (TCP/UDP) */
         __be16                  vport;          /* virtual port number */
         union nf_inet_addr      vaddr;          /* virtual IP address */
         __u32                   vfwmark;        /* firewall mark of service */
 
         struct list_head        t_list;         /* in dest_trash */
-        struct rcu_head         rcu_head;
         unsigned int            in_rs_table:1;  /* we are in rs_table */
 };
 
@@ -1649,7 +1646,7 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
 /* CONFIG_IP_VS_NFCT */
 #endif
 
-static inline unsigned int
+static inline int
 ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
 {
         /*
diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index d0d11df9cba1..807d6b7a943f 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -133,7 +133,7 @@ struct ieee802154_ops {
 
 /* Basic interface to register ieee802154 device */
 struct ieee802154_dev *
-ieee802154_alloc_device(size_t priv_data_lex, struct ieee802154_ops *ops);
+ieee802154_alloc_device(size_t priv_data_len, struct ieee802154_ops *ops);
 void ieee802154_free_device(struct ieee802154_dev *dev);
 int ieee802154_register_device(struct ieee802154_dev *dev);
 void ieee802154_unregister_device(struct ieee802154_dev *dev);
diff --git a/include/net/mrp.h b/include/net/mrp.h
index 4fbf02aa2ec1..0f7558b638ae 100644
--- a/include/net/mrp.h
+++ b/include/net/mrp.h
@@ -112,6 +112,7 @@ struct mrp_applicant {
         struct mrp_application  *app;
         struct net_device       *dev;
         struct timer_list       join_timer;
+        struct timer_list       periodic_timer;
 
         spinlock_t              lock;
         struct sk_buff_head     queue;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 1313456a0994..9d22f08896c6 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -74,6 +74,7 @@ struct net {
         struct hlist_head       *dev_index_head;
         unsigned int            dev_base_seq;   /* protected by rtnl_mutex */
         int                     ifindex;
+        unsigned int            dev_unreg_count;
 
         /* core fib_rules */
         struct list_head        rules_ops;
diff --git a/include/net/netfilter/nf_conntrack_synproxy.h b/include/net/netfilter/nf_conntrack_synproxy.h
index 806f54a290d6..f572f313d6f1 100644
--- a/include/net/netfilter/nf_conntrack_synproxy.h
+++ b/include/net/netfilter/nf_conntrack_synproxy.h
@@ -56,7 +56,7 @@ struct synproxy_options {
 
 struct tcphdr;
 struct xt_synproxy_info;
-extern void synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
+extern bool synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                                    const struct tcphdr *th,
                                    struct synproxy_options *opts);
 extern unsigned int synproxy_options_size(const struct synproxy_options *opts);
diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
index 6ca975bebd37..c2e542b27a5a 100644
--- a/include/net/secure_seq.h
+++ b/include/net/secure_seq.h
@@ -3,7 +3,6 @@
 
 #include <linux/types.h>
 
-extern void net_secret_init(void);
 extern __u32 secure_ip_id(__be32 daddr);
 extern __u32 secure_ipv6_id(const __be32 daddr[4]);
 extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
diff --git a/include/net/sock.h b/include/net/sock.h
index 6ba2e7b0e2b1..808cbc2ec6c1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -409,6 +409,11 @@ struct sock {
         void                    (*sk_destruct)(struct sock *sk);
 };
 
+#define __sk_user_data(sk) ((*((void __rcu **)&(sk)->sk_user_data)))
+
+#define rcu_dereference_sk_user_data(sk)        rcu_dereference(__sk_user_data((sk)))
+#define rcu_assign_sk_user_data(sk, ptr)        rcu_assign_pointer(__sk_user_data((sk)), ptr)
+
 /*
  * SK_CAN_REUSE and SK_NO_REUSE on a socket mean that the socket is OK
  * or not whether his port will be reused by someone else. SK_FORCE_REUSE
@@ -1625,16 +1630,14 @@ static inline void sk_filter_release(struct sk_filter *fp)
 
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
 {
-        unsigned int size = sk_filter_len(fp);
-
-        atomic_sub(size, &sk->sk_omem_alloc);
+        atomic_sub(sk_filter_size(fp->len), &sk->sk_omem_alloc);
         sk_filter_release(fp);
 }
 
 static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 {
         atomic_inc(&fp->refcnt);
-        atomic_add(sk_filter_len(fp), &sk->sk_omem_alloc);
+        atomic_add(sk_filter_size(fp->len), &sk->sk_omem_alloc);
 }
 
 /*
diff --git a/include/sound/rcar_snd.h b/include/sound/rcar_snd.h
index fe66533e9b7a..fb0a312bcb81 100644
--- a/include/sound/rcar_snd.h
+++ b/include/sound/rcar_snd.h
@@ -68,6 +68,7 @@ struct rsnd_scu_platform_info {
  *
  * A : generation
  */
+#define RSND_GEN_MASK   (0xF << 0)
 #define RSND_GEN1       (1 << 0) /* fixme */
 #define RSND_GEN2       (2 << 0) /* fixme */
 
diff --git a/include/trace/events/target.h b/include/trace/events/target.h
index aef8fc354025..da9cc0f05c93 100644
--- a/include/trace/events/target.h
+++ b/include/trace/events/target.h
@@ -144,7 +144,7 @@ TRACE_EVENT(target_sequencer_start,
         ),
 
         TP_fast_assign(
-                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->unpacked_lun   = cmd->orig_fe_lun;
                 __entry->opcode         = cmd->t_task_cdb[0];
                 __entry->data_length    = cmd->data_length;
                 __entry->task_attribute = cmd->sam_task_attr;
@@ -182,7 +182,7 @@ TRACE_EVENT(target_cmd_complete,
         ),
 
         TP_fast_assign(
-                __entry->unpacked_lun   = cmd->se_lun->unpacked_lun;
+                __entry->unpacked_lun   = cmd->orig_fe_lun;
                 __entry->opcode         = cmd->t_task_cdb[0];
                 __entry->data_length    = cmd->data_length;
                 __entry->task_attribute = cmd->sam_task_attr;
diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
index 550811712f78..28acbaf4a81e 100644
--- a/include/uapi/drm/drm_mode.h
+++ b/include/uapi/drm/drm_mode.h
@@ -223,6 +223,8 @@ struct drm_mode_get_connector {
         __u32 connection;
         __u32 mm_width, mm_height; /**< HxW in millimeters */
         __u32 subpixel;
+
+        __u32 pad;
 };
 
 #define DRM_MODE_PROP_PENDING   (1<<0)
diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
index fa8b3adf9ffb..46d41e8b0dcc 100644
--- a/include/uapi/drm/radeon_drm.h
+++ b/include/uapi/drm/radeon_drm.h
@@ -1007,4 +1007,6 @@ struct drm_radeon_info {
 #define SI_TILE_MODE_DEPTH_STENCIL_2D_4AA       3
 #define SI_TILE_MODE_DEPTH_STENCIL_2D_8AA       2
 
+#define CIK_TILE_MODE_DEPTH_STENCIL_1D          5
+
 #endif
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index 40a1fb807396..009a655a5d35 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -380,10 +380,13 @@ struct perf_event_mmap_page {
         union {
                 __u64   capabilities;
                 struct {
-                        __u64   cap_usr_time            : 1,
-                                cap_usr_rdpmc           : 1,
-                                cap_usr_time_zero       : 1,
-                                cap_____res             : 61;
+                        __u64   cap_bit0                : 1, /* Always 0, deprecated, see commit 860f085b74e9 */
+                                cap_bit0_is_deprecated  : 1, /* Always 1, signals that bit 0 is zero */
+
+                                cap_user_rdpmc          : 1, /* The RDPMC instruction can be used to read counts */
+                                cap_user_time           : 1, /* The time_* fields are used */
+                                cap_user_time_zero      : 1, /* The time_zero field is used */
+                                cap_____res             : 59;
                 };
         };
 
@@ -442,12 +445,13 @@ struct perf_event_mmap_page {
          *               ((rem * time_mult) >> time_shift);
          */
         __u64   time_zero;
+        __u32   size;                   /* Header size up to __reserved[] fields. */
 
                 /*
                  * Hole for extension of the self monitor capabilities
                  */
 
-        __u64   __reserved[119];        /* align to 1k */
+        __u8    __reserved[118*8+4];    /* align to 1k. */
 
         /*
          * Control data for the mmap() data buffer.
@@ -528,6 +532,7 @@ enum perf_event_type {
          *      u64                             len;
          *      u64                             pgoff;
          *      char                            filename[];
+         *      struct sample_id                sample_id;
          * };
          */
         PERF_RECORD_MMAP                        = 1,
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index 0623ec4e728f..56f121605c99 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -1,5 +1,6 @@
 # UAPI Header export list
 header-y += tc_csum.h
+header-y += tc_defact.h
 header-y += tc_gact.h
 header-y += tc_ipt.h
 header-y += tc_mirred.h
diff --git a/include/linux/tc_act/tc_defact.h b/include/uapi/linux/tc_act/tc_defact.h
index 6f65d07c7ce2..17dddb40f740 100644
--- a/include/linux/tc_act/tc_defact.h
+++ b/include/uapi/linux/tc_act/tc_defact.h
@@ -6,7 +6,7 @@
 struct tc_defact {
         tc_gen;
 };
-                                                                                
+
 enum {
         TCA_DEF_UNSPEC,
         TCA_DEF_TM,
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 0b233c56b0e4..e3ddd86c90a6 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -87,8 +87,10 @@ enum {
         IB_USER_VERBS_CMD_CLOSE_XRCD,
         IB_USER_VERBS_CMD_CREATE_XSRQ,
         IB_USER_VERBS_CMD_OPEN_QP,
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
         IB_USER_VERBS_CMD_CREATE_FLOW = IB_USER_VERBS_CMD_THRESHOLD,
         IB_USER_VERBS_CMD_DESTROY_FLOW
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 };
 
 /*
@@ -126,6 +128,7 @@ struct ib_uverbs_cmd_hdr {
         __u16 out_words;
 };
 
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 struct ib_uverbs_cmd_hdr_ex {
         __u32 command;
         __u16 in_words;
@@ -134,6 +137,7 @@ struct ib_uverbs_cmd_hdr_ex {
         __u16 provider_out_words;
         __u32 cmd_hdr_reserved;
 };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 
 struct ib_uverbs_get_context {
         __u64 response;
@@ -696,6 +700,7 @@ struct ib_uverbs_detach_mcast {
         __u64 driver_data[0];
 };
 
+#ifdef CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING
 struct ib_kern_eth_filter {
         __u8  dst_mac[6];
         __u8  src_mac[6];
@@ -780,6 +785,7 @@ struct ib_uverbs_destroy_flow  {
         __u32 comp_mask;
         __u32 flow_handle;
 };
+#endif /* CONFIG_INFINIBAND_EXPERIMENTAL_UVERBS_FLOW_STEERING */
 
 struct ib_uverbs_create_srq {
         __u64 response;
diff --git a/init/main.c b/init/main.c
index af310afbef28..63d3e8f2970c 100644
--- a/init/main.c
+++ b/init/main.c
@@ -76,6 +76,7 @@
 #include <linux/elevator.h>
 #include <linux/sched_clock.h>
 #include <linux/context_tracking.h>
+#include <linux/random.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -780,6 +781,7 @@ static void __init do_basic_setup(void)
         do_ctors();
         usermodehelper_enable();
         do_initcalls();
+        random_int_secret_init();
 }
 
 static void __init do_pre_smp_initcalls(void)
diff --git a/ipc/msg.c b/ipc/msg.c
index b0d541d42677..558aa91186b6 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -165,6 +165,15 @@ static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
         ipc_rmid(&msg_ids(ns), &s->q_perm);
 }
 
+static void msg_rcu_free(struct rcu_head *head)
+{
+        struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
+        struct msg_queue *msq = ipc_rcu_to_struct(p);
+
+        security_msg_queue_free(msq);
+        ipc_rcu_free(head);
+}
+
 /**
  * newque - Create a new msg queue
  * @ns: namespace
@@ -189,15 +198,14 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
         msq->q_perm.security = NULL;
         retval = security_msg_queue_alloc(msq);
         if (retval) {
-                ipc_rcu_putref(msq);
+                ipc_rcu_putref(msq, ipc_rcu_free);
                 return retval;
         }
 
         /* ipc_addid() locks msq upon success. */
         id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
         if (id < 0) {
-                security_msg_queue_free(msq);
-                ipc_rcu_putref(msq);
+                ipc_rcu_putref(msq, msg_rcu_free);
                 return id;
         }
 
@@ -276,8 +284,7 @@ static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
                 free_msg(msg);
         }
         atomic_sub(msq->q_cbytes, &ns->msg_bytes);
-        security_msg_queue_free(msq);
-        ipc_rcu_putref(msq);
+        ipc_rcu_putref(msq, msg_rcu_free);
 }
 
 /*
@@ -688,6 +695,12 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
                 if (ipcperms(ns, &msq->q_perm, S_IWUGO))
                         goto out_unlock0;
 
+                /* raced with RMID? */
+                if (msq->q_perm.deleted) {
+                        err = -EIDRM;
+                        goto out_unlock0;
+                }
+
                 err = security_msg_queue_msgsnd(msq, msg, msgflg);
                 if (err)
                         goto out_unlock0;
@@ -717,7 +730,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
                 rcu_read_lock();
                 ipc_lock_object(&msq->q_perm);
 
-                ipc_rcu_putref(msq);
+                ipc_rcu_putref(msq, ipc_rcu_free);
                 if (msq->q_perm.deleted) {
                         err = -EIDRM;
                         goto out_unlock0;
@@ -894,6 +907,13 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
                         goto out_unlock1;
 
                 ipc_lock_object(&msq->q_perm);
+
+                /* raced with RMID? */
+                if (msq->q_perm.deleted) {
+                        msg = ERR_PTR(-EIDRM);
+                        goto out_unlock0;
+                }
+
                 msg = find_msg(msq, &msgtyp, mode);
                 if (!IS_ERR(msg)) {
                         /*
diff --git a/ipc/sem.c b/ipc/sem.c
index 69b6a21f3844..db9d241af133 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -243,71 +243,122 @@ static void merge_queues(struct sem_array *sma)
         }
 }
 
+static void sem_rcu_free(struct rcu_head *head)
+{
+        struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
+        struct sem_array *sma = ipc_rcu_to_struct(p);
+
+        security_sem_free(sma);
+        ipc_rcu_free(head);
+}
+
+/*
+ * Wait until all currently ongoing simple ops have completed.
+ * Caller must own sem_perm.lock.
+ * New simple ops cannot start, because simple ops first check
+ * that sem_perm.lock is free.
+ * that a) sem_perm.lock is free and b) complex_count is 0.
+ */
+static void sem_wait_array(struct sem_array *sma)
+{
+        int i;
+        struct sem *sem;
+
+        if (sma->complex_count)  {
+                /* The thread that increased sma->complex_count waited on
+                 * all sem->lock locks. Thus we don't need to wait again.
+                 */
+                return;
+        }
+
+        for (i = 0; i < sma->sem_nsems; i++) {
+                sem = sma->sem_base + i;
+                spin_unlock_wait(&sem->lock);
+        }
+}
+
 /*
  * If the request contains only one semaphore operation, and there are
  * no complex transactions pending, lock only the semaphore involved.
  * Otherwise, lock the entire semaphore array, since we either have
  * multiple semaphores in our own semops, or we need to look at
  * semaphores from other pending complex operations.
- *
- * Carefully guard against sma->complex_count changing between zero
- * and non-zero while we are spinning for the lock. The value of
- * sma->complex_count cannot change while we are holding the lock,
- * so sem_unlock should be fine.
- *
- * The global lock path checks that all the local locks have been released,
- * checking each local lock once. This means that the local lock paths
- * cannot start their critical sections while the global lock is held.
  */
 static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
                               int nsops)
 {
-        int locknum;
- again:
-        if (nsops == 1 && !sma->complex_count) {
-                struct sem *sem = sma->sem_base + sops->sem_num;
+        struct sem *sem;
 
-                /* Lock just the semaphore we are interested in. */
-                spin_lock(&sem->lock);
+        if (nsops != 1) {
+                /* Complex operation - acquire a full lock */
+                ipc_lock_object(&sma->sem_perm);
 
-                /*
-                 * If sma->complex_count was set while we were spinning,
-                 * we may need to look at things we did not lock here.
+                /* And wait until all simple ops that are processed
+                 * right now have dropped their locks.
                  */
-                if (unlikely(sma->complex_count)) {
-                        spin_unlock(&sem->lock);
-                        goto lock_array;
-                }
+                sem_wait_array(sma);
+                return -1;
+        }
+
+        /*
+         * Only one semaphore affected - try to optimize locking.
+         * The rules are:
+         * - optimized locking is possible if no complex operation
+         *   is either enqueued or processed right now.
+         * - The test for enqueued complex ops is simple:
+         *      sma->complex_count != 0
+         * - Testing for complex ops that are processed right now is
+         *   a bit more difficult. Complex ops acquire the full lock
+         *   and first wait that the running simple ops have completed.
+         *   (see above)
+         *   Thus: If we own a simple lock and the global lock is free
+         *      and complex_count is now 0, then it will stay 0 and
+         *      thus just locking sem->lock is sufficient.
+         */
+        sem = sma->sem_base + sops->sem_num;
 
+        if (sma->complex_count == 0) {
                 /*
-                 * Another process is holding the global lock on the
-                 * sem_array; we cannot enter our critical section,
-                 * but have to wait for the global lock to be released.
+                 * It appears that no complex operation is around.
+                 * Acquire the per-semaphore lock.
                  */
-                if (unlikely(spin_is_locked(&sma->sem_perm.lock))) {
-                        spin_unlock(&sem->lock);
-                        spin_unlock_wait(&sma->sem_perm.lock);
-                        goto again;
+                spin_lock(&sem->lock);
+
+                /* Then check that the global lock is free */
+                if (!spin_is_locked(&sma->sem_perm.lock)) {
+                        /* spin_is_locked() is not a memory barrier */
+                        smp_mb();
+
+                        /* Now repeat the test of complex_count:
+                         * It can't change anymore until we drop sem->lock.
+                         * Thus: if is now 0, then it will stay 0.
+                         */
+                        if (sma->complex_count == 0) {
+                                /* fast path successful! */
+                                return sops->sem_num;
+                        }
                 }
+                spin_unlock(&sem->lock);
+        }
 
-                locknum = sops->sem_num;
+        /* slow path: acquire the full lock */
+        ipc_lock_object(&sma->sem_perm);
+
+        if (sma->complex_count == 0) {
+                /* False alarm:
+                 * There is no complex operation, thus we can switch
+                 * back to the fast path.
+                 */
+                spin_lock(&sem->lock);
+                ipc_unlock_object(&sma->sem_perm);
+                return sops->sem_num;
         } else {
-                int i;
-                /*
-                 * Lock the semaphore array, and wait for all of the
-                 * individual semaphore locks to go away.  The code
-                 * above ensures no new single-lock holders will enter
-                 * their critical section while the array lock is held.
+                /* Not a false alarm, thus complete the sequence for a
+                 * full lock.
                  */
- lock_array:
-                ipc_lock_object(&sma->sem_perm);
-                for (i = 0; i < sma->sem_nsems; i++) {
-                        struct sem *sem = sma->sem_base + i;
-                        spin_unlock_wait(&sem->lock);
-                }
-                locknum = -1;
+                sem_wait_array(sma);
+                return -1;
         }
-        return locknum;
 }
 
 static inline void sem_unlock(struct sem_array *sma, int locknum)
@@ -374,12 +425,7 @@ static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns
 static inline void sem_lock_and_putref(struct sem_array *sma)
 {
         sem_lock(sma, NULL, -1);
-        ipc_rcu_putref(sma);
-}
-
-static inline void sem_putref(struct sem_array *sma)
-{
-        ipc_rcu_putref(sma);
+        ipc_rcu_putref(sma, ipc_rcu_free);
 }
 
 static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s)
@@ -458,14 +504,13 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
         sma->sem_perm.security = NULL;
         retval = security_sem_alloc(sma);
         if (retval) {
-                ipc_rcu_putref(sma);
+                ipc_rcu_putref(sma, ipc_rcu_free);
                 return retval;
         }
 
         id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
         if (id < 0) {
-                security_sem_free(sma);
-                ipc_rcu_putref(sma);
+                ipc_rcu_putref(sma, sem_rcu_free);
                 return id;
         }
         ns->used_sems += nsems;
@@ -873,6 +918,24 @@ again:
 }
 
 /**
+ * set_semotime(sma, sops) - set sem_otime
+ * @sma: semaphore array
+ * @sops: operations that modified the array, may be NULL
+ *
+ * sem_otime is replicated to avoid cache line trashing.
+ * This function sets one instance to the current time.
+ */
+static void set_semotime(struct sem_array *sma, struct sembuf *sops)
+{
+        if (sops == NULL) {
+                sma->sem_base[0].sem_otime = get_seconds();
+        } else {
+                sma->sem_base[sops[0].sem_num].sem_otime =
+                                                        get_seconds();
+        }
+}
+
+/**
  * do_smart_update(sma, sops, nsops, otime, pt) - optimized update_queue
  * @sma: semaphore array
  * @sops: operations that were performed
@@ -922,17 +985,10 @@ static void do_smart_update(struct sem_array *sma, struct sembuf *sops, int nsop
                         }
                 }
         }
-        if (otime) {
-                if (sops == NULL) {
-                        sma->sem_base[0].sem_otime = get_seconds();
-                } else {
-                        sma->sem_base[sops[0].sem_num].sem_otime =
-                                                                get_seconds();
-                }
-        }
+        if (otime)
+                set_semotime(sma, sops);
 }
 
-
 /* The following counts are associated to each semaphore:
  *   semncnt        number of tasks waiting on semval being nonzero
  *   semzcnt        number of tasks waiting on semval being zero
@@ -1047,8 +1103,7 @@ static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
 
         wake_up_sem_queue_do(&tasks);
         ns->used_sems -= sma->sem_nsems;
-        security_sem_free(sma);
-        ipc_rcu_putref(sma);
+        ipc_rcu_putref(sma, sem_rcu_free);
 }
 
 static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in, int version)
@@ -1227,6 +1282,12 @@ static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum,
 
         sem_lock(sma, NULL, -1);
 
+        if (sma->sem_perm.deleted) {
+                sem_unlock(sma, -1);
+                rcu_read_unlock();
+                return -EIDRM;
+        }
+
         curr = &sma->sem_base[semnum];
 
         ipc_assert_locked_object(&sma->sem_perm);
@@ -1281,28 +1342,28 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                 int i;
 
                 sem_lock(sma, NULL, -1);
+                if (sma->sem_perm.deleted) {
+                        err = -EIDRM;
+                        goto out_unlock;
+                }
                 if(nsems > SEMMSL_FAST) {
                         if (!ipc_rcu_getref(sma)) {
-                                sem_unlock(sma, -1);
-                                rcu_read_unlock();
                                 err = -EIDRM;
-                                goto out_free;
+                                goto out_unlock;
                         }
                         sem_unlock(sma, -1);
                         rcu_read_unlock();
                         sem_io = ipc_alloc(sizeof(ushort)*nsems);
                         if(sem_io == NULL) {
-                                sem_putref(sma);
+                                ipc_rcu_putref(sma, ipc_rcu_free);
                                 return -ENOMEM;
                         }
 
                         rcu_read_lock();
                         sem_lock_and_putref(sma);
                         if (sma->sem_perm.deleted) {
-                                sem_unlock(sma, -1);
-                                rcu_read_unlock();
                                 err = -EIDRM;
-                                goto out_free;
+                                goto out_unlock;
                         }
                 }
                 for (i = 0; i < sma->sem_nsems; i++)
@@ -1320,28 +1381,28 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                 struct sem_undo *un;
 
                 if (!ipc_rcu_getref(sma)) {
-                        rcu_read_unlock();
-                        return -EIDRM;
+                        err = -EIDRM;
+                        goto out_rcu_wakeup;
                 }
                 rcu_read_unlock();
 
                 if(nsems > SEMMSL_FAST) {
                         sem_io = ipc_alloc(sizeof(ushort)*nsems);
                         if(sem_io == NULL) {
-                                sem_putref(sma);
+                                ipc_rcu_putref(sma, ipc_rcu_free);
                                 return -ENOMEM;
                         }
                 }
 
                 if (copy_from_user (sem_io, p, nsems*sizeof(ushort))) {
-                        sem_putref(sma);
+                        ipc_rcu_putref(sma, ipc_rcu_free);
                         err = -EFAULT;
                         goto out_free;
                 }
 
                 for (i = 0; i < nsems; i++) {
                         if (sem_io[i] > SEMVMX) {
-                                sem_putref(sma);
+                                ipc_rcu_putref(sma, ipc_rcu_free);
                                 err = -ERANGE;
                                 goto out_free;
                         }
@@ -1349,10 +1410,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                 rcu_read_lock();
                 sem_lock_and_putref(sma);
                 if (sma->sem_perm.deleted) {
-                        sem_unlock(sma, -1);
-                        rcu_read_unlock();
                         err = -EIDRM;
-                        goto out_free;
+                        goto out_unlock;
                 }
 
                 for (i = 0; i < nsems; i++)
@@ -1376,6 +1435,10 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                 goto out_rcu_wakeup;
 
         sem_lock(sma, NULL, -1);
+        if (sma->sem_perm.deleted) {
+                err = -EIDRM;
+                goto out_unlock;
+        }
         curr = &sma->sem_base[semnum];
 
         switch (cmd) {
@@ -1629,7 +1692,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
         /* step 2: allocate new undo structure */
         new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
         if (!new) {
-                sem_putref(sma);
+                ipc_rcu_putref(sma, ipc_rcu_free);
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -1781,6 +1844,10 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
         if (error)
                 goto out_rcu_wakeup;
 
+        error = -EIDRM;
+        locknum = sem_lock(sma, sops, nsops);
+        if (sma->sem_perm.deleted)
+                goto out_unlock_free;
         /*
          * semid identifiers are not unique - find_alloc_undo may have
          * allocated an undo structure, it was invalidated by an RMID
@@ -1788,19 +1855,22 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
          * This case can be detected checking un->semid. The existence of
          * "un" itself is guaranteed by rcu.
          */
-        error = -EIDRM;
-        locknum = sem_lock(sma, sops, nsops);
         if (un && un->semid == -1)
                 goto out_unlock_free;
 
         error = perform_atomic_semop(sma, sops, nsops, un,
                                         task_tgid_vnr(current));
-        if (error <= 0) {
-                if (alter && error == 0)
+        if (error == 0) {
+                /* If the operation was successful, then do
+                 * the required updates.
+                 */
+                if (alter)
                         do_smart_update(sma, sops, nsops, 1, &tasks);
-
-                goto out_unlock_free;
+                else
+                        set_semotime(sma, sops);
         }
+        if (error <= 0)
+                goto out_unlock_free;
 
         /* We need to sleep on this operation, so we put the current
          * task into the pending queue and go to sleep.
@@ -1997,6 +2067,12 @@ void exit_sem(struct task_struct *tsk)
                 }
 
                 sem_lock(sma, NULL, -1);
+                /* exit_sem raced with IPC_RMID, nothing to do */
+                if (sma->sem_perm.deleted) {
+                        sem_unlock(sma, -1);
+                        rcu_read_unlock();
+                        continue;
+                }
                 un = __lookup_undo(ulp, semid);
                 if (un == NULL) {
                         /* exit_sem raced with IPC_RMID+semget() that created
@@ -2059,6 +2135,14 @@ static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
         struct sem_array *sma = it;
         time_t sem_otime;
 
+        /*
+         * The proc interface isn't aware of sem_lock(), it calls
+         * ipc_lock_object() directly (in sysvipc_find_ipc).
+         * In order to stay compatible with sem_lock(), we must wait until
+         * all simple semop() calls have left their critical regions.
+         */
+        sem_wait_array(sma);
+
         sem_otime = get_semotime(sma);
 
         return seq_printf(s,
diff --git a/ipc/shm.c b/ipc/shm.c
index 2821cdf93adb..d69739610fd4 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -167,6 +167,15 @@ static inline void shm_lock_by_ptr(struct shmid_kernel *ipcp)
         ipc_lock_object(&ipcp->shm_perm);
 }
 
+static void shm_rcu_free(struct rcu_head *head)
+{
+        struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
+        struct shmid_kernel *shp = ipc_rcu_to_struct(p);
+
+        security_shm_free(shp);
+        ipc_rcu_free(head);
+}
+
 static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
 {
         ipc_rmid(&shm_ids(ns), &s->shm_perm);
@@ -208,8 +217,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
                 user_shm_unlock(file_inode(shp->shm_file)->i_size,
                                                 shp->mlock_user);
         fput (shp->shm_file);
-        security_shm_free(shp);
-        ipc_rcu_putref(shp);
+        ipc_rcu_putref(shp, shm_rcu_free);
 }
 
 /*
@@ -497,7 +505,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         shp->shm_perm.security = NULL;
         error = security_shm_alloc(shp);
         if (error) {
-                ipc_rcu_putref(shp);
+                ipc_rcu_putref(shp, ipc_rcu_free);
                 return error;
         }
 
@@ -566,8 +574,7 @@ no_id:
                 user_shm_unlock(size, shp->mlock_user);
         fput(file);
 no_file:
-        security_shm_free(shp);
-        ipc_rcu_putref(shp);
+        ipc_rcu_putref(shp, shm_rcu_free);
         return error;
 }
 
diff --git a/ipc/util.c b/ipc/util.c
index e829da9ed01f..7684f41bce76 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -17,12 +17,27 @@
  *            Pavel Emelianov <xemul@openvz.org>
  *
  * General sysv ipc locking scheme:
- *  when doing ipc id lookups, take the ids->rwsem
- *      rcu_read_lock()
- *          obtain the ipc object (kern_ipc_perm)
- *          perform security, capabilities, auditing and permission checks, etc.
- *          acquire the ipc lock (kern_ipc_perm.lock) throught ipc_lock_object()
- *             perform data updates (ie: SET, RMID, LOCK/UNLOCK commands)
+ *      rcu_read_lock()
+ *          obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
+ *          tree.
+ *          - perform initial checks (capabilities, auditing and permission,
+ *            etc).
+ *          - perform read-only operations, such as STAT, INFO commands.
+ *            acquire the ipc lock (kern_ipc_perm.lock) through
+ *            ipc_lock_object()
+ *              - perform data updates, such as SET, RMID commands and
+ *                mechanism-specific operations (semop/semtimedop,
+ *                msgsnd/msgrcv, shmat/shmdt).
+ *          drop the ipc lock, through ipc_unlock_object().
+ *      rcu_read_unlock()
+ *
+ *  The ids->rwsem must be taken when:
+ *      - creating, removing and iterating the existing entries in ipc
+ *        identifier sets.
+ *      - iterating through files under /proc/sysvipc/
+ *
+ *  Note that sems have a special fast path that avoids kern_ipc_perm.lock -
+ *  see sem_lock().
  */
 
 #include <linux/mm.h>
@@ -474,11 +489,6 @@ void ipc_free(void* ptr, int size)
                 kfree(ptr);
 }
 
-struct ipc_rcu {
-        struct rcu_head rcu;
-        atomic_t refcount;
-} ____cacheline_aligned_in_smp;
-
 /**
  *      ipc_rcu_alloc   -       allocate ipc and rcu space 
  *      @size: size desired
@@ -505,27 +515,24 @@ int ipc_rcu_getref(void *ptr)
         return atomic_inc_not_zero(&p->refcount);
 }
 
-/**
- * ipc_schedule_free - free ipc + rcu space
- * @head: RCU callback structure for queued work
- */
-static void ipc_schedule_free(struct rcu_head *head)
-{
-        vfree(container_of(head, struct ipc_rcu, rcu));
-}
-
-void ipc_rcu_putref(void *ptr)
+void ipc_rcu_putref(void *ptr, void (*func)(struct rcu_head *head))
 {
         struct ipc_rcu *p = ((struct ipc_rcu *)ptr) - 1;
 
         if (!atomic_dec_and_test(&p->refcount))
                 return;
 
-        if (is_vmalloc_addr(ptr)) {
-                call_rcu(&p->rcu, ipc_schedule_free);
-        } else {
-                kfree_rcu(p, rcu);
-        }
+        call_rcu(&p->rcu, func);
+}
+
+void ipc_rcu_free(struct rcu_head *head)
+{
+        struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
+
+        if (is_vmalloc_addr(p))
+                vfree(p);
+        else
+                kfree(p);
 }
 
 /**
diff --git a/ipc/util.h b/ipc/util.h
index c5f3338ba1fa..f2f5036f2eed 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -47,6 +47,13 @@ static inline void msg_exit_ns(struct ipc_namespace *ns) { }
 static inline void shm_exit_ns(struct ipc_namespace *ns) { }
 #endif
 
+struct ipc_rcu {
+        struct rcu_head rcu;
+        atomic_t refcount;
+} ____cacheline_aligned_in_smp;
+
+#define ipc_rcu_to_struct(p)  ((void *)(p+1))
+
 /*
  * Structure that holds the parameters needed by the ipc operations
  * (see after)
@@ -120,7 +127,8 @@ void ipc_free(void* ptr, int size);
  */
 void* ipc_rcu_alloc(int size);
 int ipc_rcu_getref(void *ptr);
-void ipc_rcu_putref(void *ptr);
+void ipc_rcu_putref(void *ptr, void (*func)(struct rcu_head *head));
+void ipc_rcu_free(struct rcu_head *head);
 
 struct kern_ipc_perm *ipc_lock(struct ipc_ids *, int);
 struct kern_ipc_perm *ipc_obtain_object(struct ipc_ids *ids, int id);
diff --git a/kernel/audit.c b/kernel/audit.c
index 91e53d04b6a9..7b0e23a740ce 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1117,9 +1117,10 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 
                         sleep_time = timeout_start + audit_backlog_wait_time -
                                         jiffies;
-                        if ((long)sleep_time > 0)
+                        if ((long)sleep_time > 0) {
                                 wait_for_auditd(sleep_time);
-                        continue;
+                                continue;
+                        }
                 }
                 if (audit_rate_check() && printk_ratelimit())
                         printk(KERN_WARNING
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2418b6e71a85..8bd9cfdc70d7 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2039,7 +2039,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
 
                 /* @tsk either already exited or can't exit until the end */
                 if (tsk->flags & PF_EXITING)
-                        continue;
+                        goto next;
 
                 /* as per above, nr_threads may decrease, but not increase. */
                 BUG_ON(i >= group_size);
@@ -2047,7 +2047,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                 ent.cgrp = task_cgroup_from_root(tsk, root);
                 /* nothing to do if this task is already in the cgroup */
                 if (ent.cgrp == cgrp)
-                        continue;
+                        goto next;
                 /*
                  * saying GFP_ATOMIC has no effect here because we did prealloc
                  * earlier, but it's good form to communicate our expectations.
@@ -2055,7 +2055,7 @@ static int cgroup_attach_task(struct cgroup *cgrp, struct task_struct *tsk,
                 retval = flex_array_put(group, i, &ent, GFP_ATOMIC);
                 BUG_ON(retval != 0);
                 i++;
-
+        next:
                 if (!threadgroup)
                         break;
         } while_each_thread(leader, tsk);
@@ -3188,11 +3188,9 @@ css_next_descendant_post(struct cgroup_subsys_state *pos,
 
         WARN_ON_ONCE(!rcu_read_lock_held());
 
-        /* if first iteration, visit the leftmost descendant */
-        if (!pos) {
-                next = css_leftmost_descendant(root);
-                return next != root ? next : NULL;
-        }
+        /* if first iteration, visit leftmost descendant which may be @root */
+        if (!pos)
+                return css_leftmost_descendant(root);
 
         /* if we visited @root, we're done */
         if (pos == root)
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
index 247091bf0587..859c8dfd78a1 100644
--- a/kernel/context_tracking.c
+++ b/kernel/context_tracking.c
@@ -51,6 +51,15 @@ void context_tracking_user_enter(void)
         unsigned long flags;
 
         /*
+         * Repeat the user_enter() check here because some archs may be calling
+         * this from asm and if no CPU needs context tracking, they shouldn't
+         * go further. Repeat the check here until they support the static key
+         * check.
+         */
+        if (!static_key_false(&context_tracking_enabled))
+                return;
+
+        /*
          * Some contexts may involve an exception occuring in an irq,
          * leading to that nesting:
          * rcu_irq_enter() rcu_user_exit() rcu_user_exit() rcu_irq_exit()
@@ -151,6 +160,9 @@ void context_tracking_user_exit(void)
 {
         unsigned long flags;
 
+        if (!static_key_false(&context_tracking_enabled))
+                return;
+
         if (in_interrupt())
                 return;
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index dd236b66ca3a..953c14348375 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3660,6 +3660,26 @@ static void calc_timer_values(struct perf_event *event,
         *running = ctx_time - event->tstamp_running;
 }
 
+static void perf_event_init_userpage(struct perf_event *event)
+{
+        struct perf_event_mmap_page *userpg;
+        struct ring_buffer *rb;
+
+        rcu_read_lock();
+        rb = rcu_dereference(event->rb);
+        if (!rb)
+                goto unlock;
+
+        userpg = rb->user_page;
+
+        /* Allow new userspace to detect that bit 0 is deprecated */
+        userpg->cap_bit0_is_deprecated = 1;
+        userpg->size = offsetof(struct perf_event_mmap_page, __reserved);
+
+unlock:
+        rcu_read_unlock();
+}
+
 void __weak arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
 {
 }
@@ -4044,6 +4064,7 @@ again:
         ring_buffer_attach(event, rb);
         rcu_assign_pointer(event->rb, rb);
 
+        perf_event_init_userpage(event);
         perf_event_update_userpage(event);
 
 unlock:
@@ -6746,6 +6767,10 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
         if (ret)
                 return -EFAULT;
 
+        /* disabled for now */
+        if (attr->mmap2)
+                return -EINVAL;
+
         if (attr->__reserved_1)
                 return -EINVAL;
 
@@ -7213,15 +7238,15 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
                 perf_remove_from_context(event);
                 unaccount_event_cpu(event, src_cpu);
                 put_ctx(src_ctx);
-                list_add(&event->event_entry, &events);
+                list_add(&event->migrate_entry, &events);
         }
         mutex_unlock(&src_ctx->mutex);
 
         synchronize_rcu();
 
         mutex_lock(&dst_ctx->mutex);
-        list_for_each_entry_safe(event, tmp, &events, event_entry) {
-                list_del(&event->event_entry);
+        list_for_each_entry_safe(event, tmp, &events, migrate_entry) {
+                list_del(&event->migrate_entry);
                 if (event->state >= PERF_EVENT_STATE_OFF)
                         event->state = PERF_EVENT_STATE_INACTIVE;
                 account_event_cpu(event, dst_cpu);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index fb326365b694..b086006c59e7 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -571,6 +571,10 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
         DECLARE_COMPLETION_ONSTACK(done);
         int retval = 0;
 
+        if (!sub_info->path) {
+                call_usermodehelper_freeinfo(sub_info);
+                return -EINVAL;
+        }
         helper_lock();
         if (!khelper_wq || usermodehelper_disabled) {
                 retval = -EBUSY;
diff --git a/kernel/mutex.c b/kernel/mutex.c
index 6d647aedffea..d24105b1b794 100644
--- a/kernel/mutex.c
+++ b/kernel/mutex.c
@@ -410,7 +410,7 @@ ww_mutex_set_context_fastpath(struct ww_mutex *lock,
 static __always_inline int __sched
 __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                     struct lockdep_map *nest_lock, unsigned long ip,
-                    struct ww_acquire_ctx *ww_ctx)
+                    struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
 {
         struct task_struct *task = current;
         struct mutex_waiter waiter;
@@ -450,7 +450,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                 struct task_struct *owner;
                 struct mspin_node  node;
 
-                if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) {
+                if (use_ww_ctx && ww_ctx->acquired > 0) {
                         struct ww_mutex *ww;
 
                         ww = container_of(lock, struct ww_mutex, base);
@@ -480,7 +480,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                 if ((atomic_read(&lock->count) == 1) &&
                     (atomic_cmpxchg(&lock->count, 1, 0) == 1)) {
                         lock_acquired(&lock->dep_map, ip);
-                        if (!__builtin_constant_p(ww_ctx == NULL)) {
+                        if (use_ww_ctx) {
                                 struct ww_mutex *ww;
                                 ww = container_of(lock, struct ww_mutex, base);
 
@@ -551,7 +551,7 @@ slowpath:
                         goto err;
                 }
 
-                if (!__builtin_constant_p(ww_ctx == NULL) && ww_ctx->acquired > 0) {
+                if (use_ww_ctx && ww_ctx->acquired > 0) {
                         ret = __mutex_lock_check_stamp(lock, ww_ctx);
                         if (ret)
                                 goto err;
@@ -575,7 +575,7 @@ skip_wait:
         lock_acquired(&lock->dep_map, ip);
         mutex_set_owner(lock);
 
-        if (!__builtin_constant_p(ww_ctx == NULL)) {
+        if (use_ww_ctx) {
                 struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
                 struct mutex_waiter *cur;
 
@@ -615,7 +615,7 @@ mutex_lock_nested(struct mutex *lock, unsigned int subclass)
 {
         might_sleep();
         __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE,
-                            subclass, NULL, _RET_IP_, NULL);
+                            subclass, NULL, _RET_IP_, NULL, 0);
 }
 
 EXPORT_SYMBOL_GPL(mutex_lock_nested);
@@ -625,7 +625,7 @@ _mutex_lock_nest_lock(struct mutex *lock, struct lockdep_map *nest)
 {
         might_sleep();
         __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE,
-                            0, nest, _RET_IP_, NULL);
+                            0, nest, _RET_IP_, NULL, 0);
 }
 
 EXPORT_SYMBOL_GPL(_mutex_lock_nest_lock);
@@ -635,7 +635,7 @@ mutex_lock_killable_nested(struct mutex *lock, unsigned int subclass)
 {
         might_sleep();
         return __mutex_lock_common(lock, TASK_KILLABLE,
-                                   subclass, NULL, _RET_IP_, NULL);
+                                   subclass, NULL, _RET_IP_, NULL, 0);
 }
 EXPORT_SYMBOL_GPL(mutex_lock_killable_nested);
 
@@ -644,7 +644,7 @@ mutex_lock_interruptible_nested(struct mutex *lock, unsigned int subclass)
 {
         might_sleep();
         return __mutex_lock_common(lock, TASK_INTERRUPTIBLE,
-                                   subclass, NULL, _RET_IP_, NULL);
+                                   subclass, NULL, _RET_IP_, NULL, 0);
 }
 
 EXPORT_SYMBOL_GPL(mutex_lock_interruptible_nested);
@@ -682,7 +682,7 @@ __ww_mutex_lock(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
 
         might_sleep();
         ret =  __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE,
-                                   0, &ctx->dep_map, _RET_IP_, ctx);
+                                   0, &ctx->dep_map, _RET_IP_, ctx, 1);
         if (!ret && ctx->acquired > 1)
                 return ww_mutex_deadlock_injection(lock, ctx);
 
@@ -697,7 +697,7 @@ __ww_mutex_lock_interruptible(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
 
         might_sleep();
         ret = __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE,
-                                  0, &ctx->dep_map, _RET_IP_, ctx);
+                                  0, &ctx->dep_map, _RET_IP_, ctx, 1);
 
         if (!ret && ctx->acquired > 1)
                 return ww_mutex_deadlock_injection(lock, ctx);
@@ -809,28 +809,28 @@ __mutex_lock_slowpath(atomic_t *lock_count)
         struct mutex *lock = container_of(lock_count, struct mutex, count);
 
         __mutex_lock_common(lock, TASK_UNINTERRUPTIBLE, 0,
-                            NULL, _RET_IP_, NULL);
+                            NULL, _RET_IP_, NULL, 0);
 }
 
 static noinline int __sched
 __mutex_lock_killable_slowpath(struct mutex *lock)
 {
         return __mutex_lock_common(lock, TASK_KILLABLE, 0,
-                                   NULL, _RET_IP_, NULL);
+                                   NULL, _RET_IP_, NULL, 0);
 }
 
 static noinline int __sched
 __mutex_lock_interruptible_slowpath(struct mutex *lock)
 {
         return __mutex_lock_common(lock, TASK_INTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, NULL);
+                                   NULL, _RET_IP_, NULL, 0);
 }
 
 static noinline int __sched
 __ww_mutex_lock_slowpath(struct ww_mutex *lock, struct ww_acquire_ctx *ctx)
 {
         return __mutex_lock_common(&lock->base, TASK_UNINTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, ctx);
+                                   NULL, _RET_IP_, ctx, 1);
 }
 
 static noinline int __sched
@@ -838,7 +838,7 @@ __ww_mutex_lock_interruptible_slowpath(struct ww_mutex *lock,
                                             struct ww_acquire_ctx *ctx)
 {
         return __mutex_lock_common(&lock->base, TASK_INTERRUPTIBLE, 0,
-                                   NULL, _RET_IP_, ctx);
+                                   NULL, _RET_IP_, ctx, 1);
 }
 
 #endif
diff --git a/kernel/params.c b/kernel/params.c
index 81c4e78c8f4c..c00d5b502aa4 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -254,11 +254,11 @@ int parse_args(const char *doing,
 
 
 STANDARD_PARAM_DEF(byte, unsigned char, "%hhu", unsigned long, kstrtoul);
-STANDARD_PARAM_DEF(short, short, "%hi", long, kstrtoul);
+STANDARD_PARAM_DEF(short, short, "%hi", long, kstrtol);
 STANDARD_PARAM_DEF(ushort, unsigned short, "%hu", unsigned long, kstrtoul);
-STANDARD_PARAM_DEF(int, int, "%i", long, kstrtoul);
+STANDARD_PARAM_DEF(int, int, "%i", long, kstrtol);
 STANDARD_PARAM_DEF(uint, unsigned int, "%u", unsigned long, kstrtoul);
-STANDARD_PARAM_DEF(long, long, "%li", long, kstrtoul);
+STANDARD_PARAM_DEF(long, long, "%li", long, kstrtol);
 STANDARD_PARAM_DEF(ulong, unsigned long, "%lu", unsigned long, kstrtoul);
 
 int param_set_charp(const char *val, const struct kernel_param *kp)
diff --git a/kernel/pid.c b/kernel/pid.c
index ebe5e80b10f8..9b9a26698144 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -273,6 +273,11 @@ void free_pid(struct pid *pid)
                          */
                         wake_up_process(ns->child_reaper);
                         break;
+                case PIDNS_HASH_ADDING:
+                        /* Handle a fork failure of the first process */
+                        WARN_ON(ns->child_reaper);
+                        ns->nr_hashed = 0;
+                        /* fall through */
                 case 0:
                         schedule_work(&ns->proc_work);
                         break;
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index d444c4e834f4..2fac9cc79b3d 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -178,6 +178,22 @@ config PM_SLEEP_DEBUG
         def_bool y
         depends on PM_DEBUG && PM_SLEEP
 
+config DPM_WATCHDOG
+        bool "Device suspend/resume watchdog"
+        depends on PM_DEBUG && PSTORE
+        ---help---
+          Sets up a watchdog timer to capture drivers that are
+          locked up attempting to suspend/resume a device.
+          A detected lockup causes system panic with message
+          captured in pstore device for inspection in subsequent
+          boot session.
+
+config DPM_WATCHDOG_TIMEOUT
+        int "Watchdog timeout in seconds"
+        range 1 120
+        default 12
+        depends on DPM_WATCHDOG
+
 config PM_TRACE
         bool
         help
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index c9c759d5a15c..0121dab83f43 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -846,7 +846,7 @@ static int software_resume(void)
         goto Finish;
 }
 
-late_initcall(software_resume);
+late_initcall_sync(software_resume);
 
 
 static const char * const hibernation_modes[] = {
diff --git a/kernel/power/qos.c b/kernel/power/qos.c
index a394297f8b2f..8dff9b48075a 100644
--- a/kernel/power/qos.c
+++ b/kernel/power/qos.c
@@ -558,30 +558,12 @@ static ssize_t pm_qos_power_write(struct file *filp, const char __user *buf,
         if (count == sizeof(s32)) {
                 if (copy_from_user(&value, buf, sizeof(s32)))
                         return -EFAULT;
-        } else if (count <= 11) { /* ASCII perhaps? */
-                char ascii_value[11];
-                unsigned long int ulval;
+        } else {
                 int ret;
 
-                if (copy_from_user(ascii_value, buf, count))
-                        return -EFAULT;
-
-                if (count > 10) {
-                        if (ascii_value[10] == '\n')
-                                ascii_value[10] = '\0';
-                        else
-                                return -EINVAL;
-                } else {
-                        ascii_value[count] = '\0';
-                }
-                ret = kstrtoul(ascii_value, 16, &ulval);
-                if (ret) {
-                        pr_debug("%s, 0x%lx, 0x%x\n", ascii_value, ulval, ret);
-                        return -EINVAL;
-                }
-                value = (s32)lower_32_bits(ulval);
-        } else {
-                return -EINVAL;
+                ret = kstrtos32_from_user(buf, count, 16, &value);
+                if (ret)
+                        return ret;
         }
 
         req = filp->private_data;
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 358a146fd4da..10c22cae83a0 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -743,7 +743,10 @@ int create_basic_memory_bitmaps(void)
         struct memory_bitmap *bm1, *bm2;
         int error = 0;
 
-        BUG_ON(forbidden_pages_map || free_pages_map);
+        if (forbidden_pages_map && free_pages_map)
+                return 0;
+        else
+                BUG_ON(forbidden_pages_map || free_pages_map);
 
         bm1 = kzalloc(sizeof(struct memory_bitmap), GFP_KERNEL);
         if (!bm1)
@@ -1399,7 +1402,11 @@ int hibernate_preallocate_memory(void)
          * highmem and non-highmem zones separately.
          */
         pages_highmem = preallocate_image_highmem(highmem / 2);
-        alloc = (count - max_size) - pages_highmem;
+        alloc = count - max_size;
+        if (alloc > pages_highmem)
+                alloc -= pages_highmem;
+        else
+                alloc = 0;
         pages = preallocate_image_memory(alloc, avail_normal);
         if (pages < alloc) {
                 /* We have exhausted non-highmem pages, try highmem. */
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 72e8f4fd616d..24850270c802 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -36,9 +36,10 @@ static struct snapshot_data {
         struct snapshot_handle handle;
         int swap;
         int mode;
-        char frozen;
-        char ready;
-        char platform_support;
+        bool frozen;
+        bool ready;
+        bool platform_support;
+        bool free_bitmaps;
 } snapshot_state;
 
 atomic_t snapshot_device_available = ATOMIC_INIT(1);
@@ -82,15 +83,19 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                 data->swap = -1;
                 data->mode = O_WRONLY;
                 error = pm_notifier_call_chain(PM_RESTORE_PREPARE);
+                if (!error) {
+                        error = create_basic_memory_bitmaps();
+                        data->free_bitmaps = !error;
+                }
                 if (error)
                         pm_notifier_call_chain(PM_POST_RESTORE);
         }
         if (error)
                 atomic_inc(&snapshot_device_available);
 
-        data->frozen = 0;
-        data->ready = 0;
-        data->platform_support = 0;
+        data->frozen = false;
+        data->ready = false;
+        data->platform_support = false;
 
  Unlock:
         unlock_system_sleep();
@@ -111,6 +116,8 @@ static int snapshot_release(struct inode *inode, struct file *filp)
                 pm_restore_gfp_mask();
                 free_basic_memory_bitmaps();
                 thaw_processes();
+        } else if (data->free_bitmaps) {
+                free_basic_memory_bitmaps();
         }
         pm_notifier_call_chain(data->mode == O_RDONLY ?
                         PM_POST_HIBERNATION : PM_POST_RESTORE);
@@ -222,7 +229,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                 if (error)
                         thaw_processes();
                 else
-                        data->frozen = 1;
+                        data->frozen = true;
 
                 break;
 
@@ -231,8 +238,9 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                         break;
                 pm_restore_gfp_mask();
                 free_basic_memory_bitmaps();
+                data->free_bitmaps = false;
                 thaw_processes();
-                data->frozen = 0;
+                data->frozen = false;
                 break;
 
         case SNAPSHOT_CREATE_IMAGE:
@@ -262,7 +270,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
         case SNAPSHOT_FREE:
                 swsusp_free();
                 memset(&data->handle, 0, sizeof(struct snapshot_handle));
-                data->ready = 0;
+                data->ready = false;
                 /*
                  * It is necessary to thaw kernel threads here, because
                  * SNAPSHOT_CREATE_IMAGE may be invoked directly after
@@ -326,7 +334,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                  * PM_HIBERNATION_PREPARE
                  */
                 error = suspend_devices_and_enter(PM_SUSPEND_MEM);
-                data->ready = 0;
+                data->ready = false;
                 break;
 
         case SNAPSHOT_PLATFORM_SUPPORT:
diff --git a/kernel/reboot.c b/kernel/reboot.c
index 269ed9384cc4..f813b3474646 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -32,7 +32,14 @@ EXPORT_SYMBOL(cad_pid);
 #endif
 enum reboot_mode reboot_mode DEFAULT_REBOOT_MODE;
 
-int reboot_default;
+/*
+ * This variable is used privately to keep track of whether or not
+ * reboot_type is still set to its default value (i.e., reboot= hasn't
+ * been set on the command line).  This is needed so that we can
+ * suppress DMI scanning for reboot quirks.  Without it, it's
+ * impossible to override a faulty reboot quirk without recompiling.
+ */
+int reboot_default = 1;
 int reboot_cpu;
 enum reboot_type reboot_type = BOOT_ACPI;
 int reboot_force;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 11cd13667359..7c70201fbc61 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4242,7 +4242,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
         }
 
         if (!se) {
-                cfs_rq->h_load = rq->avg.load_avg_contrib;
+                cfs_rq->h_load = cfs_rq->runnable_load_avg;
                 cfs_rq->last_h_load_update = now;
         }
 
@@ -4823,8 +4823,8 @@ void fix_small_imbalance(struct lb_env *env, struct sd_lb_stats *sds)
                 (busiest->load_per_task * SCHED_POWER_SCALE) /
                 busiest->group_power;
 
-        if (busiest->avg_load - local->avg_load + scaled_busy_load_per_task >=
-            (scaled_busy_load_per_task * imbn)) {
+        if (busiest->avg_load + scaled_busy_load_per_task >=
+            local->avg_load + (scaled_busy_load_per_task * imbn)) {
                 env->imbalance = busiest->load_per_task;
                 return;
         }
@@ -4896,7 +4896,8 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
          * max load less than avg load(as we skip the groups at or below
          * its cpu_power, while calculating max_load..)
          */
-        if (busiest->avg_load < sds->avg_load) {
+        if (busiest->avg_load <= sds->avg_load ||
+            local->avg_load >= sds->avg_load) {
                 env->imbalance = 0;
                 return fix_small_imbalance(env, sds);
         }
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 53cc09ceb0b8..d7d498d8cc4f 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -328,10 +328,19 @@ void irq_enter(void)
 
 static inline void invoke_softirq(void)
 {
-        if (!force_irqthreads)
-                __do_softirq();
-        else
+        if (!force_irqthreads) {
+                /*
+                 * We can safely execute softirq on the current stack if
+                 * it is the irq stack, because it should be near empty
+                 * at this stage. But we have no way to know if the arch
+                 * calls irq_exit() on the irq stack. So call softirq
+                 * in its own stack to prevent from any overrun on top
+                 * of a potentially deep task stack.
+                 */
+                do_softirq();
+        } else {
                 wakeup_softirqd();
+        }
 }
 
 static inline void tick_irq_exit(void)
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 38959c866789..662c5798a685 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -33,29 +33,64 @@ struct ce_unbind {
         int res;
 };
 
-/**
- * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
- * @latch:      value to convert
- * @evt:        pointer to clock event device descriptor
- *
- * Math helper, returns latch value converted to nanoseconds (bound checked)
- */
-u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
+static u64 cev_delta2ns(unsigned long latch, struct clock_event_device *evt,
+                        bool ismax)
 {
         u64 clc = (u64) latch << evt->shift;
+        u64 rnd;
 
         if (unlikely(!evt->mult)) {
                 evt->mult = 1;
                 WARN_ON(1);
         }
+        rnd = (u64) evt->mult - 1;
+
+        /*
+         * Upper bound sanity check. If the backwards conversion is
+         * not equal latch, we know that the above shift overflowed.
+         */
+        if ((clc >> evt->shift) != (u64)latch)
+                clc = ~0ULL;
+
+        /*
+         * Scaled math oddities:
+         *
+         * For mult <= (1 << shift) we can safely add mult - 1 to
+         * prevent integer rounding loss. So the backwards conversion
+         * from nsec to device ticks will be correct.
+         *
+         * For mult > (1 << shift), i.e. device frequency is > 1GHz we
+         * need to be careful. Adding mult - 1 will result in a value
+         * which when converted back to device ticks can be larger
+         * than latch by up to (mult - 1) >> shift. For the min_delta
+         * calculation we still want to apply this in order to stay
+         * above the minimum device ticks limit. For the upper limit
+         * we would end up with a latch value larger than the upper
+         * limit of the device, so we omit the add to stay below the
+         * device upper boundary.
+         *
+         * Also omit the add if it would overflow the u64 boundary.
+         */
+        if ((~0ULL - clc > rnd) &&
+            (!ismax || evt->mult <= (1U << evt->shift)))
+                clc += rnd;
 
         do_div(clc, evt->mult);
-        if (clc < 1000)
-                clc = 1000;
-        if (clc > KTIME_MAX)
-                clc = KTIME_MAX;
 
-        return clc;
+        /* Deltas less than 1usec are pointless noise */
+        return clc > 1000 ? clc : 1000;
+}
+
+/**
+ * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
+ * @latch:      value to convert
+ * @evt:        pointer to clock event device descriptor
+ *
+ * Math helper, returns latch value converted to nanoseconds (bound checked)
+ */
+u64 clockevent_delta2ns(unsigned long latch, struct clock_event_device *evt)
+{
+        return cev_delta2ns(latch, evt, false);
 }
 EXPORT_SYMBOL_GPL(clockevent_delta2ns);
 
@@ -380,8 +415,8 @@ void clockevents_config(struct clock_event_device *dev, u32 freq)
                 sec = 600;
 
         clockevents_calc_mult_shift(dev, freq, sec);
-        dev->min_delta_ns = clockevent_delta2ns(dev->min_delta_ticks, dev);
-        dev->max_delta_ns = clockevent_delta2ns(dev->max_delta_ticks, dev);
+        dev->min_delta_ns = cev_delta2ns(dev->min_delta_ticks, dev, false);
+        dev->max_delta_ns = cev_delta2ns(dev->max_delta_ticks, dev, true);
 }
 
 /**
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 51c4f34d258e..4431610f049a 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -486,7 +486,52 @@ static struct smp_hotplug_thread watchdog_threads = {
         .unpark                 = watchdog_enable,
 };
 
-static int watchdog_enable_all_cpus(void)
+static void restart_watchdog_hrtimer(void *info)
+{
+        struct hrtimer *hrtimer = &__raw_get_cpu_var(watchdog_hrtimer);
+        int ret;
+
+        /*
+         * No need to cancel and restart hrtimer if it is currently executing
+         * because it will reprogram itself with the new period now.
+         * We should never see it unqueued here because we are running per-cpu
+         * with interrupts disabled.
+         */
+        ret = hrtimer_try_to_cancel(hrtimer);
+        if (ret == 1)
+                hrtimer_start(hrtimer, ns_to_ktime(sample_period),
+                                HRTIMER_MODE_REL_PINNED);
+}
+
+static void update_timers(int cpu)
+{
+        struct call_single_data data = {.func = restart_watchdog_hrtimer};
+        /*
+         * Make sure that perf event counter will adopt to a new
+         * sampling period. Updating the sampling period directly would
+         * be much nicer but we do not have an API for that now so
+         * let's use a big hammer.
+         * Hrtimer will adopt the new period on the next tick but this
+         * might be late already so we have to restart the timer as well.
+         */
+        watchdog_nmi_disable(cpu);
+        __smp_call_function_single(cpu, &data, 1);
+        watchdog_nmi_enable(cpu);
+}
+
+static void update_timers_all_cpus(void)
+{
+        int cpu;
+
+        get_online_cpus();
+        preempt_disable();
+        for_each_online_cpu(cpu)
+                update_timers(cpu);
+        preempt_enable();
+        put_online_cpus();
+}
+
+static int watchdog_enable_all_cpus(bool sample_period_changed)
 {
         int err = 0;
 
@@ -496,6 +541,8 @@ static int watchdog_enable_all_cpus(void)
                         pr_err("Failed to create watchdog threads, disabled\n");
                 else
                         watchdog_running = 1;
+        } else if (sample_period_changed) {
+                update_timers_all_cpus();
         }
 
         return err;
@@ -520,13 +567,15 @@ int proc_dowatchdog(struct ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int err, old_thresh, old_enabled;
+        static DEFINE_MUTEX(watchdog_proc_mutex);
 
+        mutex_lock(&watchdog_proc_mutex);
         old_thresh = ACCESS_ONCE(watchdog_thresh);
         old_enabled = ACCESS_ONCE(watchdog_user_enabled);
 
         err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
         if (err || !write)
-                return err;
+                goto out;
 
         set_sample_period();
         /*
@@ -535,7 +584,7 @@ int proc_dowatchdog(struct ctl_table *table, int write,
          * watchdog_*_all_cpus() function takes care of this.
          */
         if (watchdog_user_enabled && watchdog_thresh)
-                err = watchdog_enable_all_cpus();
+                err = watchdog_enable_all_cpus(old_thresh != watchdog_thresh);
         else
                 watchdog_disable_all_cpus();
 
@@ -544,7 +593,8 @@ int proc_dowatchdog(struct ctl_table *table, int write,
                 watchdog_thresh = old_thresh;
                 watchdog_user_enabled = old_enabled;
         }
-
+out:
+        mutex_unlock(&watchdog_proc_mutex);
         return err;
 }
 #endif /* CONFIG_SYSCTL */
@@ -554,5 +604,5 @@ void __init lockup_detector_init(void)
         set_sample_period();
 
         if (watchdog_user_enabled)
-                watchdog_enable_all_cpus();
+                watchdog_enable_all_cpus(false);
 }
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 3f0494c9d57a..8499c810909a 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -14,6 +14,8 @@
 
 const char hex_asc[] = "0123456789abcdef";
 EXPORT_SYMBOL(hex_asc);
+const char hex_asc_upper[] = "0123456789ABCDEF";
+EXPORT_SYMBOL(hex_asc_upper);
 
 /**
  * hex_to_bin - convert a hex digit to its real value
diff --git a/lib/kobject.c b/lib/kobject.c
index 962175134702..084f7b18d0c0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -592,7 +592,7 @@ static void kobject_release(struct kref *kref)
 {
         struct kobject *kobj = container_of(kref, struct kobject, kref);
 #ifdef CONFIG_DEBUG_KOBJECT_RELEASE
-        pr_debug("kobject: '%s' (%p): %s, parent %p (delayed)\n",
+        pr_info("kobject: '%s' (%p): %s, parent %p (delayed)\n",
                  kobject_name(kobj), kobj, __func__, kobj->parent);
         INIT_DELAYED_WORK(&kobj->release, kobject_delayed_cleanup);
         schedule_delayed_work(&kobj->release, HZ);
@@ -933,10 +933,7 @@ const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj)
 
 bool kobj_ns_current_may_mount(enum kobj_ns_type type)
 {
-        bool may_mount = false;
-
-        if (type == KOBJ_NS_TYPE_NONE)
-                return true;
+        bool may_mount = true;
 
         spin_lock(&kobj_ns_type_lock);
         if ((type > KOBJ_NS_TYPE_NONE) && (type < KOBJ_NS_TYPES) &&
diff --git a/lib/lockref.c b/lib/lockref.c
index 677d036cf3c7..6f9d434c1521 100644
--- a/lib/lockref.c
+++ b/lib/lockref.c
@@ -4,6 +4,22 @@
 #ifdef CONFIG_CMPXCHG_LOCKREF
 
 /*
+ * Allow weakly-ordered memory architectures to provide barrier-less
+ * cmpxchg semantics for lockref updates.
+ */
+#ifndef cmpxchg64_relaxed
+# define cmpxchg64_relaxed cmpxchg64
+#endif
+
+/*
+ * Allow architectures to override the default cpu_relax() within CMPXCHG_LOOP.
+ * This is useful for architectures with an expensive cpu_relax().
+ */
+#ifndef arch_mutex_cpu_relax
+# define arch_mutex_cpu_relax() cpu_relax()
+#endif
+
+/*
  * Note that the "cmpxchg()" reloads the "old" value for the
  * failure case.
  */
@@ -14,12 +30,13 @@
         while (likely(arch_spin_value_unlocked(old.lock.rlock.raw_lock))) {     \
                 struct lockref new = old, prev = old;                           \
                 CODE                                                            \
-                old.lock_count = cmpxchg64(&lockref->lock_count,                \
-                                           old.lock_count, new.lock_count);     \
+                old.lock_count = cmpxchg64_relaxed(&lockref->lock_count,        \
+                                                   old.lock_count,              \
+                                                   new.lock_count);             \
                 if (likely(old.lock_count == prev.lock_count)) {                \
                         SUCCESS;                                                \
                 }                                                               \
-                cpu_relax();                                                    \
+                arch_mutex_cpu_relax();                                         \
         }                                                                       \
 } while (0)
 
diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 7deeb6297a48..1a53d497a8c5 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -53,6 +53,7 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release)
         ref->release = release;
         return 0;
 }
+EXPORT_SYMBOL_GPL(percpu_ref_init);
 
 /**
  * percpu_ref_cancel_init - cancel percpu_ref_init()
@@ -84,6 +85,7 @@ void percpu_ref_cancel_init(struct percpu_ref *ref)
                 free_percpu(ref->pcpu_count);
         }
 }
+EXPORT_SYMBOL_GPL(percpu_ref_cancel_init);
 
 static void percpu_ref_kill_rcu(struct rcu_head *rcu)
 {
@@ -156,3 +158,4 @@ void percpu_ref_kill_and_confirm(struct percpu_ref *ref,
 
         call_rcu_sched(&ref->rcu, percpu_ref_kill_rcu);
 }
+EXPORT_SYMBOL_GPL(percpu_ref_kill_and_confirm);
diff --git a/mm/Kconfig b/mm/Kconfig
index 026771a9b097..394838f489eb 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -183,7 +183,7 @@ config MEMORY_HOTPLUG_SPARSE
 config MEMORY_HOTREMOVE
         bool "Allow for memory hot remove"
         select MEMORY_ISOLATION
-        select HAVE_BOOTMEM_INFO_NODE if X86_64
+        select HAVE_BOOTMEM_INFO_NODE if (X86_64 || PPC64)
         depends on MEMORY_HOTPLUG && ARCH_ENABLE_MEMORY_HOTREMOVE
         depends on MIGRATION
 
diff --git a/mm/bounce.c b/mm/bounce.c
index c9f0a4339a7d..5a7d58fb883b 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -204,6 +204,8 @@ static void __blk_queue_bounce(struct request_queue *q, struct bio **bio_orig,
         struct bio_vec *to, *from;
         unsigned i;
 
+        if (force)
+                goto bounce;
         bio_for_each_segment(from, *bio_orig, i)
                 if (page_to_pfn(from->bv_page) > queue_bounce_pfn(q))
                         goto bounce;
diff --git a/mm/compaction.c b/mm/compaction.c
index c43789388cd8..b5326b141a25 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -677,6 +677,13 @@ static void isolate_freepages(struct zone *zone,
                                         pfn -= pageblock_nr_pages) {
                 unsigned long isolated;
 
+                /*
+                 * This can iterate a massively long zone without finding any
+                 * suitable migration targets, so periodically check if we need
+                 * to schedule.
+                 */
+                cond_resched();
+
                 if (!pfn_valid(pfn))
                         continue;
 
diff --git a/mm/filemap.c b/mm/filemap.c
index 1e6aec4a2d2e..ae4846ff4849 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1616,7 +1616,6 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         struct inode *inode = mapping->host;
         pgoff_t offset = vmf->pgoff;
         struct page *page;
-        bool memcg_oom;
         pgoff_t size;
         int ret = 0;
 
@@ -1625,11 +1624,7 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
 
         /*
-         * Do we have something in the page cache already?  Either
-         * way, try readahead, but disable the memcg OOM killer for it
-         * as readahead is optional and no errors are propagated up
-         * the fault stack.  The OOM killer is enabled while trying to
-         * instantiate the faulting page individually below.
+         * Do we have something in the page cache already?
          */
         page = find_get_page(mapping, offset);
         if (likely(page) && !(vmf->flags & FAULT_FLAG_TRIED)) {
@@ -1637,14 +1632,10 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                  * We found the page, so try async readahead before
                  * waiting for the lock.
                  */
-                memcg_oom = mem_cgroup_toggle_oom(false);
                 do_async_mmap_readahead(vma, ra, file, page, offset);
-                mem_cgroup_toggle_oom(memcg_oom);
         } else if (!page) {
                 /* No page in the page cache at all */
-                memcg_oom = mem_cgroup_toggle_oom(false);
                 do_sync_mmap_readahead(vma, ra, file, offset);
-                mem_cgroup_toggle_oom(memcg_oom);
                 count_vm_event(PGMAJFAULT);
                 mem_cgroup_count_vm_event(vma->vm_mm, PGMAJFAULT);
                 ret = VM_FAULT_MAJOR;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 7489884682d8..610e3df2768a 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2697,6 +2697,7 @@ void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address,
 
         mmun_start = haddr;
         mmun_end   = haddr + HPAGE_PMD_SIZE;
+again:
         mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
         spin_lock(&mm->page_table_lock);
         if (unlikely(!pmd_trans_huge(*pmd))) {
@@ -2719,7 +2720,14 @@ void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address,
         split_huge_page(page);
 
         put_page(page);
-        BUG_ON(pmd_trans_huge(*pmd));
+
+        /*
+         * We don't always have down_write of mmap_sem here: a racing
+         * do_huge_pmd_wp_page() might have copied-on-write to another
+         * huge page before our split_huge_page() got the anon_vma lock.
+         */
+        if (unlikely(pmd_trans_huge(*pmd)))
+                goto again;
 }
 
 void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address,
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b49579c7f2a5..0b7656e804d1 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -653,6 +653,7 @@ static void free_huge_page(struct page *page)
         BUG_ON(page_count(page));
         BUG_ON(page_mapcount(page));
         restore_reserve = PagePrivate(page);
+        ClearPagePrivate(page);
 
         spin_lock(&hugetlb_lock);
         hugetlb_cgroup_uncharge_page(hstate_index(h),
@@ -695,8 +696,22 @@ static void prep_compound_gigantic_page(struct page *page, unsigned long order)
         /* we rely on prep_new_huge_page to set the destructor */
         set_compound_order(page, order);
         __SetPageHead(page);
+        __ClearPageReserved(page);
         for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
                 __SetPageTail(p);
+                /*
+                 * For gigantic hugepages allocated through bootmem at
+                 * boot, it's safer to be consistent with the not-gigantic
+                 * hugepages and clear the PG_reserved bit from all tail pages
+                 * too.  Otherwse drivers using get_user_pages() to access tail
+                 * pages may get the reference counting wrong if they see
+                 * PG_reserved set on a tail page (despite the head page not
+                 * having PG_reserved set).  Enforcing this consistency between
+                 * head and tail pages allows drivers to optimize away a check
+                 * on the head page when they need know if put_page() is needed
+                 * after get_user_pages().
+                 */
+                __ClearPageReserved(p);
                 set_page_count(p, 0);
                 p->first_page = page;
         }
@@ -1329,9 +1344,9 @@ static void __init gather_bootmem_prealloc(void)
 #else
                 page = virt_to_page(m);
 #endif
-                __ClearPageReserved(page);
                 WARN_ON(page_count(page) != 1);
                 prep_compound_huge_page(page, h->order);
+                WARN_ON(PageReserved(page));
                 prep_new_huge_page(h, page, page_to_nid(page));
                 /*
                  * If we had gigantic hugepages allocated at boot time, we need
diff --git a/mm/hwpoison-inject.c b/mm/hwpoison-inject.c
index afc2daa91c60..4c84678371eb 100644
--- a/mm/hwpoison-inject.c
+++ b/mm/hwpoison-inject.c
@@ -20,8 +20,6 @@ static int hwpoison_inject(void *data, u64 val)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        if (!hwpoison_filter_enable)
-                goto inject;
         if (!pfn_valid(pfn))
                 return -ENXIO;
 
@@ -33,6 +31,9 @@ static int hwpoison_inject(void *data, u64 val)
         if (!get_page_unless_zero(hpage))
                 return 0;
 
+        if (!hwpoison_filter_enable)
+                goto inject;
+
         if (!PageLRU(p) && !PageHuge(p))
                 shake_page(p, 0);
         /*
diff --git a/mm/madvise.c b/mm/madvise.c
index 6975bc812542..539eeb96b323 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -343,10 +343,11 @@ static long madvise_remove(struct vm_area_struct *vma,
  */
 static int madvise_hwpoison(int bhv, unsigned long start, unsigned long end)
 {
+        struct page *p;
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
-        for (; start < end; start += PAGE_SIZE) {
-                struct page *p;
+        for (; start < end; start += PAGE_SIZE <<
+                                compound_order(compound_head(p))) {
                 int ret;
 
                 ret = get_user_pages_fast(start, 1, 0, &p);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d5ff3ce13029..34d3ca9572d6 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -39,6 +39,7 @@
 #include <linux/limits.h>
 #include <linux/export.h>
 #include <linux/mutex.h>
+#include <linux/rbtree.h>
 #include <linux/slab.h>
 #include <linux/swap.h>
 #include <linux/swapops.h>
@@ -160,6 +161,10 @@ struct mem_cgroup_per_zone {
 
         struct mem_cgroup_reclaim_iter reclaim_iter[DEF_PRIORITY + 1];
 
+        struct rb_node          tree_node;      /* RB tree node */
+        unsigned long long      usage_in_excess;/* Set to the value by which */
+                                                /* the soft limit is exceeded*/
+        bool                    on_tree;
         struct mem_cgroup       *memcg;         /* Back pointer, we cannot */
                                                 /* use container_of        */
 };
@@ -168,6 +173,26 @@ struct mem_cgroup_per_node {
         struct mem_cgroup_per_zone zoneinfo[MAX_NR_ZONES];
 };
 
+/*
+ * Cgroups above their limits are maintained in a RB-Tree, independent of
+ * their hierarchy representation
+ */
+
+struct mem_cgroup_tree_per_zone {
+        struct rb_root rb_root;
+        spinlock_t lock;
+};
+
+struct mem_cgroup_tree_per_node {
+        struct mem_cgroup_tree_per_zone rb_tree_per_zone[MAX_NR_ZONES];
+};
+
+struct mem_cgroup_tree {
+        struct mem_cgroup_tree_per_node *rb_tree_per_node[MAX_NUMNODES];
+};
+
+static struct mem_cgroup_tree soft_limit_tree __read_mostly;
+
 struct mem_cgroup_threshold {
         struct eventfd_ctx *eventfd;
         u64 threshold;
@@ -303,22 +328,6 @@ struct mem_cgroup {
         atomic_t        numainfo_events;
         atomic_t        numainfo_updating;
 #endif
-        /*
-         * Protects soft_contributed transitions.
-         * See mem_cgroup_update_soft_limit
-         */
-        spinlock_t soft_lock;
-
-        /*
-         * If true then this group has increased parents' children_in_excess
-         * when it got over the soft limit.
-         * When a group falls bellow the soft limit, parents' children_in_excess
-         * is decreased and soft_contributed changed to false.
-         */
-        bool soft_contributed;
-
-        /* Number of children that are in soft limit excess */
-        atomic_t children_in_excess;
 
         struct mem_cgroup_per_node *nodeinfo[0];
         /* WARNING: nodeinfo must be the last member here */
@@ -422,6 +431,7 @@ static bool move_file(void)
  * limit reclaim to prevent infinite loops, if they ever occur.
  */
 #define MEM_CGROUP_MAX_RECLAIM_LOOPS            100
+#define MEM_CGROUP_MAX_SOFT_LIMIT_RECLAIM_LOOPS 2
 
 enum charge_type {
         MEM_CGROUP_CHARGE_TYPE_CACHE = 0,
@@ -648,6 +658,164 @@ page_cgroup_zoneinfo(struct mem_cgroup *memcg, struct page *page)
         return mem_cgroup_zoneinfo(memcg, nid, zid);
 }
 
+static struct mem_cgroup_tree_per_zone *
+soft_limit_tree_node_zone(int nid, int zid)
+{
+        return &soft_limit_tree.rb_tree_per_node[nid]->rb_tree_per_zone[zid];
+}
+
+static struct mem_cgroup_tree_per_zone *
+soft_limit_tree_from_page(struct page *page)
+{
+        int nid = page_to_nid(page);
+        int zid = page_zonenum(page);
+
+        return &soft_limit_tree.rb_tree_per_node[nid]->rb_tree_per_zone[zid];
+}
+
+static void
+__mem_cgroup_insert_exceeded(struct mem_cgroup *memcg,
+                                struct mem_cgroup_per_zone *mz,
+                                struct mem_cgroup_tree_per_zone *mctz,
+                                unsigned long long new_usage_in_excess)
+{
+        struct rb_node **p = &mctz->rb_root.rb_node;
+        struct rb_node *parent = NULL;
+        struct mem_cgroup_per_zone *mz_node;
+
+        if (mz->on_tree)
+                return;
+
+        mz->usage_in_excess = new_usage_in_excess;
+        if (!mz->usage_in_excess)
+                return;
+        while (*p) {
+                parent = *p;
+                mz_node = rb_entry(parent, struct mem_cgroup_per_zone,
+                                        tree_node);
+                if (mz->usage_in_excess < mz_node->usage_in_excess)
+                        p = &(*p)->rb_left;
+                /*
+                 * We can't avoid mem cgroups that are over their soft
+                 * limit by the same amount
+                 */
+                else if (mz->usage_in_excess >= mz_node->usage_in_excess)
+                        p = &(*p)->rb_right;
+        }
+        rb_link_node(&mz->tree_node, parent, p);
+        rb_insert_color(&mz->tree_node, &mctz->rb_root);
+        mz->on_tree = true;
+}
+
+static void
+__mem_cgroup_remove_exceeded(struct mem_cgroup *memcg,
+                                struct mem_cgroup_per_zone *mz,
+                                struct mem_cgroup_tree_per_zone *mctz)
+{
+        if (!mz->on_tree)
+                return;
+        rb_erase(&mz->tree_node, &mctz->rb_root);
+        mz->on_tree = false;
+}
+
+static void
+mem_cgroup_remove_exceeded(struct mem_cgroup *memcg,
+                                struct mem_cgroup_per_zone *mz,
+                                struct mem_cgroup_tree_per_zone *mctz)
+{
+        spin_lock(&mctz->lock);
+        __mem_cgroup_remove_exceeded(memcg, mz, mctz);
+        spin_unlock(&mctz->lock);
+}
+
+
+static void mem_cgroup_update_tree(struct mem_cgroup *memcg, struct page *page)
+{
+        unsigned long long excess;
+        struct mem_cgroup_per_zone *mz;
+        struct mem_cgroup_tree_per_zone *mctz;
+        int nid = page_to_nid(page);
+        int zid = page_zonenum(page);
+        mctz = soft_limit_tree_from_page(page);
+
+        /*
+         * Necessary to update all ancestors when hierarchy is used.
+         * because their event counter is not touched.
+         */
+        for (; memcg; memcg = parent_mem_cgroup(memcg)) {
+                mz = mem_cgroup_zoneinfo(memcg, nid, zid);
+                excess = res_counter_soft_limit_excess(&memcg->res);
+                /*
+                 * We have to update the tree if mz is on RB-tree or
+                 * mem is over its softlimit.
+                 */
+                if (excess || mz->on_tree) {
+                        spin_lock(&mctz->lock);
+                        /* if on-tree, remove it */
+                        if (mz->on_tree)
+                                __mem_cgroup_remove_exceeded(memcg, mz, mctz);
+                        /*
+                         * Insert again. mz->usage_in_excess will be updated.
+                         * If excess is 0, no tree ops.
+                         */
+                        __mem_cgroup_insert_exceeded(memcg, mz, mctz, excess);
+                        spin_unlock(&mctz->lock);
+                }
+        }
+}
+
+static void mem_cgroup_remove_from_trees(struct mem_cgroup *memcg)
+{
+        int node, zone;
+        struct mem_cgroup_per_zone *mz;
+        struct mem_cgroup_tree_per_zone *mctz;
+
+        for_each_node(node) {
+                for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+                        mz = mem_cgroup_zoneinfo(memcg, node, zone);
+                        mctz = soft_limit_tree_node_zone(node, zone);
+                        mem_cgroup_remove_exceeded(memcg, mz, mctz);
+                }
+        }
+}
+
+static struct mem_cgroup_per_zone *
+__mem_cgroup_largest_soft_limit_node(struct mem_cgroup_tree_per_zone *mctz)
+{
+        struct rb_node *rightmost = NULL;
+        struct mem_cgroup_per_zone *mz;
+
+retry:
+        mz = NULL;
+        rightmost = rb_last(&mctz->rb_root);
+        if (!rightmost)
+                goto done;              /* Nothing to reclaim from */
+
+        mz = rb_entry(rightmost, struct mem_cgroup_per_zone, tree_node);
+        /*
+         * Remove the node now but someone else can add it back,
+         * we will to add it back at the end of reclaim to its correct
+         * position in the tree.
+         */
+        __mem_cgroup_remove_exceeded(mz->memcg, mz, mctz);
+        if (!res_counter_soft_limit_excess(&mz->memcg->res) ||
+                !css_tryget(&mz->memcg->css))
+                goto retry;
+done:
+        return mz;
+}
+
+static struct mem_cgroup_per_zone *
+mem_cgroup_largest_soft_limit_node(struct mem_cgroup_tree_per_zone *mctz)
+{
+        struct mem_cgroup_per_zone *mz;
+
+        spin_lock(&mctz->lock);
+        mz = __mem_cgroup_largest_soft_limit_node(mctz);
+        spin_unlock(&mctz->lock);
+        return mz;
+}
+
 /*
  * Implementation Note: reading percpu statistics for memcg.
  *
@@ -698,6 +866,7 @@ static unsigned long mem_cgroup_read_events(struct mem_cgroup *memcg,
         unsigned long val = 0;
         int cpu;
 
+        get_online_cpus();
         for_each_online_cpu(cpu)
                 val += per_cpu(memcg->stat->events[idx], cpu);
 #ifdef CONFIG_HOTPLUG_CPU
@@ -705,6 +874,7 @@ static unsigned long mem_cgroup_read_events(struct mem_cgroup *memcg,
         val += memcg->nocpu_base.events[idx];
         spin_unlock(&memcg->pcp_counter_lock);
 #endif
+        put_online_cpus();
         return val;
 }
 
@@ -822,48 +992,6 @@ static bool mem_cgroup_event_ratelimit(struct mem_cgroup *memcg,
 }
 
 /*
- * Called from rate-limited memcg_check_events when enough
- * MEM_CGROUP_TARGET_SOFTLIMIT events are accumulated and it makes sure
- * that all the parents up the hierarchy will be notified that this group
- * is in excess or that it is not in excess anymore. mmecg->soft_contributed
- * makes the transition a single action whenever the state flips from one to
- * the other.
- */
-static void mem_cgroup_update_soft_limit(struct mem_cgroup *memcg)
-{
-        unsigned long long excess = res_counter_soft_limit_excess(&memcg->res);
-        struct mem_cgroup *parent = memcg;
-        int delta = 0;
-
-        spin_lock(&memcg->soft_lock);
-        if (excess) {
-                if (!memcg->soft_contributed) {
-                        delta = 1;
-                        memcg->soft_contributed = true;
-                }
-        } else {
-                if (memcg->soft_contributed) {
-                        delta = -1;
-                        memcg->soft_contributed = false;
-                }
-        }
-
-        /*
-         * Necessary to update all ancestors when hierarchy is used
-         * because their event counter is not touched.
-         * We track children even outside the hierarchy for the root
-         * cgroup because tree walk starting at root should visit
-         * all cgroups and we want to prevent from pointless tree
-         * walk if no children is below the limit.
-         */
-        while (delta && (parent = parent_mem_cgroup(parent)))
-                atomic_add(delta, &parent->children_in_excess);
-        if (memcg != root_mem_cgroup && !root_mem_cgroup->use_hierarchy)
-                atomic_add(delta, &root_mem_cgroup->children_in_excess);
-        spin_unlock(&memcg->soft_lock);
-}
-
-/*
  * Check events in order.
  *
  */
@@ -886,7 +1014,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
 
                 mem_cgroup_threshold(memcg);
                 if (unlikely(do_softlimit))
-                        mem_cgroup_update_soft_limit(memcg);
+                        mem_cgroup_update_tree(memcg, page);
 #if MAX_NUMNODES > 1
                 if (unlikely(do_numainfo))
                         atomic_inc(&memcg->numainfo_events);
@@ -929,15 +1057,6 @@ struct mem_cgroup *try_get_mem_cgroup_from_mm(struct mm_struct *mm)
         return memcg;
 }
 
-static enum mem_cgroup_filter_t
-mem_cgroup_filter(struct mem_cgroup *memcg, struct mem_cgroup *root,
-                mem_cgroup_iter_filter cond)
-{
-        if (!cond)
-                return VISIT;
-        return cond(memcg, root);
-}
-
 /*
  * Returns a next (in a pre-order walk) alive memcg (with elevated css
  * ref. count) or NULL if the whole root's subtree has been visited.
@@ -945,7 +1064,7 @@ mem_cgroup_filter(struct mem_cgroup *memcg, struct mem_cgroup *root,
  * helper function to be used by mem_cgroup_iter
  */
 static struct mem_cgroup *__mem_cgroup_iter_next(struct mem_cgroup *root,
-                struct mem_cgroup *last_visited, mem_cgroup_iter_filter cond)
+                struct mem_cgroup *last_visited)
 {
         struct cgroup_subsys_state *prev_css, *next_css;
 
@@ -963,31 +1082,11 @@ skip_node:
         if (next_css) {
                 struct mem_cgroup *mem = mem_cgroup_from_css(next_css);
 
-                switch (mem_cgroup_filter(mem, root, cond)) {
-                case SKIP:
+                if (css_tryget(&mem->css))
+                        return mem;
+                else {
                         prev_css = next_css;
                         goto skip_node;
-                case SKIP_TREE:
-                        if (mem == root)
-                                return NULL;
-                        /*
-                         * css_rightmost_descendant is not an optimal way to
-                         * skip through a subtree (especially for imbalanced
-                         * trees leaning to right) but that's what we have right
-                         * now. More effective solution would be traversing
-                         * right-up for first non-NULL without calling
-                         * css_next_descendant_pre afterwards.
-                         */
-                        prev_css = css_rightmost_descendant(next_css);
-                        goto skip_node;
-                case VISIT:
-                        if (css_tryget(&mem->css))
-                                return mem;
-                        else {
-                                prev_css = next_css;
-                                goto skip_node;
-                        }
-                        break;
                 }
         }
 
@@ -1051,7 +1150,6 @@ static void mem_cgroup_iter_update(struct mem_cgroup_reclaim_iter *iter,
  * @root: hierarchy root
  * @prev: previously returned memcg, NULL on first invocation
  * @reclaim: cookie for shared reclaim walks, NULL for full walks
- * @cond: filter for visited nodes, NULL for no filter
  *
  * Returns references to children of the hierarchy below @root, or
  * @root itself, or %NULL after a full round-trip.
@@ -1064,18 +1162,15 @@ static void mem_cgroup_iter_update(struct mem_cgroup_reclaim_iter *iter,
  * divide up the memcgs in the hierarchy among all concurrent
  * reclaimers operating on the same zone and priority.
  */
-struct mem_cgroup *mem_cgroup_iter_cond(struct mem_cgroup *root,
+struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                                    struct mem_cgroup *prev,
-                                   struct mem_cgroup_reclaim_cookie *reclaim,
-                                   mem_cgroup_iter_filter cond)
+                                   struct mem_cgroup_reclaim_cookie *reclaim)
 {
         struct mem_cgroup *memcg = NULL;
         struct mem_cgroup *last_visited = NULL;
 
-        if (mem_cgroup_disabled()) {
-                /* first call must return non-NULL, second return NULL */
-                return (struct mem_cgroup *)(unsigned long)!prev;
-        }
+        if (mem_cgroup_disabled())
+                return NULL;
 
         if (!root)
                 root = root_mem_cgroup;
@@ -1086,9 +1181,7 @@ struct mem_cgroup *mem_cgroup_iter_cond(struct mem_cgroup *root,
         if (!root->use_hierarchy && root != root_mem_cgroup) {
                 if (prev)
                         goto out_css_put;
-                if (mem_cgroup_filter(root, root, cond) == VISIT)
-                        return root;
-                return NULL;
+                return root;
         }
 
         rcu_read_lock();
@@ -1111,7 +1204,7 @@ struct mem_cgroup *mem_cgroup_iter_cond(struct mem_cgroup *root,
                         last_visited = mem_cgroup_iter_load(iter, root, &seq);
                 }
 
-                memcg = __mem_cgroup_iter_next(root, last_visited, cond);
+                memcg = __mem_cgroup_iter_next(root, last_visited);
 
                 if (reclaim) {
                         mem_cgroup_iter_update(iter, last_visited, memcg, seq);
@@ -1122,11 +1215,7 @@ struct mem_cgroup *mem_cgroup_iter_cond(struct mem_cgroup *root,
                                 reclaim->generation = iter->generation;
                 }
 
-                /*
-                 * We have finished the whole tree walk or no group has been
-                 * visited because filter told us to skip the root node.
-                 */
-                if (!memcg && (prev || (cond && !last_visited)))
+                if (prev && !memcg)
                         goto out_unlock;
         }
 out_unlock:
@@ -1767,7 +1856,6 @@ static unsigned long mem_cgroup_reclaim(struct mem_cgroup *memcg,
         return total;
 }
 
-#if MAX_NUMNODES > 1
 /**
  * test_mem_cgroup_node_reclaimable
  * @memcg: the target memcg
@@ -1790,6 +1878,7 @@ static bool test_mem_cgroup_node_reclaimable(struct mem_cgroup *memcg,
         return false;
 
 }
+#if MAX_NUMNODES > 1
 
 /*
  * Always updating the nodemask is not very good - even if we have an empty
@@ -1857,50 +1946,104 @@ int mem_cgroup_select_victim_node(struct mem_cgroup *memcg)
         return node;
 }
 
+/*
+ * Check all nodes whether it contains reclaimable pages or not.
+ * For quick scan, we make use of scan_nodes. This will allow us to skip
+ * unused nodes. But scan_nodes is lazily updated and may not cotain
+ * enough new information. We need to do double check.
+ */
+static bool mem_cgroup_reclaimable(struct mem_cgroup *memcg, bool noswap)
+{
+        int nid;
+
+        /*
+         * quick check...making use of scan_node.
+         * We can skip unused nodes.
+         */
+        if (!nodes_empty(memcg->scan_nodes)) {
+                for (nid = first_node(memcg->scan_nodes);
+                     nid < MAX_NUMNODES;
+                     nid = next_node(nid, memcg->scan_nodes)) {
+
+                        if (test_mem_cgroup_node_reclaimable(memcg, nid, noswap))
+                                return true;
+                }
+        }
+        /*
+         * Check rest of nodes.
+         */
+        for_each_node_state(nid, N_MEMORY) {
+                if (node_isset(nid, memcg->scan_nodes))
+                        continue;
+                if (test_mem_cgroup_node_reclaimable(memcg, nid, noswap))
+                        return true;
+        }
+        return false;
+}
+
 #else
 int mem_cgroup_select_victim_node(struct mem_cgroup *memcg)
 {
         return 0;
 }
 
-#endif
-
-/*
- * A group is eligible for the soft limit reclaim under the given root
- * hierarchy if
- *      a) it is over its soft limit
- *      b) any parent up the hierarchy is over its soft limit
- *
- * If the given group doesn't have any children over the limit then it
- * doesn't make any sense to iterate its subtree.
- */
-enum mem_cgroup_filter_t
-mem_cgroup_soft_reclaim_eligible(struct mem_cgroup *memcg,
-                struct mem_cgroup *root)
+static bool mem_cgroup_reclaimable(struct mem_cgroup *memcg, bool noswap)
 {
-        struct mem_cgroup *parent;
-
-        if (!memcg)
-                memcg = root_mem_cgroup;
-        parent = memcg;
-
-        if (res_counter_soft_limit_excess(&memcg->res))
-                return VISIT;
+        return test_mem_cgroup_node_reclaimable(memcg, 0, noswap);
+}
+#endif
 
-        /*
-         * If any parent up to the root in the hierarchy is over its soft limit
-         * then we have to obey and reclaim from this group as well.
-         */
-        while ((parent = parent_mem_cgroup(parent))) {
-                if (res_counter_soft_limit_excess(&parent->res))
-                        return VISIT;
-                if (parent == root)
+static int mem_cgroup_soft_reclaim(struct mem_cgroup *root_memcg,
+                                   struct zone *zone,
+                                   gfp_t gfp_mask,
+                                   unsigned long *total_scanned)
+{
+        struct mem_cgroup *victim = NULL;
+        int total = 0;
+        int loop = 0;
+        unsigned long excess;
+        unsigned long nr_scanned;
+        struct mem_cgroup_reclaim_cookie reclaim = {
+                .zone = zone,
+                .priority = 0,
+        };
+
+        excess = res_counter_soft_limit_excess(&root_memcg->res) >> PAGE_SHIFT;
+
+        while (1) {
+                victim = mem_cgroup_iter(root_memcg, victim, &reclaim);
+                if (!victim) {
+                        loop++;
+                        if (loop >= 2) {
+                                /*
+                                 * If we have not been able to reclaim
+                                 * anything, it might because there are
+                                 * no reclaimable pages under this hierarchy
+                                 */
+                                if (!total)
+                                        break;
+                                /*
+                                 * We want to do more targeted reclaim.
+                                 * excess >> 2 is not to excessive so as to
+                                 * reclaim too much, nor too less that we keep
+                                 * coming back to reclaim from this cgroup
+                                 */
+                                if (total >= (excess >> 2) ||
+                                        (loop > MEM_CGROUP_MAX_RECLAIM_LOOPS))
+                                        break;
+                        }
+                        continue;
+                }
+                if (!mem_cgroup_reclaimable(victim, false))
+                        continue;
+                total += mem_cgroup_shrink_node_zone(victim, gfp_mask, false,
+                                                     zone, &nr_scanned);
+                *total_scanned += nr_scanned;
+                if (!res_counter_soft_limit_excess(&root_memcg->res))
                         break;
         }
-
-        if (!atomic_read(&memcg->children_in_excess))
-                return SKIP_TREE;
-        return SKIP;
+        mem_cgroup_iter_break(root_memcg, victim);
+        return total;
 }
 
 static DEFINE_SPINLOCK(memcg_oom_lock);
@@ -2018,110 +2161,59 @@ static void memcg_oom_recover(struct mem_cgroup *memcg)
                 memcg_wakeup_oom(memcg);
 }
 
-/*
- * try to call OOM killer
- */
 static void mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int order)
 {
-        bool locked;
-        int wakeups;
-
         if (!current->memcg_oom.may_oom)
                 return;
-
-        current->memcg_oom.in_memcg_oom = 1;
-
         /*
-         * As with any blocking lock, a contender needs to start
-         * listening for wakeups before attempting the trylock,
-         * otherwise it can miss the wakeup from the unlock and sleep
-         * indefinitely.  This is just open-coded because our locking
-         * is so particular to memcg hierarchies.
+         * We are in the middle of the charge context here, so we
+         * don't want to block when potentially sitting on a callstack
+         * that holds all kinds of filesystem and mm locks.
+         *
+         * Also, the caller may handle a failed allocation gracefully
+         * (like optional page cache readahead) and so an OOM killer
+         * invocation might not even be necessary.
+         *
+         * That's why we don't do anything here except remember the
+         * OOM context and then deal with it at the end of the page
+         * fault when the stack is unwound, the locks are released,
+         * and when we know whether the fault was overall successful.
          */
-        wakeups = atomic_read(&memcg->oom_wakeups);
-        mem_cgroup_mark_under_oom(memcg);
-
-        locked = mem_cgroup_oom_trylock(memcg);
-
-        if (locked)
-                mem_cgroup_oom_notify(memcg);
-
-        if (locked && !memcg->oom_kill_disable) {
-                mem_cgroup_unmark_under_oom(memcg);
-                mem_cgroup_out_of_memory(memcg, mask, order);
-                mem_cgroup_oom_unlock(memcg);
-                /*
-                 * There is no guarantee that an OOM-lock contender
-                 * sees the wakeups triggered by the OOM kill
-                 * uncharges.  Wake any sleepers explicitely.
-                 */
-                memcg_oom_recover(memcg);
-        } else {
-                /*
-                 * A system call can just return -ENOMEM, but if this
-                 * is a page fault and somebody else is handling the
-                 * OOM already, we need to sleep on the OOM waitqueue
-                 * for this memcg until the situation is resolved.
-                 * Which can take some time because it might be
-                 * handled by a userspace task.
-                 *
-                 * However, this is the charge context, which means
-                 * that we may sit on a large call stack and hold
-                 * various filesystem locks, the mmap_sem etc. and we
-                 * don't want the OOM handler to deadlock on them
-                 * while we sit here and wait.  Store the current OOM
-                 * context in the task_struct, then return -ENOMEM.
-                 * At the end of the page fault handler, with the
-                 * stack unwound, pagefault_out_of_memory() will check
-                 * back with us by calling
-                 * mem_cgroup_oom_synchronize(), possibly putting the
-                 * task to sleep.
-                 */
-                current->memcg_oom.oom_locked = locked;
-                current->memcg_oom.wakeups = wakeups;
-                css_get(&memcg->css);
-                current->memcg_oom.wait_on_memcg = memcg;
-        }
+        css_get(&memcg->css);
+        current->memcg_oom.memcg = memcg;
+        current->memcg_oom.gfp_mask = mask;
+        current->memcg_oom.order = order;
 }
 
 /**
  * mem_cgroup_oom_synchronize - complete memcg OOM handling
+ * @handle: actually kill/wait or just clean up the OOM state
  *
- * This has to be called at the end of a page fault if the the memcg
- * OOM handler was enabled and the fault is returning %VM_FAULT_OOM.
+ * This has to be called at the end of a page fault if the memcg OOM
+ * handler was enabled.
  *
- * Memcg supports userspace OOM handling, so failed allocations must
+ * Memcg supports userspace OOM handling where failed allocations must
  * sleep on a waitqueue until the userspace task resolves the
  * situation.  Sleeping directly in the charge context with all kinds
  * of locks held is not a good idea, instead we remember an OOM state
  * in the task and mem_cgroup_oom_synchronize() has to be called at
- * the end of the page fault to put the task to sleep and clean up the
- * OOM state.
+ * the end of the page fault to complete the OOM handling.
  *
  * Returns %true if an ongoing memcg OOM situation was detected and
- * finalized, %false otherwise.
+ * completed, %false otherwise.
  */
-bool mem_cgroup_oom_synchronize(void)
+bool mem_cgroup_oom_synchronize(bool handle)
 {
+        struct mem_cgroup *memcg = current->memcg_oom.memcg;
         struct oom_wait_info owait;
-        struct mem_cgroup *memcg;
+        bool locked;
 
         /* OOM is global, do not handle */
-        if (!current->memcg_oom.in_memcg_oom)
-                return false;
-
-        /*
-         * We invoked the OOM killer but there is a chance that a kill
-         * did not free up any charges.  Everybody else might already
-         * be sleeping, so restart the fault and keep the rampage
-         * going until some charges are released.
-         */
-        memcg = current->memcg_oom.wait_on_memcg;
         if (!memcg)
-                goto out;
+                return false;
 
-        if (test_thread_flag(TIF_MEMDIE) || fatal_signal_pending(current))
-                goto out_memcg;
+        if (!handle)
+                goto cleanup;
 
         owait.memcg = memcg;
         owait.wait.flags = 0;
@@ -2130,13 +2222,25 @@ bool mem_cgroup_oom_synchronize(void)
         INIT_LIST_HEAD(&owait.wait.task_list);
 
         prepare_to_wait(&memcg_oom_waitq, &owait.wait, TASK_KILLABLE);
-        /* Only sleep if we didn't miss any wakeups since OOM */
-        if (atomic_read(&memcg->oom_wakeups) == current->memcg_oom.wakeups)
+        mem_cgroup_mark_under_oom(memcg);
+
+        locked = mem_cgroup_oom_trylock(memcg);
+
+        if (locked)
+                mem_cgroup_oom_notify(memcg);
+
+        if (locked && !memcg->oom_kill_disable) {
+                mem_cgroup_unmark_under_oom(memcg);
+                finish_wait(&memcg_oom_waitq, &owait.wait);
+                mem_cgroup_out_of_memory(memcg, current->memcg_oom.gfp_mask,
+                                         current->memcg_oom.order);
+        } else {
                 schedule();
-        finish_wait(&memcg_oom_waitq, &owait.wait);
-out_memcg:
-        mem_cgroup_unmark_under_oom(memcg);
-        if (current->memcg_oom.oom_locked) {
+                mem_cgroup_unmark_under_oom(memcg);
+                finish_wait(&memcg_oom_waitq, &owait.wait);
+        }
+
+        if (locked) {
                 mem_cgroup_oom_unlock(memcg);
                 /*
                  * There is no guarantee that an OOM-lock contender
@@ -2145,10 +2249,9 @@ out_memcg:
                  */
                 memcg_oom_recover(memcg);
         }
+cleanup:
+        current->memcg_oom.memcg = NULL;
         css_put(&memcg->css);
-        current->memcg_oom.wait_on_memcg = NULL;
-out:
-        current->memcg_oom.in_memcg_oom = 0;
         return true;
 }
 
@@ -2562,6 +2665,9 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                      || fatal_signal_pending(current)))
                 goto bypass;
 
+        if (unlikely(task_in_memcg_oom(current)))
+                goto bypass;
+
         /*
          * We always charge the cgroup the mm_struct belongs to.
          * The mm_struct's mem_cgroup changes on task migration if the
@@ -2660,6 +2766,8 @@ done:
         return 0;
 nomem:
         *ptr = NULL;
+        if (gfp_mask & __GFP_NOFAIL)
+                return 0;
         return -ENOMEM;
 bypass:
         *ptr = root_mem_cgroup;
@@ -2812,7 +2920,9 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
         unlock_page_cgroup(pc);
 
         /*
-         * "charge_statistics" updated event counter.
+         * "charge_statistics" updated event counter. Then, check it.
+         * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
+         * if they exceeds softlimit.
          */
         memcg_check_events(memcg, page);
 }
@@ -4647,6 +4757,98 @@ static int mem_cgroup_resize_memsw_limit(struct mem_cgroup *memcg,
         return ret;
 }
 
+unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
+                                            gfp_t gfp_mask,
+                                            unsigned long *total_scanned)
+{
+        unsigned long nr_reclaimed = 0;
+        struct mem_cgroup_per_zone *mz, *next_mz = NULL;
+        unsigned long reclaimed;
+        int loop = 0;
+        struct mem_cgroup_tree_per_zone *mctz;
+        unsigned long long excess;
+        unsigned long nr_scanned;
+
+        if (order > 0)
+                return 0;
+
+        mctz = soft_limit_tree_node_zone(zone_to_nid(zone), zone_idx(zone));
+        /*
+         * This loop can run a while, specially if mem_cgroup's continuously
+         * keep exceeding their soft limit and putting the system under
+         * pressure
+         */
+        do {
+                if (next_mz)
+                        mz = next_mz;
+                else
+                        mz = mem_cgroup_largest_soft_limit_node(mctz);
+                if (!mz)
+                        break;
+
+                nr_scanned = 0;
+                reclaimed = mem_cgroup_soft_reclaim(mz->memcg, zone,
+                                                    gfp_mask, &nr_scanned);
+                nr_reclaimed += reclaimed;
+                *total_scanned += nr_scanned;
+                spin_lock(&mctz->lock);
+
+                /*
+                 * If we failed to reclaim anything from this memory cgroup
+                 * it is time to move on to the next cgroup
+                 */
+                next_mz = NULL;
+                if (!reclaimed) {
+                        do {
+                                /*
+                                 * Loop until we find yet another one.
+                                 *
+                                 * By the time we get the soft_limit lock
+                                 * again, someone might have aded the
+                                 * group back on the RB tree. Iterate to
+                                 * make sure we get a different mem.
+                                 * mem_cgroup_largest_soft_limit_node returns
+                                 * NULL if no other cgroup is present on
+                                 * the tree
+                                 */
+                                next_mz =
+                                __mem_cgroup_largest_soft_limit_node(mctz);
+                                if (next_mz == mz)
+                                        css_put(&next_mz->memcg->css);
+                                else /* next_mz == NULL or other memcg */
+                                        break;
+                        } while (1);
+                }
+                __mem_cgroup_remove_exceeded(mz->memcg, mz, mctz);
+                excess = res_counter_soft_limit_excess(&mz->memcg->res);
+                /*
+                 * One school of thought says that we should not add
+                 * back the node to the tree if reclaim returns 0.
+                 * But our reclaim could return 0, simply because due
+                 * to priority we are exposing a smaller subset of
+                 * memory to reclaim from. Consider this as a longer
+                 * term TODO.
+                 */
+                /* If excess == 0, no tree ops */
+                __mem_cgroup_insert_exceeded(mz->memcg, mz, mctz, excess);
+                spin_unlock(&mctz->lock);
+                css_put(&mz->memcg->css);
+                loop++;
+                /*
+                 * Could not reclaim anything and there are no more
+                 * mem cgroups to try or we seem to be looping without
+                 * reclaiming anything.
+                 */
+                if (!nr_reclaimed &&
+                        (next_mz == NULL ||
+                        loop > MEM_CGROUP_MAX_SOFT_LIMIT_RECLAIM_LOOPS))
+                        break;
+        } while (!nr_reclaimed);
+        if (next_mz)
+                css_put(&next_mz->memcg->css);
+        return nr_reclaimed;
+}
+
 /**
  * mem_cgroup_force_empty_list - clears LRU of a group
  * @memcg: group to clear
@@ -5911,6 +6113,8 @@ static int alloc_mem_cgroup_per_zone_info(struct mem_cgroup *memcg, int node)
         for (zone = 0; zone < MAX_NR_ZONES; zone++) {
                 mz = &pn->zoneinfo[zone];
                 lruvec_init(&mz->lruvec);
+                mz->usage_in_excess = 0;
+                mz->on_tree = false;
                 mz->memcg = memcg;
         }
         memcg->nodeinfo[node] = pn;
@@ -5966,6 +6170,7 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
         int node;
         size_t size = memcg_size();
 
+        mem_cgroup_remove_from_trees(memcg);
         free_css_id(&mem_cgroup_subsys, &memcg->css);
 
         for_each_node(node)
@@ -6002,6 +6207,29 @@ struct mem_cgroup *parent_mem_cgroup(struct mem_cgroup *memcg)
 }
 EXPORT_SYMBOL(parent_mem_cgroup);
 
+static void __init mem_cgroup_soft_limit_tree_init(void)
+{
+        struct mem_cgroup_tree_per_node *rtpn;
+        struct mem_cgroup_tree_per_zone *rtpz;
+        int tmp, node, zone;
+
+        for_each_node(node) {
+                tmp = node;
+                if (!node_state(node, N_NORMAL_MEMORY))
+                        tmp = -1;
+                rtpn = kzalloc_node(sizeof(*rtpn), GFP_KERNEL, tmp);
+                BUG_ON(!rtpn);
+
+                soft_limit_tree.rb_tree_per_node[node] = rtpn;
+
+                for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+                        rtpz = &rtpn->rb_tree_per_zone[zone];
+                        rtpz->rb_root = RB_ROOT;
+                        spin_lock_init(&rtpz->lock);
+                }
+        }
+}
+
 static struct cgroup_subsys_state * __ref
 mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
 {
@@ -6031,7 +6259,6 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
         mutex_init(&memcg->thresholds_lock);
         spin_lock_init(&memcg->move_lock);
         vmpressure_init(&memcg->vmpressure);
-        spin_lock_init(&memcg->soft_lock);
 
         return &memcg->css;
 
@@ -6109,13 +6336,6 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 
         mem_cgroup_invalidate_reclaim_iterators(memcg);
         mem_cgroup_reparent_charges(memcg);
-        if (memcg->soft_contributed) {
-                while ((memcg = parent_mem_cgroup(memcg)))
-                        atomic_dec(&memcg->children_in_excess);
-
-                if (memcg != root_mem_cgroup && !root_mem_cgroup->use_hierarchy)
-                        atomic_dec(&root_mem_cgroup->children_in_excess);
-        }
         mem_cgroup_destroy_all_caches(memcg);
         vmpressure_cleanup(&memcg->vmpressure);
 }
@@ -6790,6 +7010,7 @@ static int __init mem_cgroup_init(void)
 {
         hotcpu_notifier(memcg_cpu_hotplug_callback, 0);
         enable_swap_cgroup();
+        mem_cgroup_soft_limit_tree_init();
         memcg_stock_init();
         return 0;
 }
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 947ed5413279..bf3351b5115e 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1114,8 +1114,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                          * shake_page could have turned it free.
                          */
                         if (is_free_buddy_page(p)) {
-                                action_result(pfn, "free buddy, 2nd try",
-                                                DELAYED);
+                                if (flags & MF_COUNT_INCREASED)
+                                        action_result(pfn, "free buddy", DELAYED);
+                                else
+                                        action_result(pfn, "free buddy, 2nd try", DELAYED);
                                 return 0;
                         }
                         action_result(pfn, "non LRU", IGNORED);
@@ -1349,7 +1351,7 @@ int unpoison_memory(unsigned long pfn)
          * worked by memory_failure() and the page lock is not held yet.
          * In such case, we yield to memory_failure() and make unpoison fail.
          */
-        if (PageTransHuge(page)) {
+        if (!PageHuge(page) && PageTransHuge(page)) {
                 pr_info("MCE: Memory failure is now running on %#lx\n", pfn);
                         return 0;
         }
diff --git a/mm/memory.c b/mm/memory.c
index ca0003947115..1311f26497e6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -837,6 +837,8 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                                          */
                                         make_migration_entry_read(&entry);
                                         pte = swp_entry_to_pte(entry);
+                                        if (pte_swp_soft_dirty(*src_pte))
+                                                pte = pte_swp_mksoft_dirty(pte);
                                         set_pte_at(src_mm, addr, src_pte, pte);
                                 }
                         }
@@ -3863,15 +3865,21 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * space.  Kernel faults are handled more gracefully.
          */
         if (flags & FAULT_FLAG_USER)
-                mem_cgroup_enable_oom();
+                mem_cgroup_oom_enable();
 
         ret = __handle_mm_fault(mm, vma, address, flags);
 
-        if (flags & FAULT_FLAG_USER)
-                mem_cgroup_disable_oom();
-
-        if (WARN_ON(task_in_memcg_oom(current) && !(ret & VM_FAULT_OOM)))
-                mem_cgroup_oom_synchronize();
+        if (flags & FAULT_FLAG_USER) {
+                mem_cgroup_oom_disable();
+                /*
+                 * The task may have entered a memcg OOM situation but
+                 * if the allocation error was handled gracefully (no
+                 * VM_FAULT_OOM), there is no need to kill anything.
+                 * Just clean up the OOM state peacefully.
+                 */
+                if (task_in_memcg_oom(current) && !(ret & VM_FAULT_OOM))
+                        mem_cgroup_oom_synchronize(false);
+        }
 
         return ret;
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 9c8d5f59d30b..7a7325ee1d08 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -107,7 +107,7 @@ void putback_movable_pages(struct list_head *l)
                 list_del(&page->lru);
                 dec_zone_page_state(page, NR_ISOLATED_ANON +
                                 page_is_file_cache(page));
-                if (unlikely(balloon_page_movable(page)))
+                if (unlikely(isolated_balloon_page(page)))
                         balloon_page_putback(page);
                 else
                         putback_lru_page(page);
@@ -161,6 +161,8 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
 
         get_page(new);
         pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
+        if (pte_swp_soft_dirty(*ptep))
+                pte = pte_mksoft_dirty(pte);
         if (is_write_migration_entry(entry))
                 pte = pte_mkwrite(pte);
 #ifdef CONFIG_HUGETLB_PAGE
diff --git a/mm/mlock.c b/mm/mlock.c
index d63802663242..d480cd6fc475 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -379,10 +379,14 @@ static unsigned long __munlock_pagevec_fill(struct pagevec *pvec,
 
         /*
          * Initialize pte walk starting at the already pinned page where we
-         * are sure that there is a pte.
+         * are sure that there is a pte, as it was pinned under the same
+         * mmap_sem write op.
          */
         pte = get_locked_pte(vma->vm_mm, start, &ptl);
-        end = min(end, pmd_addr_end(start, end));
+        /* Make sure we do not cross the page table boundary */
+        end = pgd_addr_end(start, end);
+        end = pud_addr_end(start, end);
+        end = pmd_addr_end(start, end);
 
         /* The page next to the pinned page is the first we will try to get */
         start += PAGE_SIZE;
@@ -736,6 +740,7 @@ static int do_mlockall(int flags)
 
                 /* Ignore errors */
                 mlock_fixup(vma, &prev, vma->vm_start, vma->vm_end, newflags);
+                cond_resched();
         }
 out:
         return 0;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 94722a4d6b43..a3af058f68e4 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -94,13 +94,16 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                         swp_entry_t entry = pte_to_swp_entry(oldpte);
 
                         if (is_write_migration_entry(entry)) {
+                                pte_t newpte;
                                 /*
                                  * A protection check is difficult so
                                  * just be safe and disable write
                                  */
                                 make_migration_entry_read(&entry);
-                                set_pte_at(mm, addr, pte,
-                                        swp_entry_to_pte(entry));
+                                newpte = swp_entry_to_pte(entry);
+                                if (pte_swp_soft_dirty(oldpte))
+                                        newpte = pte_swp_mksoft_dirty(newpte);
+                                set_pte_at(mm, addr, pte, newpte);
                         }
                         pages++;
                 }
diff --git a/mm/mremap.c b/mm/mremap.c
index 91b13d6a16d4..0843feb66f3d 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -25,7 +25,6 @@
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
-#include <asm/pgalloc.h>
 
 #include "internal.h"
 
@@ -63,10 +62,8 @@ static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
                 return NULL;
 
         pmd = pmd_alloc(mm, pud, addr);
-        if (!pmd) {
-                pud_free(mm, pud);
+        if (!pmd)
                 return NULL;
-        }
 
         VM_BUG_ON(pmd_trans_huge(*pmd));
 
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 314e9d274381..6738c47f1f72 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -680,7 +680,7 @@ void pagefault_out_of_memory(void)
 {
         struct zonelist *zonelist;
 
-        if (mem_cgroup_oom_synchronize())
+        if (mem_cgroup_oom_synchronize(true))
                 return;
 
         zonelist = node_zonelist(first_online_node, GFP_KERNEL);
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index f5236f804aa6..63807583d8e8 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -1210,11 +1210,11 @@ static unsigned long dirty_poll_interval(unsigned long dirty,
         return 1;
 }
 
-static long bdi_max_pause(struct backing_dev_info *bdi,
-                          unsigned long bdi_dirty)
+static unsigned long bdi_max_pause(struct backing_dev_info *bdi,
+                                   unsigned long bdi_dirty)
 {
-        long bw = bdi->avg_write_bandwidth;
-        long t;
+        unsigned long bw = bdi->avg_write_bandwidth;
+        unsigned long t;
 
         /*
          * Limit pause time for small memory systems. If sleeping for too long
@@ -1226,7 +1226,7 @@ static long bdi_max_pause(struct backing_dev_info *bdi,
         t = bdi_dirty / (1 + bw / roundup_pow_of_two(1 + HZ / 8));
         t++;
 
-        return min_t(long, t, MAX_PAUSE);
+        return min_t(unsigned long, t, MAX_PAUSE);
 }
 
 static long bdi_min_pause(struct backing_dev_info *bdi,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 0ee638f76ebe..dd886fac451a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6366,10 +6366,6 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
                 list_del(&page->lru);
                 rmv_page_order(page);
                 zone->free_area[order].nr_free--;
-#ifdef CONFIG_HIGHMEM
-                if (PageHighMem(page))
-                        totalhigh_pages -= 1 << order;
-#endif
                 for (i = 0; i < (1 << order); i++)
                         SetPageReserved((page+i));
                 pfn += (1 << order);
diff --git a/mm/slab_common.c b/mm/slab_common.c
index a3443278ce3a..e2e98af703ea 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -56,6 +56,7 @@ static int kmem_cache_sanity_check(struct mem_cgroup *memcg, const char *name,
                         continue;
                 }
 
+#if !defined(CONFIG_SLUB) || !defined(CONFIG_SLUB_DEBUG_ON)
                 /*
                  * For simplicity, we won't check this in the list of memcg
                  * caches. We have control over memcg naming, and if there
@@ -69,6 +70,7 @@ static int kmem_cache_sanity_check(struct mem_cgroup *memcg, const char *name,
                         s = NULL;
                         return -EINVAL;
                 }
+#endif
         }
 
         WARN_ON(strchr(name, ' '));     /* It confuses parsers */
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 3963fc24fcc1..de7c904e52e5 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1824,6 +1824,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         struct filename *pathname;
         int i, type, prev;
         int err;
+        unsigned int old_block_size;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
@@ -1914,6 +1915,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         }
 
         swap_file = p->swap_file;
+        old_block_size = p->old_block_size;
         p->swap_file = NULL;
         p->max = 0;
         swap_map = p->swap_map;
@@ -1938,7 +1940,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
         inode = mapping->host;
         if (S_ISBLK(inode->i_mode)) {
                 struct block_device *bdev = I_BDEV(inode);
-                set_blocksize(bdev, p->old_block_size);
+                set_blocksize(bdev, old_block_size);
                 blkdev_put(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
         } else {
                 mutex_lock(&inode->i_mutex);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8ed1b775bdc9..eea668d9cff6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -48,6 +48,7 @@
 #include <asm/div64.h>
 
 #include <linux/swapops.h>
+#include <linux/balloon_compaction.h>
 
 #include "internal.h"
 
@@ -139,23 +140,11 @@ static bool global_reclaim(struct scan_control *sc)
 {
         return !sc->target_mem_cgroup;
 }
-
-static bool mem_cgroup_should_soft_reclaim(struct scan_control *sc)
-{
-        struct mem_cgroup *root = sc->target_mem_cgroup;
-        return !mem_cgroup_disabled() &&
-                mem_cgroup_soft_reclaim_eligible(root, root) != SKIP_TREE;
-}
 #else
 static bool global_reclaim(struct scan_control *sc)
 {
         return true;
 }
-
-static bool mem_cgroup_should_soft_reclaim(struct scan_control *sc)
-{
-        return false;
-}
 #endif
 
 unsigned long zone_reclaimable_pages(struct zone *zone)
@@ -222,6 +211,7 @@ void unregister_shrinker(struct shrinker *shrinker)
         down_write(&shrinker_rwsem);
         list_del(&shrinker->list);
         up_write(&shrinker_rwsem);
+        kfree(shrinker->nr_deferred);
 }
 EXPORT_SYMBOL(unregister_shrinker);
 
@@ -1125,7 +1115,8 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
         LIST_HEAD(clean_pages);
 
         list_for_each_entry_safe(page, next, page_list, lru) {
-                if (page_is_file_cache(page) && !PageDirty(page)) {
+                if (page_is_file_cache(page) && !PageDirty(page) &&
+                    !isolated_balloon_page(page)) {
                         ClearPageActive(page);
                         list_move(&page->lru, &clean_pages);
                 }
@@ -2176,11 +2167,9 @@ static inline bool should_continue_reclaim(struct zone *zone,
         }
 }
 
-static int
-__shrink_zone(struct zone *zone, struct scan_control *sc, bool soft_reclaim)
+static void shrink_zone(struct zone *zone, struct scan_control *sc)
 {
         unsigned long nr_reclaimed, nr_scanned;
-        int groups_scanned = 0;
 
         do {
                 struct mem_cgroup *root = sc->target_mem_cgroup;
@@ -2188,17 +2177,15 @@ __shrink_zone(struct zone *zone, struct scan_control *sc, bool soft_reclaim)
                         .zone = zone,
                         .priority = sc->priority,
                 };
-                struct mem_cgroup *memcg = NULL;
-                mem_cgroup_iter_filter filter = (soft_reclaim) ?
-                        mem_cgroup_soft_reclaim_eligible : NULL;
+                struct mem_cgroup *memcg;
 
                 nr_reclaimed = sc->nr_reclaimed;
                 nr_scanned = sc->nr_scanned;
 
-                while ((memcg = mem_cgroup_iter_cond(root, memcg, &reclaim, filter))) {
+                memcg = mem_cgroup_iter(root, NULL, &reclaim);
+                do {
                         struct lruvec *lruvec;
 
-                        groups_scanned++;
                         lruvec = mem_cgroup_zone_lruvec(zone, memcg);
 
                         shrink_lruvec(lruvec, sc);
@@ -2218,7 +2205,8 @@ __shrink_zone(struct zone *zone, struct scan_control *sc, bool soft_reclaim)
                                 mem_cgroup_iter_break(root, memcg);
                                 break;
                         }
-                }
+                        memcg = mem_cgroup_iter(root, memcg, &reclaim);
+                } while (memcg);
 
                 vmpressure(sc->gfp_mask, sc->target_mem_cgroup,
                            sc->nr_scanned - nr_scanned,
@@ -2226,37 +2214,6 @@ __shrink_zone(struct zone *zone, struct scan_control *sc, bool soft_reclaim)
 
         } while (should_continue_reclaim(zone, sc->nr_reclaimed - nr_reclaimed,
                                          sc->nr_scanned - nr_scanned, sc));
-
-        return groups_scanned;
-}
-
-
-static void shrink_zone(struct zone *zone, struct scan_control *sc)
-{
-        bool do_soft_reclaim = mem_cgroup_should_soft_reclaim(sc);
-        unsigned long nr_scanned = sc->nr_scanned;
-        int scanned_groups;
-
-        scanned_groups = __shrink_zone(zone, sc, do_soft_reclaim);
-        /*
-         * memcg iterator might race with other reclaimer or start from
-         * a incomplete tree walk so the tree walk in __shrink_zone
-         * might have missed groups that are above the soft limit. Try
-         * another loop to catch up with others. Do it just once to
-         * prevent from reclaim latencies when other reclaimers always
-         * preempt this one.
-         */
-        if (do_soft_reclaim && !scanned_groups)
-                __shrink_zone(zone, sc, do_soft_reclaim);
-
-        /*
-         * No group is over the soft limit or those that are do not have
-         * pages in the zone we are reclaiming so we have to reclaim everybody
-         */
-        if (do_soft_reclaim && (sc->nr_scanned == nr_scanned)) {
-                __shrink_zone(zone, sc, false);
-                return;
-        }
 }
 
 /* Returns true if compaction should go ahead for a high-order request */
@@ -2320,6 +2277,8 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc)
 {
         struct zoneref *z;
         struct zone *zone;
+        unsigned long nr_soft_reclaimed;
+        unsigned long nr_soft_scanned;
         bool aborted_reclaim = false;
 
         /*
@@ -2359,6 +2318,18 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc)
                                         continue;
                                 }
                         }
+                        /*
+                         * This steals pages from memory cgroups over softlimit
+                         * and returns the number of reclaimed pages and
+                         * scanned pages. This works for global memory pressure
+                         * and balancing, not for a memcg's limit.
+                         */
+                        nr_soft_scanned = 0;
+                        nr_soft_reclaimed = mem_cgroup_soft_limit_reclaim(zone,
+                                                sc->order, sc->gfp_mask,
+                                                &nr_soft_scanned);
+                        sc->nr_reclaimed += nr_soft_reclaimed;
+                        sc->nr_scanned += nr_soft_scanned;
                         /* need some check for avoid more shrink_zone() */
                 }
 
@@ -2952,6 +2923,8 @@ static unsigned long balance_pgdat(pg_data_t *pgdat, int order,
 {
         int i;
         int end_zone = 0;       /* Inclusive.  0 = ZONE_DMA */
+        unsigned long nr_soft_reclaimed;
+        unsigned long nr_soft_scanned;
         struct scan_control sc = {
                 .gfp_mask = GFP_KERNEL,
                 .priority = DEF_PRIORITY,
@@ -3066,6 +3039,15 @@ static unsigned long balance_pgdat(pg_data_t *pgdat, int order,
 
                         sc.nr_scanned = 0;
 
+                        nr_soft_scanned = 0;
+                        /*
+                         * Call soft limit reclaim before calling shrink_zone.
+                         */
+                        nr_soft_reclaimed = mem_cgroup_soft_limit_reclaim(zone,
+                                                        order, sc.gfp_mask,
+                                                        &nr_soft_scanned);
+                        sc.nr_reclaimed += nr_soft_reclaimed;
+
                         /*
                          * There should be no need to raise the scanning
                          * priority if enough pages are already being scanned
diff --git a/mm/zswap.c b/mm/zswap.c
index 841e35f1db22..d93510c6aa2d 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -804,6 +804,10 @@ static void zswap_frontswap_invalidate_area(unsigned type)
         }
         tree->rbroot = RB_ROOT;
         spin_unlock(&tree->lock);
+
+        zbud_destroy_pool(tree->pool);
+        kfree(tree);
+        zswap_trees[type] = NULL;
 }
 
 static struct zbud_ops zswap_zbud_ops = {
diff --git a/net/802/mrp.c b/net/802/mrp.c
index 1eb05d80b07b..3ed616215870 100644
--- a/net/802/mrp.c
+++ b/net/802/mrp.c
@@ -24,6 +24,11 @@
 static unsigned int mrp_join_time __read_mostly = 200;
 module_param(mrp_join_time, uint, 0644);
 MODULE_PARM_DESC(mrp_join_time, "Join time in ms (default 200ms)");
+
+static unsigned int mrp_periodic_time __read_mostly = 1000;
+module_param(mrp_periodic_time, uint, 0644);
+MODULE_PARM_DESC(mrp_periodic_time, "Periodic time in ms (default 1s)");
+
 MODULE_LICENSE("GPL");
 
 static const u8
@@ -595,6 +600,24 @@ static void mrp_join_timer(unsigned long data)
         mrp_join_timer_arm(app);
 }
 
+static void mrp_periodic_timer_arm(struct mrp_applicant *app)
+{
+        mod_timer(&app->periodic_timer,
+                  jiffies + msecs_to_jiffies(mrp_periodic_time));
+}
+
+static void mrp_periodic_timer(unsigned long data)
+{
+        struct mrp_applicant *app = (struct mrp_applicant *)data;
+
+        spin_lock(&app->lock);
+        mrp_mad_event(app, MRP_EVENT_PERIODIC);
+        mrp_pdu_queue(app);
+        spin_unlock(&app->lock);
+
+        mrp_periodic_timer_arm(app);
+}
+
 static int mrp_pdu_parse_end_mark(struct sk_buff *skb, int *offset)
 {
         __be16 endmark;
@@ -845,6 +868,9 @@ int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl)
         rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app);
         setup_timer(&app->join_timer, mrp_join_timer, (unsigned long)app);
         mrp_join_timer_arm(app);
+        setup_timer(&app->periodic_timer, mrp_periodic_timer,
+                    (unsigned long)app);
+        mrp_periodic_timer_arm(app);
         return 0;
 
 err3:
@@ -870,6 +896,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl)
          * all pending messages before the applicant is gone.
          */
         del_timer_sync(&app->join_timer);
+        del_timer_sync(&app->periodic_timer);
 
         spin_lock_bh(&app->lock);
         mrp_mad_event(app, MRP_EVENT_TX);
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 309129732285..c7e634af8516 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -171,7 +171,7 @@ static size_t vlan_get_size(const struct net_device *dev)
 
         return nla_total_size(2) +      /* IFLA_VLAN_PROTOCOL */
                nla_total_size(2) +      /* IFLA_VLAN_ID */
-               sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
+               nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */
                vlan_qos_map_size(vlan->nr_ingress_mappings) +
                vlan_qos_map_size(vlan->nr_egress_mappings);
 }
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index c72d1bcdcf49..1356af660b5b 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -65,6 +65,7 @@ static int __init batadv_init(void)
         batadv_recv_handler_init();
 
         batadv_iv_init();
+        batadv_nc_init();
 
         batadv_event_workqueue = create_singlethread_workqueue("bat_events");
 
@@ -142,7 +143,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
         if (ret < 0)
                 goto err;
 
-        ret = batadv_nc_init(bat_priv);
+        ret = batadv_nc_mesh_init(bat_priv);
         if (ret < 0)
                 goto err;
 
@@ -167,7 +168,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
         batadv_vis_quit(bat_priv);
 
         batadv_gw_node_purge(bat_priv);
-        batadv_nc_free(bat_priv);
+        batadv_nc_mesh_free(bat_priv);
         batadv_dat_free(bat_priv);
         batadv_bla_free(bat_priv);
 
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index a487d46e0aec..4ecc0b6bf8ab 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -35,6 +35,20 @@ static int batadv_nc_recv_coded_packet(struct sk_buff *skb,
                                        struct batadv_hard_iface *recv_if);
 
 /**
+ * batadv_nc_init - one-time initialization for network coding
+ */
+int __init batadv_nc_init(void)
+{
+        int ret;
+
+        /* Register our packet type */
+        ret = batadv_recv_handler_register(BATADV_CODED,
+                                           batadv_nc_recv_coded_packet);
+
+        return ret;
+}
+
+/**
  * batadv_nc_start_timer - initialise the nc periodic worker
  * @bat_priv: the bat priv with all the soft interface information
  */
@@ -45,10 +59,10 @@ static void batadv_nc_start_timer(struct batadv_priv *bat_priv)
 }
 
 /**
- * batadv_nc_init - initialise coding hash table and start house keeping
+ * batadv_nc_mesh_init - initialise coding hash table and start house keeping
  * @bat_priv: the bat priv with all the soft interface information
  */
-int batadv_nc_init(struct batadv_priv *bat_priv)
+int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
 {
         bat_priv->nc.timestamp_fwd_flush = jiffies;
         bat_priv->nc.timestamp_sniffed_purge = jiffies;
@@ -70,11 +84,6 @@ int batadv_nc_init(struct batadv_priv *bat_priv)
         batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
                                    &batadv_nc_decoding_hash_lock_class_key);
 
-        /* Register our packet type */
-        if (batadv_recv_handler_register(BATADV_CODED,
-                                         batadv_nc_recv_coded_packet) < 0)
-                goto err;
-
         INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
         batadv_nc_start_timer(bat_priv);
 
@@ -1721,12 +1730,11 @@ free_nc_packet:
 }
 
 /**
- * batadv_nc_free - clean up network coding memory
+ * batadv_nc_mesh_free - clean up network coding memory
  * @bat_priv: the bat priv with all the soft interface information
  */
-void batadv_nc_free(struct batadv_priv *bat_priv)
+void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
 {
-        batadv_recv_handler_unregister(BATADV_CODED);
         cancel_delayed_work_sync(&bat_priv->nc.work);
 
         batadv_nc_purge_paths(bat_priv, bat_priv->nc.coding_hash, NULL);
diff --git a/net/batman-adv/network-coding.h b/net/batman-adv/network-coding.h
index 85a4ec81ad50..ddfa618e80bf 100644
--- a/net/batman-adv/network-coding.h
+++ b/net/batman-adv/network-coding.h
@@ -22,8 +22,9 @@
 
 #ifdef CONFIG_BATMAN_ADV_NC
 
-int batadv_nc_init(struct batadv_priv *bat_priv);
-void batadv_nc_free(struct batadv_priv *bat_priv);
+int batadv_nc_init(void);
+int batadv_nc_mesh_init(struct batadv_priv *bat_priv);
+void batadv_nc_mesh_free(struct batadv_priv *bat_priv);
 void batadv_nc_update_nc_node(struct batadv_priv *bat_priv,
                               struct batadv_orig_node *orig_node,
                               struct batadv_orig_node *orig_neigh_node,
@@ -46,12 +47,17 @@ int batadv_nc_init_debugfs(struct batadv_priv *bat_priv);
 
 #else /* ifdef CONFIG_BATMAN_ADV_NC */
 
-static inline int batadv_nc_init(struct batadv_priv *bat_priv)
+static inline int batadv_nc_init(void)
 {
         return 0;
 }
 
-static inline void batadv_nc_free(struct batadv_priv *bat_priv)
+static inline int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
+{
+        return 0;
+}
+
+static inline void batadv_nc_mesh_free(struct batadv_priv *bat_priv)
 {
         return;
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 634debab4d54..fb7356fcfe51 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1146,7 +1146,11 @@ int hci_dev_open(__u16 dev)
                 goto done;
         }
 
-        if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
+        /* Check for rfkill but allow the HCI setup stage to proceed
+         * (which in itself doesn't cause any RF activity).
+         */
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags) &&
+            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                 ret = -ERFKILL;
                 goto done;
         }
@@ -1566,10 +1570,13 @@ static int hci_rfkill_set_block(void *data, bool blocked)
 
         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
 
-        if (!blocked)
-                return 0;
-
-        hci_dev_do_close(hdev);
+        if (blocked) {
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+                if (!test_bit(HCI_SETUP, &hdev->dev_flags))
+                        hci_dev_do_close(hdev);
+        } else {
+                clear_bit(HCI_RFKILLED, &hdev->dev_flags);
+        }
 
         return 0;
 }
@@ -1591,9 +1598,13 @@ static void hci_power_on(struct work_struct *work)
                 return;
         }
 
-        if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
+        if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
+                clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+                hci_dev_do_close(hdev);
+        } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
                                    HCI_AUTO_OFF_TIMEOUT);
+        }
 
         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
@@ -2209,6 +2220,9 @@ int hci_register_dev(struct hci_dev *hdev)
                 }
         }
 
+        if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
+                set_bit(HCI_RFKILLED, &hdev->dev_flags);
+
         set_bit(HCI_SETUP, &hdev->dev_flags);
 
         if (hdev->dev_type != HCI_AMP)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 94aab73f89d4..8db3e89fae35 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3557,7 +3557,11 @@ static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
         cp.handle = cpu_to_le16(conn->handle);
 
         if (ltk->authenticated)
-                conn->sec_level = BT_SECURITY_HIGH;
+                conn->pending_sec_level = BT_SECURITY_HIGH;
+        else
+                conn->pending_sec_level = BT_SECURITY_MEDIUM;
+
+        conn->enc_key_size = ltk->enc_size;
 
         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b3bb7bca8e60..63fa11109a1c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3755,6 +3755,13 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
 
         sk = chan->sk;
 
+        /* For certain devices (ex: HID mouse), support for authentication,
+         * pairing and bonding is optional. For such devices, inorder to avoid
+         * the ACL alive for too long after L2CAP disconnection, reset the ACL
+         * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
+         */
+        conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
+
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
         chan->psm  = psm;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 6d126faf145f..84fcf9fff3ea 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -569,7 +569,6 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 {
         struct rfcomm_dev *dev = dlc->owner;
-        struct tty_struct *tty;
         if (!dev)
                 return;
 
@@ -581,38 +580,8 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                             DPM_ORDER_DEV_AFTER_PARENT);
 
                 wake_up_interruptible(&dev->port.open_wait);
-        } else if (dlc->state == BT_CLOSED) {
-                tty = tty_port_tty_get(&dev->port);
-                if (!tty) {
-                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                /* Drop DLC lock here to avoid deadlock
-                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
-                                 *    but in rfcomm_dev_add there's lock order:
-                                 *    rfcomm_dev_lock -> dlc lock
-                                 * 2. tty_port_put will deadlock if it's
-                                 *    the last reference
-                                 *
-                                 * FIXME: when we release the lock anything
-                                 * could happen to dev, even its destruction
-                                 */
-                                rfcomm_dlc_unlock(dlc);
-                                if (rfcomm_dev_get(dev->id) == NULL) {
-                                        rfcomm_dlc_lock(dlc);
-                                        return;
-                                }
-
-                                if (!test_and_set_bit(RFCOMM_TTY_RELEASED,
-                                                      &dev->flags))
-                                        tty_port_put(&dev->port);
-
-                                tty_port_put(&dev->port);
-                                rfcomm_dlc_lock(dlc);
-                        }
-                } else {
-                        tty_hangup(tty);
-                        tty_kref_put(tty);
-                }
-        }
+        } else if (dlc->state == BT_CLOSED)
+                tty_port_tty_hangup(&dev->port, false);
 }
 
 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index ffd5874f2592..33e8f23acddd 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -700,7 +700,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
 
                 vid = nla_get_u16(tb[NDA_VLAN]);
 
-                if (vid >= VLAN_N_VID) {
+                if (!vid || vid >= VLAN_VID_MASK) {
                         pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
                                 vid);
                         return -EINVAL;
@@ -794,7 +794,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
 
                 vid = nla_get_u16(tb[NDA_VLAN]);
 
-                if (vid >= VLAN_N_VID) {
+                if (!vid || vid >= VLAN_VID_MASK) {
                         pr_info("bridge: RTM_NEWNEIGH with invalid vlan id %d\n",
                                 vid);
                         return -EINVAL;
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 85a09bb5ca51..b7b1914dfa25 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -453,7 +453,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
                 err = 0;
 
-                if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                if (!mp->ports && !mp->mglist &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
                 break;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index d1c578630678..8b0b610ca2c9 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -272,7 +272,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 del_timer(&p->timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
-                if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                if (!mp->ports && !mp->mglist &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
 
@@ -620,7 +620,6 @@ rehash:
 
         mp->br = br;
         mp->addr = *group;
-
         setup_timer(&mp->timer, br_multicast_group_expired,
                     (unsigned long)mp);
 
@@ -660,6 +659,7 @@ static int br_multicast_add_group(struct net_bridge *br,
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
         struct net_bridge_port_group __rcu **pp;
+        unsigned long now = jiffies;
         int err;
 
         spin_lock(&br->multicast_lock);
@@ -674,6 +674,7 @@ static int br_multicast_add_group(struct net_bridge *br,
 
         if (!port) {
                 mp->mglist = true;
+                mod_timer(&mp->timer, now + br->multicast_membership_interval);
                 goto out;
         }
 
@@ -681,7 +682,7 @@ static int br_multicast_add_group(struct net_bridge *br,
              (p = mlock_dereference(*pp, br)) != NULL;
              pp = &p->next) {
                 if (p->port == port)
-                        goto out;
+                        goto found;
                 if ((unsigned long)p->port < (unsigned long)port)
                         break;
         }
@@ -692,6 +693,8 @@ static int br_multicast_add_group(struct net_bridge *br,
         rcu_assign_pointer(*pp, p);
         br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
 
+found:
+        mod_timer(&p->timer, now + br->multicast_membership_interval);
 out:
         err = 0;
 
@@ -1191,9 +1194,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        mod_timer(&mp->timer, now + br->multicast_membership_interval);
-        mp->timer_armed = true;
-
         max_delay *= br->multicast_last_member_count;
 
         if (mp->mglist &&
@@ -1270,9 +1270,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!mp)
                 goto out;
 
-        mod_timer(&mp->timer, now + br->multicast_membership_interval);
-        mp->timer_armed = true;
-
         max_delay *= br->multicast_last_member_count;
         if (mp->mglist &&
             (timer_pending(&mp->timer) ?
@@ -1358,7 +1355,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                         call_rcu_bh(&p->rcu, br_multicast_free_pg);
                         br_mdb_notify(br->dev, port, group, RTM_DELMDB);
 
-                        if (!mp->ports && !mp->mglist && mp->timer_armed &&
+                        if (!mp->ports && !mp->mglist &&
                             netif_running(br->dev))
                                 mod_timer(&mp->timer, jiffies);
                 }
@@ -1370,12 +1367,30 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      br->multicast_last_member_interval;
 
         if (!port) {
-                if (mp->mglist && mp->timer_armed &&
+                if (mp->mglist &&
                     (timer_pending(&mp->timer) ?
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
                         mod_timer(&mp->timer, time);
                 }
+
+                goto out;
+        }
+
+        for (p = mlock_dereference(mp->ports, br);
+             p != NULL;
+             p = mlock_dereference(p->next, br)) {
+                if (p->port != port)
+                        continue;
+
+                if (!hlist_unhashed(&p->mglist) &&
+                    (timer_pending(&p->timer) ?
+                     time_after(p->timer.expires, time) :
+                     try_to_del_timer_sync(&p->timer) >= 0)) {
+                        mod_timer(&p->timer, time);
+                }
+
+                break;
         }
 out:
         spin_unlock(&br->multicast_lock);
@@ -1798,7 +1813,6 @@ void br_multicast_stop(struct net_bridge *br)
                 hlist_for_each_entry_safe(mp, n, &mdb->mhash[i],
                                           hlist[ver]) {
                         del_timer(&mp->timer);
-                        mp->timer_armed = false;
                         call_rcu_bh(&mp->rcu, br_multicast_free_group);
                 }
         }
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index e74ddc1c29a8..f75d92e4f96b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -243,7 +243,7 @@ static int br_afspec(struct net_bridge *br,
 
                 vinfo = nla_data(tb[IFLA_BRIDGE_VLAN_INFO]);
 
-                if (vinfo->vid >= VLAN_N_VID)
+                if (!vinfo->vid || vinfo->vid >= VLAN_VID_MASK)
                         return -EINVAL;
 
                 switch (cmd) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index efb57d911569..e14c33b42f75 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -126,7 +126,6 @@ struct net_bridge_mdb_entry
         struct timer_list               timer;
         struct br_ip                    addr;
         bool                            mglist;
-        bool                            timer_armed;
 };
 
 struct net_bridge_mdb_htable
@@ -643,9 +642,7 @@ static inline u16 br_get_pvid(const struct net_port_vlans *v)
          * vid wasn't set
          */
         smp_rmb();
-        return (v->pvid & VLAN_TAG_PRESENT) ?
-                        (v->pvid & ~VLAN_TAG_PRESENT) :
-                        VLAN_N_VID;
+        return v->pvid ?: VLAN_N_VID;
 }
 
 #else
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 108084a04671..656a6f3e40de 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -134,7 +134,7 @@ static void br_stp_start(struct net_bridge *br)
 
         if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
                 __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
-        else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
+        else if (br->bridge_forward_delay > BR_MAX_FORWARD_DELAY)
                 __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
 
         if (r == 0) {
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 9a9ffe7e4019..53f0990eab58 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -45,37 +45,34 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
                 return 0;
         }
 
-        if (vid) {
-                if (v->port_idx) {
-                        p = v->parent.port;
-                        br = p->br;
-                        dev = p->dev;
-                } else {
-                        br = v->parent.br;
-                        dev = br->dev;
-                }
-                ops = dev->netdev_ops;
-
-                if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
-                        /* Add VLAN to the device filter if it is supported.
-                         * Stricly speaking, this is not necessary now, since
-                         * devices are made promiscuous by the bridge, but if
-                         * that ever changes this code will allow tagged
-                         * traffic to enter the bridge.
-                         */
-                        err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
-                                                       vid);
-                        if (err)
-                                return err;
-                }
-
-                err = br_fdb_insert(br, p, dev->dev_addr, vid);
-                if (err) {
-                        br_err(br, "failed insert local address into bridge "
-                               "forwarding table\n");
-                        goto out_filt;
-                }
+        if (v->port_idx) {
+                p = v->parent.port;
+                br = p->br;
+                dev = p->dev;
+        } else {
+                br = v->parent.br;
+                dev = br->dev;
+        }
+        ops = dev->netdev_ops;
+
+        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
+                /* Add VLAN to the device filter if it is supported.
+                 * Stricly speaking, this is not necessary now, since
+                 * devices are made promiscuous by the bridge, but if
+                 * that ever changes this code will allow tagged
+                 * traffic to enter the bridge.
+                 */
+                err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
+                                               vid);
+                if (err)
+                        return err;
+        }
 
+        err = br_fdb_insert(br, p, dev->dev_addr, vid);
+        if (err) {
+                br_err(br, "failed insert local address into bridge "
+                       "forwarding table\n");
+                goto out_filt;
         }
 
         set_bit(vid, v->vlan_bitmap);
@@ -98,7 +95,7 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
         __vlan_delete_pvid(v, vid);
         clear_bit(vid, v->untagged_bitmap);
 
-        if (v->port_idx && vid) {
+        if (v->port_idx) {
                 struct net_device *dev = v->parent.port->dev;
                 const struct net_device_ops *ops = dev->netdev_ops;
 
@@ -192,6 +189,8 @@ out:
 bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
                         struct sk_buff *skb, u16 *vid)
 {
+        int err;
+
         /* If VLAN filtering is disabled on the bridge, all packets are
          * permitted.
          */
@@ -204,20 +203,32 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
         if (!v)
                 return false;
 
-        if (br_vlan_get_tag(skb, vid)) {
+        err = br_vlan_get_tag(skb, vid);
+        if (!*vid) {
                 u16 pvid = br_get_pvid(v);
 
-                /* Frame did not have a tag.  See if pvid is set
-                 * on this port.  That tells us which vlan untagged
-                 * traffic belongs to.
+                /* Frame had a tag with VID 0 or did not have a tag.
+                 * See if pvid is set on this port.  That tells us which
+                 * vlan untagged or priority-tagged traffic belongs to.
                  */
                 if (pvid == VLAN_N_VID)
                         return false;
 
-                /* PVID is set on this port.  Any untagged ingress
-                 * frame is considered to belong to this vlan.
+                /* PVID is set on this port.  Any untagged or priority-tagged
+                 * ingress frame is considered to belong to this vlan.
                  */
-                __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), pvid);
+                *vid = pvid;
+                if (likely(err))
+                        /* Untagged Frame. */
+                        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), pvid);
+                else
+                        /* Priority-tagged Frame.
+                         * At this point, We know that skb->vlan_tci had
+                         * VLAN_TAG_PRESENT bit and its VID field was 0x000.
+                         * We update only VID field and preserve PCP field.
+                         */
+                        skb->vlan_tci |= pvid;
+
                 return true;
         }
 
@@ -248,7 +259,9 @@ bool br_allowed_egress(struct net_bridge *br,
         return false;
 }
 
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int br_vlan_add(struct net_bridge *br, u16 vid, u16 flags)
 {
         struct net_port_vlans *pv = NULL;
@@ -278,7 +291,9 @@ out:
         return err;
 }
 
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int br_vlan_delete(struct net_bridge *br, u16 vid)
 {
         struct net_port_vlans *pv;
@@ -289,14 +304,9 @@ int br_vlan_delete(struct net_bridge *br, u16 vid)
         if (!pv)
                 return -EINVAL;
 
-        if (vid) {
-                /* If the VID !=0 remove fdb for this vid. VID 0 is special
-                 * in that it's the default and is always there in the fdb.
-                 */
-                spin_lock_bh(&br->hash_lock);
-                fdb_delete_by_addr(br, br->dev->dev_addr, vid);
-                spin_unlock_bh(&br->hash_lock);
-        }
+        spin_lock_bh(&br->hash_lock);
+        fdb_delete_by_addr(br, br->dev->dev_addr, vid);
+        spin_unlock_bh(&br->hash_lock);
 
         __vlan_del(pv, vid);
         return 0;
@@ -329,7 +339,9 @@ unlock:
         return 0;
 }
 
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int nbp_vlan_add(struct net_bridge_port *port, u16 vid, u16 flags)
 {
         struct net_port_vlans *pv = NULL;
@@ -363,7 +375,9 @@ clean_up:
         return err;
 }
 
-/* Must be protected by RTNL */
+/* Must be protected by RTNL.
+ * Must be called with vid in range from 1 to 4094 inclusive.
+ */
 int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
 {
         struct net_port_vlans *pv;
@@ -374,14 +388,9 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
         if (!pv)
                 return -EINVAL;
 
-        if (vid) {
-                /* If the VID !=0 remove fdb for this vid. VID 0 is special
-                 * in that it's the default and is always there in the fdb.
-                 */
-                spin_lock_bh(&port->br->hash_lock);
-                fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
-                spin_unlock_bh(&port->br->hash_lock);
-        }
+        spin_lock_bh(&port->br->hash_lock);
+        fdb_delete_by_addr(port->br, port->dev->dev_addr, vid);
+        spin_unlock_bh(&port->br->hash_lock);
 
         return __vlan_del(pv, vid);
 }
diff --git a/net/compat.c b/net/compat.c
index f0a1ba6c8086..89032580bd1d 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -71,6 +71,8 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
             __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
+        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+                return -EINVAL;
         kmsg->msg_name = compat_ptr(tmp1);
         kmsg->msg_iov = compat_ptr(tmp2);
         kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/dev.c b/net/core/dev.c
index 5c713f2239cc..3430b1ed12e5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1917,7 +1917,8 @@ static struct xps_map *expand_xps_map(struct xps_map *map,
         return new_map;
 }
 
-int netif_set_xps_queue(struct net_device *dev, struct cpumask *mask, u16 index)
+int netif_set_xps_queue(struct net_device *dev, const struct cpumask *mask,
+                        u16 index)
 {
         struct xps_dev_maps *dev_maps, *new_dev_maps = NULL;
         struct xps_map *map, *new_map;
@@ -5247,10 +5248,12 @@ static int dev_new_index(struct net *net)
 
 /* Delayed registration/unregisteration */
 static LIST_HEAD(net_todo_list);
+static DECLARE_WAIT_QUEUE_HEAD(netdev_unregistering_wq);
 
 static void net_set_todo(struct net_device *dev)
 {
         list_add_tail(&dev->todo_list, &net_todo_list);
+        dev_net(dev)->dev_unreg_count++;
 }
 
 static void rollback_registered_many(struct list_head *head)
@@ -5918,6 +5921,12 @@ void netdev_run_todo(void)
                 if (dev->destructor)
                         dev->destructor(dev);
 
+                /* Report a network device has been unregistered */
+                rtnl_lock();
+                dev_net(dev)->dev_unreg_count--;
+                __rtnl_unlock();
+                wake_up(&netdev_unregistering_wq);
+
                 /* Free network device */
                 kobject_put(&dev->dev.kobj);
         }
@@ -6603,6 +6612,34 @@ static void __net_exit default_device_exit(struct net *net)
         rtnl_unlock();
 }
 
+static void __net_exit rtnl_lock_unregistering(struct list_head *net_list)
+{
+        /* Return with the rtnl_lock held when there are no network
+         * devices unregistering in any network namespace in net_list.
+         */
+        struct net *net;
+        bool unregistering;
+        DEFINE_WAIT(wait);
+
+        for (;;) {
+                prepare_to_wait(&netdev_unregistering_wq, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                unregistering = false;
+                rtnl_lock();
+                list_for_each_entry(net, net_list, exit_list) {
+                        if (net->dev_unreg_count > 0) {
+                                unregistering = true;
+                                break;
+                        }
+                }
+                if (!unregistering)
+                        break;
+                __rtnl_unlock();
+                schedule();
+        }
+        finish_wait(&netdev_unregistering_wq, &wait);
+}
+
 static void __net_exit default_device_exit_batch(struct list_head *net_list)
 {
         /* At exit all network devices most be removed from a network
@@ -6614,7 +6651,18 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
         struct net *net;
         LIST_HEAD(dev_kill_list);
 
-        rtnl_lock();
+        /* To prevent network device cleanup code from dereferencing
+         * loopback devices or network devices that have been freed
+         * wait here for all pending unregistrations to complete,
+         * before unregistring the loopback device and allowing the
+         * network namespace be freed.
+         *
+         * The netdev todo list containing all network devices
+         * unregistrations that happen in default_device_exit_batch
+         * will run in the rtnl_unlock() at the end of
+         * default_device_exit_batch.
+         */
+        rtnl_lock_unregistering(net_list);
         list_for_each_entry(net, net_list, exit_list) {
                 for_each_netdev_reverse(net, dev) {
                         if (dev->rtnl_link_ops)
diff --git a/net/core/filter.c b/net/core/filter.c
index 6438f29ff266..01b780856db2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -644,7 +644,6 @@ void sk_filter_release_rcu(struct rcu_head *rcu)
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 
         bpf_jit_free(fp);
-        kfree(fp);
 }
 EXPORT_SYMBOL(sk_filter_release_rcu);
 
@@ -683,7 +682,7 @@ int sk_unattached_filter_create(struct sk_filter **pfp,
         if (fprog->filter == NULL)
                 return -EINVAL;
 
-        fp = kmalloc(fsize + sizeof(*fp), GFP_KERNEL);
+        fp = kmalloc(sk_filter_size(fprog->len), GFP_KERNEL);
         if (!fp)
                 return -ENOMEM;
         memcpy(fp->insns, fprog->filter, fsize);
@@ -723,6 +722,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 {
         struct sk_filter *fp, *old_fp;
         unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
+        unsigned int sk_fsize = sk_filter_size(fprog->len);
         int err;
 
         if (sock_flag(sk, SOCK_FILTER_LOCKED))
@@ -732,11 +732,11 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         if (fprog->filter == NULL)
                 return -EINVAL;
 
-        fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
+        fp = sock_kmalloc(sk, sk_fsize, GFP_KERNEL);
         if (!fp)
                 return -ENOMEM;
         if (copy_from_user(fp->insns, fprog->filter, fsize)) {
-                sock_kfree_s(sk, fp, fsize+sizeof(*fp));
+                sock_kfree_s(sk, fp, sk_fsize);
                 return -EFAULT;
         }
 
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 1929af87b260..8d7d0dd72db2 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -154,8 +154,8 @@ ipv6:
         if (poff >= 0) {
                 __be32 *ports, _ports;
 
-                nhoff += poff;
-                ports = skb_header_pointer(skb, nhoff, sizeof(_ports), &_ports);
+                ports = skb_header_pointer(skb, nhoff + poff,
+                                           sizeof(_ports), &_ports);
                 if (ports)
                         flow->ports = *ports;
         }
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 6a2f13cee86a..8d9d05edd2eb 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -10,12 +10,27 @@
 
 #include <net/secure_seq.h>
 
-static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET)
+#define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
 
-void net_secret_init(void)
+static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
+
+static void net_secret_init(void)
 {
-        get_random_bytes(net_secret, sizeof(net_secret));
+        u32 tmp;
+        int i;
+
+        if (likely(net_secret[0]))
+                return;
+
+        for (i = NET_SECRET_SIZE; i > 0;) {
+                do {
+                        get_random_bytes(&tmp, sizeof(tmp));
+                } while (!tmp);
+                cmpxchg(&net_secret[--i], 0, tmp);
+        }
 }
+#endif
 
 #ifdef CONFIG_INET
 static u32 seq_scale(u32 seq)
@@ -42,6 +57,7 @@ __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
         u32 hash[MD5_DIGEST_WORDS];
         u32 i;
 
+        net_secret_init();
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
                 secret[i] = net_secret[i] + (__force u32)daddr[i];
@@ -63,6 +79,7 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
         u32 hash[MD5_DIGEST_WORDS];
         u32 i;
 
+        net_secret_init();
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
                 secret[i] = net_secret[i] + (__force u32) daddr[i];
@@ -82,6 +99,7 @@ __u32 secure_ip_id(__be32 daddr)
 {
         u32 hash[MD5_DIGEST_WORDS];
 
+        net_secret_init();
         hash[0] = (__force __u32) daddr;
         hash[1] = net_secret[13];
         hash[2] = net_secret[14];
@@ -96,6 +114,7 @@ __u32 secure_ipv6_id(const __be32 daddr[4])
 {
         __u32 hash[4];
 
+        net_secret_init();
         memcpy(hash, daddr, 16);
         md5_transform(hash, net_secret);
 
@@ -107,6 +126,7 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
 {
         u32 hash[MD5_DIGEST_WORDS];
 
+        net_secret_init();
         hash[0] = (__force u32)saddr;
         hash[1] = (__force u32)daddr;
         hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
@@ -121,6 +141,7 @@ u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
 {
         u32 hash[MD5_DIGEST_WORDS];
 
+        net_secret_init();
         hash[0] = (__force u32)saddr;
         hash[1] = (__force u32)daddr;
         hash[2] = (__force u32)dport ^ net_secret[14];
@@ -140,6 +161,7 @@ u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
         u32 hash[MD5_DIGEST_WORDS];
         u64 seq;
 
+        net_secret_init();
         hash[0] = (__force u32)saddr;
         hash[1] = (__force u32)daddr;
         hash[2] = ((__force u16)sport << 16) + (__force u16)dport;
@@ -164,6 +186,7 @@ u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr,
         u64 seq;
         u32 i;
 
+        net_secret_init();
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
                 secret[i] = net_secret[i] + daddr[i];
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6beba494a3..0b39e7ae4383 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2319,6 +2319,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
 
+        sk->sk_pacing_rate = ~0U;
         /*
          * Before updating sk_refcnt, we must commit prior changes to memory
          * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index c85e71e0c7ff..ff41b4d60d30 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -1372,6 +1372,8 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         real_dev = dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
         if (!real_dev)
                 return -ENODEV;
+        if (real_dev->type != ARPHRD_IEEE802154)
+                return -EINVAL;
 
         lowpan_dev_info(dev)->real_dev = real_dev;
         lowpan_dev_info(dev)->fragment_tag = 0;
@@ -1386,6 +1388,9 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
 
         entry->ldev = dev;
 
+        /* Set the lowpan harware address to the wpan hardware address. */
+        memcpy(dev->dev_addr, real_dev->dev_addr, IEEE802154_ADDR_LEN);
+
         mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
         INIT_LIST_HEAD(&entry->list);
         list_add_tail(&entry->list, &lowpan_devices);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 7a1874b7b8fd..cfeb85cff4f0 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -263,10 +263,8 @@ void build_ehash_secret(void)
                 get_random_bytes(&rnd, sizeof(rnd));
         } while (rnd == 0);
 
-        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
+        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
                 get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
-                net_secret_init();
-        }
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index dace87f06e5f..7defdc9ba167 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -736,7 +736,7 @@ static void igmp_gq_timer_expire(unsigned long data)
 
         in_dev->mr_gq_running = 0;
         igmpv3_send_report(in_dev, NULL);
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 
 static void igmp_ifc_timer_expire(unsigned long data)
@@ -749,7 +749,7 @@ static void igmp_ifc_timer_expire(unsigned long data)
                 igmp_ifc_start_timer(in_dev,
                                      unsolicited_report_interval(in_dev));
         }
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 
 static void igmp_ifc_event(struct in_device *in_dev)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 7bd8983dbfcf..96da9c77deca 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -287,7 +287,7 @@ begintw:
                         if (unlikely(!INET_TW_MATCH(sk, net, acookie,
                                                     saddr, daddr, ports,
                                                     dif))) {
-                                sock_put(sk);
+                                inet_twsk_put(inet_twsk(sk));
                                 goto begintw;
                         }
                         goto out;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index a04d872c54f9..3982eabf61e1 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -772,15 +772,20 @@ static inline int ip_ufo_append_data(struct sock *sk,
                 /* initialize protocol header pointer */
                 skb->transport_header = skb->network_header + fragheaderlen;
 
-                skb->ip_summed = CHECKSUM_PARTIAL;
                 skb->csum = 0;
 
-                /* specify the length of each IP datagram fragment */
-                skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+
                 __skb_queue_tail(queue, skb);
+        } else if (skb_is_gso(skb)) {
+                goto append;
         }
 
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        /* specify the length of each IP datagram fragment */
+        skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
+        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+
+append:
         return skb_append_datato_frags(sk, skb, getfrag, from,
                                        (length - transhdrlen));
 }
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index ac9fabe0300f..63a6d6d6b875 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -623,6 +623,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                         tunnel->err_count = 0;
         }
 
+        tos = ip_tunnel_ecn_encap(tos, inner_iph, skb);
         ttl = tnl_params->ttl;
         if (ttl == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
@@ -641,18 +642,17 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 
         max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
                         + rt->dst.header_len;
-        if (max_headroom > dev->needed_headroom) {
+        if (max_headroom > dev->needed_headroom)
                 dev->needed_headroom = max_headroom;
-                if (skb_cow_head(skb, dev->needed_headroom)) {
-                        dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
-                        return;
-                }
+
+        if (skb_cow_head(skb, dev->needed_headroom)) {
+                dev->stats.tx_dropped++;
+                dev_kfree_skb(skb);
+                return;
         }
 
         err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
-                            ip_tunnel_ecn_encap(tos, inner_iph, skb), ttl, df,
-                            !net_eq(tunnel->net, dev_net(dev)));
+                            tos, ttl, df, !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 
         return;
@@ -853,8 +853,10 @@ int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
         /* FB netdevice is special: we have one, and only one per netns.
          * Allowing to move it to another netns is clearly unsafe.
          */
-        if (!IS_ERR(itn->fb_tunnel_dev))
+        if (!IS_ERR(itn->fb_tunnel_dev)) {
                 itn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
+                ip_tunnel_add(itn, netdev_priv(itn->fb_tunnel_dev));
+        }
         rtnl_unlock();
 
         return PTR_RET(itn->fb_tunnel_dev);
@@ -884,8 +886,6 @@ static void ip_tunnel_destroy(struct ip_tunnel_net *itn, struct list_head *head,
                         if (!net_eq(dev_net(t->dev), net))
                                 unregister_netdevice_queue(t->dev, head);
         }
-        if (itn->fb_tunnel_dev)
-                unregister_netdevice_queue(itn->fb_tunnel_dev, head);
 }
 
 void ip_tunnel_delete_net(struct ip_tunnel_net *itn, struct rtnl_link_ops *ops)
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index d6c856b17fd4..c31e3ad98ef2 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -61,7 +61,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
         /* Push down and install the IP header. */
-        __skb_push(skb, sizeof(struct iphdr));
+        skb_push(skb, sizeof(struct iphdr));
         skb_reset_network_header(skb);
 
         iph = ip_hdr(skb);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e805e7b3030e..6e87f853d033 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -125,8 +125,17 @@ static int vti_rcv(struct sk_buff *skb)
                                   iph->saddr, iph->daddr, 0);
         if (tunnel != NULL) {
                 struct pcpu_tstats *tstats;
+                u32 oldmark = skb->mark;
+                int ret;
 
-                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+
+                /* temporarily mark the skb with the tunnel o_key, to
+                 * only match policies with this mark.
+                 */
+                skb->mark = be32_to_cpu(tunnel->parms.o_key);
+                ret = xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb);
+                skb->mark = oldmark;
+                if (!ret)
                         return -1;
 
                 tstats = this_cpu_ptr(tunnel->dev->tstats);
@@ -135,7 +144,6 @@ static int vti_rcv(struct sk_buff *skb)
                 tstats->rx_bytes += skb->len;
                 u64_stats_update_end(&tstats->syncp);
 
-                skb->mark = 0;
                 secpath_reset(skb);
                 skb->dev = tunnel->dev;
                 return 1;
@@ -167,7 +175,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         memset(&fl4, 0, sizeof(fl4));
         flowi4_init_output(&fl4, tunnel->parms.link,
-                           be32_to_cpu(tunnel->parms.i_key), RT_TOS(tos),
+                           be32_to_cpu(tunnel->parms.o_key), RT_TOS(tos),
                            RT_SCOPE_UNIVERSE,
                            IPPROTO_IPIP, 0,
                            dst, tiph->saddr, 0, 0);
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 67e17dcda65e..b6346bf2fde3 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -267,7 +267,8 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
         if (th == NULL)
                 return NF_DROP;
 
-        synproxy_parse_options(skb, par->thoff, th, &opts);
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
 
         if (th->syn && !(th->ack || th->fin || th->rst)) {
                 /* Initial SYN from client */
@@ -350,7 +351,8 @@ static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
 
                 /* fall through */
         case TCP_CONNTRACK_SYN_SENT:
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
 
                 if (!th->syn && th->ack &&
                     CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
@@ -373,7 +375,9 @@ static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
                 if (!th->syn || !th->ack)
                         break;
 
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
                 if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
                         synproxy->tsoff = opts.tsval - synproxy->its;
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bfec521c717f..193db03540ad 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -218,8 +218,10 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
 
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
                 ipv4_sk_update_pmtu(skb, sk, info);
-        else if (type == ICMP_REDIRECT)
+        else if (type == ICMP_REDIRECT) {
                 ipv4_sk_redirect(skb, sk);
+                return;
+        }
 
         /* Report error on raw socket, if:
            1. User requested ip_recverr.
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 727f4365bcdf..6011615e810d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2072,7 +2072,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                                                               RT_SCOPE_LINK);
                         goto make_route;
                 }
-                if (fl4->saddr) {
+                if (!fl4->saddr) {
                         if (ipv4_is_multicast(fl4->daddr))
                                 fl4->saddr = inet_select_addr(dev_out, 0,
                                                               fl4->flowi4_scope);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 25a89eaa669d..a16b01b537ba 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1284,7 +1284,10 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 tp->lost_cnt_hint -= tcp_skb_pcount(prev);
         }
 
-        TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags;
+        TCP_SKB_CB(prev)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
+        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+                TCP_SKB_CB(prev)->end_seq++;
+
         if (skb == tcp_highest_sack(sk))
                 tcp_advance_highest_sack(sk, skb);
 
@@ -3288,7 +3291,7 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
                         tcp_init_cwnd_reduction(sk, true);
                         tcp_set_ca_state(sk, TCP_CA_CWR);
                         tcp_end_cwnd_reduction(sk);
-                        tcp_set_ca_state(sk, TCP_CA_Open);
+                        tcp_try_keep_open(sk);
                         NET_INC_STATS_BH(sock_net(sk),
                                          LINUX_MIB_TCPLOSSPROBERECOVERY);
                 }
@@ -5709,6 +5712,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 } else
                         tcp_init_metrics(sk);
 
+                tcp_update_pacing_rate(sk);
+
                 /* Prevent spurious tcp_cwnd_restart() on first data packet */
                 tp->lsndtime = tcp_time_stamp;
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7c83cb8bf137..d46f2143305c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -637,6 +637,8 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
         unsigned int size = 0;
         unsigned int eff_sacks;
 
+        opts->options = 0;
+
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tp->af_specific->md5_lookup(sk, sk);
         if (unlikely(*md5)) {
@@ -895,8 +897,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         skb_orphan(skb);
         skb->sk = sk;
-        skb->destructor = (sysctl_tcp_limit_output_bytes > 0) ?
-                          tcp_wfree : sock_wfree;
+        skb->destructor = tcp_wfree;
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
 
         /* Build TCP header and checksum it. */
@@ -985,8 +986,10 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk) ||
-            skb->ip_summed == CHECKSUM_NONE) {
+        /* Make sure we own this skb before messing gso_size/gso_segs */
+        WARN_ON_ONCE(skb_cloned(skb));
+
+        if (skb->len <= mss_now || skb->ip_summed == CHECKSUM_NONE) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
@@ -1066,9 +1069,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
         if (nsize < 0)
                 nsize = 0;
 
-        if (skb_cloned(skb) &&
-            skb_is_nonlinear(skb) &&
-            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+        if (skb_unclone(skb, GFP_ATOMIC))
                 return -ENOMEM;
 
         /* Get a new skb... force flag on. */
@@ -1840,7 +1841,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
         while ((skb = tcp_send_head(sk))) {
                 unsigned int limit;
 
-
                 tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                 BUG_ON(!tso_segs);
 
@@ -1869,13 +1869,20 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                                 break;
                 }
 
-                /* TSQ : sk_wmem_alloc accounts skb truesize,
-                 * including skb overhead. But thats OK.
+                /* TCP Small Queues :
+                 * Control number of packets in qdisc/devices to two packets / or ~1 ms.
+                 * This allows for :
+                 *  - better RTT estimation and ACK scheduling
+                 *  - faster recovery
+                 *  - high rates
                  */
-                if (atomic_read(&sk->sk_wmem_alloc) >= sysctl_tcp_limit_output_bytes) {
+                limit = max(skb->truesize, sk->sk_pacing_rate >> 10);
+
+                if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                         set_bit(TSQ_THROTTLED, &tp->tsq_flags);
                         break;
                 }
+
                 limit = mss_now;
                 if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
@@ -2337,6 +2344,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 int oldpcount = tcp_skb_pcount(skb);
 
                 if (unlikely(oldpcount > 1)) {
+                        if (skb_unclone(skb, GFP_ATOMIC))
+                                return -ENOMEM;
                         tcp_init_tso_segs(sk, skb, cur_mss);
                         tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
                 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 74d2c95db57f..0ca44df51ee9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -658,7 +658,7 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
                 break;
         case ICMP_REDIRECT:
                 ipv4_sk_redirect(skb, sk);
-                break;
+                goto out;
         }
 
         /*
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 9a459be24af7..ccde54248c8c 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -107,6 +107,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
 
         memset(fl4, 0, sizeof(struct flowi4));
         fl4->flowi4_mark = skb->mark;
+        fl4->flowi4_oif = skb_dst(skb)->dev->ifindex;
 
         if (!ip_is_fragment(iph)) {
                 switch (iph->protocol) {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d6ff12617f36..cd3fb301da38 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1499,6 +1499,33 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
         return false;
 }
 
+/* Compares an address/prefix_len with addresses on device @dev.
+ * If one is found it returns true.
+ */
+bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
+        const unsigned int prefix_len, struct net_device *dev)
+{
+        struct inet6_dev *idev;
+        struct inet6_ifaddr *ifa;
+        bool ret = false;
+
+        rcu_read_lock();
+        idev = __in6_dev_get(dev);
+        if (idev) {
+                read_lock_bh(&idev->lock);
+                list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                        ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
+                        if (ret)
+                                break;
+                }
+                read_unlock_bh(&idev->lock);
+        }
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(ipv6_chk_custom_prefix);
+
 int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -2193,43 +2220,21 @@ ok:
                         else
                                 stored_lft = 0;
                         if (!update_lft && !create && stored_lft) {
-                                if (valid_lft > MIN_VALID_LIFETIME ||
-                                    valid_lft > stored_lft)
-                                        update_lft = 1;
-                                else if (stored_lft <= MIN_VALID_LIFETIME) {
-                                        /* valid_lft <= stored_lft is always true */
-                                        /*
-                                         * RFC 4862 Section 5.5.3e:
-                                         * "Note that the preferred lifetime of
-                                         *  the corresponding address is always
-                                         *  reset to the Preferred Lifetime in
-                                         *  the received Prefix Information
-                                         *  option, regardless of whether the
-                                         *  valid lifetime is also reset or
-                                         *  ignored."
-                                         *
-                                         *  So if the preferred lifetime in
-                                         *  this advertisement is different
-                                         *  than what we have stored, but the
-                                         *  valid lifetime is invalid, just
-                                         *  reset prefered_lft.
-                                         *
-                                         *  We must set the valid lifetime
-                                         *  to the stored lifetime since we'll
-                                         *  be updating the timestamp below,
-                                         *  else we'll set it back to the
-                                         *  minimum.
-                                         */
-                                        if (prefered_lft != ifp->prefered_lft) {
-                                                valid_lft = stored_lft;
-                                                update_lft = 1;
-                                        }
-                                } else {
-                                        valid_lft = MIN_VALID_LIFETIME;
-                                        if (valid_lft < prefered_lft)
-                                                prefered_lft = valid_lft;
-                                        update_lft = 1;
-                                }
+                                const u32 minimum_lft = min(
+                                        stored_lft, (u32)MIN_VALID_LIFETIME);
+                                valid_lft = max(valid_lft, minimum_lft);
+
+                                /* RFC4862 Section 5.5.3e:
+                                 * "Note that the preferred lifetime of the
+                                 *  corresponding address is always reset to
+                                 *  the Preferred Lifetime in the received
+                                 *  Prefix Information option, regardless of
+                                 *  whether the valid lifetime is also reset or
+                                 *  ignored."
+                                 *
+                                 * So we should always update prefered_lft here.
+                                 */
+                                update_lft = 1;
                         }
 
                         if (update_lft) {
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 73784c3d4642..82e1da3a40b9 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -618,8 +618,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
         struct xfrm_state *x;
 
-        if (type != ICMPV6_DEST_UNREACH &&
-            type != ICMPV6_PKT_TOOBIG &&
+        if (type != ICMPV6_PKT_TOOBIG &&
             type != NDISC_REDIRECT)
                 return;
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index d3618a78fcac..e67e63f9858d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -436,8 +436,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset);
         struct xfrm_state *x;
 
-        if (type != ICMPV6_DEST_UNREACH &&
-            type != ICMPV6_PKT_TOOBIG &&
+        if (type != ICMPV6_PKT_TOOBIG &&
             type != NDISC_REDIRECT)
                 return;
 
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 32b4a1675d82..066640e0ba8e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -116,7 +116,7 @@ begintw:
                         }
                         if (unlikely(!INET6_TW_MATCH(sk, net, saddr, daddr,
                                                      ports, dif))) {
-                                sock_put(sk);
+                                inet_twsk_put(inet_twsk(sk));
                                 goto begintw;
                         }
                         goto out;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 6b26e9feafb9..bf4a9a084de5 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -618,7 +618,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
         struct ip6_tnl *tunnel = netdev_priv(dev);
         struct net_device *tdev;    /* Device to other host */
         struct ipv6hdr  *ipv6h;     /* Our new IP header */
-        unsigned int max_headroom;  /* The extra header space needed */
+        unsigned int max_headroom = 0; /* The extra header space needed */
         int    gre_hlen;
         struct ipv6_tel_txoption opt;
         int    mtu;
@@ -693,7 +693,7 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
 
         skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
+        max_headroom += LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
@@ -976,6 +976,7 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                 if (t->parms.o_flags&GRE_SEQ)
                         addend += 4;
         }
+        t->hlen = addend;
 
         if (p->flags & IP6_TNL_F_CAP_XMIT) {
                 int strict = (ipv6_addr_type(&p->raddr) &
@@ -1002,8 +1003,6 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                 }
                 ip6_rt_put(rt);
         }
-
-        t->hlen = addend;
 }
 
 static int ip6gre_tnl_change(struct ip6_tnl *t,
@@ -1173,9 +1172,8 @@ done:
 
 static int ip6gre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 {
-        struct ip6_tnl *tunnel = netdev_priv(dev);
         if (new_mtu < 68 ||
-            new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
+            new_mtu > 0xFFF8 - dev->hard_header_len)
                 return -EINVAL;
         dev->mtu = new_mtu;
         return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3a692d529163..91fb4e8212f5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -105,7 +105,7 @@ static int ip6_finish_output2(struct sk_buff *skb)
         }
 
         rcu_read_lock_bh();
-        nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
+        nexthop = rt6_nexthop((struct rt6_info *)dst);
         neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
         if (unlikely(!neigh))
                 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
@@ -874,7 +874,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
          */
         rt = (struct rt6_info *) *dst;
         rcu_read_lock_bh();
-        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr));
+        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
         err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
         rcu_read_unlock_bh();
 
@@ -1008,6 +1008,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 
 {
         struct sk_buff *skb;
+        struct frag_hdr fhdr;
         int err;
 
         /* There is support for UDP large send offload by network
@@ -1034,33 +1035,26 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 skb->transport_header = skb->network_header + fragheaderlen;
 
                 skb->protocol = htons(ETH_P_IPV6);
-                skb->ip_summed = CHECKSUM_PARTIAL;
                 skb->csum = 0;
-        }
-
-        err = skb_append_datato_frags(sk,skb, getfrag, from,
-                                      (length - transhdrlen));
-        if (!err) {
-                struct frag_hdr fhdr;
 
-                /* Specify the length of each IPv6 datagram fragment.
-                 * It has to be a multiple of 8.
-                 */
-                skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
-                                             sizeof(struct frag_hdr)) & ~7;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
-                ipv6_select_ident(&fhdr, rt);
-                skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
-
-                return 0;
+        } else if (skb_is_gso(skb)) {
+                goto append;
         }
-        /* There is not enough support do UPD LSO,
-         * so follow normal path
-         */
-        kfree_skb(skb);
 
-        return err;
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        /* Specify the length of each IPv6 datagram fragment.
+         * It has to be a multiple of 8.
+         */
+        skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
+                                     sizeof(struct frag_hdr)) & ~7;
+        skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+        ipv6_select_ident(&fhdr, rt);
+        skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
+
+append:
+        return skb_append_datato_frags(sk, skb, getfrag, from,
+                                       (length - transhdrlen));
 }
 
 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
@@ -1227,27 +1221,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
          * --yoshfuji
          */
 
-        cork->length += length;
-        if (length > mtu) {
-                int proto = sk->sk_protocol;
-                if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
-                        ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-                        return -EMSGSIZE;
-                }
-
-                if (proto == IPPROTO_UDP &&
-                    (rt->dst.dev->features & NETIF_F_UFO)) {
+        if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
+                                           sk->sk_protocol == IPPROTO_RAW)) {
+                ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
+                return -EMSGSIZE;
+        }
 
-                        err = ip6_ufo_append_data(sk, getfrag, from, length,
-                                                  hh_len, fragheaderlen,
-                                                  transhdrlen, mtu, flags, rt);
-                        if (err)
-                                goto error;
-                        return 0;
-                }
+        skb = skb_peek_tail(&sk->sk_write_queue);
+        cork->length += length;
+        if (((length > mtu) ||
+             (skb && skb_is_gso(skb))) &&
+            (sk->sk_protocol == IPPROTO_UDP) &&
+            (rt->dst.dev->features & NETIF_F_UFO)) {
+                err = ip6_ufo_append_data(sk, getfrag, from, length,
+                                          hh_len, fragheaderlen,
+                                          transhdrlen, mtu, flags, rt);
+                if (err)
+                        goto error;
+                return 0;
         }
 
-        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+        if (!skb)
                 goto alloc_new_skb;
 
         while (length > 0) {
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2d8f4829575b..583b77e2f69b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1430,9 +1430,17 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 static int
 ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu < IPV6_MIN_MTU) {
-                return -EINVAL;
+        struct ip6_tnl *tnl = netdev_priv(dev);
+
+        if (tnl->parms.proto == IPPROTO_IPIP) {
+                if (new_mtu < 68)
+                        return -EINVAL;
+        } else {
+                if (new_mtu < IPV6_MIN_MTU)
+                        return -EINVAL;
         }
+        if (new_mtu > 0xFFF8 - dev->hard_header_len)
+                return -EINVAL;
         dev->mtu = new_mtu;
         return 0;
 }
@@ -1731,8 +1739,6 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
                 }
         }
 
-        t = rtnl_dereference(ip6n->tnls_wc[0]);
-        unregister_netdevice_queue(t->dev, &list);
         unregister_netdevice_many(&list);
 }
 
@@ -1752,6 +1758,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         if (!ip6n->fb_tnl_dev)
                 goto err_alloc_dev;
         dev_net_set(ip6n->fb_tnl_dev, net);
+        ip6n->fb_tnl_dev->rtnl_link_ops = &ip6_link_ops;
         /* FB netdevice is special: we have one, and only one per netns.
          * Allowing to move it to another netns is clearly unsafe.
          */
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 5636a912074a..ce507d9e1c90 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -64,8 +64,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 (struct ip_comp_hdr *)(skb->data + offset);
         struct xfrm_state *x;
 
-        if (type != ICMPV6_DEST_UNREACH &&
-            type != ICMPV6_PKT_TOOBIG &&
+        if (type != ICMPV6_PKT_TOOBIG &&
             type != NDISC_REDIRECT)
                 return;
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 096cd67b737c..d18f9f903db6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2034,7 +2034,7 @@ static void mld_dad_timer_expire(unsigned long data)
                 if (idev->mc_dad_count)
                         mld_dad_start_timer(idev, idev->mc_maxdelay);
         }
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
@@ -2379,7 +2379,7 @@ static void mld_gq_timer_expire(unsigned long data)
 
         idev->mc_gq_running = 0;
         mld_send_report(idev, NULL);
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 
 static void mld_ifc_timer_expire(unsigned long data)
@@ -2392,7 +2392,7 @@ static void mld_ifc_timer_expire(unsigned long data)
                 if (idev->mc_ifc_count)
                         mld_ifc_start_timer(idev, idev->mc_maxdelay);
         }
-        __in6_dev_put(idev);
+        in6_dev_put(idev);
 }
 
 static void mld_ifc_event(struct inet6_dev *idev)
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 19cfea8dbcaa..2748b042da72 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -282,7 +282,8 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
         if (th == NULL)
                 return NF_DROP;
 
-        synproxy_parse_options(skb, par->thoff, th, &opts);
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
 
         if (th->syn && !(th->ack || th->fin || th->rst)) {
                 /* Initial SYN from client */
@@ -372,7 +373,8 @@ static unsigned int ipv6_synproxy_hook(unsigned int hooknum,
 
                 /* fall through */
         case TCP_CONNTRACK_SYN_SENT:
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
 
                 if (!th->syn && th->ack &&
                     CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
@@ -395,7 +397,9 @@ static unsigned int ipv6_synproxy_hook(unsigned int hooknum,
                 if (!th->syn || !th->ack)
                         break;
 
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
                 if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
                         synproxy->tsoff = opts.tsval - synproxy->its;
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 58916bbb1728..a4ed2416399e 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -335,8 +335,10 @@ static void rawv6_err(struct sock *sk, struct sk_buff *skb,
                 ip6_sk_update_pmtu(skb, sk, info);
                 harderr = (np->pmtudisc == IPV6_PMTUDISC_DO);
         }
-        if (type == NDISC_REDIRECT)
+        if (type == NDISC_REDIRECT) {
                 ip6_sk_redirect(skb, sk);
+                return;
+        }
         if (np->recverr) {
                 u8 *payload = skb->data;
                 if (!inet->hdrincl)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c979dd96d82a..f54e3a101098 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -476,6 +476,24 @@ out:
 }
 
 #ifdef CONFIG_IPV6_ROUTER_PREF
+struct __rt6_probe_work {
+        struct work_struct work;
+        struct in6_addr target;
+        struct net_device *dev;
+};
+
+static void rt6_probe_deferred(struct work_struct *w)
+{
+        struct in6_addr mcaddr;
+        struct __rt6_probe_work *work =
+                container_of(w, struct __rt6_probe_work, work);
+
+        addrconf_addr_solict_mult(&work->target, &mcaddr);
+        ndisc_send_ns(work->dev, NULL, &work->target, &mcaddr, NULL);
+        dev_put(work->dev);
+        kfree(w);
+}
+
 static void rt6_probe(struct rt6_info *rt)
 {
         struct neighbour *neigh;
@@ -499,17 +517,23 @@ static void rt6_probe(struct rt6_info *rt)
 
         if (!neigh ||
             time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
-                struct in6_addr mcaddr;
-                struct in6_addr *target;
+                struct __rt6_probe_work *work;
 
-                if (neigh) {
+                work = kmalloc(sizeof(*work), GFP_ATOMIC);
+
+                if (neigh && work)
                         neigh->updated = jiffies;
+
+                if (neigh)
                         write_unlock(&neigh->lock);
-                }
 
-                target = (struct in6_addr *)&rt->rt6i_gateway;
-                addrconf_addr_solict_mult(target, &mcaddr);
-                ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
+                if (work) {
+                        INIT_WORK(&work->work, rt6_probe_deferred);
+                        work->target = rt->rt6i_gateway;
+                        dev_hold(rt->dst.dev);
+                        work->dev = rt->dst.dev;
+                        schedule_work(&work->work);
+                }
         } else {
 out:
                 write_unlock(&neigh->lock);
@@ -851,7 +875,6 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                         if (ort->rt6i_dst.plen != 128 &&
                             ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
                                 rt->rt6i_flags |= RTF_ANYCAST;
-                        rt->rt6i_gateway = *daddr;
                 }
 
                 rt->rt6i_flags |= RTF_CACHE;
@@ -1338,6 +1361,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         rt->dst.flags |= DST_HOST;
         rt->dst.output  = ip6_output;
         atomic_set(&rt->dst.__refcnt, 1);
+        rt->rt6i_gateway  = fl6->daddr;
         rt->rt6i_dst.addr = fl6->daddr;
         rt->rt6i_dst.plen = 128;
         rt->rt6i_idev     = idev;
@@ -1873,7 +1897,10 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                         in6_dev_hold(rt->rt6i_idev);
                 rt->dst.lastuse = jiffies;
 
-                rt->rt6i_gateway = ort->rt6i_gateway;
+                if (ort->rt6i_flags & RTF_GATEWAY)
+                        rt->rt6i_gateway = ort->rt6i_gateway;
+                else
+                        rt->rt6i_gateway = *dest;
                 rt->rt6i_flags = ort->rt6i_flags;
                 if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
                     (RTF_DEFAULT | RTF_ADDRCONF))
@@ -2160,6 +2187,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         else
                 rt->rt6i_flags |= RTF_LOCAL;
 
+        rt->rt6i_gateway  = *addr;
         rt->rt6i_dst.addr = *addr;
         rt->rt6i_dst.plen = 128;
         rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 7ee5cb96db34..19269453a8ea 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -566,6 +566,70 @@ static inline bool is_spoofed_6rd(struct ip_tunnel *tunnel, const __be32 v4addr,
         return false;
 }
 
+/* Checks if an address matches an address on the tunnel interface.
+ * Used to detect the NAT of proto 41 packets and let them pass spoofing test.
+ * Long story:
+ * This function is called after we considered the packet as spoofed
+ * in is_spoofed_6rd.
+ * We may have a router that is doing NAT for proto 41 packets
+ * for an internal station. Destination a.a.a.a/PREFIX:bbbb:bbbb
+ * will be translated to n.n.n.n/PREFIX:bbbb:bbbb. And is_spoofed_6rd
+ * function will return true, dropping the packet.
+ * But, we can still check if is spoofed against the IP
+ * addresses associated with the interface.
+ */
+static bool only_dnatted(const struct ip_tunnel *tunnel,
+        const struct in6_addr *v6dst)
+{
+        int prefix_len;
+
+#ifdef CONFIG_IPV6_SIT_6RD
+        prefix_len = tunnel->ip6rd.prefixlen + 32
+                - tunnel->ip6rd.relay_prefixlen;
+#else
+        prefix_len = 48;
+#endif
+        return ipv6_chk_custom_prefix(v6dst, prefix_len, tunnel->dev);
+}
+
+/* Returns true if a packet is spoofed */
+static bool packet_is_spoofed(struct sk_buff *skb,
+                              const struct iphdr *iph,
+                              struct ip_tunnel *tunnel)
+{
+        const struct ipv6hdr *ipv6h;
+
+        if (tunnel->dev->priv_flags & IFF_ISATAP) {
+                if (!isatap_chksrc(skb, iph, tunnel))
+                        return true;
+
+                return false;
+        }
+
+        if (tunnel->dev->flags & IFF_POINTOPOINT)
+                return false;
+
+        ipv6h = ipv6_hdr(skb);
+
+        if (unlikely(is_spoofed_6rd(tunnel, iph->saddr, &ipv6h->saddr))) {
+                net_warn_ratelimited("Src spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
+                                     &iph->saddr, &ipv6h->saddr,
+                                     &iph->daddr, &ipv6h->daddr);
+                return true;
+        }
+
+        if (likely(!is_spoofed_6rd(tunnel, iph->daddr, &ipv6h->daddr)))
+                return false;
+
+        if (only_dnatted(tunnel, &ipv6h->daddr))
+                return false;
+
+        net_warn_ratelimited("Dst spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
+                             &iph->saddr, &ipv6h->saddr,
+                             &iph->daddr, &ipv6h->daddr);
+        return true;
+}
+
 static int ipip6_rcv(struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
@@ -586,19 +650,9 @@ static int ipip6_rcv(struct sk_buff *skb)
                 IPCB(skb)->flags = 0;
                 skb->protocol = htons(ETH_P_IPV6);
 
-                if (tunnel->dev->priv_flags & IFF_ISATAP) {
-                        if (!isatap_chksrc(skb, iph, tunnel)) {
-                                tunnel->dev->stats.rx_errors++;
-                                goto out;
-                        }
-                } else if (!(tunnel->dev->flags&IFF_POINTOPOINT)) {
-                        if (is_spoofed_6rd(tunnel, iph->saddr,
-                                           &ipv6_hdr(skb)->saddr) ||
-                            is_spoofed_6rd(tunnel, iph->daddr,
-                                           &ipv6_hdr(skb)->daddr)) {
-                                tunnel->dev->stats.rx_errors++;
-                                goto out;
-                        }
+                if (packet_is_spoofed(skb, iph, tunnel)) {
+                        tunnel->dev->stats.rx_errors++;
+                        goto out;
                 }
 
                 __skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
@@ -748,7 +802,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 
                 if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("nexthop == NULL\n");
                         goto tx_error;
                 }
 
@@ -777,7 +831,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 
                 if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        net_dbg_ratelimited("nexthop == NULL\n");
                         goto tx_error;
                 }
 
@@ -1612,6 +1666,7 @@ static int __net_init sit_init_net(struct net *net)
                 goto err_alloc_dev;
         }
         dev_net_set(sitn->fb_tunnel_dev, net);
+        sitn->fb_tunnel_dev->rtnl_link_ops = &sit_link_ops;
         /* FB netdevice is special: we have one, and only one per netns.
          * Allowing to move it to another netns is clearly unsafe.
          */
@@ -1646,7 +1701,6 @@ static void __net_exit sit_exit_net(struct net *net)
 
         rtnl_lock();
         sit_destroy_tunnels(sitn, &list);
-        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
         unregister_netdevice_many(&list);
         rtnl_unlock();
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f4058150262b..18786098fd41 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -525,8 +525,10 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (type == ICMPV6_PKT_TOOBIG)
                 ip6_sk_update_pmtu(skb, sk, info);
-        if (type == NDISC_REDIRECT)
+        if (type == NDISC_REDIRECT) {
                 ip6_sk_redirect(skb, sk);
+                goto out;
+        }
 
         np = inet6_sk(sk);
 
@@ -1223,9 +1225,6 @@ do_udp_sendmsg:
         if (tclass < 0)
                 tclass = np->tclass;
 
-        if (dontfrag < 0)
-                dontfrag = np->dontfrag;
-
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 back_from_confirm:
@@ -1244,6 +1243,8 @@ back_from_confirm:
         up->pending = AF_INET6;
 
 do_append_data:
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
         up->len += ulen;
         getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
         err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 23ed03d786c8..08ed2772b7aa 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -138,6 +138,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
         memset(fl6, 0, sizeof(struct flowi6));
         fl6->flowi6_mark = skb->mark;
+        fl6->flowi6_oif = skb_dst(skb)->dev->ifindex;
 
         fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
         fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9d585370c5b4..911ef03bf8fb 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1098,7 +1098,8 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
 
         x->id.proto = proto;
         x->id.spi = sa->sadb_sa_spi;
-        x->props.replay_window = sa->sadb_sa_replay;
+        x->props.replay_window = min_t(unsigned int, sa->sadb_sa_replay,
+                                        (sizeof(x->replay.bitmap) * 8));
         if (sa->sadb_sa_flags & SADB_SAFLAGS_NOECN)
                 x->props.flags |= XFRM_STATE_NOECN;
         if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index feae495a0a30..b076e8309bc2 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -115,6 +115,11 @@ struct l2tp_net {
 static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 
+static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
+{
+        return sk->sk_user_data;
+}
+
 static inline struct l2tp_net *l2tp_pernet(struct net *net)
 {
         BUG_ON(!net);
@@ -504,7 +509,7 @@ static inline int l2tp_verify_udp_checksum(struct sock *sk,
                 return 0;
 
 #if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
+        if (sk->sk_family == PF_INET6 && !l2tp_tunnel(sk)->v4mapped) {
                 if (!uh->check) {
                         LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
                         return 1;
@@ -1128,7 +1133,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         /* Queue the packet to IP for output */
         skb->local_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (skb->sk->sk_family == PF_INET6)
+        if (skb->sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                 error = inet6_csk_xmit(skb, NULL);
         else
 #endif
@@ -1255,7 +1260,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
 
                 /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6)
+                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                         l2tp_xmit_ipv6_csum(sk, skb, udp_len);
                 else
 #endif
@@ -1304,10 +1309,9 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
  */
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel;
+        struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
         struct l2tp_net *pn;
 
-        tunnel = sk->sk_user_data;
         if (tunnel == NULL)
                 goto end;
 
@@ -1675,7 +1679,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         }
 
         /* Check if this socket has already been prepped */
-        tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
+        tunnel = l2tp_tunnel(sk);
         if (tunnel != NULL) {
                 /* This socket has already been prepped */
                 err = -EBUSY;
@@ -1704,6 +1708,24 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         if (cfg != NULL)
                 tunnel->debug = cfg->debug;
 
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+
+                if (ipv6_addr_v4mapped(&np->saddr) &&
+                    ipv6_addr_v4mapped(&np->daddr)) {
+                        struct inet_sock *inet = inet_sk(sk);
+
+                        tunnel->v4mapped = true;
+                        inet->inet_saddr = np->saddr.s6_addr32[3];
+                        inet->inet_rcv_saddr = np->rcv_saddr.s6_addr32[3];
+                        inet->inet_daddr = np->daddr.s6_addr32[3];
+                } else {
+                        tunnel->v4mapped = false;
+                }
+        }
+#endif
+
         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
         if (encap == L2TP_ENCAPTYPE_UDP) {
@@ -1712,7 +1734,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
                 udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6)
+                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
                         udpv6_encap_enable();
                 else
 #endif
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 66a559b104b6..6f251cbc2ed7 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -194,6 +194,9 @@ struct l2tp_tunnel {
         struct sock             *sock;          /* Parent socket */
         int                     fd;             /* Parent fd, if tunnel socket
                                                  * was created by userspace */
+#if IS_ENABLED(CONFIG_IPV6)
+        bool                    v4mapped;
+#endif
 
         struct work_struct      del_work;
 
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 5ebee2ded9e9..8c46b271064a 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -353,7 +353,9 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                 goto error_put_sess_tun;
         }
 
+        local_bh_disable();
         l2tp_xmit_skb(session, skb, session->hdr_len);
+        local_bh_enable();
 
         sock_put(ps->tunnel_sock);
         sock_put(sk);
@@ -422,7 +424,9 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         skb->data[0] = ppph[0];
         skb->data[1] = ppph[1];
 
+        local_bh_disable();
         l2tp_xmit_skb(session, skb, session->hdr_len);
+        local_bh_enable();
 
         sock_put(sk_tun);
         sock_put(sk);
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index 54563ad8aeb1..355cc3b6fa4d 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -154,6 +154,7 @@ static void lapb_t1timer_expiry(unsigned long param)
                         } else {
                                 lapb->n2count++;
                                 lapb_requeue_frames(lapb);
+                                lapb_kick(lapb);
                         }
                         break;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 2e7855a1b10d..629dee7ec9bf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3518,7 +3518,7 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
         band = chanctx_conf->def.chan->band;
-        sta = sta_info_get(sdata, peer);
+        sta = sta_info_get_bss(sdata, peer);
         if (sta) {
                 qos = test_sta_flag(sta, WLAN_STA_WME);
         } else {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b6186517ec56..611abfcfb5eb 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -893,6 +893,8 @@ struct tpt_led_trigger {
  *      that the scan completed.
  * @SCAN_ABORTED: Set for our scan work function when the driver reported
  *      a scan complete for an aborted scan.
+ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
+ *      cancelled.
  */
 enum {
         SCAN_SW_SCANNING,
@@ -900,6 +902,7 @@ enum {
         SCAN_ONCHANNEL_SCANNING,
         SCAN_COMPLETED,
         SCAN_ABORTED,
+        SCAN_HW_CANCELLED,
 };
 
 /**
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index acd1f71adc03..0c2a29484c07 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -394,6 +394,8 @@ void ieee80211_sw_roc_work(struct work_struct *work)
 
                 if (started)
                         ieee80211_start_next_roc(local);
+                else if (list_empty(&local->roc_list))
+                        ieee80211_run_deferred_scan(local);
         }
 
  out_unlock:
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 54395d7583ba..674eac1f996c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3056,6 +3056,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
         case NL80211_IFTYPE_ADHOC:
                 if (!bssid)
                         return 0;
+                if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
+                    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
+                        return 0;
                 if (ieee80211_is_beacon(hdr->frame_control)) {
                         return 1;
                 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 08afe74b98f4..d2d17a449224 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -238,6 +238,9 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         enum ieee80211_band band;
         int i, ielen, n_chans;
 
+        if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
+                return false;
+
         do {
                 if (local->hw_scan_band == IEEE80211_NUM_BANDS)
                         return false;
@@ -940,7 +943,23 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
         if (!local->scan_req)
                 goto out;
 
+        /*
+         * We have a scan running and the driver already reported completion,
+         * but the worker hasn't run yet or is stuck on the mutex - mark it as
+         * cancelled.
+         */
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
+            test_bit(SCAN_COMPLETED, &local->scanning)) {
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
+                goto out;
+        }
+
         if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
+                /*
+                 * Make sure that __ieee80211_scan_completed doesn't trigger a
+                 * scan on another band.
+                 */
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
                 if (local->ops->cancel_hw_scan)
                         drv_cancel_hw_scan(local,
                                 rcu_dereference_protected(local->scan_sdata,
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 368837fe3b80..78dc2e99027e 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                sta->last_rx = jiffies;
+
         if (ieee80211_is_data_qos(mgmt->frame_control)) {
                 struct ieee80211_hdr *hdr = (void *) skb->data;
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3456c0486b48..70b5a05c0a4e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1120,7 +1120,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+        } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
+                                  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
                    tx->sdata->control_port_protocol == tx->skb->protocol) {
                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index e1b34a18b243..69e4ef5348a0 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2103,7 +2103,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        int rate, skip, shift;
+        int rate, shift;
         u8 i, exrates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
         u32 rate_flags;
@@ -2131,14 +2131,11 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                 pos = skb_put(skb, exrates + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = exrates;
-                skip = 0;
                 for (i = 8; i < sband->n_bitrates; i++) {
                         u8 basic = 0;
                         if ((rate_flags & sband->bitrates[i].flags)
                             != rate_flags)
                                 continue;
-                        if (skip++ < 8)
-                                continue;
                         if (need_basic && basic_rates & BIT(i))
                                 basic = 0x80;
                         rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
@@ -2241,6 +2238,10 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
         }
 
         rate = cfg80211_calculate_bitrate(&ri);
+        if (WARN_ONCE(!rate,
+                      "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
+                      status->flag, status->rate_idx, status->vht_nss))
+                return 0;
 
         /* rewind from end of MPDU */
         if (status->flag & RX_FLAG_MACTIME_END)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 4f69e83ff836..74fd00c27210 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -116,6 +116,7 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 
         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 struct ip_vs_cpu_stats *s;
+                struct ip_vs_service *svc;
 
                 s = this_cpu_ptr(dest->stats.cpustats);
                 s->ustats.inpkts++;
@@ -123,11 +124,14 @@ ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
                 s->ustats.inbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
 
-                s = this_cpu_ptr(dest->svc->stats.cpustats);
+                rcu_read_lock();
+                svc = rcu_dereference(dest->svc);
+                s = this_cpu_ptr(svc->stats.cpustats);
                 s->ustats.inpkts++;
                 u64_stats_update_begin(&s->syncp);
                 s->ustats.inbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
+                rcu_read_unlock();
 
                 s = this_cpu_ptr(ipvs->tot_stats.cpustats);
                 s->ustats.inpkts++;
@@ -146,6 +150,7 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 
         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                 struct ip_vs_cpu_stats *s;
+                struct ip_vs_service *svc;
 
                 s = this_cpu_ptr(dest->stats.cpustats);
                 s->ustats.outpkts++;
@@ -153,11 +158,14 @@ ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
                 s->ustats.outbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
 
-                s = this_cpu_ptr(dest->svc->stats.cpustats);
+                rcu_read_lock();
+                svc = rcu_dereference(dest->svc);
+                s = this_cpu_ptr(svc->stats.cpustats);
                 s->ustats.outpkts++;
                 u64_stats_update_begin(&s->syncp);
                 s->ustats.outbytes += skb->len;
                 u64_stats_update_end(&s->syncp);
+                rcu_read_unlock();
 
                 s = this_cpu_ptr(ipvs->tot_stats.cpustats);
                 s->ustats.outpkts++;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c8148e487386..a3df9bddc4f7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -460,7 +460,7 @@ static inline void
 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 {
         atomic_inc(&svc->refcnt);
-        dest->svc = svc;
+        rcu_assign_pointer(dest->svc, svc);
 }
 
 static void ip_vs_service_free(struct ip_vs_service *svc)
@@ -470,18 +470,25 @@ static void ip_vs_service_free(struct ip_vs_service *svc)
         kfree(svc);
 }
 
-static void
-__ip_vs_unbind_svc(struct ip_vs_dest *dest)
+static void ip_vs_service_rcu_free(struct rcu_head *head)
 {
-        struct ip_vs_service *svc = dest->svc;
+        struct ip_vs_service *svc;
+
+        svc = container_of(head, struct ip_vs_service, rcu_head);
+        ip_vs_service_free(svc);
+}
 
-        dest->svc = NULL;
+static void __ip_vs_svc_put(struct ip_vs_service *svc, bool do_delay)
+{
         if (atomic_dec_and_test(&svc->refcnt)) {
                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
                               svc->fwmark,
                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
                               ntohs(svc->port));
-                ip_vs_service_free(svc);
+                if (do_delay)
+                        call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
+                else
+                        ip_vs_service_free(svc);
         }
 }
 
@@ -667,11 +674,6 @@ ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
                               ntohs(dest->port),
                               atomic_read(&dest->refcnt));
-                /* We can not reuse dest while in grace period
-                 * because conns still can use dest->svc
-                 */
-                if (test_bit(IP_VS_DEST_STATE_REMOVING, &dest->state))
-                        continue;
                 if (dest->af == svc->af &&
                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
                     dest->port == dport &&
@@ -697,8 +699,10 @@ out:
 
 static void ip_vs_dest_free(struct ip_vs_dest *dest)
 {
+        struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);
+
         __ip_vs_dst_cache_reset(dest);
-        __ip_vs_unbind_svc(dest);
+        __ip_vs_svc_put(svc, false);
         free_percpu(dest->stats.cpustats);
         kfree(dest);
 }
@@ -771,6 +775,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
                     struct ip_vs_dest_user_kern *udest, int add)
 {
         struct netns_ipvs *ipvs = net_ipvs(svc->net);
+        struct ip_vs_service *old_svc;
         struct ip_vs_scheduler *sched;
         int conn_flags;
 
@@ -792,13 +797,14 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         atomic_set(&dest->conn_flags, conn_flags);
 
         /* bind the service */
-        if (!dest->svc) {
+        old_svc = rcu_dereference_protected(dest->svc, 1);
+        if (!old_svc) {
                 __ip_vs_bind_svc(dest, svc);
         } else {
-                if (dest->svc != svc) {
-                        __ip_vs_unbind_svc(dest);
+                if (old_svc != svc) {
                         ip_vs_zero_stats(&dest->stats);
                         __ip_vs_bind_svc(dest, svc);
+                        __ip_vs_svc_put(old_svc, true);
                 }
         }
 
@@ -998,16 +1004,6 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
         return 0;
 }
 
-static void ip_vs_dest_wait_readers(struct rcu_head *head)
-{
-        struct ip_vs_dest *dest = container_of(head, struct ip_vs_dest,
-                                               rcu_head);
-
-        /* End of grace period after unlinking */
-        clear_bit(IP_VS_DEST_STATE_REMOVING, &dest->state);
-}
-
-
 /*
  *      Delete a destination (must be already unlinked from the service)
  */
@@ -1023,20 +1019,16 @@ static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest,
          */
         ip_vs_rs_unhash(dest);
 
-        if (!cleanup) {
-                set_bit(IP_VS_DEST_STATE_REMOVING, &dest->state);
-                call_rcu(&dest->rcu_head, ip_vs_dest_wait_readers);
-        }
-
         spin_lock_bh(&ipvs->dest_trash_lock);
         IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
                       IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
                       atomic_read(&dest->refcnt));
         if (list_empty(&ipvs->dest_trash) && !cleanup)
                 mod_timer(&ipvs->dest_trash_timer,
-                          jiffies + IP_VS_DEST_TRASH_PERIOD);
+                          jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
         /* dest lives in trash without reference */
         list_add(&dest->t_list, &ipvs->dest_trash);
+        dest->idle_start = 0;
         spin_unlock_bh(&ipvs->dest_trash_lock);
         ip_vs_dest_put(dest);
 }
@@ -1108,24 +1100,30 @@ static void ip_vs_dest_trash_expire(unsigned long data)
         struct net *net = (struct net *) data;
         struct netns_ipvs *ipvs = net_ipvs(net);
         struct ip_vs_dest *dest, *next;
+        unsigned long now = jiffies;
 
         spin_lock(&ipvs->dest_trash_lock);
         list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) {
-                /* Skip if dest is in grace period */
-                if (test_bit(IP_VS_DEST_STATE_REMOVING, &dest->state))
-                        continue;
                 if (atomic_read(&dest->refcnt) > 0)
                         continue;
+                if (dest->idle_start) {
+                        if (time_before(now, dest->idle_start +
+                                             IP_VS_DEST_TRASH_PERIOD))
+                                continue;
+                } else {
+                        dest->idle_start = max(1UL, now);
+                        continue;
+                }
                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n",
                               dest->vfwmark,
-                              IP_VS_DBG_ADDR(dest->svc->af, &dest->addr),
+                              IP_VS_DBG_ADDR(dest->af, &dest->addr),
                               ntohs(dest->port));
                 list_del(&dest->t_list);
                 ip_vs_dest_free(dest);
         }
         if (!list_empty(&ipvs->dest_trash))
                 mod_timer(&ipvs->dest_trash_timer,
-                          jiffies + IP_VS_DEST_TRASH_PERIOD);
+                          jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
         spin_unlock(&ipvs->dest_trash_lock);
 }
 
@@ -1320,14 +1318,6 @@ out:
         return ret;
 }
 
-static void ip_vs_service_rcu_free(struct rcu_head *head)
-{
-        struct ip_vs_service *svc;
-
-        svc = container_of(head, struct ip_vs_service, rcu_head);
-        ip_vs_service_free(svc);
-}
-
 /*
  *      Delete a service from the service list
  *      - The service must be unlinked, unlocked and not referenced!
@@ -1376,13 +1366,7 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
         /*
          *    Free the service if nobody refers to it
          */
-        if (atomic_dec_and_test(&svc->refcnt)) {
-                IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
-                              svc->fwmark,
-                              IP_VS_DBG_ADDR(svc->af, &svc->addr),
-                              ntohs(svc->port));
-                call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
-        }
+        __ip_vs_svc_put(svc, true);
 
         /* decrease the module use count */
         ip_vs_use_count_dec();
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index 6bee6d0c73a5..1425e9a924c4 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -59,12 +59,13 @@ static void ip_vs_read_cpu_stats(struct ip_vs_stats_user *sum,
                                  struct ip_vs_cpu_stats __percpu *stats)
 {
         int i;
+        bool add = false;
 
         for_each_possible_cpu(i) {
                 struct ip_vs_cpu_stats *s = per_cpu_ptr(stats, i);
                 unsigned int start;
                 __u64 inbytes, outbytes;
-                if (i) {
+                if (add) {
                         sum->conns += s->ustats.conns;
                         sum->inpkts += s->ustats.inpkts;
                         sum->outpkts += s->ustats.outpkts;
@@ -76,6 +77,7 @@ static void ip_vs_read_cpu_stats(struct ip_vs_stats_user *sum,
                         sum->inbytes += inbytes;
                         sum->outbytes += outbytes;
                 } else {
+                        add = true;
                         sum->conns = s->ustats.conns;
                         sum->inpkts = s->ustats.inpkts;
                         sum->outpkts = s->ustats.outpkts;
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 1383b0eadc0e..eff13c94498e 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -93,7 +93,7 @@ struct ip_vs_lblc_entry {
         struct hlist_node       list;
         int                     af;             /* address family */
         union nf_inet_addr      addr;           /* destination IP address */
-        struct ip_vs_dest __rcu *dest;          /* real server (cache) */
+        struct ip_vs_dest       *dest;          /* real server (cache) */
         unsigned long           lastuse;        /* last used time */
         struct rcu_head         rcu_head;
 };
@@ -130,20 +130,21 @@ static struct ctl_table vs_vars_table[] = {
 };
 #endif
 
-static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
+static void ip_vs_lblc_rcu_free(struct rcu_head *head)
 {
-        struct ip_vs_dest *dest;
+        struct ip_vs_lblc_entry *en = container_of(head,
+                                                   struct ip_vs_lblc_entry,
+                                                   rcu_head);
 
-        hlist_del_rcu(&en->list);
-        /*
-         * We don't kfree dest because it is referred either by its service
-         * or the trash dest list.
-         */
-        dest = rcu_dereference_protected(en->dest, 1);
-        ip_vs_dest_put(dest);
-        kfree_rcu(en, rcu_head);
+        ip_vs_dest_put(en->dest);
+        kfree(en);
 }
 
+static inline void ip_vs_lblc_del(struct ip_vs_lblc_entry *en)
+{
+        hlist_del_rcu(&en->list);
+        call_rcu(&en->rcu_head, ip_vs_lblc_rcu_free);
+}
 
 /*
  *      Returns hash value for IPVS LBLC entry
@@ -203,30 +204,23 @@ ip_vs_lblc_new(struct ip_vs_lblc_table *tbl, const union nf_inet_addr *daddr,
         struct ip_vs_lblc_entry *en;
 
         en = ip_vs_lblc_get(dest->af, tbl, daddr);
-        if (!en) {
-                en = kmalloc(sizeof(*en), GFP_ATOMIC);
-                if (!en)
-                        return NULL;
-
-                en->af = dest->af;
-                ip_vs_addr_copy(dest->af, &en->addr, daddr);
-                en->lastuse = jiffies;
+        if (en) {
+                if (en->dest == dest)
+                        return en;
+                ip_vs_lblc_del(en);
+        }
+        en = kmalloc(sizeof(*en), GFP_ATOMIC);
+        if (!en)
+                return NULL;
 
-                ip_vs_dest_hold(dest);
-                RCU_INIT_POINTER(en->dest, dest);
+        en->af = dest->af;
+        ip_vs_addr_copy(dest->af, &en->addr, daddr);
+        en->lastuse = jiffies;
 
-                ip_vs_lblc_hash(tbl, en);
-        } else {
-                struct ip_vs_dest *old_dest;
+        ip_vs_dest_hold(dest);
+        en->dest = dest;
 
-                old_dest = rcu_dereference_protected(en->dest, 1);
-                if (old_dest != dest) {
-                        ip_vs_dest_put(old_dest);
-                        ip_vs_dest_hold(dest);
-                        /* No ordering constraints for refcnt */
-                        RCU_INIT_POINTER(en->dest, dest);
-                }
-        }
+        ip_vs_lblc_hash(tbl, en);
 
         return en;
 }
@@ -246,7 +240,7 @@ static void ip_vs_lblc_flush(struct ip_vs_service *svc)
         tbl->dead = 1;
         for (i=0; i<IP_VS_LBLC_TAB_SIZE; i++) {
                 hlist_for_each_entry_safe(en, next, &tbl->bucket[i], list) {
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
                 }
         }
@@ -281,7 +275,7 @@ static inline void ip_vs_lblc_full_check(struct ip_vs_service *svc)
                                         sysctl_lblc_expiration(svc)))
                                 continue;
 
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
                 }
                 spin_unlock(&svc->sched_lock);
@@ -335,7 +329,7 @@ static void ip_vs_lblc_check_expire(unsigned long data)
                         if (time_before(now, en->lastuse + ENTRY_TIMEOUT))
                                 continue;
 
-                        ip_vs_lblc_free(en);
+                        ip_vs_lblc_del(en);
                         atomic_dec(&tbl->entries);
                         goal--;
                 }
@@ -443,8 +437,8 @@ __ip_vs_lblc_schedule(struct ip_vs_service *svc)
                         continue;
 
                 doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
@@ -511,7 +505,7 @@ ip_vs_lblc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                  * free up entries from the trash at any time.
                  */
 
-                dest = rcu_dereference(en->dest);
+                dest = en->dest;
                 if ((dest->flags & IP_VS_DEST_F_AVAILABLE) &&
                     atomic_read(&dest->weight) > 0 && !is_overloaded(dest, svc))
                         goto out;
@@ -631,7 +625,7 @@ static void __exit ip_vs_lblc_cleanup(void)
 {
         unregister_ip_vs_scheduler(&ip_vs_lblc_scheduler);
         unregister_pernet_subsys(&ip_vs_lblc_ops);
-        synchronize_rcu();
+        rcu_barrier();
 }
 
 
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 5199448697f6..0b8550089a2e 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -89,7 +89,7 @@
  */
 struct ip_vs_dest_set_elem {
         struct list_head        list;          /* list link */
-        struct ip_vs_dest __rcu *dest;         /* destination server */
+        struct ip_vs_dest       *dest;          /* destination server */
         struct rcu_head         rcu_head;
 };
 
@@ -107,11 +107,7 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
 
         if (check) {
                 list_for_each_entry(e, &set->list, list) {
-                        struct ip_vs_dest *d;
-
-                        d = rcu_dereference_protected(e->dest, 1);
-                        if (d == dest)
-                                /* already existed */
+                        if (e->dest == dest)
                                 return;
                 }
         }
@@ -121,7 +117,7 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
                 return;
 
         ip_vs_dest_hold(dest);
-        RCU_INIT_POINTER(e->dest, dest);
+        e->dest = dest;
 
         list_add_rcu(&e->list, &set->list);
         atomic_inc(&set->size);
@@ -129,22 +125,27 @@ static void ip_vs_dest_set_insert(struct ip_vs_dest_set *set,
         set->lastmod = jiffies;
 }
 
+static void ip_vs_lblcr_elem_rcu_free(struct rcu_head *head)
+{
+        struct ip_vs_dest_set_elem *e;
+
+        e = container_of(head, struct ip_vs_dest_set_elem, rcu_head);
+        ip_vs_dest_put(e->dest);
+        kfree(e);
+}
+
 static void
 ip_vs_dest_set_erase(struct ip_vs_dest_set *set, struct ip_vs_dest *dest)
 {
         struct ip_vs_dest_set_elem *e;
 
         list_for_each_entry(e, &set->list, list) {
-                struct ip_vs_dest *d;
-
-                d = rcu_dereference_protected(e->dest, 1);
-                if (d == dest) {
+                if (e->dest == dest) {
                         /* HIT */
                         atomic_dec(&set->size);
                         set->lastmod = jiffies;
-                        ip_vs_dest_put(dest);
                         list_del_rcu(&e->list);
-                        kfree_rcu(e, rcu_head);
+                        call_rcu(&e->rcu_head, ip_vs_lblcr_elem_rcu_free);
                         break;
                 }
         }
@@ -155,16 +156,8 @@ static void ip_vs_dest_set_eraseall(struct ip_vs_dest_set *set)
         struct ip_vs_dest_set_elem *e, *ep;
 
         list_for_each_entry_safe(e, ep, &set->list, list) {
-                struct ip_vs_dest *d;
-
-                d = rcu_dereference_protected(e->dest, 1);
-                /*
-                 * We don't kfree dest because it is referred either
-                 * by its service or by the trash dest list.
-                 */
-                ip_vs_dest_put(d);
                 list_del_rcu(&e->list);
-                kfree_rcu(e, rcu_head);
+                call_rcu(&e->rcu_head, ip_vs_lblcr_elem_rcu_free);
         }
 }
 
@@ -175,12 +168,9 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
         struct ip_vs_dest *dest, *least;
         int loh, doh;
 
-        if (set == NULL)
-                return NULL;
-
         /* select the first destination server, whose weight > 0 */
         list_for_each_entry_rcu(e, &set->list, list) {
-                least = rcu_dereference(e->dest);
+                least = e->dest;
                 if (least->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
 
@@ -195,13 +185,13 @@ static inline struct ip_vs_dest *ip_vs_dest_set_min(struct ip_vs_dest_set *set)
         /* find the destination with the weighted least load */
   nextstage:
         list_for_each_entry_continue_rcu(e, &set->list, list) {
-                dest = rcu_dereference(e->dest);
+                dest = e->dest;
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
 
                 doh = ip_vs_dest_conn_overhead(dest);
-                if ((loh * atomic_read(&dest->weight) >
-                     doh * atomic_read(&least->weight))
+                if (((__s64)loh * atomic_read(&dest->weight) >
+                     (__s64)doh * atomic_read(&least->weight))
                     && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
                         least = dest;
                         loh = doh;
@@ -232,7 +222,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
 
         /* select the first destination server, whose weight > 0 */
         list_for_each_entry(e, &set->list, list) {
-                most = rcu_dereference_protected(e->dest, 1);
+                most = e->dest;
                 if (atomic_read(&most->weight) > 0) {
                         moh = ip_vs_dest_conn_overhead(most);
                         goto nextstage;
@@ -243,11 +233,11 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
         /* find the destination with the weighted most load */
   nextstage:
         list_for_each_entry_continue(e, &set->list, list) {
-                dest = rcu_dereference_protected(e->dest, 1);
+                dest = e->dest;
                 doh = ip_vs_dest_conn_overhead(dest);
                 /* moh/mw < doh/dw ==> moh*dw < doh*mw, where mw,dw>0 */
-                if ((moh * atomic_read(&dest->weight) <
-                     doh * atomic_read(&most->weight))
+                if (((__s64)moh * atomic_read(&dest->weight) <
+                     (__s64)doh * atomic_read(&most->weight))
                     && (atomic_read(&dest->weight) > 0)) {
                         most = dest;
                         moh = doh;
@@ -611,8 +601,8 @@ __ip_vs_lblcr_schedule(struct ip_vs_service *svc)
                         continue;
 
                 doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
@@ -819,7 +809,7 @@ static void __exit ip_vs_lblcr_cleanup(void)
 {
         unregister_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
         unregister_pernet_subsys(&ip_vs_lblcr_ops);
-        synchronize_rcu();
+        rcu_barrier();
 }
 
 
diff --git a/net/netfilter/ipvs/ip_vs_nq.c b/net/netfilter/ipvs/ip_vs_nq.c
index d8d9860934fe..961a6de9bb29 100644
--- a/net/netfilter/ipvs/ip_vs_nq.c
+++ b/net/netfilter/ipvs/ip_vs_nq.c
@@ -40,7 +40,7 @@
 #include <net/ip_vs.h>
 
 
-static inline unsigned int
+static inline int
 ip_vs_nq_dest_overhead(struct ip_vs_dest *dest)
 {
         /*
@@ -59,7 +59,7 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                   struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least = NULL;
-        unsigned int loh = 0, doh;
+        int loh = 0, doh;
 
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
@@ -92,8 +92,8 @@ ip_vs_nq_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                 }
 
                 if (!least ||
-                    (loh * atomic_read(&dest->weight) >
-                     doh * atomic_read(&least->weight))) {
+                    ((__s64)loh * atomic_read(&dest->weight) >
+                     (__s64)doh * atomic_read(&least->weight))) {
                         least = dest;
                         loh = doh;
                 }
diff --git a/net/netfilter/ipvs/ip_vs_sed.c b/net/netfilter/ipvs/ip_vs_sed.c
index a5284cc3d882..e446b9fa7424 100644
--- a/net/netfilter/ipvs/ip_vs_sed.c
+++ b/net/netfilter/ipvs/ip_vs_sed.c
@@ -44,7 +44,7 @@
 #include <net/ip_vs.h>
 
 
-static inline unsigned int
+static inline int
 ip_vs_sed_dest_overhead(struct ip_vs_dest *dest)
 {
         /*
@@ -63,7 +63,7 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                    struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least;
-        unsigned int loh, doh;
+        int loh, doh;
 
         IP_VS_DBG(6, "%s(): Scheduling...\n", __func__);
 
@@ -99,8 +99,8 @@ ip_vs_sed_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
                 doh = ip_vs_sed_dest_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
diff --git a/net/netfilter/ipvs/ip_vs_wlc.c b/net/netfilter/ipvs/ip_vs_wlc.c
index 6dc1fa128840..b5b4650d50a9 100644
--- a/net/netfilter/ipvs/ip_vs_wlc.c
+++ b/net/netfilter/ipvs/ip_vs_wlc.c
@@ -35,7 +35,7 @@ ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                    struct ip_vs_iphdr *iph)
 {
         struct ip_vs_dest *dest, *least;
-        unsigned int loh, doh;
+        int loh, doh;
 
         IP_VS_DBG(6, "ip_vs_wlc_schedule(): Scheduling...\n");
 
@@ -71,8 +71,8 @@ ip_vs_wlc_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
                         continue;
                 doh = ip_vs_dest_conn_overhead(dest);
-                if (loh * atomic_read(&dest->weight) >
-                    doh * atomic_read(&least->weight)) {
+                if ((__s64)loh * atomic_read(&dest->weight) >
+                    (__s64)doh * atomic_read(&least->weight)) {
                         least = dest;
                         loh = doh;
                 }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bdebd03bc8cd..70866d192efc 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -778,8 +778,8 @@ static int callforward_do_filter(const union nf_inet_addr *src,
                                    flowi6_to_flowi(&fl1), false)) {
                         if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
                                            flowi6_to_flowi(&fl2), false)) {
-                                if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
-                                            sizeof(rt1->rt6i_gateway)) &&
+                                if (ipv6_addr_equal(rt6_nexthop(rt1),
+                                                    rt6_nexthop(rt2)) &&
                                     rt1->dst.dev == rt2->dst.dev)
                                         ret = 1;
                                 dst_release(&rt2->dst);
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 6fd967c6278c..cdf4567ba9b3 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -24,7 +24,7 @@
 int synproxy_net_id;
 EXPORT_SYMBOL_GPL(synproxy_net_id);
 
-void
+bool
 synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                        const struct tcphdr *th, struct synproxy_options *opts)
 {
@@ -32,7 +32,8 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
         u8 buf[40], *ptr;
 
         ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
-        BUG_ON(ptr == NULL);
+        if (ptr == NULL)
+                return false;
 
         opts->options = 0;
         while (length > 0) {
@@ -41,16 +42,16 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
 
                 switch (opcode) {
                 case TCPOPT_EOL:
-                        return;
+                        return true;
                 case TCPOPT_NOP:
                         length--;
                         continue;
                 default:
                         opsize = *ptr++;
                         if (opsize < 2)
-                                return;
+                                return true;
                         if (opsize > length)
-                                return;
+                                return true;
 
                         switch (opcode) {
                         case TCPOPT_MSS:
@@ -84,6 +85,7 @@ synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
                         length -= opsize;
                 }
         }
+        return true;
 }
 EXPORT_SYMBOL_GPL(synproxy_parse_options);
 
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 32ad015ee8ce..a9dfdda9ed1d 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -285,7 +285,7 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
 
 
 /* remove one skb from head of flow queue */
-static struct sk_buff *fq_dequeue_head(struct fq_flow *flow)
+static struct sk_buff *fq_dequeue_head(struct Qdisc *sch, struct fq_flow *flow)
 {
         struct sk_buff *skb = flow->head;
 
@@ -293,6 +293,8 @@ static struct sk_buff *fq_dequeue_head(struct fq_flow *flow)
                 flow->head = skb->next;
                 skb->next = NULL;
                 flow->qlen--;
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                sch->q.qlen--;
         }
         return skb;
 }
@@ -418,8 +420,9 @@ static struct sk_buff *fq_dequeue(struct Qdisc *sch)
         struct fq_flow_head *head;
         struct sk_buff *skb;
         struct fq_flow *f;
+        u32 rate;
 
-        skb = fq_dequeue_head(&q->internal);
+        skb = fq_dequeue_head(sch, &q->internal);
         if (skb)
                 goto out;
         fq_check_throttled(q, now);
@@ -449,7 +452,7 @@ begin:
                 goto begin;
         }
 
-        skb = fq_dequeue_head(f);
+        skb = fq_dequeue_head(sch, f);
         if (!skb) {
                 head->first = f->next;
                 /* force a pass through old_flows to prevent starvation */
@@ -466,43 +469,70 @@ begin:
         f->time_next_packet = now;
         f->credit -= qdisc_pkt_len(skb);
 
-        if (f->credit <= 0 &&
-            q->rate_enable &&
-            skb->sk && skb->sk->sk_state != TCP_TIME_WAIT) {
-                u32 rate = skb->sk->sk_pacing_rate ?: q->flow_default_rate;
+        if (f->credit > 0 || !q->rate_enable)
+                goto out;
 
-                rate = min(rate, q->flow_max_rate);
-                if (rate) {
-                        u64 len = (u64)qdisc_pkt_len(skb) * NSEC_PER_SEC;
+        rate = q->flow_max_rate;
+        if (skb->sk && skb->sk->sk_state != TCP_TIME_WAIT)
+                rate = min(skb->sk->sk_pacing_rate, rate);
 
-                        do_div(len, rate);
-                        /* Since socket rate can change later,
-                         * clamp the delay to 125 ms.
-                         * TODO: maybe segment the too big skb, as in commit
-                         * e43ac79a4bc ("sch_tbf: segment too big GSO packets")
-                         */
-                        if (unlikely(len > 125 * NSEC_PER_MSEC)) {
-                                len = 125 * NSEC_PER_MSEC;
-                                q->stat_pkts_too_long++;
-                        }
+        if (rate != ~0U) {
+                u32 plen = max(qdisc_pkt_len(skb), q->quantum);
+                u64 len = (u64)plen * NSEC_PER_SEC;
 
-                        f->time_next_packet = now + len;
+                if (likely(rate))
+                        do_div(len, rate);
+                /* Since socket rate can change later,
+                 * clamp the delay to 125 ms.
+                 * TODO: maybe segment the too big skb, as in commit
+                 * e43ac79a4bc ("sch_tbf: segment too big GSO packets")
+                 */
+                if (unlikely(len > 125 * NSEC_PER_MSEC)) {
+                        len = 125 * NSEC_PER_MSEC;
+                        q->stat_pkts_too_long++;
                 }
+
+                f->time_next_packet = now + len;
         }
 out:
-        sch->qstats.backlog -= qdisc_pkt_len(skb);
         qdisc_bstats_update(sch, skb);
-        sch->q.qlen--;
         qdisc_unthrottled(sch);
         return skb;
 }
 
 static void fq_reset(struct Qdisc *sch)
 {
+        struct fq_sched_data *q = qdisc_priv(sch);
+        struct rb_root *root;
         struct sk_buff *skb;
+        struct rb_node *p;
+        struct fq_flow *f;
+        unsigned int idx;
 
-        while ((skb = fq_dequeue(sch)) != NULL)
+        while ((skb = fq_dequeue_head(sch, &q->internal)) != NULL)
                 kfree_skb(skb);
+
+        if (!q->fq_root)
+                return;
+
+        for (idx = 0; idx < (1U << q->fq_trees_log); idx++) {
+                root = &q->fq_root[idx];
+                while ((p = rb_first(root)) != NULL) {
+                        f = container_of(p, struct fq_flow, fq_node);
+                        rb_erase(p, root);
+
+                        while ((skb = fq_dequeue_head(sch, f)) != NULL)
+                                kfree_skb(skb);
+
+                        kmem_cache_free(fq_flow_cachep, f);
+                }
+        }
+        q->new_flows.first      = NULL;
+        q->old_flows.first      = NULL;
+        q->delayed              = RB_ROOT;
+        q->flows                = 0;
+        q->inactive_flows       = 0;
+        q->throttled_flows      = 0;
 }
 
 static void fq_rehash(struct fq_sched_data *q,
@@ -622,7 +652,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                 q->quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
 
         if (tb[TCA_FQ_INITIAL_QUANTUM])
-                q->quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
+                q->initial_quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
 
         if (tb[TCA_FQ_FLOW_DEFAULT_RATE])
                 q->flow_default_rate = nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]);
@@ -645,6 +675,8 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
         while (sch->q.qlen > sch->limit) {
                 struct sk_buff *skb = fq_dequeue(sch);
 
+                if (!skb)
+                        break;
                 kfree_skb(skb);
                 drop_count++;
         }
@@ -657,21 +689,9 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
 static void fq_destroy(struct Qdisc *sch)
 {
         struct fq_sched_data *q = qdisc_priv(sch);
-        struct rb_root *root;
-        struct rb_node *p;
-        unsigned int idx;
 
-        if (q->fq_root) {
-                for (idx = 0; idx < (1U << q->fq_trees_log); idx++) {
-                        root = &q->fq_root[idx];
-                        while ((p = rb_first(root)) != NULL) {
-                                rb_erase(p, root);
-                                kmem_cache_free(fq_flow_cachep,
-                                                container_of(p, struct fq_flow, fq_node));
-                        }
-                }
-                kfree(q->fq_root);
-        }
+        fq_reset(sch);
+        kfree(q->fq_root);
         qdisc_watchdog_cancel(&q->watchdog);
 }
 
@@ -711,12 +731,14 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
         if (opts == NULL)
                 goto nla_put_failure;
 
+        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore,
+         * do not bother giving its value
+         */
         if (nla_put_u32(skb, TCA_FQ_PLIMIT, sch->limit) ||
             nla_put_u32(skb, TCA_FQ_FLOW_PLIMIT, q->flow_plimit) ||
             nla_put_u32(skb, TCA_FQ_QUANTUM, q->quantum) ||
             nla_put_u32(skb, TCA_FQ_INITIAL_QUANTUM, q->initial_quantum) ||
             nla_put_u32(skb, TCA_FQ_RATE_ENABLE, q->rate_enable) ||
-            nla_put_u32(skb, TCA_FQ_FLOW_DEFAULT_RATE, q->flow_default_rate) ||
             nla_put_u32(skb, TCA_FQ_FLOW_MAX_RATE, q->flow_max_rate) ||
             nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
                 goto nla_put_failure;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a6d788d45216..b87e83d07478 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -358,6 +358,21 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
         return PSCHED_NS2TICKS(ticks);
 }
 
+static void tfifo_reset(struct Qdisc *sch)
+{
+        struct netem_sched_data *q = qdisc_priv(sch);
+        struct rb_node *p;
+
+        while ((p = rb_first(&q->t_root))) {
+                struct sk_buff *skb = netem_rb_to_skb(p);
+
+                rb_erase(p, &q->t_root);
+                skb->next = NULL;
+                skb->prev = NULL;
+                kfree_skb(skb);
+        }
+}
+
 static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
@@ -520,6 +535,7 @@ static unsigned int netem_drop(struct Qdisc *sch)
                         skb->next = NULL;
                         skb->prev = NULL;
                         len = qdisc_pkt_len(skb);
+                        sch->qstats.backlog -= len;
                         kfree_skb(skb);
                 }
         }
@@ -609,6 +625,7 @@ static void netem_reset(struct Qdisc *sch)
         struct netem_sched_data *q = qdisc_priv(sch);
 
         qdisc_reset_queue(sch);
+        tfifo_reset(sch);
         if (q->qdisc)
                 qdisc_reset(q->qdisc);
         qdisc_watchdog_cancel(&q->watchdog);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 0ac3a65daccb..319137340d15 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -536,7 +536,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
          */
         if (!sctp_checksum_disable) {
-                if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
+                if (!(dst->dev->features & NETIF_F_SCTP_CSUM) ||
+                    (dst_xfrm(dst) != NULL) || packet->ipfragok) {
                         __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
 
                         /* 3) Put the resultant value into the checksum field in the
diff --git a/net/socket.c b/net/socket.c
index ebed4b68f768..c226aceee65b 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1964,6 +1964,16 @@ struct used_address {
         unsigned int name_len;
 };
 
+static int copy_msghdr_from_user(struct msghdr *kmsg,
+                                 struct msghdr __user *umsg)
+{
+        if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
+                return -EFAULT;
+        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+                return -EINVAL;
+        return 0;
+}
+
 static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
                          struct msghdr *msg_sys, unsigned int flags,
                          struct used_address *used_address)
@@ -1982,8 +1992,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
         if (MSG_CMSG_COMPAT & flags) {
                 if (get_compat_msghdr(msg_sys, msg_compat))
                         return -EFAULT;
-        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
-                return -EFAULT;
+        } else {
+                err = copy_msghdr_from_user(msg_sys, msg);
+                if (err)
+                        return err;
+        }
 
         if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                 err = -EMSGSIZE;
@@ -2191,8 +2204,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
         if (MSG_CMSG_COMPAT & flags) {
                 if (get_compat_msghdr(msg_sys, msg_compat))
                         return -EFAULT;
-        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
-                return -EFAULT;
+        } else {
+                err = copy_msghdr_from_user(msg_sys, msg);
+                if (err)
+                        return err;
+        }
 
         if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                 err = -EMSGSIZE;
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 9bc6db04be3e..e7000be321b0 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -47,12 +47,12 @@ static int net_ctl_permissions(struct ctl_table_header *head,
 
         /* Allow network administrator to have same access as root. */
         if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-            uid_eq(root_uid, current_uid())) {
+            uid_eq(root_uid, current_euid())) {
                 int mode = (table->mode >> 6) & 7;
                 return (mode << 6) | (mode << 3) | mode;
         }
         /* Allow netns root group to have the same access as the root group */
-        if (gid_eq(root_gid, current_gid())) {
+        if (in_egroup_p(root_gid)) {
                 int mode = (table->mode >> 3) & 7;
                 return (mode << 3) | mode;
         }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 86de99ad2976..c1f403bed683 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1246,6 +1246,15 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb)
         return 0;
 }
 
+static void unix_sock_inherit_flags(const struct socket *old,
+                                    struct socket *new)
+{
+        if (test_bit(SOCK_PASSCRED, &old->flags))
+                set_bit(SOCK_PASSCRED, &new->flags);
+        if (test_bit(SOCK_PASSSEC, &old->flags))
+                set_bit(SOCK_PASSSEC, &new->flags);
+}
+
 static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
 {
         struct sock *sk = sock->sk;
@@ -1280,6 +1289,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
         /* attach accepted sock to socket */
         unix_state_lock(tsk);
         newsock->state = SS_CONNECTED;
+        unix_sock_inherit_flags(sock, newsock);
         sock_graft(tsk, newsock);
         unix_state_unlock(tsk);
         return 0;
diff --git a/net/unix/diag.c b/net/unix/diag.c
index d591091603bf..86fa0f3b2caf 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -124,6 +124,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
         rep->udiag_family = AF_UNIX;
         rep->udiag_type = sk->sk_type;
         rep->udiag_state = sk->sk_state;
+        rep->pad = 0;
         rep->udiag_ino = sk_ino;
         sock_diag_save_cookie(sk, rep->udiag_cookie);
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 67153964aad2..aff959e5a1b3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -566,18 +566,13 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-
+        rtnl_lock();
         res = device_add(&rdev->wiphy.dev);
-        if (res)
-                return res;
-
-        res = rfkill_register(rdev->rfkill);
         if (res) {
-                device_del(&rdev->wiphy.dev);
+                rtnl_unlock();
                 return res;
         }
 
-        rtnl_lock();
         /* set up regulatory info */
         wiphy_regulatory_register(wiphy);
 
@@ -606,6 +601,15 @@ int wiphy_register(struct wiphy *wiphy)
 
         rdev->wiphy.registered = true;
         rtnl_unlock();
+
+        res = rfkill_register(rdev->rfkill);
+        if (res) {
+                rfkill_destroy(rdev->rfkill);
+                rdev->rfkill = NULL;
+                wiphy_unregister(&rdev->wiphy);
+                return res;
+        }
+
         return 0;
 }
 EXPORT_SYMBOL(wiphy_register);
@@ -640,7 +644,8 @@ void wiphy_unregister(struct wiphy *wiphy)
                 rtnl_unlock();
                 __count == 0; }));
 
-        rfkill_unregister(rdev->rfkill);
+        if (rdev->rfkill)
+                rfkill_unregister(rdev->rfkill);
 
         rtnl_lock();
         rdev->wiphy.registered = false;
@@ -953,8 +958,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                         return notifier_from_errno(-EOPNOTSUPP);
-                if (rfkill_blocked(rdev->rfkill))
-                        return notifier_from_errno(-ERFKILL);
                 ret = cfg80211_can_add_interface(rdev, wdev->iftype);
                 if (ret)
                         return notifier_from_errno(ret);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 9ad43c619c54..3159e9c284c5 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -411,6 +411,9 @@ static inline int
 cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
                            enum nl80211_iftype iftype)
 {
+        if (rfkill_blocked(rdev->rfkill))
+                return -ERFKILL;
+
         return cfg80211_can_change_interface(rdev, NULL, iftype);
 }
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 39bff7d36768..403fe29c024d 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
                                         continue;
                                 wdev->wext.ibss.chandef.chan = chan;
+                                wdev->wext.ibss.chandef.center_freq1 =
+                                        chan->center_freq;
                                 break;
                         }
 
@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         if (chan) {
                 wdev->wext.ibss.chandef.chan = chan;
                 wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                wdev->wext.ibss.chandef.center_freq1 = freq;
                 wdev->wext.ibss.channel_fixed = true;
         } else {
                 /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index af8d84a4a5b2..626dc3b5fd8d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2421,7 +2421,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
-        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
@@ -2483,7 +2483,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
 
-        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 7d604c06c3dc..a271c27fac77 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
         struct ieee80211_radiotap_header *radiotap_header,
         int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+        /* check the radiotap header can actually be present */
+        if (max_length < sizeof(struct ieee80211_radiotap_header))
+                return -EINVAL;
+
         /* Linux only supports version 0 radiotap format */
         if (radiotap_header->it_version)
                 return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
                          */
 
                         if ((unsigned long)iterator->_arg -
-                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_rtheader +
+                            sizeof(uint32_t) >
                             (unsigned long)iterator->_max_length)
                                 return -EINVAL;
                 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ed38d5d81f9e..76e1873811d4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -334,7 +334,8 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
 
         atomic_inc(&policy->genid);
 
-        del_timer(&policy->polq.hold_timer);
+        if (del_timer(&policy->polq.hold_timer))
+                xfrm_pol_put(policy);
         xfrm_queue_purge(&policy->polq.hold_queue);
 
         if (del_timer(&policy->timer))
@@ -589,7 +590,8 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
 
         spin_lock_bh(&pq->hold_queue.lock);
         skb_queue_splice_init(&pq->hold_queue, &list);
-        del_timer(&pq->hold_timer);
+        if (del_timer(&pq->hold_timer))
+                xfrm_pol_put(old);
         spin_unlock_bh(&pq->hold_queue.lock);
 
         if (skb_queue_empty(&list))
@@ -600,7 +602,8 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
         spin_lock_bh(&pq->hold_queue.lock);
         skb_queue_splice(&list, &pq->hold_queue);
         pq->timeout = XFRM_QUEUE_TMO_MIN;
-        mod_timer(&pq->hold_timer, jiffies);
+        if (!mod_timer(&pq->hold_timer, jiffies))
+                xfrm_pol_hold(new);
         spin_unlock_bh(&pq->hold_queue.lock);
 }
 
@@ -1769,6 +1772,10 @@ static void xfrm_policy_queue_process(unsigned long arg)
 
         spin_lock(&pq->hold_queue.lock);
         skb = skb_peek(&pq->hold_queue);
+        if (!skb) {
+                spin_unlock(&pq->hold_queue.lock);
+                goto out;
+        }
         dst = skb_dst(skb);
         sk = skb->sk;
         xfrm_decode_session(skb, &fl, dst->ops->family);
@@ -1787,8 +1794,9 @@ static void xfrm_policy_queue_process(unsigned long arg)
                         goto purge_queue;
 
                 pq->timeout = pq->timeout << 1;
-                mod_timer(&pq->hold_timer, jiffies + pq->timeout);
-                return;
+                if (!mod_timer(&pq->hold_timer, jiffies + pq->timeout))
+                        xfrm_pol_hold(pol);
+        goto out;
         }
 
         dst_release(dst);
@@ -1819,11 +1827,14 @@ static void xfrm_policy_queue_process(unsigned long arg)
                 err = dst_output(skb);
         }
 
+out:
+        xfrm_pol_put(pol);
         return;
 
 purge_queue:
         pq->timeout = 0;
         xfrm_queue_purge(&pq->hold_queue);
+        xfrm_pol_put(pol);
 }
 
 static int xdst_queue_output(struct sk_buff *skb)
@@ -1831,7 +1842,8 @@ static int xdst_queue_output(struct sk_buff *skb)
         unsigned long sched_next;
         struct dst_entry *dst = skb_dst(skb);
         struct xfrm_dst *xdst = (struct xfrm_dst *) dst;
-        struct xfrm_policy_queue *pq = &xdst->pols[0]->polq;
+        struct xfrm_policy *pol = xdst->pols[0];
+        struct xfrm_policy_queue *pq = &pol->polq;
 
         if (pq->hold_queue.qlen > XFRM_MAX_QUEUE_LEN) {
                 kfree_skb(skb);
@@ -1850,10 +1862,12 @@ static int xdst_queue_output(struct sk_buff *skb)
         if (del_timer(&pq->hold_timer)) {
                 if (time_before(pq->hold_timer.expires, sched_next))
                         sched_next = pq->hold_timer.expires;
+                xfrm_pol_put(pol);
         }
 
         __skb_queue_tail(&pq->hold_queue, skb);
-        mod_timer(&pq->hold_timer, sched_next);
+        if (!mod_timer(&pq->hold_timer, sched_next))
+                xfrm_pol_hold(pol);
 
         spin_unlock_bh(&pq->hold_queue.lock);
 
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 8dafe6d3c6e4..dab57daae408 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -61,9 +61,9 @@ static void xfrm_replay_notify(struct xfrm_state *x, int event)
 
         switch (event) {
         case XFRM_REPLAY_UPDATE:
-                if (x->replay_maxdiff &&
-                    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
-                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
+                if (!x->replay_maxdiff ||
+                    ((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
+                    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
                         if (x->xflags & XFRM_TIME_DEFER)
                                 event = XFRM_REPLAY_TIMEOUT;
                         else
@@ -129,8 +129,7 @@ static int xfrm_replay_check(struct xfrm_state *x,
                 return 0;
 
         diff = x->replay.seq - seq;
-        if (diff >= min_t(unsigned int, x->props.replay_window,
-                          sizeof(x->replay.bitmap) * 8)) {
+        if (diff >= x->props.replay_window) {
                 x->stats.replay_window++;
                 goto err;
         }
@@ -302,9 +301,10 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
 
         switch (event) {
         case XFRM_REPLAY_UPDATE:
-                if (x->replay_maxdiff &&
-                    (replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
-                    (replay_esn->oseq - preplay_esn->oseq < x->replay_maxdiff)) {
+                if (!x->replay_maxdiff ||
+                    ((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
+                    (replay_esn->oseq - preplay_esn->oseq
+                     < x->replay_maxdiff))) {
                         if (x->xflags & XFRM_TIME_DEFER)
                                 event = XFRM_REPLAY_TIMEOUT;
                         else
@@ -353,28 +353,30 @@ static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
 
         switch (event) {
         case XFRM_REPLAY_UPDATE:
-                if (!x->replay_maxdiff)
-                        break;
-
-                if (replay_esn->seq_hi == preplay_esn->seq_hi)
-                        seq_diff = replay_esn->seq - preplay_esn->seq;
-                else
-                        seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
-
-                if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
-                        oseq_diff = replay_esn->oseq - preplay_esn->oseq;
-                else
-                        oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
-
-                if (seq_diff < x->replay_maxdiff &&
-                    oseq_diff < x->replay_maxdiff) {
+                if (x->replay_maxdiff) {
+                        if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                                seq_diff = replay_esn->seq - preplay_esn->seq;
+                        else
+                                seq_diff = ~preplay_esn->seq + replay_esn->seq
+                                           + 1;
 
-                        if (x->xflags & XFRM_TIME_DEFER)
-                                event = XFRM_REPLAY_TIMEOUT;
+                        if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
+                                oseq_diff = replay_esn->oseq
+                                            - preplay_esn->oseq;
                         else
-                                return;
+                                oseq_diff = ~preplay_esn->oseq
+                                            + replay_esn->oseq + 1;
+
+                        if (seq_diff >= x->replay_maxdiff ||
+                            oseq_diff >= x->replay_maxdiff)
+                                break;
                 }
 
+                if (x->xflags & XFRM_TIME_DEFER)
+                        event = XFRM_REPLAY_TIMEOUT;
+                else
+                        return;
+
                 break;
 
         case XFRM_REPLAY_TIMEOUT:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 3f565e495ac6..f964d4c00ffb 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -446,7 +446,8 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
         memcpy(&x->sel, &p->sel, sizeof(x->sel));
         memcpy(&x->lft, &p->lft, sizeof(x->lft));
         x->props.mode = p->mode;
-        x->props.replay_window = p->replay_window;
+        x->props.replay_window = min_t(unsigned int, p->replay_window,
+                                        sizeof(x->replay.bitmap) * 8);
         x->props.reqid = p->reqid;
         x->props.family = p->family;
         memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
@@ -1856,7 +1857,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (x->km.state != XFRM_STATE_VALID)
                 goto out;
 
-        err = xfrm_replay_verify_len(x->replay_esn, rp);
+        err = xfrm_replay_verify_len(x->replay_esn, re);
         if (err)
                 goto out;
 
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 47016c304c84..66cad506b8a2 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3975,8 +3975,8 @@ sub string_find_replace {
 # check for new externs in .h files.
                 if ($realfile =~ /\.h$/ &&
                     $line =~ /^\+\s*(extern\s+)$Type\s*$Ident\s*\(/s) {
-                        if (WARN("AVOID_EXTERNS",
-                                 "extern prototypes should be avoided in .h files\n" . $herecurr) &&
+                        if (CHK("AVOID_EXTERNS",
+                                "extern prototypes should be avoided in .h files\n" . $herecurr) &&
                             $fix) {
                                 $fixed[$linenr - 1] =~ s/(.*)\bextern\b\s*(.*)/$1$2/;
                         }
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 95c2b2689a03..7db9954f1af2 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -580,15 +580,13 @@ static struct aa_namespace *__next_namespace(struct aa_namespace *root,
 
         /* check if the next ns is a sibling, parent, gp, .. */
         parent = ns->parent;
-        while (parent) {
+        while (ns != root) {
                 mutex_unlock(&ns->lock);
                 next = list_entry_next(ns, base.list);
                 if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
                         mutex_lock(&next->lock);
                         return next;
                 }
-                if (parent == root)
-                        return NULL;
                 ns = parent;
                 parent = parent->parent;
         }
diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
index d6222ba4e919..532471d0b3a0 100644
--- a/security/apparmor/crypto.c
+++ b/security/apparmor/crypto.c
@@ -15,14 +15,14 @@
  * it should be.
  */
 
-#include <linux/crypto.h>
+#include <crypto/hash.h>
 
 #include "include/apparmor.h"
 #include "include/crypto.h"
 
 static unsigned int apparmor_hash_size;
 
-static struct crypto_hash *apparmor_tfm;
+static struct crypto_shash *apparmor_tfm;
 
 unsigned int aa_hash_size(void)
 {
@@ -32,35 +32,33 @@ unsigned int aa_hash_size(void)
 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
                          size_t len)
 {
-        struct scatterlist sg[2];
-        struct hash_desc desc = {
-                .tfm = apparmor_tfm,
-                .flags = 0
-        };
+        struct {
+                struct shash_desc shash;
+                char ctx[crypto_shash_descsize(apparmor_tfm)];
+        } desc;
         int error = -ENOMEM;
         u32 le32_version = cpu_to_le32(version);
 
         if (!apparmor_tfm)
                 return 0;
 
-        sg_init_table(sg, 2);
-        sg_set_buf(&sg[0], &le32_version, 4);
-        sg_set_buf(&sg[1], (u8 *) start, len);
-
         profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
         if (!profile->hash)
                 goto fail;
 
-        error = crypto_hash_init(&desc);
+        desc.shash.tfm = apparmor_tfm;
+        desc.shash.flags = 0;
+
+        error = crypto_shash_init(&desc.shash);
         if (error)
                 goto fail;
-        error = crypto_hash_update(&desc, &sg[0], 4);
+        error = crypto_shash_update(&desc.shash, (u8 *) &le32_version, 4);
         if (error)
                 goto fail;
-        error = crypto_hash_update(&desc, &sg[1], len);
+        error = crypto_shash_update(&desc.shash, (u8 *) start, len);
         if (error)
                 goto fail;
-        error = crypto_hash_final(&desc, profile->hash);
+        error = crypto_shash_final(&desc.shash, profile->hash);
         if (error)
                 goto fail;
 
@@ -75,19 +73,19 @@ fail:
 
 static int __init init_profile_hash(void)
 {
-        struct crypto_hash *tfm;
+        struct crypto_shash *tfm;
 
         if (!apparmor_initialized)
                 return 0;
 
-        tfm = crypto_alloc_hash("sha1", 0, CRYPTO_ALG_ASYNC);
+        tfm = crypto_alloc_shash("sha1", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm)) {
                 int error = PTR_ERR(tfm);
                 AA_ERROR("failed to setup profile sha1 hashing: %d\n", error);
                 return error;
         }
         apparmor_tfm = tfm;
-        apparmor_hash_size = crypto_hash_digestsize(apparmor_tfm);
+        apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);
 
         aa_info_message("AppArmor sha1 policy hashing enabled");
 
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index f2d4b6348cbc..c28b0f20ab53 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -360,7 +360,9 @@ static inline void aa_put_replacedby(struct aa_replacedby *p)
 static inline void __aa_update_replacedby(struct aa_profile *orig,
                                           struct aa_profile *new)
 {
-        struct aa_profile *tmp = rcu_dereference(orig->replacedby->profile);
+        struct aa_profile *tmp;
+        tmp = rcu_dereference_protected(orig->replacedby->profile,
+                                        mutex_is_locked(&orig->ns->lock));
         rcu_assign_pointer(orig->replacedby->profile, aa_get_profile(new));
         orig->flags |= PFLAG_INVALID;
         aa_put_profile(tmp);
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 6172509fa2b7..705c2879d3a9 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -563,7 +563,8 @@ void __init aa_free_root_ns(void)
 static void free_replacedby(struct aa_replacedby *r)
 {
         if (r) {
-                aa_put_profile(rcu_dereference(r->profile));
+                /* r->profile will not be updated any more as r is dead */
+                aa_put_profile(rcu_dereference_protected(r->profile, true));
                 kzfree(r);
         }
 }
@@ -609,6 +610,7 @@ void aa_free_profile(struct aa_profile *profile)
         aa_put_dfa(profile->policy.dfa);
         aa_put_replacedby(profile->replacedby);
 
+        kzfree(profile->hash);
         kzfree(profile);
 }
 
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index dad36a6ab45f..fc3e6628a864 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -746,7 +746,6 @@ inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * @tclass: target security class
  * @requested: requested permissions, interpreted based on @tclass
  * @auditdata: auxiliary audit data
- * @flags: VFS walk flags
  *
  * Check the AVC to determine whether the @requested permissions are granted
  * for the SID pair (@ssid, @tsid), interpreting the permissions
@@ -756,17 +755,15 @@ inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * permissions are granted, -%EACCES if any permissions are denied, or
  * another -errno upon other errors.
  */
-int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
-                       u32 requested, struct common_audit_data *auditdata,
-                       unsigned flags)
+int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
+                 u32 requested, struct common_audit_data *auditdata)
 {
         struct av_decision avd;
         int rc, rc2;
 
         rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
 
-        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata,
-                        flags);
+        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
         if (rc2)
                 return rc2;
         return rc;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a5091ec06aa6..5b5231068516 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1502,7 +1502,7 @@ static int cred_has_capability(const struct cred *cred,
 
         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
         if (audit == SECURITY_CAP_AUDIT) {
-                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
                 if (rc2)
                         return rc2;
         }
@@ -1525,8 +1525,7 @@ static int task_has_system(struct task_struct *tsk,
 static int inode_has_perm(const struct cred *cred,
                           struct inode *inode,
                           u32 perms,
-                          struct common_audit_data *adp,
-                          unsigned flags)
+                          struct common_audit_data *adp)
 {
         struct inode_security_struct *isec;
         u32 sid;
@@ -1539,7 +1538,7 @@ static int inode_has_perm(const struct cred *cred,
         sid = cred_sid(cred);
         isec = inode->i_security;
 
-        return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
+        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
 }
 
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1554,7 +1553,7 @@ static inline int dentry_has_perm(const struct cred *cred,
 
         ad.type = LSM_AUDIT_DATA_DENTRY;
         ad.u.dentry = dentry;
-        return inode_has_perm(cred, inode, av, &ad, 0);
+        return inode_has_perm(cred, inode, av, &ad);
 }
 
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1569,7 +1568,7 @@ static inline int path_has_perm(const struct cred *cred,
 
         ad.type = LSM_AUDIT_DATA_PATH;
         ad.u.path = *path;
-        return inode_has_perm(cred, inode, av, &ad, 0);
+        return inode_has_perm(cred, inode, av, &ad);
 }
 
 /* Same as path_has_perm, but uses the inode from the file struct. */
@@ -1581,7 +1580,7 @@ static inline int file_path_has_perm(const struct cred *cred,
 
         ad.type = LSM_AUDIT_DATA_PATH;
         ad.u.path = file->f_path;
-        return inode_has_perm(cred, file_inode(file), av, &ad, 0);
+        return inode_has_perm(cred, file_inode(file), av, &ad);
 }
 
 /* Check whether a task can use an open file descriptor to
@@ -1617,7 +1616,7 @@ static int file_has_perm(const struct cred *cred,
         /* av is zero if only checking access to the descriptor. */
         rc = 0;
         if (av)
-                rc = inode_has_perm(cred, inode, av, &ad, 0);
+                rc = inode_has_perm(cred, inode, av, &ad);
 
 out:
         return rc;
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 92d0ab561db8..f53ee3c58d0f 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -130,7 +130,7 @@ static inline int avc_audit(u32 ssid, u32 tsid,
                             u16 tclass, u32 requested,
                             struct av_decision *avd,
                             int result,
-                            struct common_audit_data *a, unsigned flags)
+                            struct common_audit_data *a)
 {
         u32 audited, denied;
         audited = avc_audit_required(requested, avd, result, 0, &denied);
@@ -138,7 +138,7 @@ static inline int avc_audit(u32 ssid, u32 tsid,
                 return 0;
         return slow_avc_audit(ssid, tsid, tclass,
                               requested, audited, denied,
-                              a, flags);
+                              a, 0);
 }
 
 #define AVC_STRICT 1 /* Ignore permissive mode. */
@@ -147,17 +147,9 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                          unsigned flags,
                          struct av_decision *avd);
 
-int avc_has_perm_flags(u32 ssid, u32 tsid,
-                       u16 tclass, u32 requested,
-                       struct common_audit_data *auditdata,
-                       unsigned);
-
-static inline int avc_has_perm(u32 ssid, u32 tsid,
-                               u16 tclass, u32 requested,
-                               struct common_audit_data *auditdata)
-{
-        return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
-}
+int avc_has_perm(u32 ssid, u32 tsid,
+                 u16 tclass, u32 requested,
+                 struct common_audit_data *auditdata);
 
 u32 avc_policy_seqno(void);
 
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 98969541cbcc..bea523a5d852 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -139,6 +139,18 @@ static int snd_compr_open(struct inode *inode, struct file *f)
 static int snd_compr_free(struct inode *inode, struct file *f)
 {
         struct snd_compr_file *data = f->private_data;
+        struct snd_compr_runtime *runtime = data->stream.runtime;
+
+        switch (runtime->state) {
+        case SNDRV_PCM_STATE_RUNNING:
+        case SNDRV_PCM_STATE_DRAINING:
+        case SNDRV_PCM_STATE_PAUSED:
+                data->stream.ops->trigger(&data->stream, SNDRV_PCM_TRIGGER_STOP);
+                break;
+        default:
+                break;
+        }
+
         data->stream.ops->free(&data->stream);
         kfree(data->stream.runtime->buffer);
         kfree(data->stream.runtime);
@@ -837,7 +849,8 @@ static int snd_compress_dev_disconnect(struct snd_device *device)
         struct snd_compr *compr;
 
         compr = device->device_data;
-        snd_unregister_device(compr->direction, compr->card, compr->device);
+        snd_unregister_device(SNDRV_DEVICE_TYPE_COMPRESS, compr->card,
+                compr->device);
         return 0;
 }
 
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index 445ca481d8d3..bf578ba2677e 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -175,6 +175,7 @@ static const struct ac97_codec_id snd_ac97_codec_ids[] = {
 { 0x54524106, 0xffffffff, "TR28026",            NULL,           NULL },
 { 0x54524108, 0xffffffff, "TR28028",            patch_tritech_tr28028,  NULL }, // added by xin jin [07/09/99]
 { 0x54524123, 0xffffffff, "TR28602",            NULL,           NULL }, // only guess --jk [TR28023 = eMicro EM28023 (new CT1297)]
+{ 0x54584e03, 0xffffffff, "TLV320AIC27",        NULL,           NULL },
 { 0x54584e20, 0xffffffff, "TLC320AD9xC",        NULL,           NULL },
 { 0x56494161, 0xffffffff, "VIA1612A",           NULL,           NULL }, // modified ICE1232 with S/PDIF
 { 0x56494170, 0xffffffff, "VIA1617A",           patch_vt1617a,  NULL }, // modified VT1616 with S/PDIF
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index ac41e9cdc976..26ad4f0aade3 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -3531,7 +3531,7 @@ static int create_capture_mixers(struct hda_codec *codec)
                 if (!multi)
                         err = create_single_cap_vol_ctl(codec, n, vol, sw,
                                                         inv_dmic);
-                else if (!multi_cap_vol)
+                else if (!multi_cap_vol && !inv_dmic)
                         err = create_bind_cap_vol_ctl(codec, n, vol, sw);
                 else
                         err = create_multi_cap_vol_ctl(codec);
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index b524f89a1f13..18d972501585 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -111,6 +111,9 @@ enum {
 /* 0x0009 - 0x0014 -> 12 test regs */
 /* 0x0015 - visibility reg */
 
+/* Cirrus Logic CS4208 */
+#define CS4208_VENDOR_NID       0x24
+
 /*
  * Cirrus Logic CS4210
  *
@@ -223,6 +226,16 @@ static const struct hda_verb cs_coef_init_verbs[] = {
         {} /* terminator */
 };
 
+static const struct hda_verb cs4208_coef_init_verbs[] = {
+        {0x01, AC_VERB_SET_POWER_STATE, 0x00}, /* AFG: D0 */
+        {0x24, AC_VERB_SET_PROC_STATE, 0x01},  /* VPW: processing on */
+        {0x24, AC_VERB_SET_COEF_INDEX, 0x0033},
+        {0x24, AC_VERB_SET_PROC_COEF, 0x0001}, /* A1 ICS */
+        {0x24, AC_VERB_SET_COEF_INDEX, 0x0034},
+        {0x24, AC_VERB_SET_PROC_COEF, 0x1C01}, /* A1 Enable, A Thresh = 300mV */
+        {} /* terminator */
+};
+
 /* Errata: CS4207 rev C0/C1/C2 Silicon
  *
  * http://www.cirrus.com/en/pubs/errata/ER880C3.pdf
@@ -295,6 +308,8 @@ static int cs_init(struct hda_codec *codec)
                 /* init_verb sequence for C0/C1/C2 errata*/
                 snd_hda_sequence_write(codec, cs_errata_init_verbs);
                 snd_hda_sequence_write(codec, cs_coef_init_verbs);
+        } else if (spec->vendor_nid == CS4208_VENDOR_NID) {
+                snd_hda_sequence_write(codec, cs4208_coef_init_verbs);
         }
 
         snd_hda_gen_init(codec);
@@ -434,6 +449,29 @@ static const struct hda_pintbl mba42_pincfgs[] = {
         {} /* terminator */
 };
 
+static const struct hda_pintbl mba6_pincfgs[] = {
+        { 0x10, 0x032120f0 }, /* HP */
+        { 0x11, 0x500000f0 },
+        { 0x12, 0x90100010 }, /* Speaker */
+        { 0x13, 0x500000f0 },
+        { 0x14, 0x500000f0 },
+        { 0x15, 0x770000f0 },
+        { 0x16, 0x770000f0 },
+        { 0x17, 0x430000f0 },
+        { 0x18, 0x43ab9030 }, /* Mic */
+        { 0x19, 0x770000f0 },
+        { 0x1a, 0x770000f0 },
+        { 0x1b, 0x770000f0 },
+        { 0x1c, 0x90a00090 },
+        { 0x1d, 0x500000f0 },
+        { 0x1e, 0x500000f0 },
+        { 0x1f, 0x500000f0 },
+        { 0x20, 0x500000f0 },
+        { 0x21, 0x430000f0 },
+        { 0x22, 0x430000f0 },
+        {} /* terminator */
+};
+
 static void cs420x_fixup_gpio_13(struct hda_codec *codec,
                                  const struct hda_fixup *fix, int action)
 {
@@ -556,22 +594,23 @@ static int patch_cs420x(struct hda_codec *codec)
 
 /*
  * CS4208 support:
- * Its layout is no longer compatible with CS4206/CS4207, and the generic
- * parser seems working fairly well, except for trivial fixups.
+ * Its layout is no longer compatible with CS4206/CS4207
  */
 enum {
+        CS4208_MBA6,
         CS4208_GPIO0,
 };
 
 static const struct hda_model_fixup cs4208_models[] = {
         { .id = CS4208_GPIO0, .name = "gpio0" },
+        { .id = CS4208_MBA6, .name = "mba6" },
         {}
 };
 
 static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
         /* codec SSID */
-        SND_PCI_QUIRK(0x106b, 0x7100, "MacBookPro 6,1", CS4208_GPIO0),
-        SND_PCI_QUIRK(0x106b, 0x7200, "MacBookPro 6,2", CS4208_GPIO0),
+        SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
+        SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
         {} /* terminator */
 };
 
@@ -588,18 +627,35 @@ static void cs4208_fixup_gpio0(struct hda_codec *codec,
 }
 
 static const struct hda_fixup cs4208_fixups[] = {
+        [CS4208_MBA6] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = mba6_pincfgs,
+                .chained = true,
+                .chain_id = CS4208_GPIO0,
+        },
         [CS4208_GPIO0] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cs4208_fixup_gpio0,
         },
 };
 
+/* correct the 0dB offset of input pins */
+static void cs4208_fix_amp_caps(struct hda_codec *codec, hda_nid_t adc)
+{
+        unsigned int caps;
+
+        caps = query_amp_caps(codec, adc, HDA_INPUT);
+        caps &= ~(AC_AMPCAP_OFFSET);
+        caps |= 0x02;
+        snd_hda_override_amp_caps(codec, adc, HDA_INPUT, caps);
+}
+
 static int patch_cs4208(struct hda_codec *codec)
 {
         struct cs_spec *spec;
         int err;
 
-        spec = cs_alloc_spec(codec, 0); /* no specific w/a */
+        spec = cs_alloc_spec(codec, CS4208_VENDOR_NID);
         if (!spec)
                 return -ENOMEM;
 
@@ -609,6 +665,12 @@ static int patch_cs4208(struct hda_codec *codec)
                            cs4208_fixups);
         snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
 
+        snd_hda_override_wcaps(codec, 0x18,
+                               get_wcaps(codec, 0x18) | AC_WCAP_STEREO);
+        cs4208_fix_amp_caps(codec, 0x18);
+        cs4208_fix_amp_caps(codec, 0x1b);
+        cs4208_fix_amp_caps(codec, 0x1c);
+
         err = cs_parse_auto_config(codec);
         if (err < 0)
                 goto error;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 4edd2d0f9a3c..ec68eaea0336 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3231,6 +3231,7 @@ enum {
         CXT_FIXUP_INC_MIC_BOOST,
         CXT_FIXUP_HEADPHONE_MIC_PIN,
         CXT_FIXUP_HEADPHONE_MIC,
+        CXT_FIXUP_GPIO1,
 };
 
 static void cxt_fixup_stereo_dmic(struct hda_codec *codec,
@@ -3375,6 +3376,15 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_headphone_mic,
         },
+        [CXT_FIXUP_GPIO1] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        { 0x01, AC_VERB_SET_GPIO_MASK, 0x01 },
+                        { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x01 },
+                        { 0x01, AC_VERB_SET_GPIO_DATA, 0x01 },
+                        { }
+                },
+        },
 };
 
 static const struct snd_pci_quirk cxt5051_fixups[] = {
@@ -3384,6 +3394,7 @@ static const struct snd_pci_quirk cxt5051_fixups[] = {
 
 static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
+        SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_GPIO1),
         SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 3d8cd04455a6..50173d412ac5 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -937,6 +937,14 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
         }
 
         /*
+         * always configure channel mapping, it may have been changed by the
+         * user in the meantime
+         */
+        hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
+                                   channels, per_pin->chmap,
+                                   per_pin->chmap_set);
+
+        /*
          * sizeof(ai) is used instead of sizeof(*hdmi_ai) or
          * sizeof(*dp_ai) to avoid partial match/update problems when
          * the user switches between HDMI/DP monitors.
@@ -947,20 +955,10 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec,
                             "pin=%d channels=%d\n",
                             pin_nid,
                             channels);
-                hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
-                                           channels, per_pin->chmap,
-                                           per_pin->chmap_set);
                 hdmi_stop_infoframe_trans(codec, pin_nid);
                 hdmi_fill_audio_infoframe(codec, pin_nid,
                                             ai.bytes, sizeof(ai));
                 hdmi_start_infoframe_trans(codec, pin_nid);
-        } else {
-                /* For non-pcm audio switch, setup new channel mapping
-                 * accordingly */
-                if (per_pin->non_pcm != non_pcm)
-                        hdmi_setup_channel_mapping(codec, pin_nid, non_pcm, ca,
-                                                   channels, per_pin->chmap,
-                                                   per_pin->chmap_set);
         }
 
         per_pin->non_pcm = non_pcm;
@@ -1149,32 +1147,43 @@ static int hdmi_choose_cvt(struct hda_codec *codec,
 }
 
 static void haswell_config_cvts(struct hda_codec *codec,
-                        int pin_id, int mux_id)
+                        hda_nid_t pin_nid, int mux_idx)
 {
         struct hdmi_spec *spec = codec->spec;
-        struct hdmi_spec_per_pin *per_pin;
-        int pin_idx, mux_idx;
-        int curr;
-        int err;
+        hda_nid_t nid, end_nid;
+        int cvt_idx, curr;
+        struct hdmi_spec_per_cvt *per_cvt;
 
-        for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
-                per_pin = get_pin(spec, pin_idx);
+        /* configure all pins, including "no physical connection" ones */
+        end_nid = codec->start_nid + codec->num_nodes;
+        for (nid = codec->start_nid; nid < end_nid; nid++) {
+                unsigned int wid_caps = get_wcaps(codec, nid);
+                unsigned int wid_type = get_wcaps_type(wid_caps);
+
+                if (wid_type != AC_WID_PIN)
+                        continue;
 
-                if (pin_idx == pin_id)
+                if (nid == pin_nid)
                         continue;
 
-                curr = snd_hda_codec_read(codec, per_pin->pin_nid, 0,
+                curr = snd_hda_codec_read(codec, nid, 0,
                                           AC_VERB_GET_CONNECT_SEL, 0);
+                if (curr != mux_idx)
+                        continue;
 
-                /* Choose another unused converter */
-                if (curr == mux_id) {
-                        err = hdmi_choose_cvt(codec, pin_idx, NULL, &mux_idx);
-                        if (err < 0)
-                                return;
-                        snd_printdd("HDMI: choose converter %d for pin %d\n", mux_idx, pin_idx);
-                        snd_hda_codec_write_cache(codec, per_pin->pin_nid, 0,
+                /* choose an unassigned converter. The conveters in the
+                 * connection list are in the same order as in the codec.
+                 */
+                for (cvt_idx = 0; cvt_idx < spec->num_cvts; cvt_idx++) {
+                        per_cvt = get_cvt(spec, cvt_idx);
+                        if (!per_cvt->assigned) {
+                                snd_printdd("choose cvt %d for pin nid %d\n",
+                                        cvt_idx, nid);
+                                snd_hda_codec_write_cache(codec, nid, 0,
                                             AC_VERB_SET_CONNECT_SEL,
-                                            mux_idx);
+                                            cvt_idx);
+                                break;
+                        }
                 }
         }
 }
@@ -1216,7 +1225,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
 
         /* configure unused pins to choose other converters */
         if (is_haswell(codec))
-                haswell_config_cvts(codec, pin_idx, mux_idx);
+                haswell_config_cvts(codec, per_pin->pin_nid, mux_idx);
 
         snd_hda_spdif_ctls_assign(codec, pin_idx, per_cvt->cvt_nid);
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bc07d369fac4..bf313bea7085 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2819,6 +2819,15 @@ static void alc269_fixup_hweq(struct hda_codec *codec,
         alc_write_coef_idx(codec, 0x1e, coef | 0x80);
 }
 
+static void alc269_fixup_headset_mic(struct hda_codec *codec,
+                                       const struct hda_fixup *fix, int action)
+{
+        struct alc_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE)
+                spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
+}
+
 static void alc271_fixup_dmic(struct hda_codec *codec,
                               const struct hda_fixup *fix, int action)
 {
@@ -3439,6 +3448,9 @@ static void alc283_fixup_chromebook(struct hda_codec *codec,
                 /* Set to manual mode */
                 val = alc_read_coef_idx(codec, 0x06);
                 alc_write_coef_idx(codec, 0x06, val & ~0x000c);
+                /* Enable Line1 input control by verb */
+                val = alc_read_coef_idx(codec, 0x1a);
+                alc_write_coef_idx(codec, 0x1a, val | (1 << 4));
                 break;
         }
 }
@@ -3493,6 +3505,15 @@ static void alc282_fixup_asus_tx300(struct hda_codec *codec,
         }
 }
 
+static void alc290_fixup_mono_speakers(struct hda_codec *codec,
+                                       const struct hda_fixup *fix, int action)
+{
+        if (action == HDA_FIXUP_ACT_PRE_PROBE)
+                /* Remove DAC node 0x03, as it seems to be
+                   giving mono output */
+                snd_hda_override_wcaps(codec, 0x03, 0);
+}
+
 enum {
         ALC269_FIXUP_SONY_VAIO,
         ALC275_FIXUP_SONY_VAIO_GPIO2,
@@ -3504,6 +3525,7 @@ enum {
         ALC271_FIXUP_DMIC,
         ALC269_FIXUP_PCM_44K,
         ALC269_FIXUP_STEREO_DMIC,
+        ALC269_FIXUP_HEADSET_MIC,
         ALC269_FIXUP_QUANTA_MUTE,
         ALC269_FIXUP_LIFEBOOK,
         ALC269_FIXUP_AMIC,
@@ -3516,9 +3538,11 @@ enum {
         ALC269_FIXUP_HP_GPIO_LED,
         ALC269_FIXUP_INV_DMIC,
         ALC269_FIXUP_LENOVO_DOCK,
+        ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
         ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
         ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
+        ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
         ALC269_FIXUP_HEADSET_MODE,
         ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
         ALC269_FIXUP_ASUS_X101_FUNC,
@@ -3531,6 +3555,8 @@ enum {
         ALC269VB_FIXUP_ORDISSIMO_EVE2,
         ALC283_FIXUP_CHROME_BOOK,
         ALC282_FIXUP_ASUS_TX300,
+        ALC283_FIXUP_INT_MIC,
+        ALC290_FIXUP_MONO_SPEAKERS,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -3599,6 +3625,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_stereo_dmic,
         },
+        [ALC269_FIXUP_HEADSET_MIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_headset_mic,
+        },
         [ALC269_FIXUP_QUANTA_MUTE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_quanta_mute,
@@ -3708,6 +3738,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
         },
+        [ALC269_FIXUP_DELL3_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1a, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
+        },
         [ALC269_FIXUP_HEADSET_MODE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_mode,
@@ -3716,6 +3755,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_mode_no_hp_mic,
         },
+        [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MIC
+        },
         [ALC269_FIXUP_ASUS_X101_FUNC] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_x101_headset_mic,
@@ -3790,6 +3838,22 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc282_fixup_asus_tx300,
         },
+        [ALC283_FIXUP_INT_MIC] = {
+                .type = HDA_FIXUP_VERBS,
+                .v.verbs = (const struct hda_verb[]) {
+                        {0x20, AC_VERB_SET_COEF_INDEX, 0x1a},
+                        {0x20, AC_VERB_SET_PROC_COEF, 0x0011},
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
+        },
+        [ALC290_FIXUP_MONO_SPEAKERS] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc290_fixup_mono_speakers,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -3831,6 +3895,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0608, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0609, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
         SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -3853,6 +3918,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
+        SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
         SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
         SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
@@ -3874,7 +3940,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-        SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
         SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
@@ -3938,6 +4004,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC269_FIXUP_STEREO_DMIC, .name = "alc269-dmic"},
         {.id = ALC271_FIXUP_DMIC, .name = "alc271-dmic"},
         {.id = ALC269_FIXUP_INV_DMIC, .name = "inv-dmic"},
+        {.id = ALC269_FIXUP_HEADSET_MIC, .name = "headset-mic"},
         {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
         {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
         {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
@@ -4555,6 +4622,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x05d8, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x05db, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+        SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_ASUS_MODE4),
         SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
         SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
         SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index 4f255dfee450..f59a321a6d6a 100644
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -4845,6 +4845,7 @@ static int snd_hdsp_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, unsigne
                         if ((err = hdsp_get_iobox_version(hdsp)) < 0)
                                 return err;
                 }
+                memset(&hdsp_version, 0, sizeof(hdsp_version));
                 hdsp_version.io_type = hdsp->io_type;
                 hdsp_version.firmware_rev = hdsp->firmware_rev;
                 if ((err = copy_to_user(argp, &hdsp_version, sizeof(hdsp_version))))
diff --git a/sound/soc/blackfin/bf6xx-i2s.c b/sound/soc/blackfin/bf6xx-i2s.c
index c02405cc007d..5810a0603f2f 100644
--- a/sound/soc/blackfin/bf6xx-i2s.c
+++ b/sound/soc/blackfin/bf6xx-i2s.c
@@ -88,6 +88,7 @@ static int bfin_i2s_hw_params(struct snd_pcm_substream *substream,
         case SNDRV_PCM_FORMAT_S8:
                 param.spctl |= 0x70;
                 sport->wdsize = 1;
+                break;
         case SNDRV_PCM_FORMAT_S16_LE:
                 param.spctl |= 0xf0;
                 sport->wdsize = 2;
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 8af04343cc1a..259d1ac4492f 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -349,6 +349,9 @@ static int snd_soc_put_volsw_2r_st(struct snd_kcontrol *kcontrol,
         val = ucontrol->value.integer.value[0];
         val2 = ucontrol->value.integer.value[1];
 
+        if (val >= ARRAY_SIZE(st_table) || val2 >= ARRAY_SIZE(st_table))
+                return -EINVAL;
+
         err = snd_soc_update_bits(codec, reg, 0x3f, st_table[val].m);
         if (err < 0)
                 return err;
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index b8ba0adacfce..80555d7551e6 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -1225,13 +1225,18 @@ static int anc_status_control_put(struct snd_kcontrol *kcontrol,
         struct ab8500_codec_drvdata *drvdata = dev_get_drvdata(codec->dev);
         struct device *dev = codec->dev;
         bool apply_fir, apply_iir;
-        int req, status;
+        unsigned int req;
+        int status;
 
         dev_dbg(dev, "%s: Enter.\n", __func__);
 
         mutex_lock(&drvdata->anc_lock);
 
         req = ucontrol->value.integer.value[0];
+        if (req >= ARRAY_SIZE(enum_anc_state)) {
+                status = -EINVAL;
+                goto cleanup;
+        }
         if (req != ANC_APPLY_FIR_IIR && req != ANC_APPLY_FIR &&
                 req != ANC_APPLY_IIR) {
                 dev_err(dev, "%s: ERROR: Unsupported status to set '%s'!\n",
diff --git a/sound/soc/codecs/max98095.c b/sound/soc/codecs/max98095.c
index 41cdd1642970..8dbcacd44e6a 100644
--- a/sound/soc/codecs/max98095.c
+++ b/sound/soc/codecs/max98095.c
@@ -1863,7 +1863,7 @@ static int max98095_put_eq_enum(struct snd_kcontrol *kcontrol,
         struct max98095_pdata *pdata = max98095->pdata;
         int channel = max98095_get_eq_channel(kcontrol->id.name);
         struct max98095_cdata *cdata;
-        int sel = ucontrol->value.integer.value[0];
+        unsigned int sel = ucontrol->value.integer.value[0];
         struct max98095_eq_cfg *coef_set;
         int fs, best, best_val, i;
         int regmask, regsave;
@@ -2016,7 +2016,7 @@ static int max98095_put_bq_enum(struct snd_kcontrol *kcontrol,
         struct max98095_pdata *pdata = max98095->pdata;
         int channel = max98095_get_bq_channel(codec, kcontrol->id.name);
         struct max98095_cdata *cdata;
-        int sel = ucontrol->value.integer.value[0];
+        unsigned int sel = ucontrol->value.integer.value[0];
         struct max98095_biquad_cfg *coef_set;
         int fs, best, best_val, i;
         int regmask, regsave;
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index 651ce0923675..c91eba504f92 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -270,7 +270,7 @@ MODULE_DEVICE_TABLE(of, pcm1681_dt_ids);
 static const struct regmap_config pcm1681_regmap = {
         .reg_bits               = 8,
         .val_bits               = 8,
-        .max_register           = ARRAY_SIZE(pcm1681_reg_defaults) + 1,
+        .max_register           = 0x13,
         .reg_defaults           = pcm1681_reg_defaults,
         .num_reg_defaults       = ARRAY_SIZE(pcm1681_reg_defaults),
         .writeable_reg          = pcm1681_writeable_reg,
diff --git a/sound/soc/codecs/pcm1792a.c b/sound/soc/codecs/pcm1792a.c
index 2a8eccf64c76..7613181123fe 100644
--- a/sound/soc/codecs/pcm1792a.c
+++ b/sound/soc/codecs/pcm1792a.c
@@ -188,7 +188,7 @@ MODULE_DEVICE_TABLE(of, pcm1792a_of_match);
 static const struct regmap_config pcm1792a_regmap = {
         .reg_bits               = 8,
         .val_bits               = 8,
-        .max_register           = 24,
+        .max_register           = 23,
         .reg_defaults           = pcm1792a_reg_defaults,
         .num_reg_defaults       = ARRAY_SIZE(pcm1792a_reg_defaults),
         .writeable_reg          = pcm1792a_writeable_reg,
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 6e3f269243e0..64ad84d8a306 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -674,6 +674,8 @@ static const struct snd_soc_dapm_route intercon[] = {
         /* Left Input */
         {"Left Line1L Mux", "single-ended", "LINE1L"},
         {"Left Line1L Mux", "differential", "LINE1L"},
+        {"Left Line1R Mux", "single-ended", "LINE1R"},
+        {"Left Line1R Mux", "differential", "LINE1R"},
 
         {"Left Line2L Mux", "single-ended", "LINE2L"},
         {"Left Line2L Mux", "differential", "LINE2L"},
@@ -690,6 +692,8 @@ static const struct snd_soc_dapm_route intercon[] = {
         /* Right Input */
         {"Right Line1R Mux", "single-ended", "LINE1R"},
         {"Right Line1R Mux", "differential", "LINE1R"},
+        {"Right Line1L Mux", "single-ended", "LINE1L"},
+        {"Right Line1L Mux", "differential", "LINE1L"},
 
         {"Right Line2R Mux", "single-ended", "LINE2R"},
         {"Right Line2R Mux", "differential", "LINE2R"},
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index c6b743978d5e..6b81d0ce2c44 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -936,7 +936,7 @@ static int fsl_ssi_probe(struct platform_device *pdev)
         ssi_private->ssi_phys = res.start;
 
         ssi_private->irq = irq_of_parse_and_map(np, 0);
-        if (ssi_private->irq == NO_IRQ) {
+        if (ssi_private->irq == 0) {
                 dev_err(&pdev->dev, "no irq for node %s\n", np->full_name);
                 return -ENXIO;
         }
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index a3d60d4bea4c..a2fd7321b5a9 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -112,7 +112,7 @@ static int imx_mc13783_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        if (machine_is_mx31_3ds()) {
+        if (machine_is_mx31_3ds() || machine_is_mx31moboard()) {
                 imx_audmux_v2_configure_port(MX31_AUDMUX_PORT4_SSI_PINS_4,
                         IMX_AUDMUX_V2_PTCR_SYN,
                         IMX_AUDMUX_V2_PDCR_RXDSEL(MX31_AUDMUX_PORT1_SSI0) |
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index 46c5b4fdfc52..ca1be1d9dcf0 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -62,7 +62,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
         struct device_node *ssi_np, *codec_np;
         struct platform_device *ssi_pdev;
         struct i2c_client *codec_dev;
-        struct imx_sgtl5000_data *data;
+        struct imx_sgtl5000_data *data = NULL;
         int int_port, ext_port;
         int ret;
 
@@ -128,7 +128,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
                 goto fail;
         }
 
-        data->codec_clk = devm_clk_get(&codec_dev->dev, NULL);
+        data->codec_clk = clk_get(&codec_dev->dev, NULL);
         if (IS_ERR(data->codec_clk)) {
                 ret = PTR_ERR(data->codec_clk);
                 goto fail;
@@ -172,6 +172,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
         return 0;
 
 fail:
+        if (data && !IS_ERR(data->codec_clk))
+                clk_put(data->codec_clk);
         if (ssi_np)
                 of_node_put(ssi_np);
         if (codec_np)
@@ -185,6 +187,7 @@ static int imx_sgtl5000_remove(struct platform_device *pdev)
         struct imx_sgtl5000_data *data = platform_get_drvdata(pdev);
 
         snd_soc_unregister_card(&data->card);
+        clk_put(data->codec_clk);
 
         return 0;
 }
diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
index f58bcd85c07f..57d6941676ff 100644
--- a/sound/soc/fsl/imx-ssi.c
+++ b/sound/soc/fsl/imx-ssi.c
@@ -600,19 +600,17 @@ static int imx_ssi_probe(struct platform_device *pdev)
         ssi->fiq_params.dma_params_rx = &ssi->dma_params_rx;
         ssi->fiq_params.dma_params_tx = &ssi->dma_params_tx;
 
-        ret = imx_pcm_fiq_init(pdev, &ssi->fiq_params);
-        if (ret)
-                goto failed_pcm_fiq;
+        ssi->fiq_init = imx_pcm_fiq_init(pdev, &ssi->fiq_params);
+        ssi->dma_init = imx_pcm_dma_init(pdev);
 
-        ret = imx_pcm_dma_init(pdev);
-        if (ret)
-                goto failed_pcm_dma;
+        if (ssi->fiq_init && ssi->dma_init) {
+                ret = ssi->fiq_init;
+                goto failed_pcm;
+        }
 
         return 0;
 
-failed_pcm_dma:
-        imx_pcm_fiq_exit(pdev);
-failed_pcm_fiq:
+failed_pcm:
         snd_soc_unregister_component(&pdev->dev);
 failed_register:
         release_mem_region(res->start, resource_size(res));
@@ -628,8 +626,11 @@ static int imx_ssi_remove(struct platform_device *pdev)
         struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         struct imx_ssi *ssi = platform_get_drvdata(pdev);
 
-        imx_pcm_dma_exit(pdev);
-        imx_pcm_fiq_exit(pdev);
+        if (!ssi->dma_init)
+                imx_pcm_dma_exit(pdev);
+
+        if (!ssi->fiq_init)
+                imx_pcm_fiq_exit(pdev);
 
         snd_soc_unregister_component(&pdev->dev);
 
diff --git a/sound/soc/fsl/imx-ssi.h b/sound/soc/fsl/imx-ssi.h
index fb1616ba8c59..560c40fc9ebb 100644
--- a/sound/soc/fsl/imx-ssi.h
+++ b/sound/soc/fsl/imx-ssi.h
@@ -211,6 +211,8 @@ struct imx_ssi {
         struct imx_dma_data filter_data_rx;
         struct imx_pcm_fiq_params fiq_params;
 
+        int fiq_init;
+        int dma_init;
         int enabled;
 };
 
diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
index daa78a0095fa..4a07f7179690 100644
--- a/sound/soc/omap/Kconfig
+++ b/sound/soc/omap/Kconfig
@@ -1,6 +1,6 @@
 config SND_OMAP_SOC
         tristate "SoC Audio for the Texas Instruments OMAP chips"
-        depends on (ARCH_OMAP && DMA_OMAP) || (ARCH_ARM && COMPILE_TEST)
+        depends on (ARCH_OMAP && DMA_OMAP) || (ARM && COMPILE_TEST)
         select SND_DMAENGINE_PCM
 
 config SND_OMAP_SOC_DMIC
@@ -26,7 +26,7 @@ config SND_OMAP_SOC_N810
 
 config SND_OMAP_SOC_RX51
         tristate "SoC Audio support for Nokia RX-51"
-        depends on SND_OMAP_SOC && ARCH_ARM && (MACH_NOKIA_RX51 || COMPILE_TEST)
+        depends on SND_OMAP_SOC && ARM && (MACH_NOKIA_RX51 || COMPILE_TEST)
         select SND_OMAP_SOC_MCBSP
         select SND_SOC_TLV320AIC3X
         select SND_SOC_TPA6130A2
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 9cc6986a8cfb..5dd87f4c919e 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -220,8 +220,8 @@ int rsnd_gen_path_exit(struct rsnd_priv *priv,
 void __iomem *rsnd_gen_reg_get(struct rsnd_priv *priv,
                                struct rsnd_mod *mod,
                                enum rsnd_reg reg);
-#define rsnd_is_gen1(s)         ((s)->info->flags & RSND_GEN1)
-#define rsnd_is_gen2(s)         ((s)->info->flags & RSND_GEN2)
+#define rsnd_is_gen1(s)         (((s)->info->flags & RSND_GEN_MASK) == RSND_GEN1)
+#define rsnd_is_gen2(s)         (((s)->info->flags & RSND_GEN_MASK) == RSND_GEN2)
 
 /*
  *      R-Car ADG
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 4d0561312f3b..1a38be0d0ca8 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1380,7 +1380,6 @@ static int soc_probe_link_dais(struct snd_soc_card *card, int num, int order)
                                 return -ENODEV;
 
                         list_add(&cpu_dai->dapm.list, &card->dapm_list);
-                        snd_soc_dapm_new_dai_widgets(&cpu_dai->dapm, cpu_dai);
                 }
 
                 if (cpu_dai->driver->probe) {
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index d0323a693ba2..999550bbad40 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -262,7 +262,9 @@ static int usb_stream_hwdep_mmap(struct snd_hwdep *hw,
         }
 
         area->vm_ops = &usb_stream_hwdep_vm_ops;
-        area->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+        area->vm_flags |= VM_DONTDUMP;
+        if (!read)
+                area->vm_flags |= VM_DONTEXPAND;
         area->vm_private_data = us122l;
         atomic_inc(&us122l->mmap_count);
 out:
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 63fb5219f0f8..6234a51625b1 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -299,19 +299,6 @@ static void usX2Y_error_urb_status(struct usX2Ydev *usX2Y,
         usX2Y_clients_stop(usX2Y);
 }
 
-static void usX2Y_error_sequence(struct usX2Ydev *usX2Y,
-                                 struct snd_usX2Y_substream *subs, struct urb *urb)
-{
-        snd_printk(KERN_ERR
-"Sequence Error!(hcd_frame=%i ep=%i%s;wait=%i,frame=%i).\n"
-"Most probably some urb of usb-frame %i is still missing.\n"
-"Cause could be too long delays in usb-hcd interrupt handling.\n",
-                   usb_get_current_frame_number(usX2Y->dev),
-                   subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
-                   usX2Y->wait_iso_frame, urb->start_frame, usX2Y->wait_iso_frame);
-        usX2Y_clients_stop(usX2Y);
-}
-
 static void i_usX2Y_urb_complete(struct urb *urb)
 {
         struct snd_usX2Y_substream *subs = urb->context;
@@ -328,12 +315,9 @@ static void i_usX2Y_urb_complete(struct urb *urb)
                 usX2Y_error_urb_status(usX2Y, subs, urb);
                 return;
         }
-        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
-                subs->completed_urb = urb;
-        else {
-                usX2Y_error_sequence(usX2Y, subs, urb);
-                return;
-        }
+
+        subs->completed_urb = urb;
+
         {
                 struct snd_usX2Y_substream *capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE],
                         *playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK];
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index f2a1acdc4d83..814d0e887c62 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -244,13 +244,8 @@ static void i_usX2Y_usbpcm_urb_complete(struct urb *urb)
                 usX2Y_error_urb_status(usX2Y, subs, urb);
                 return;
         }
-        if (likely((urb->start_frame & 0xFFFF) == (usX2Y->wait_iso_frame & 0xFFFF)))
-                subs->completed_urb = urb;
-        else {
-                usX2Y_error_sequence(usX2Y, subs, urb);
-                return;
-        }
 
+        subs->completed_urb = urb;
         capsubs = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE];
         capsubs2 = usX2Y->subs[SNDRV_PCM_STREAM_CAPTURE + 2];
         playbacksubs = usX2Y->subs[SNDRV_PCM_STREAM_PLAYBACK];
diff --git a/tools/lib/lk/debugfs.c b/tools/lib/lk/debugfs.c
index 099e7cd022e4..7c4347962353 100644
--- a/tools/lib/lk/debugfs.c
+++ b/tools/lib/lk/debugfs.c
@@ -5,7 +5,6 @@
 #include <stdbool.h>
 #include <sys/vfs.h>
 #include <sys/mount.h>
-#include <linux/magic.h>
 #include <linux/kernel.h>
 
 #include "debugfs.h"
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 3a0ff7fb71b6..64c043b7a438 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -770,6 +770,7 @@ check: $(OUTPUT)common-cmds.h
 install-bin: all
         $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(bindir_SQ)'
         $(INSTALL) $(OUTPUT)perf '$(DESTDIR_SQ)$(bindir_SQ)'
+        $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
         $(INSTALL) $(OUTPUT)perf-archive -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
 ifndef NO_LIBPERL
         $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/perl/Perf-Trace-Util/lib/Perf/Trace'
diff --git a/tools/perf/arch/x86/util/tsc.c b/tools/perf/arch/x86/util/tsc.c
index 9570c2b0f83c..b2519e49424f 100644
--- a/tools/perf/arch/x86/util/tsc.c
+++ b/tools/perf/arch/x86/util/tsc.c
@@ -32,7 +32,7 @@ u64 tsc_to_perf_time(u64 cyc, struct perf_tsc_conversion *tc)
 int perf_read_tsc_conversion(const struct perf_event_mmap_page *pc,
                              struct perf_tsc_conversion *tc)
 {
-        bool cap_usr_time_zero;
+        bool cap_user_time_zero;
         u32 seq;
         int i = 0;
 
@@ -42,7 +42,7 @@ int perf_read_tsc_conversion(const struct perf_event_mmap_page *pc,
                 tc->time_mult = pc->time_mult;
                 tc->time_shift = pc->time_shift;
                 tc->time_zero = pc->time_zero;
-                cap_usr_time_zero = pc->cap_usr_time_zero;
+                cap_user_time_zero = pc->cap_user_time_zero;
                 rmb();
                 if (pc->lock == seq && !(seq & 1))
                         break;
@@ -52,7 +52,7 @@ int perf_read_tsc_conversion(const struct perf_event_mmap_page *pc,
                 }
         }
 
-        if (!cap_usr_time_zero)
+        if (!cap_user_time_zero)
                 return -EOPNOTSUPP;
 
         return 0;
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 423875c999b2..afe377b2884f 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -321,8 +321,6 @@ found:
         return perf_event__repipe(tool, event_sw, &sample_sw, machine);
 }
 
-extern volatile int session_done;
-
 static void sig_handler(int sig __maybe_unused)
 {
         session_done = 1;
diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
index c2dff9cb1f2c..9b5f077fee5b 100644
--- a/tools/perf/builtin-kmem.c
+++ b/tools/perf/builtin-kmem.c
@@ -101,7 +101,7 @@ static int setup_cpunode_map(void)
 
         dir1 = opendir(PATH_SYS_NODE);
         if (!dir1)
-                return -1;
+                return 0;
 
         while ((dent1 = readdir(dir1)) != NULL) {
                 if (dent1->d_type != DT_DIR ||
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 8e50d8d77419..72eae7498c09 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -401,8 +401,6 @@ static int perf_report__setup_sample_type(struct perf_report *rep)
         return 0;
 }
 
-extern volatile int session_done;
-
 static void sig_handler(int sig __maybe_unused)
 {
         session_done = 1;
@@ -568,6 +566,9 @@ static int __cmd_report(struct perf_report *rep)
                 }
         }
 
+        if (session_done())
+                return 0;
+
         if (nr_samples == 0) {
                 ui__error("The %s file has no samples!\n", session->filename);
                 return 0;
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 7f31a3ded1b6..9c333ff3dfeb 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -553,8 +553,6 @@ static struct perf_tool perf_script = {
         .ordering_requires_timestamps = true,
 };
 
-extern volatile int session_done;
-
 static void sig_handler(int sig __maybe_unused)
 {
         session_done = 1;
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index f686d5ff594e..5098f144b92d 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -457,6 +457,7 @@ static int __run_perf_stat(int argc, const char **argv)
                         perror("failed to prepare workload");
                         return -1;
                 }
+                child_pid = evsel_list->workload.pid;
         }
 
         if (group)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index f5aa6375e3e9..71aa3e35406b 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -16,6 +16,23 @@
 #include <sys/mman.h>
 #include <linux/futex.h>
 
+/* For older distros: */
+#ifndef MAP_STACK
+# define MAP_STACK              0x20000
+#endif
+
+#ifndef MADV_HWPOISON
+# define MADV_HWPOISON          100
+#endif
+
+#ifndef MADV_MERGEABLE
+# define MADV_MERGEABLE         12
+#endif
+
+#ifndef MADV_UNMERGEABLE
+# define MADV_UNMERGEABLE       13
+#endif
+
 static size_t syscall_arg__scnprintf_hex(char *bf, size_t size,
                                          unsigned long arg,
                                          u8 arg_idx __maybe_unused,
@@ -1038,6 +1055,7 @@ static int trace__replay(struct trace *trace)
 
         trace->tool.sample        = trace__process_sample;
         trace->tool.mmap          = perf_event__process_mmap;
+        trace->tool.mmap2         = perf_event__process_mmap2;
         trace->tool.comm          = perf_event__process_comm;
         trace->tool.exit          = perf_event__process_exit;
         trace->tool.fork          = perf_event__process_fork;
diff --git a/tools/perf/config/Makefile b/tools/perf/config/Makefile
index 214e17e97e5c..5f6f9b3271bb 100644
--- a/tools/perf/config/Makefile
+++ b/tools/perf/config/Makefile
@@ -87,7 +87,7 @@ CFLAGS += -Wall
 CFLAGS += -Wextra
 CFLAGS += -std=gnu99
 
-EXTLIBS = -lelf -lpthread -lrt -lm
+EXTLIBS = -lelf -lpthread -lrt -lm -ldl
 
 ifeq ($(call try-cc,$(SOURCE_HELLO),$(CFLAGS) -Werror -fstack-protector-all,-fstack-protector-all),y)
   CFLAGS += -fstack-protector-all
@@ -180,6 +180,9 @@ FLAGS_LIBELF=$(CFLAGS) $(LDFLAGS) $(EXTLIBS)
 ifeq ($(call try-cc,$(SOURCE_ELF_MMAP),$(FLAGS_LIBELF),-DLIBELF_MMAP),y)
   CFLAGS += -DLIBELF_MMAP
 endif
+ifeq ($(call try-cc,$(SOURCE_ELF_GETPHDRNUM),$(FLAGS_LIBELF),-DHAVE_ELF_GETPHDRNUM),y)
+  CFLAGS += -DHAVE_ELF_GETPHDRNUM
+endif
 
 # include ARCH specific config
 -include $(src-perf)/arch/$(ARCH)/Makefile
diff --git a/tools/perf/config/feature-tests.mak b/tools/perf/config/feature-tests.mak
index 708fb8e9822a..f79305739ecc 100644
--- a/tools/perf/config/feature-tests.mak
+++ b/tools/perf/config/feature-tests.mak
@@ -61,6 +61,15 @@ int main(void)
 }
 endef
 
+define SOURCE_ELF_GETPHDRNUM
+#include <libelf.h>
+int main(void)
+{
+        size_t dst;
+        return elf_getphdrnum(0, &dst);
+}
+endef
+
 ifndef NO_SLANG
 define SOURCE_SLANG
 #include <slang.h>
@@ -210,6 +219,7 @@ define SOURCE_LIBAUDIT
 
 int main(void)
 {
+        printf(\"error message: %s\", audit_errno_to_name(0));
         return audit_open();
 }
 endef
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index bfc5a27597d6..7eae5488ecea 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -809,7 +809,7 @@ static int symbol__parse_objdump_line(struct symbol *sym, struct map *map,
                     end = map__rip_2objdump(map, sym->end);
 
                 offset = line_ip - start;
-                if (offset < 0 || (u64)line_ip > end)
+                if ((u64)line_ip < start || (u64)line_ip > end)
                         offset = -1;
                 else
                         parsed_line = tmp2 + 1;
diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index 3e5f5430a28a..7defd77105d0 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -263,6 +263,21 @@ bool die_is_signed_type(Dwarf_Die *tp_die)
 }
 
 /**
+ * die_is_func_def - Ensure that this DIE is a subprogram and definition
+ * @dw_die: a DIE
+ *
+ * Ensure that this DIE is a subprogram and NOT a declaration. This
+ * returns true if @dw_die is a function definition.
+ **/
+bool die_is_func_def(Dwarf_Die *dw_die)
+{
+        Dwarf_Attribute attr;
+
+        return (dwarf_tag(dw_die) == DW_TAG_subprogram &&
+                dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL);
+}
+
+/**
  * die_get_data_member_location - Get the data-member offset
  * @mb_die: a DIE of a member of a data structure
  * @offs: The offset of the member in the data structure
@@ -392,6 +407,10 @@ static int __die_search_func_cb(Dwarf_Die *fn_die, void *data)
 {
         struct __addr_die_search_param *ad = data;
 
+        /*
+         * Since a declaration entry doesn't has given pc, this always returns
+         * function definition entry.
+         */
         if (dwarf_tag(fn_die) == DW_TAG_subprogram &&
             dwarf_haspc(fn_die, ad->addr)) {
                 memcpy(ad->die_mem, fn_die, sizeof(Dwarf_Die));
@@ -407,7 +426,7 @@ static int __die_search_func_cb(Dwarf_Die *fn_die, void *data)
  * @die_mem: a buffer for result DIE
  *
  * Search a non-inlined function DIE which includes @addr. Stores the
- * DIE to @die_mem and returns it if found. Returns NULl if failed.
+ * DIE to @die_mem and returns it if found. Returns NULL if failed.
  */
 Dwarf_Die *die_find_realfunc(Dwarf_Die *cu_die, Dwarf_Addr addr,
                                     Dwarf_Die *die_mem)
@@ -435,15 +454,32 @@ static int __die_find_inline_cb(Dwarf_Die *die_mem, void *data)
 }
 
 /**
+ * die_find_top_inlinefunc - Search the top inlined function at given address
+ * @sp_die: a subprogram DIE which including @addr
+ * @addr: target address
+ * @die_mem: a buffer for result DIE
+ *
+ * Search an inlined function DIE which includes @addr. Stores the
+ * DIE to @die_mem and returns it if found. Returns NULL if failed.
+ * Even if several inlined functions are expanded recursively, this
+ * doesn't trace it down, and returns the topmost one.
+ */
+Dwarf_Die *die_find_top_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
+                                   Dwarf_Die *die_mem)
+{
+        return die_find_child(sp_die, __die_find_inline_cb, &addr, die_mem);
+}
+
+/**
  * die_find_inlinefunc - Search an inlined function at given address
- * @cu_die: a CU DIE which including @addr
+ * @sp_die: a subprogram DIE which including @addr
  * @addr: target address
  * @die_mem: a buffer for result DIE
  *
  * Search an inlined function DIE which includes @addr. Stores the
- * DIE to @die_mem and returns it if found. Returns NULl if failed.
+ * DIE to @die_mem and returns it if found. Returns NULL if failed.
  * If several inlined functions are expanded recursively, this trace
- * it and returns deepest one.
+ * it down and returns deepest one.
  */
 Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
                                Dwarf_Die *die_mem)
diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
index 6ce1717784b7..b4fe90c6cb2d 100644
--- a/tools/perf/util/dwarf-aux.h
+++ b/tools/perf/util/dwarf-aux.h
@@ -38,6 +38,9 @@ extern int cu_find_lineinfo(Dwarf_Die *cudie, unsigned long addr,
 extern int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr,
                         int (*callback)(Dwarf_Die *, void *), void *data);
 
+/* Ensure that this DIE is a subprogram and definition (not declaration) */
+extern bool die_is_func_def(Dwarf_Die *dw_die);
+
 /* Compare diename and tname */
 extern bool die_compare_name(Dwarf_Die *dw_die, const char *tname);
 
@@ -76,7 +79,11 @@ extern Dwarf_Die *die_find_child(Dwarf_Die *rt_die,
 extern Dwarf_Die *die_find_realfunc(Dwarf_Die *cu_die, Dwarf_Addr addr,
                                     Dwarf_Die *die_mem);
 
-/* Search an inlined function including given address */
+/* Search the top inlined function including given address */
+extern Dwarf_Die *die_find_top_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
+                                          Dwarf_Die *die_mem);
+
+/* Search the deepest inlined function including given address */
 extern Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
                                       Dwarf_Die *die_mem);
 
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 9b393e7dca6f..63df031fc9c7 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -187,7 +187,7 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                 return -1;
         }
 
-        event->header.type = PERF_RECORD_MMAP2;
+        event->header.type = PERF_RECORD_MMAP;
         /*
          * Just like the kernel, see __perf_event_mmap in kernel/perf_event.c
          */
@@ -198,7 +198,6 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                 char prot[5];
                 char execname[PATH_MAX];
                 char anonstr[] = "//anon";
-                unsigned int ino;
                 size_t size;
                 ssize_t n;
 
@@ -209,13 +208,10 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                 strcpy(execname, "");
 
                 /* 00400000-0040c000 r-xp 00000000 fd:01 41038  /bin/cat */
-                n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %x:%x %u %s\n",
-                       &event->mmap2.start, &event->mmap2.len, prot,
-                       &event->mmap2.pgoff, &event->mmap2.maj,
-                       &event->mmap2.min,
-                       &ino, execname);
-
-                event->mmap2.ino = (u64)ino;
+                n = sscanf(bf, "%"PRIx64"-%"PRIx64" %s %"PRIx64" %*x:%*x %*u %s\n",
+                       &event->mmap.start, &event->mmap.len, prot,
+                       &event->mmap.pgoff,
+                       execname);
 
                 if (n != 8)
                         continue;
@@ -227,15 +223,15 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                         strcpy(execname, anonstr);
 
                 size = strlen(execname) + 1;
-                memcpy(event->mmap2.filename, execname, size);
+                memcpy(event->mmap.filename, execname, size);
                 size = PERF_ALIGN(size, sizeof(u64));
-                event->mmap2.len -= event->mmap.start;
-                event->mmap2.header.size = (sizeof(event->mmap2) -
-                                        (sizeof(event->mmap2.filename) - size));
-                memset(event->mmap2.filename + size, 0, machine->id_hdr_size);
-                event->mmap2.header.size += machine->id_hdr_size;
-                event->mmap2.pid = tgid;
-                event->mmap2.tid = pid;
+                event->mmap.len -= event->mmap.start;
+                event->mmap.header.size = (sizeof(event->mmap) -
+                                        (sizeof(event->mmap.filename) - size));
+                memset(event->mmap.filename + size, 0, machine->id_hdr_size);
+                event->mmap.header.size += machine->id_hdr_size;
+                event->mmap.pid = tgid;
+                event->mmap.tid = pid;
 
                 if (process(tool, event, &synth_sample, machine) != 0) {
                         rc = -1;
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 0ce9febf1ba0..9f1ef9bee2d0 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -678,7 +678,6 @@ void perf_evsel__config(struct perf_evsel *evsel,
                 attr->sample_type       |= PERF_SAMPLE_WEIGHT;
 
         attr->mmap  = track;
-        attr->mmap2 = track && !perf_missing_features.mmap2;
         attr->comm  = track;
 
         /*
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 26441d0e571b..c3e5a3b817ab 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -199,9 +199,11 @@ static int write_buildid(char *name, size_t name_len, u8 *build_id,
         return write_padded(fd, name, name_len + 1, len);
 }
 
-static int __dsos__write_buildid_table(struct list_head *head, pid_t pid,
-                                u16 misc, int fd)
+static int __dsos__write_buildid_table(struct list_head *head,
+                                       struct machine *machine,
+                                       pid_t pid, u16 misc, int fd)
 {
+        char nm[PATH_MAX];
         struct dso *pos;
 
         dsos__for_each_with_build_id(pos, head) {
@@ -215,6 +217,10 @@ static int __dsos__write_buildid_table(struct list_head *head, pid_t pid,
                 if (is_vdso_map(pos->short_name)) {
                         name = (char *) VDSO__MAP_NAME;
                         name_len = sizeof(VDSO__MAP_NAME) + 1;
+                } else if (dso__is_kcore(pos)) {
+                        machine__mmap_name(machine, nm, sizeof(nm));
+                        name = nm;
+                        name_len = strlen(nm) + 1;
                 } else {
                         name = pos->long_name;
                         name_len = pos->long_name_len + 1;
@@ -240,10 +246,10 @@ static int machine__write_buildid_table(struct machine *machine, int fd)
                 umisc = PERF_RECORD_MISC_GUEST_USER;
         }
 
-        err = __dsos__write_buildid_table(&machine->kernel_dsos, machine->pid,
-                                          kmisc, fd);
+        err = __dsos__write_buildid_table(&machine->kernel_dsos, machine,
+                                          machine->pid, kmisc, fd);
         if (err == 0)
-                err = __dsos__write_buildid_table(&machine->user_dsos,
+                err = __dsos__write_buildid_table(&machine->user_dsos, machine,
                                                   machine->pid, umisc, fd);
         return err;
 }
@@ -375,23 +381,31 @@ out_free:
         return err;
 }
 
-static int dso__cache_build_id(struct dso *dso, const char *debugdir)
+static int dso__cache_build_id(struct dso *dso, struct machine *machine,
+                               const char *debugdir)
 {
         bool is_kallsyms = dso->kernel && dso->long_name[0] != '/';
         bool is_vdso = is_vdso_map(dso->short_name);
+        char *name = dso->long_name;
+        char nm[PATH_MAX];
 
-        return build_id_cache__add_b(dso->build_id, sizeof(dso->build_id),
-                                     dso->long_name, debugdir,
-                                     is_kallsyms, is_vdso);
+        if (dso__is_kcore(dso)) {
+                is_kallsyms = true;
+                machine__mmap_name(machine, nm, sizeof(nm));
+                name = nm;
+        }
+        return build_id_cache__add_b(dso->build_id, sizeof(dso->build_id), name,
+                                     debugdir, is_kallsyms, is_vdso);
 }
 
-static int __dsos__cache_build_ids(struct list_head *head, const char *debugdir)
+static int __dsos__cache_build_ids(struct list_head *head,
+                                   struct machine *machine, const char *debugdir)
 {
         struct dso *pos;
         int err = 0;
 
         dsos__for_each_with_build_id(pos, head)
-                if (dso__cache_build_id(pos, debugdir))
+                if (dso__cache_build_id(pos, machine, debugdir))
                         err = -1;
 
         return err;
@@ -399,8 +413,9 @@ static int __dsos__cache_build_ids(struct list_head *head, const char *debugdir)
 
 static int machine__cache_build_ids(struct machine *machine, const char *debugdir)
 {
-        int ret = __dsos__cache_build_ids(&machine->kernel_dsos, debugdir);
-        ret |= __dsos__cache_build_ids(&machine->user_dsos, debugdir);
+        int ret = __dsos__cache_build_ids(&machine->kernel_dsos, machine,
+                                          debugdir);
+        ret |= __dsos__cache_build_ids(&machine->user_dsos, machine, debugdir);
         return ret;
 }
 
@@ -2753,6 +2768,18 @@ int perf_session__read_header(struct perf_session *session)
         if (perf_file_header__read(&f_header, header, fd) < 0)
                 return -EINVAL;
 
+        /*
+         * Sanity check that perf.data was written cleanly; data size is
+         * initialized to 0 and updated only if the on_exit function is run.
+         * If data size is still 0 then the file contains only partial
+         * information.  Just warn user and process it as much as it can.
+         */
+        if (f_header.data.size == 0) {
+                pr_warning("WARNING: The %s file's data size field is 0 which is unexpected.\n"
+                           "Was the 'perf record' command properly terminated?\n",
+                           session->filename);
+        }
+
         nr_attrs = f_header.attrs.size / f_header.attr_size;
         lseek(fd, f_header.attrs.offset, SEEK_SET);
 
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 46a0d35a05e1..9ff6cf3e9a99 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -611,6 +611,8 @@ void hists__collapse_resort(struct hists *hists)
         next = rb_first(root);
 
         while (next) {
+                if (session_done())
+                        break;
                 n = rb_entry(next, struct hist_entry, rb_node_in);
                 next = rb_next(&n->rb_node_in);
 
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 933d14f287ca..6188d2876a71 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -792,7 +792,7 @@ static int machine__create_modules(struct machine *machine)
                 modules = path;
         }
 
-        if (symbol__restricted_filename(path, "/proc/modules"))
+        if (symbol__restricted_filename(modules, "/proc/modules"))
                 return -1;
 
         file = fopen(modules, "r");
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index be0329394d56..f0692737ebf1 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -118,7 +118,6 @@ static const Dwfl_Callbacks offline_callbacks = {
 static int debuginfo__init_offline_dwarf(struct debuginfo *self,
                                          const char *path)
 {
-        Dwfl_Module *mod;
         int fd;
 
         fd = open(path, O_RDONLY);
@@ -129,11 +128,11 @@ static int debuginfo__init_offline_dwarf(struct debuginfo *self,
         if (!self->dwfl)
                 goto error;
 
-        mod = dwfl_report_offline(self->dwfl, "", "", fd);
-        if (!mod)
+        self->mod = dwfl_report_offline(self->dwfl, "", "", fd);
+        if (!self->mod)
                 goto error;
 
-        self->dbg = dwfl_module_getdwarf(mod, &self->bias);
+        self->dbg = dwfl_module_getdwarf(self->mod, &self->bias);
         if (!self->dbg)
                 goto error;
 
@@ -676,37 +675,42 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 }
 
 /* Convert subprogram DIE to trace point */
-static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
-                                  bool retprobe, struct probe_trace_point *tp)
+static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod,
+                                  Dwarf_Addr paddr, bool retprobe,
+                                  struct probe_trace_point *tp)
 {
         Dwarf_Addr eaddr, highaddr;
-        const char *name;
-
-        /* Copy the name of probe point */
-        name = dwarf_diename(sp_die);
-        if (name) {
-                if (dwarf_entrypc(sp_die, &eaddr) != 0) {
-                        pr_warning("Failed to get entry address of %s\n",
-                                   dwarf_diename(sp_die));
-                        return -ENOENT;
-                }
-                if (dwarf_highpc(sp_die, &highaddr) != 0) {
-                        pr_warning("Failed to get end address of %s\n",
-                                   dwarf_diename(sp_die));
-                        return -ENOENT;
-                }
-                if (paddr > highaddr) {
-                        pr_warning("Offset specified is greater than size of %s\n",
-                                   dwarf_diename(sp_die));
-                        return -EINVAL;
-                }
-                tp->symbol = strdup(name);
-                if (tp->symbol == NULL)
-                        return -ENOMEM;
-                tp->offset = (unsigned long)(paddr - eaddr);
-        } else
-                /* This function has no name. */
-                tp->offset = (unsigned long)paddr;
+        GElf_Sym sym;
+        const char *symbol;
+
+        /* Verify the address is correct */
+        if (dwarf_entrypc(sp_die, &eaddr) != 0) {
+                pr_warning("Failed to get entry address of %s\n",
+                           dwarf_diename(sp_die));
+                return -ENOENT;
+        }
+        if (dwarf_highpc(sp_die, &highaddr) != 0) {
+                pr_warning("Failed to get end address of %s\n",
+                           dwarf_diename(sp_die));
+                return -ENOENT;
+        }
+        if (paddr > highaddr) {
+                pr_warning("Offset specified is greater than size of %s\n",
+                           dwarf_diename(sp_die));
+                return -EINVAL;
+        }
+
+        /* Get an appropriate symbol from symtab */
+        symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+        if (!symbol) {
+                pr_warning("Failed to find symbol at 0x%lx\n",
+                           (unsigned long)paddr);
+                return -ENOENT;
+        }
+        tp->offset = (unsigned long)(paddr - sym.st_value);
+        tp->symbol = strdup(symbol);
+        if (!tp->symbol)
+                return -ENOMEM;
 
         /* Return probe must be on the head of a subprogram */
         if (retprobe) {
@@ -734,7 +738,7 @@ static int call_probe_finder(Dwarf_Die *sc_die, struct probe_finder *pf)
         }
 
         /* If not a real subprogram, find a real one */
-        if (dwarf_tag(sc_die) != DW_TAG_subprogram) {
+        if (!die_is_func_def(sc_die)) {
                 if (!die_find_realfunc(&pf->cu_die, pf->addr, &pf->sp_die)) {
                         pr_warning("Failed to find probe point in any "
                                    "functions.\n");
@@ -980,12 +984,10 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
         struct dwarf_callback_param *param = data;
         struct probe_finder *pf = param->data;
         struct perf_probe_point *pp = &pf->pev->point;
-        Dwarf_Attribute attr;
 
         /* Check tag and diename */
-        if (dwarf_tag(sp_die) != DW_TAG_subprogram ||
-            !die_compare_name(sp_die, pp->function) ||
-            dwarf_attr(sp_die, DW_AT_declaration, &attr))
+        if (!die_is_func_def(sp_die) ||
+            !die_compare_name(sp_die, pp->function))
                 return DWARF_CB_OK;
 
         /* Check declared file */
@@ -1151,7 +1153,7 @@ static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
         tev = &tf->tevs[tf->ntevs++];
 
         /* Trace point should be converted from subprogram DIE */
-        ret = convert_to_trace_point(&pf->sp_die, pf->addr,
+        ret = convert_to_trace_point(&pf->sp_die, tf->mod, pf->addr,
                                      pf->pev->point.retprobe, &tev->point);
         if (ret < 0)
                 return ret;
@@ -1183,7 +1185,7 @@ int debuginfo__find_trace_events(struct debuginfo *self,
 {
         struct trace_event_finder tf = {
                         .pf = {.pev = pev, .callback = add_probe_trace_event},
-                        .max_tevs = max_tevs};
+                        .mod = self->mod, .max_tevs = max_tevs};
         int ret;
 
         /* Allocate result tevs array */
@@ -1252,7 +1254,7 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
         vl = &af->vls[af->nvls++];
 
         /* Trace point should be converted from subprogram DIE */
-        ret = convert_to_trace_point(&pf->sp_die, pf->addr,
+        ret = convert_to_trace_point(&pf->sp_die, af->mod, pf->addr,
                                      pf->pev->point.retprobe, &vl->point);
         if (ret < 0)
                 return ret;
@@ -1291,6 +1293,7 @@ int debuginfo__find_available_vars_at(struct debuginfo *self,
 {
         struct available_var_finder af = {
                         .pf = {.pev = pev, .callback = add_available_vars},
+                        .mod = self->mod,
                         .max_vls = max_vls, .externs = externs};
         int ret;
 
@@ -1324,8 +1327,8 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
                                 struct perf_probe_point *ppt)
 {
         Dwarf_Die cudie, spdie, indie;
-        Dwarf_Addr _addr, baseaddr;
-        const char *fname = NULL, *func = NULL, *tmp;
+        Dwarf_Addr _addr = 0, baseaddr = 0;
+        const char *fname = NULL, *func = NULL, *basefunc = NULL, *tmp;
         int baseline = 0, lineno = 0, ret = 0;
 
         /* Adjust address with bias */
@@ -1346,27 +1349,36 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
         /* Find a corresponding function (name, baseline and baseaddr) */
         if (die_find_realfunc(&cudie, (Dwarf_Addr)addr, &spdie)) {
                 /* Get function entry information */
-                tmp = dwarf_diename(&spdie);
-                if (!tmp ||
+                func = basefunc = dwarf_diename(&spdie);
+                if (!func ||
                     dwarf_entrypc(&spdie, &baseaddr) != 0 ||
-                    dwarf_decl_line(&spdie, &baseline) != 0)
+                    dwarf_decl_line(&spdie, &baseline) != 0) {
+                        lineno = 0;
                         goto post;
-                func = tmp;
+                }
 
-                if (addr == (unsigned long)baseaddr)
+                fname = dwarf_decl_file(&spdie);
+                if (addr == (unsigned long)baseaddr) {
                         /* Function entry - Relative line number is 0 */
                         lineno = baseline;
-                else if (die_find_inlinefunc(&spdie, (Dwarf_Addr)addr,
-                                             &indie)) {
+                        goto post;
+                }
+
+                /* Track down the inline functions step by step */
+                while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr,
+                                                &indie)) {
+                        /* There is an inline function */
                         if (dwarf_entrypc(&indie, &_addr) == 0 &&
-                            _addr == addr)
+                            _addr == addr) {
                                 /*
                                  * addr is at an inline function entry.
                                  * In this case, lineno should be the call-site
-                                 * line number.
+                                 * line number. (overwrite lineinfo)
                                  */
                                 lineno = die_get_call_lineno(&indie);
-                        else {
+                                fname = die_get_call_file(&indie);
+                                break;
+                        } else {
                                 /*
                                  * addr is in an inline function body.
                                  * Since lineno points one of the lines
@@ -1374,19 +1386,27 @@ int debuginfo__find_probe_point(struct debuginfo *self, unsigned long addr,
                                  * be the entry line of the inline function.
                                  */
                                 tmp = dwarf_diename(&indie);
-                                if (tmp &&
-                                    dwarf_decl_line(&spdie, &baseline) == 0)
-                                        func = tmp;
+                                if (!tmp ||
+                                    dwarf_decl_line(&indie, &baseline) != 0)
+                                        break;
+                                func = tmp;
+                                spdie = indie;
                         }
                 }
+                /* Verify the lineno and baseline are in a same file */
+                tmp = dwarf_decl_file(&spdie);
+                if (!tmp || strcmp(tmp, fname) != 0)
+                        lineno = 0;
         }
 
 post:
         /* Make a relative line number or an offset */
         if (lineno)
                 ppt->line = lineno - baseline;
-        else if (func)
+        else if (basefunc) {
                 ppt->offset = addr - (unsigned long)baseaddr;
+                func = basefunc;
+        }
 
         /* Duplicate strings */
         if (func) {
@@ -1474,7 +1494,7 @@ static int line_range_inline_cb(Dwarf_Die *in_die, void *data)
         return 0;
 }
 
-/* Search function from function name */
+/* Search function definition from function name */
 static int line_range_search_cb(Dwarf_Die *sp_die, void *data)
 {
         struct dwarf_callback_param *param = data;
@@ -1485,7 +1505,7 @@ static int line_range_search_cb(Dwarf_Die *sp_die, void *data)
         if (lr->file && strtailcmp(lr->file, dwarf_decl_file(sp_die)))
                 return DWARF_CB_OK;
 
-        if (dwarf_tag(sp_die) == DW_TAG_subprogram &&
+        if (die_is_func_def(sp_die) &&
             die_compare_name(sp_die, lr->function)) {
                 lf->fname = dwarf_decl_file(sp_die);
                 dwarf_decl_line(sp_die, &lr->offset);
diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
index 17e94d0c36f9..3b7d63018960 100644
--- a/tools/perf/util/probe-finder.h
+++ b/tools/perf/util/probe-finder.h
@@ -23,6 +23,7 @@ static inline int is_c_varname(const char *name)
 /* debug information structure */
 struct debuginfo {
         Dwarf           *dbg;
+        Dwfl_Module     *mod;
         Dwfl            *dwfl;
         Dwarf_Addr      bias;
 };
@@ -77,6 +78,7 @@ struct probe_finder {
 
 struct trace_event_finder {
         struct probe_finder     pf;
+        Dwfl_Module             *mod;           /* For solving symbols */
         struct probe_trace_event *tevs;         /* Found trace events */
         int                     ntevs;          /* Number of trace events */
         int                     max_tevs;       /* Max number of trace events */
@@ -84,6 +86,7 @@ struct trace_event_finder {
 
 struct available_var_finder {
         struct probe_finder     pf;
+        Dwfl_Module             *mod;           /* For solving symbols */
         struct variable_list    *vls;           /* Found variable lists */
         int                     nvls;           /* Number of variable lists */
         int                     max_vls;        /* Max no. of variable lists */
diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
index a85e4ae5f3ac..c0c9795c4f02 100644
--- a/tools/perf/util/scripting-engines/trace-event-perl.c
+++ b/tools/perf/util/scripting-engines/trace-event-perl.c
@@ -282,7 +282,7 @@ static void perl_process_tracepoint(union perf_event *perf_event __maybe_unused,
 
         event = find_cache_event(evsel);
         if (!event)
-                die("ug! no event found for type %" PRIu64, evsel->attr.config);
+                die("ug! no event found for type %" PRIu64, (u64)evsel->attr.config);
 
         pid = raw_field_value(event, "common_pid", data);
 
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 51f5edf2a6d0..568b750c01f6 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -256,6 +256,8 @@ void perf_tool__fill_defaults(struct perf_tool *tool)
                 tool->sample = process_event_sample_stub;
         if (tool->mmap == NULL)
                 tool->mmap = process_event_stub;
+        if (tool->mmap2 == NULL)
+                tool->mmap2 = process_event_stub;
         if (tool->comm == NULL)
                 tool->comm = process_event_stub;
         if (tool->fork == NULL)
@@ -531,6 +533,9 @@ static int flush_sample_queue(struct perf_session *s,
                 return 0;
 
         list_for_each_entry_safe(iter, tmp, head, list) {
+                if (session_done())
+                        return 0;
+
                 if (iter->timestamp > limit)
                         break;
 
@@ -1160,7 +1165,6 @@ static void perf_session__warn_about_errors(const struct perf_session *session,
         }
 }
 
-#define session_done()  (*(volatile int *)(&session_done))
 volatile int session_done;
 
 static int __perf_session__process_pipe_events(struct perf_session *self,
@@ -1308,7 +1312,7 @@ int __perf_session__process_events(struct perf_session *session,
         file_offset = page_offset;
         head = data_offset - page_offset;
 
-        if (data_offset + data_size < file_size)
+        if (data_size && (data_offset + data_size < file_size))
                 file_size = data_offset + data_size;
 
         progress_next = file_size / 16;
@@ -1372,10 +1376,13 @@ more:
                                     "Processing events...");
         }
 
+        err = 0;
+        if (session_done())
+                goto out_err;
+
         if (file_pos < file_size)
                 goto more;
 
-        err = 0;
         /* do the final flush for ordered samples */
         session->ordered_samples.next_flush = ULLONG_MAX;
         err = flush_sample_queue(session, tool);
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 3aa75fb2225f..04bf7373a7e5 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -124,4 +124,8 @@ int __perf_session__set_tracepoints_handlers(struct perf_session *session,
 
 #define perf_session__set_tracepoints_handlers(session, array) \
         __perf_session__set_tracepoints_handlers(session, array, ARRAY_SIZE(array))
+
+extern volatile int session_done;
+
+#define session_done()  (*(volatile int *)(&session_done))
 #endif /* __PERF_SESSION_H */
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index a7b9ab557380..a9c829be5216 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -8,6 +8,22 @@
 #include "symbol.h"
 #include "debug.h"
 
+#ifndef HAVE_ELF_GETPHDRNUM
+static int elf_getphdrnum(Elf *elf, size_t *dst)
+{
+        GElf_Ehdr gehdr;
+        GElf_Ehdr *ehdr;
+
+        ehdr = gelf_getehdr(elf, &gehdr);
+        if (!ehdr)
+                return -1;
+
+        *dst = ehdr->e_phnum;
+
+        return 0;
+}
+#endif
+
 #ifndef NT_GNU_BUILD_ID
 #define NT_GNU_BUILD_ID 3
 #endif
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index fe7a27d67d2b..e9e1c03f927d 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -186,7 +186,7 @@ void parse_proc_kallsyms(struct pevent *pevent,
         char *next = NULL;
         char *addr_str;
         char *mod;
-        char *fmt;
+        char *fmt = NULL;
 
         line = strtok_r(file, "\n", &next);
         while (line) {
diff --git a/tools/testing/selftests/timers/posix_timers.c b/tools/testing/selftests/timers/posix_timers.c
index 4fa655d68a81..41bd85559d4b 100644
--- a/tools/testing/selftests/timers/posix_timers.c
+++ b/tools/testing/selftests/timers/posix_timers.c
@@ -151,7 +151,7 @@ static int check_timer_create(int which)
         fflush(stdout);
 
         done = 0;
-        timer_create(which, NULL, &id);
+        err = timer_create(which, NULL, &id);
         if (err < 0) {
                 perror("Can't create timer\n");
                 return -1;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 979bff485fb0..a9dd682cf5e3 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1064,10 +1064,12 @@ EXPORT_SYMBOL_GPL(gfn_to_hva);
 unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
 {
         struct kvm_memory_slot *slot = gfn_to_memslot(kvm, gfn);
-        if (writable)
+        unsigned long hva = __gfn_to_hva_many(slot, gfn, NULL, false);
+
+        if (!kvm_is_error_hva(hva) && writable)
                 *writable = !memslot_is_readonly(slot);
 
-        return __gfn_to_hva_many(gfn_to_memslot(kvm, gfn), gfn, NULL, false);
+        return hva;
 }
 
 static int kvm_read_hva(void *data, void __user *hva, int len)